What the CMA's consumer enforcement powers mean for loyalty marketing commercial contracts

What to take away

The Competition and Markets Authority enforces consumer protection law directly, without a court case first, under the Digital Markets, Competition and Consumers Act 2024.
It can fine a trader up to 10 per cent of global annual turnover or £300,000, whichever is higher, accept undertakings and seek an online interface order.
The trader named on the loyalty offer carries that exposure, so the contract should fix who approves wording, who funds redemptions and who holds the consent record.
Unfair terms and misleading promotions are the two live risks, and both the CMA and the Advertising Standards Authority publish guidance a brand can check.
The clause list below allocates that exposure before launch. It is general guidance for England, not legal advice.

What the CMA can do about a loyalty scheme

The CMA gained direct consumer enforcement powers under the Digital Markets, Competition and Consumers Act 2024, in force from April 2025. It can act on a misleading loyalty promotion without proving a breach in court first.

What the CMA can do

Investigate a scheme and require information from the trader.
Impose a penalty of up to 10 per cent of global annual turnover or £300,000, whichever is higher.
Accept binding undertakings to change a practice.
Seek a court order to change or remove an online interface.
Publish the outcome, which is often the costliest part for a brand.

The CMA's consumer enforcement guidance collection sets out how it selects cases and what it expects from businesses.

What it does not do: approve contracts, settle commercial disputes or police data protection. Data sits with the Information Commissioner. Unfair terms guidance for traders, published as CMA37, explains the good faith test applied to standard terms.

Seven clauses that carry CMA exposure

Each clause below answers a specific power the CMA can use.

Data roles. Name the controller and the processor. A breach of the data rules sits with the Information Commissioner rather than the CMA, but a written processor term is still required. Our guide to loyalty marketing data protection in England explains the duties that follow from each role.
Points liability. Say who funds redemption and who carries the cost if points are devalued mid-term. A term allowing a silent change may be unfair.
Consent records. Say who runs the banner and who keeps the audit log, and confirm that the log can be exported.
Membership terms. A member accepts a consumer contract, so unfair terms law applies to the wording. The Consumer Rights Act 2015 sets the test of good faith and significant imbalance.
Service levels. Tie uptime and campaign delivery to service credits with a stated fix time.
Exit and migration. Cover notice, export format, deletion deadlines and handover support.
Referral approvals. Say who signs off referral copy and incentive wording, because the trader named on the offer carries the enforcement risk.

How the risk splits between brand and supplier

Split each contract point into what the brand owns and what the supplier owns. The table is a negotiation starting point.

How the risk splits

Brand

Data controller role: Chooses the lawful basis
Points at redemption: Funds the scheme
Consent for tracking: Approves the banner
Promotional claims: Approves final copy
Member data on exit: Moves to a new supplier

Supplier

Data controller role: Keeps security and processor duties
Points at redemption: Charges platform and hosting fees
Consent for tracking: Places tags correctly
Promotional claims: Builds the mechanics
Member data on exit: Exports and deletes

Enforcement follows the name on the offer, so a supplier indemnity recovers money rather than reputation. A review of loyalty marketing hidden costs in England shows where exit and migration charges tend to appear.

Example: a points devaluation mid-campaign

A retailer agrees that 100 points equal £1 with its platform. Six months later the platform resets the rate to 120 points equal £1 without notice. Members who saved for a Christmas voucher complain to the retailer.

Enforcement lands on the trader named on the offer, not on the party that edited the setting.

The UK advertising codes require promotions to show conditions and closing dates clearly, and a change made mid-campaign can turn a compliant offer into a misleading one.

Further checks before signature

Two points deserve their own line in the contract. First, require notice of any change to mechanics or points value, with a brand right to reject it. Second, require the supplier to hand over complaint records at exit, since complaints are the evidence a regulator reads first.

The wider loyalty marketing rules and compliance guide for 2027 covers the disclosure side if you need that background.

Common questions

Does a loyalty contract need a data processing agreement?

Where a supplier handles member data on the brand's instructions, a written processor contract is required. It should cover retention, security and breach duties.

Who answers for a misleading loyalty promotion?

The brand whose name is on the offer. Consumer enforcement looks at the trader making the claim, so a supplier indemnity covers cost rather than reputation.

Can a supplier change the points value without telling members?

Only if the membership terms allow it. A change a customer could not reasonably expect may count as an unfair term.

Do these powers apply to a small loyalty scheme?

Yes. Consumer protection law has no turnover threshold, so the same test applies to a scheme with a few hundred members.