The Solicitors Regulation Authority (SRA) will continue to focus on anti-money laundering breaches by law firms in the year ahead, but there will also be some new areas of interest. In particular, the SRA has reminded lawyers of their obligation when acting for claimants in group litigation to ensure that they have obtained each individual client's authority to litigate. In response to concerns that lawyers have failed to do so in certain recent high profile litigation, the SRA has issued guidance in this area. While the guidance is aimed at claims relating to financial services products, we predict that it will be applied in any case involving multiple claimants. Given the SRA's proposals to increase its fining powers, lawyers practising in this area will be well advised to heed the guidance and ensure that all clients are onboarded properly and systems are in place to ensure that they receive the same high standard of advice as any other client.

After a long wait, the implementing decree to give effect to the Gelli Law allowing direct action against the insurance company of a healthcare facility or individual healthcare professional is available. Once it comes into force, the innovative law will be definitively integrated into the legal system. The injured party's direct action will be subject to the same statute of limitations as the action against the public or private healthcare facility or healthcare professional. Such direct action will require a substantial update to current policy wordings in order to make them fully compliant with the new regulations. Insurers will also now need to prepare themselves for managing disputes made directly against them by the injured party, within restrictions on the enforceability of insurance exclusions.

M&A activity has slowed in recent years and the deals which are going through require buyers to investigate a range of factors including the impact of recent economic challenges, regulatory compliance, tax, ESG and litigation risk. AI technologies are now widely used to speed up the due diligence process and decision making. AI solutions undertake enhanced due diligence and swift reviews of large data sets, check financial crime and AML compliance, and efficiently flag inconsistencies and potential risks for further investigation by the buyer and its legal team. The adoption of AI is also freeing up manpower, allowing deal makers to focus on other aspects like negotiations and communications. Providing sensible human oversight is applied, the opportunities for using AI in the M&A process are revolutionary.

The Renters' Rights Bill will reform the private rented sector, improving rights and conditions for tenants. Abolition of no fault eviction (and revision of the other possession grounds) will make it harder for landlords to obtain possession, which may impact lenders' appetite across the sector, and therefore prices. Valuers will also need to take into account the proposed new minimum safety and maintenance standards, which will affect whether a property can be used for letting purposes. These proposed new home standards will also impact property managers, who will want to avoid exposing landlords to fines and penalties for letting non-compliant property. Risk exposure may be mitigated through appropriate caveats in a property professional's terms and conditions. On a brighter note, it remains to be seen if the Private Rented Sector Landlord Ombudsman scheme results in a decline in litigated claims brought by tenants against agents.

With the passing of the 31 July 2024 deadline for the first Consumer Duty annual report, the FCA will continue to scrutinise insurers and intermediaries to ensure that they are delivering good consumer outcomes as mandated by the Consumer Duty. Key to this is being able to monitor for and evidence good outcomes, rather than relying on an absence of evidence of poor outcomes. With the FCA noting that it continues to see “substandard service levels across insurance sectors", we expect the FCA to continue to keep a close eye on insurers and intermediaries and their compliance with the Consumer Duty. The FCA has also flagged significant concerns about failings on the part of both insurers and intermediaries with their product oversight and governance obligations, finding many examples where firms appear not to be meeting regulatory requirements. We expect to see several insurers and intermediaries being required to appoint skilled persons under s166 of the Financial Services and Markets Act, to assess their product oversight and governance frameworks and identify possible harms that may have resulted from non-compliance.

Substantial new corporate sustainability reporting duties now apply to certain categories of Italian companies (including insurance companies) following the enactment of Legislative Decree No. 125/2024, implementing Directive 2022/2464/EU. We expect there to be a significant effect on D&O liabilities, particularly concerning Environmental, Social, and Governance (ESG) risks. Directors must ensure that accurate ESG information is provided in compliance with the regulations, which introduce the possibility of administrative sanctions in case of breach. Each company must then monitor compliance with the provisions and report in its annual shareholder meeting. Internal and external analysis requires companies to monitor not only the impact of their activities externally on stakeholders but also the risks posed by external factors, such as climate change, on the company’s financial performance. The implementation of this decree could therefore increase legal actions against directors, especially for greenwashing charges and ESG transparency violations. Directors will need to update governance practices and policies to avoid potential sanctions and reputational damage, proactively managing sustainability within the company’s strategy. These new provisions require a careful review of policy wordings to take into account the risk of new liabilities towards third parties and/or company shareholders.

When foreign insurers cover risks that are likely to give rise to litigation in France, they must be particularly attentive to the rigour imposed by the Cour de cassation (Supreme Court) on the drafting of policies. For example, in June 2023, the Cour de cassation ruled that the provisions of articles L. 112-4 and L. 113-1 of the French Insurance Code constituted overriding mandatory provisions binding on the French courts, regardless of the law designated by the policy. These articles stipulate that exclusion clauses must be written in highly visible terms and must be formal and limited (i.e. they must not empty coverage of its substance and it must be possible to determine by simply reading the clause what is covered and what is not). In the absence of such compliance, exclusion clauses will not be enforceable.

Due to an increase in cyber incidents, we predict a similar rise in data breach claims. Although the European High Court has restricted the ability to claim for damages from cyber incidents as the data subject needs to show damage, it does not need to be material. The data processor needs to make sure it acts in line with data protection regulation. In addition to claims by data subjects, there is also the possibility of consumer protection authorities claiming against data processors in case of a data breach. Further, the ECJ has just acknowledged the possibility of a competitor claiming based on breach of GDPR regulation. This opens the door to different claims from different perspectives and requires even more attention on data processing compliance.

During 2024, a new law on cybersecurity and critical infrastructure was enacted. It is the first of its kind in Latin America, aimed at bolstering Chile's cybersecurity for organisations in scope through risk management; security standards for the prevention, containment and resolution of incidents; and sanctions that will vary depending on the risk and size of the organisation. The notification requirement will have the greatest impact on both the local insurance market and reinsurers, as non-compliance can lead to fines up to US$ 1,500,000. With this new law in place, we are already seeing demand for cyber insurance coverage grow and it will continue to do so into 2025.

On 26 October 2024, a new positive duty on employers to take "reasonable steps" to prevent sexual harassment in the workplace came into force. Employers must now proactively implement measures to embed a respectful work culture through zero-tolerance policies, staff training on inappropriate conduct, and effective and sensitive complaints handling procedures. Neglecting to prepare for this new duty could lead to an increase in harassment claims and more compensation. If an employee succeeds with a claim for sexual harassment and the employer has breached the new duty, the tribunal can increase compensation by up to 25%. The Equality and Human Rights Commission (EHRC) can also investigate and take enforcement action. Action can be taken based on a suspicion of non-compliance; there does not need to be an incident of sexual harassment before the EHRC will consider exercising its enforcement powers.

Fraud offences in the UK are changing. The Economic Crime and Corporate Transparency Act 2023 (ECCTA) creates a new "failure to prevent fraud" offence, committed when an employee of a large organisation perpetrates a fraud and the organisation has failed to implement reasonable fraud prevention measures. ECCTA also reforms the identification principle, making it easier to attribute criminal liability to corporations for economic crimes committed by a 'senior manager' acting within the actual or apparent scope of their authority. This represents a substantial widening of potential liability, as the definition of senior manager is broader than the board of directors and may include any individual with substantial management authority. ECCTA brings a greater risk of corporate and D&O prosecutions, and therefore organisations must implement robust fraud prevention procedures and safeguards to oversee the conduct of their senior managers. The consequences of non-compliance will otherwise be severe.

The approach of the Information Commissioner's Office (ICO) to enforcement, often favouring softer tools in the toolbox such as reprimands, will have a net effect of forcing businesses to take divergent approaches to data protection law compliance in the UK and the EU. We anticipate that this regulatory and commercial divergence will continue, creating both opportunity but also complexity for businesses. The UK's data protection regulatory regime has historically had a reputation as a more pragmatic, business-friendly regime, especially compared with some EU jurisdictions, where the enforcement of data protection law has been more dogmatic.  The ICO has continued this more pragmatic approach as evident, for example, in its approach to consent or pay models and conducting transfer impact assessments following the Schrems II decision.