The Clause That Cannot Buy Compliance: Indemnities for Regulatory Penalties in 2026
A familiar comfort in the drafting
When a commercial agreement allocates regulatory risk, the instinct is often to reach for an indemnity. The clause may promise that one party will indemnify the other against ‘all fines, penalties, costs and liabilities arising from any regulatory breach’. On paper, it appears to transfer the consequences of non-compliance. In practice, the widest version of that promise is frequently the least reliable.
The difficulty is not merely one of drafting technique. It reflects a deeper legal and policy distinction between ordinary commercial loss and a penalty imposed by a public authority. A contractual indemnity can reallocate the financial burden of a private law obligation. It cannot easily neutralise a regulatory sanction whose purpose is to uphold public law, deter misconduct and mark the seriousness of a breach.
That distinction matters more in 2026 as UK regulators continue to pursue direct enforcement, cost recovery and individual accountability. Boards reviewing contracts should therefore ask not whether a penalty indemnity sounds comprehensive, but whether it is enforceable, whether it addresses the right category of loss, and whether it creates false comfort in place of a workable compliance and cost-sharing structure.
Why a penalty indemnity is not an ordinary indemnity
UK courts are generally willing to enforce commercial allocations of risk between sophisticated parties. But they are reluctant to assist a party in escaping the personal consequences of unlawful conduct, and they are alert to arrangements that might undermine the deterrent effect of regulatory sanctions.
A criminal fine is the clearest example. An agreement to indemnify a party against a criminal penalty is vulnerable on public policy grounds. The penalty is imposed on the offender for the offender’s conduct; a private contract should not ordinarily be used to remove that burden. Civil penalties are more nuanced, but the same concerns often arise. Regulators frequently assess penalties by reference to the recipient’s conduct, turnover, cooperation and compliance history. A contractual promise by another party to pay the penalty does not alter the regulator’s assessment, and it may be viewed as an attempt to dilute the sanction’s purpose.
The point is reinforced by the nature of regulatory liability. A penalty is not simply a debt incurred in the course of trade. It is imposed because a public authority has concluded that the recipient breached a regulatory obligation. The indemnity may create a right of reimbursement between the contracting parties, but it does not transfer the regulatory responsibility itself. The regulator will still look to the regulated entity. Public naming, senior manager accountability and remediation orders cannot be undone by a private clause.
Fines, costs and consequences are not the same
The most common drafting error is to conflate every financial consequence of a regulatory event into a single defined term. That obscures the categories that can be allocated effectively and those that usually cannot.
A fine or penalty is the sanction itself. It is the category most likely to encounter public policy objections, particularly where criminal liability or deliberate misconduct is involved. A remediation cost is different: it is the expense of correcting the breach, improving systems, compensating customers or commissioning an independent review. Those costs are often more amenable to contractual allocation because they resemble ordinary compliance or operational expenditure. Investigation costs are also distinct, although they may be recoverable under statute or regulatory rules and should be checked carefully. Third-party claims from customers, employees or counterparties are private law liabilities and can, in principle, be covered by a suitably drafted indemnity. Reputational harm, management time and lost business are usually better addressed through other mechanisms, if at all.
A clause that promises to indemnify ‘all regulatory penalties’ therefore mixes together criminal fines, civil penalties, statutory costs, remediation programmes and third-party compensation. A narrower clause that defines each category separately is more likely to survive scrutiny and more useful when a regulatory event actually occurs.
What 2026 enforcement is really testing
The enforcement environment in 2026 places greater emphasis on outcomes than on formal undertakings. Regulators across the UK are using direct enforcement powers, cost recovery and public reporting. The failure to prevent fraud offence introduced by the Economic Crime and Corporate Transparency Act 2023 has sharpened boardroom attention on compliance controls. Competition, financial services, data protection, utilities and environmental regulators continue to pursue cases that combine penalties with remediation, monitoring and governance changes.
In that context, the indemnity for the fine is rarely the most valuable protection. The larger and more predictable costs often arise from remediation, customer redress, independent reviews, legal expenses and operational disruption. A contract that focuses only on the headline penalty may leave the parties arguing over the bills that actually matter.
Drafting mechanisms that hold up better
A more resilient approach begins by separating the regulatory event from the regulatory liability. The contract should define what counts as a regulatory investigation, notice, breach or enforcement action. It should then identify which consequences are to be shared, reimbursed or insured, rather than using a single broad indemnity.
Compliance warranties can be useful, but they should be precise. A warranty that a party has complied with all applicable law is often too broad to be meaningful without materiality, knowledge and temporal limits. A warranty that specific licences are held, that specified controls are in place, or that no enforcement notice has been received is more likely to be useful in practice.
Cooperation obligations are often undervalued. Notification duties, access to records, joint response protocols and restrictions on admissions can reduce the cost and friction of an investigation. They do not indemnify the penalty, but they can preserve the parties’ position and prevent avoidable escalation.
Cost-sharing schedules can address investigation costs, remediation programmes and third-party claims. A schedule that distinguishes between pre-notice costs, enforcement costs, remediation costs and compensation can avoid the all-or-nothing disputes that broad indemnities invite. Caps, baskets and exclusions for wilful misconduct or failure to maintain required licences can make the allocation more credible.
Specific indemnities remain appropriate for identifiable private law risks, such as third-party claims arising from a defined breach. Regulatory change clauses and price adjustment mechanisms may also help where new rules alter the cost of performance. Insurance should be reviewed, but parties should not assume that regulatory fines are insurable; many policies exclude them, and public policy limits may apply.
The commercial conclusion
An indemnity for regulatory penalties is not a substitute for compliance. It is a contractual allocation of financial risk, and its limits are set by public policy, regulatory design and the practical reality that the regulator deals with the regulated entity. The most effective contracts do not promise the impossible. They identify the consequences that can be shared, define them precisely, and build cooperation and remediation obligations around them.
For companies negotiating in 2026, the better question is not whether the indemnity is broad enough to cover every penalty. It is whether the contract recognises the difference between a fine, a remediation bill and a third-party claim, and whether the parties have agreed who bears each one before the regulator comes calling.
