5,731 spoken contributions under 12 words (interjections such as “Will the hon. Member give way?”) are hidden. Show them

1. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   Clauses 206 to 212 introduce measures to address the involvement of some legal professionals in tax avoidance schemes, and I reassure the Minister that we support what the clauses look to achieve. Clause 206 allows lawyers to make a formal declaration of material protected by legal professional privilege that may support HMRC’s investigations. That means that the vast majority of lawyers will be able to flag concerns and demonstrate compliance with HMRC without breaking that privilege. At the same time, clause 207 introduces a penalty of £10,000 for a lawyer who makes a deliberately false declaration in an effort to cover their involvement in the promotion or marketing of tax avoidance, although I cannot imagine a situation where a lawyer would do anything that was not 100% honest. The clauses work well together, and there is widespread agreement from those in industry about the positivity of the changes. We certainly agree with industry that these are good measures. Question put and agreed to. Clause 206 accordingly ordered to stand part of the Bill. Clauses 207 to 212 ordered to stand part of the Bill. Clause 213 Penalties for non-disclosure of tax avoidance schemes Question proposed, That the clause stand part of the Bill.

   Hansard source
2. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   As with earlier clauses, we agree with these measures, which will help to streamline the process and allow HMRC to quickly cancel benefits such as gross payment status where there is deliberate non-compliance or fraud. That will allow the authorities to stay ahead of bad actors and ultimately protect taxpayers’ money. We broadly welcome the thrust of these measures. I have one or two questions. There is a lack of clarity that needs addressing, and I would welcome the Minister’s comments on it. The clauses allow HMRC to remove gross payment status from parties that “knew or should have known” of inaccuracies with the CIS that were being carried out by another party. In the same vein as my earlier comments on the terminology “likely to be” marketed, the words “should have known” extend the liability beyond deliberate fraud. We recognise that, in this instance, the terminology follows European Court of Justice and High Court judgments that established the Kittel principle, which means that a business that “should have known” is aiding the perpetrators of fraud and is effectively an accomplice. However, there is no concrete definition of this term, and by extension there is a lack of clarity for innocent parties that make genuine errors. Getting this wrong could result in significant cash-flow issues, contract terminations and reputational damage for subcontractors, so we need to be sure the provision is airtight. Will the Minister commit to looking at this point again and providing the clarity that industry is asking for? If not, it would be useful to understand how HMRC proposes to ensure that mistakes are not made in decision making and whether it intends to publish any corresponding guidance for businesses and interested parties.

   Hansard source
3. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   Welcome to your position, Mrs Harris. I hope you will indulge me a little if I go back into some of the history of this place. I have been here for 15 years, which I think is greater than the collective experience of most members of this Committee, although that is not something to brag about. However, we sometimes forget the lessons from history. Back in 2011 and 2012, when I was a newly elected MP, we started looking at the retail distribution review. The Financial Conduct Authority felt strongly that people needed better advice from their wealth managers, and the retail distribution review was brought in to do a number of different things. One of the things the review did was require wealth managers to have proper qualifications, which is not an unreasonable proposition. Slightly more controversially, it also resulted in wealth managers potentially having unlimited liability, to the end of their life, if they messed up, which was a bit of a problem. A third measure was about the compensation of wealth managers. At the time, wealth managers were paid a commission by the providers of the products they sold. That was changed to a fee-based system, where somebody seeking the services of a wealth manager would not potentially be ripped off as a result of commissions being paid, and we would therefore have a level playing field.

   Hansard source
4. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   The Minister is being very indulgent. The Liberal Democrats and I are probably as one on this point. The reason it is incredibly important that we get this right, and the reason I brought up the retail distribution review, is that there can be unintended consequences. We should remind ourselves that the Bill is 539 pages long. The tax code is 21,000 pages long—10 million words. More importantly, the tax code costs us £15.3 billion a year to comply with—it is really complicated. We already have a very complicated system, and if we do anything that inadvertently makes it more complicated—if we get this wrong—it will be really bad news for the whole of our economy. We must not do something that inadvertently—I was going to say, screws it up—

   Hansard source
5. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   The clauses focus on compliance notices and ineligibility orders. Again, we support the thrust of the clauses, but the Institute of Chartered Accountants in England and Wales has asked for further clarity in some areas. First, clause 230(3) makes provisions for an adviser to be notified of a compliance notice. However, it does not impose a time limit and could lead to delays. Given tax advisers and relevant individuals are being subject to strict timeframes, with some exceptions or extensions, should HMRC not have to abide by similar rules and timeframes? Secondly, clauses 233 and 234 are specifically on ineligibility orders being issued to tax advisers and relevant individuals. Those are important as they will help to temporarily or permanently remove an entity from being officially registered. However, given the gravitas of the orders, clarity is needed to ensure they are issued in a reasonable manner. There should also be a mechanism for an ineligibility order to be cancelled if an appeal or a review finds in favour of the tax adviser. Finally, we agree with the ICAEW. The suspension or ineligibility orders should only apply once an order is final. I am sure the Minister would agree that it would be unfair on a business to notify clients of an order to only then have it withdrawn. The orders are serious sanctions, so the initial reputational damage could genuinely put a tax adviser out of business even if they have not done anything wrong. I would be grateful for the Minister’s reassurance that that is something they will reasonably consider.

   Hansard source
6. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   Clause 241 and schedule 20 provide more details about the review and appeals process that HMRC will operate. They also confirm that HMRC must offer a review where there is an opportunity for a person to appeal a decision. The clarity is welcome, but there are still some issues that the Government need to consider further. First, paragraph 6 of the schedule provides that a statutory review automatically concludes in HMRC’s favour if it simply does not deal with the review request. As the Chartered Institute of Taxation puts it, that “seems particularly inappropriate here, given an appeal is one of the few ways that a firm can challenge this regulatory decision (in which HMRC has a conflict of interest).” We agree that it is unfair for HMRC to find in its own favour because it failed to carry out something in a timely manner. With that in mind, will the Minister commit to taking this away, and potentially removing paragraph 6(7)? The other issue comes back to the temporary relief from suspension, as previously discussed. Under schedule 20, the decision to grant temporary relief rests with an individual authorised HMRC officer, who can be the same officer who issued the suspension. It goes further: the schedule stipulates that the officer must take into account the prospect of the review or appeal succeeding. Could that not create conflicts of interest and be fundamentally unfair to the applicant? Would it be better practice to mandate that either another authorised officer or the commissioners make the decision to grant temporary relief from the suspension? I would be grateful if the Minister could provide some clarity.

   Hansard source
7. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   This is all pretty uncontroversial, but there is one concern with clause 246, which states that the commencement date will be May this year. Although they have pushed this back by a month, are the Government not concerned that this is an insufficient length of time for tax advisers to register? From representations we have had from the industry, they are very concerned that the timeframe is too short. Indeed, is HMRC fully equipped to take on this extra workload? I expect that the Minister will say that advisers can do it all online, but I am slightly worried that things like that do not always work. There is a real concern in the advice industry of the widespread unintended effect that may come out of these measures. It is important that we get this right and that people have time to prepare. Would the Minister take that on board and have a think about how we can make sure that the process is efficient and works well?

   Hansard source
8. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   Could I ask for a little clarity on that? Does that mean that there will be a list, and that an adviser will get three months from the point at which they are published on the list? Can they elect when to go on to that list? I am not quite clear what the Minister meant.

   Hansard source
9. 3 Feb 2026·Parliament·Mark Garnier

   Finance (No. 2) Bill (Sixth sitting)

   These clauses are wide and important, but they have also drawn significant criticism. The Government have decided to amend “dishonest conduct” rules to “sanctionable conduct” rules in schedule 21. That may seem like a minor change, but it changes the current high threshold of dishonesty to one that is lower and potentially ambiguous. The Institute of Chartered Accountants in England and Wales has described the definition of “sanctionable conduct” as “exceptionally broad;…based on inferred intention; and…not limited to unethical, unprofessional or deliberately incorrect behaviour.” Couple that with significant increases in penalties for conduct in scope, and it is unsurprising that the change causes a fair amount of concern in the industry. As the Chartered Institute of Taxation points out, the objective of the Government’s policy is to target deliberate behaviour. This change seems inadvertently to miss that objective entirely. Frankly, it seems to be the wrong move, and there is significant strength of feeling in the industry that the terminology should revert to its original wording. Can the Minister provide more detail on the decision to change the wording? What representations have the Government received from the industry about it? Will he also please commit to engaging further with industry stakeholders before Report stage, and to making the necessary changes to accomplish the well-intentioned aim of the policy? I have had other representations from groups such as the Institute of Chartered Accountants in England and Wales about related issues. There are a number of other issues about the way this is working. I will not trouble the Committee with them now, but we may follow up with a letter to the to the Minister about where parts of the Bill seem to be spreading into slightly negative territory.

   Hansard source
10. 3 Feb 2026·Parliament·Mark Garnier

    Finance (No. 2) Bill (Sixth sitting)

    That was sterling support for a terrible idea. The Office for Budget Responsibility was brought in back in 2010 to try to keep an eye on what had been going on through the financial crisis, the big problems as a result of the financial crash and, interestingly, the austerity measures brought in by Chancellor Alistair Darling before the 2010 general election, which were necessary to carry on and to sort out the public finances. It is really important that the Government are held to account, that Members of this House do so, and that they do so with as much information as they can possibly have. The Office for Budget Responsibility is there to mark the homework of the Government. To reduce that homework marking to just once a year—I appreciate that there are two events, but only measuring fiscal ability once a year—is not a good idea. The Chancellor of the Exchequer came along about a year ago and proudly said that she had managed to repair the public finances, only for us to discover a year later that in fact the public finances had not been sorted out and we had to see huge amounts more taxation come in. To remove the opportunity for the OBR to have a look at the public finances is a bad idea and we do not support it.

    Hansard source
11. 3 Feb 2026·Parliament·Mark Garnier

    Finance (No. 2) Bill (Sixth sitting)

    The broad thrust of the measure is perfectly reasonable. As we go into a more digital world, it is perfectly acceptable that people should be required to interact with HMRC online. The only problem is that not everybody is as computer literate, so what measures will be in place to support people if they are genuinely struggling? That aside, we are in favour of the measure.

    Hansard source
12. 3 Feb 2026·Parliament·Mark Garnier

    Finance (No. 2) Bill (Sixth sitting)

    This is all fairly straightforward. We are delighted that, since coming to power 18 months ago, the Government have decided that they are going to follow on with the great initiatives of the last Government, and I thank the Minister for so enthusiastically celebrating our achievements. However, there is one bit that we are slightly worried about. Clause 258 will require individual users of HMRC online services to provide and keep up to date their digital contact details. That is a perfectly reasonable request, but to enforce it, people can be subject to financial penalties of up to £1,000. As the Association of Taxation Technicians has said, the proposed £1,000 penalty is “unprecedented and disproportionate”. Much more importantly, there is no comparable HMRC penalty for failing to update a postal address or traditional form of contact. Are the Government not going a bit too far? I remind them that this is about regular taxpayers, and this penalty could catch out people who are more vulnerable or less financially literate. Can the Minister commit to reviewing whether this £1,000 fine is too high and, indeed, whether we should be bringing it in? We are completely behind the thrust of the clauses, but this penalty seems disproportionate. There is no fine for not updating a postal address, so why would there be one for not updating an email address?

    Hansard source
13. 3 Feb 2026·Parliament·Mark Garnier

    Finance (No. 2) Bill (Sixth sitting)

    The clauses follow a recent Delegated Legislation Committee debate that the Minister and I had, as a result of which we are going to get together with some members of the industry to talk about the confusion on this issue. One thing that worries me about the clauses is that they fail to differentiate between a cryptoasset and a stablecoin or tokenised currency. It is important to recognise that those are two different things. As I understand it, HMRC will take reporting on interest paid on deposit accounts, for example, so that it can understand what is going on in the economy and in individuals’ accounts. However, a bitcoin is not a currency; it is a tradeable asset. It can behave like a currency, or it can behave like a share, whereby it has its own intrinsic value and people can buy it with a view to selling it when it goes up in price. Similarly, people can use it, as we saw in the case of Tesla: Elon Musk was prepared to take bitcoin as payment for Tesla cars, although not for very long. However, it is not the same as a fiat currency and is not the same as a tokenised pound or stablecoin; those so-called cryptoassets act as part of a payment system. This is where we find ourselves getting into a potentially complicated area. We may be making legislation without necessarily understanding the difference between bitcoin, dogecoin and ethereum, which are tradeable assets, and a mechanism that enhances the payment system. It would be helpful if the Minister explained a more detail what, specifically, the clauses mean by “cryptoasset”. Standing back from the minute detail of what a cryptoasset is, as opposed to what a stablecoin is, the general thrust—participation in the wider reporting of what is going on with this stuff—is probably a good idea. We need to understand how it works, get things proportionate and not become over-regulated, because if we become over-regulated we become uncompetitive. There are a number of issues that cause me concern, so I will be grateful if the Minister can offer some explanations now, and then we can have more discussions when we meet in a week or two. If we go down the wrong track, it could put us a long way behind our international competitors.

    Hansard source
14. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)

    Q On the question of closer alignment, can you give us a sense from the international picture of whether certain regulatory regimes raise the barrier to terrorists or criminals so high that they are left alone? Is that a national thing or a company-based thing? Where are the flow lines of attack and threat? Is it on a national or a corporate basis? Stuart McKean: I do not think the cyber-criminal really cares, to be blunt. They will attack anywhere. You can, of course—

    Hansard source
15. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)

    Q I appreciate that. My question was about where that leads them to attack, on the basis that they will take the route of least resistance. Where is that? Is that an international thing, a national thing or a corporate thing? Stuart McKean: It is probably across all three, to be quite honest with you. It is very dependent on what they want to achieve, whether it be an economic attack or a targeted attack on a corporate entity. I do not think it has those boundaries—I genuinely think it is across the whole industry and the whole globe. The reality is that cyber-attacks everybody. We are being attacked every day. I do not see it as an international boundary, or a UK thing or a US thing. It is generally across the globe.

    Hansard source
16. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (First sitting)

    Do either of the other witnesses have anything to say on that? Jill Broom indicated dissent. Dr Sanjana Mehta indicated dissent.

    Hansard source
17. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q One of my favourite aphorisms is, “Institutions get the behaviours they reward.” We had a cry from Amazon Web Services this morning about how, when a regulator deals with a company in the event of a cyber-security attack, please remember you are dealing with a victim. I have dealt with the ICO before. Maybe it was the company that I worked in and led, but there was a culture there that, if you had a data breach, you told the ICO. There was no question about it. How are you going to develop your reactions and the behaviours you reward in order to encourage a set of behaviours and cultures of openness within the corporate sector, bearing in mind that, as was said this morning, by opening that door, companies could be opening themselves up to a hefty fine? Stuart Okin: In the energy sector, we have that culture. It is one of safety and security, and the chief executives and the heads of security really lean into it and understand that particular space. There are many different forums where they communicate and share that type of information with each other and with us. Incident response is really the purview of DESNZ rather than us, but they will speak to us about that from a regulatory perspective. Ian Hulme: From the ICO’s perspective, we receive hundreds of data-breach reports. The vast majority of those are dealt with through information and guidance to the impacted organisation. It is only a very small number that go through to enforcement activity, and it is in only the most egregious cases—where failures are so egregious that, from a regulatory perspective, it would be a failure on our part not to take action. I anticipate that is the approach we will take in the future when dealing with the instant reporting regime that the Bill sets out. Our first instinct would be to collaborate with organisations. Only in the most egregious cases would I imagine that we would look to exercise the full range of our powers. Natalie Black: From Ofcom’s point of view, we have a long history, particularly in the telecoms sector, of dealing with a whole range of incidents, but I certainly hear your point about the victim. When I have personally dealt with some of these incidents, often you are dealing with a chief executive who has woken up that morning to the fact that they might lose their job and they have very stressed-out teams around them. It is always hard to trust the initial information that is coming out because no one really knows what is going on, certainly for the first few hours, so it is the maturity and experience that we would want to bring to this expanded role when it comes to data centres. Ultimately the best regulatory relationships I have seen is where there is a lot of trust and openness that a regulator is not going to overreact. They are really going to understand what is going on and are very purposeful about what they are trying to achieve. From Ofcom’s point of view it is always about protecting consumers and citizens, particularly with one eye on security, resilience and economic growth. The experience we have had over the years means that we can come to those conversations with a lot of history, a lot of perspective, and, to be honest, a bit of sympathy because sometimes those moments are very difficult for everyone involved.

    Hansard source
18. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q To come back to Dr Spencer’s original question about the scope of the legislation, the current situation, as I understand it, is that there is a carve-out for small and medium-sized enterprises because we do not want to put too much regulatory burden on them, but, under the new proposed legislation, operators of essential services that are SMEs will be designated by their regulator. That brings us back to the question of which regulator that would be. Do you currently use that designation for operators of essential services, or would you have to do a piece of work, presumably looking at a number of different regulators’ points of view, to designate the operators of essential services? Brian Miller: We would work with the Scottish Health Competent Authority as our regulator; I cannot speak for other regulators and what that might look like. We are doing work on what assurance for critical suppliers outside the Bill looks like just now, and we are working across the boards in Scotland on identifying critical suppliers. Outside of that, for any suppliers or any new services, we will assess the risk individually, based on the services they are providing. The Bill is really valuable for me, particularly when it comes to managed service provision. One of the questions I was looking at is: what has changed since 2018? The biggest change for me is that identity has went to the cloud, because of video conferencing and stuff like that. When identity went to the cloud, it then involved managed service providers and data centres. We have put additional controls around that, because the network perimeter extended out into the cloud. We might want to take advantage of those controls for new things that come online, integrating with national identity, but we need to be assured that the companies integrating with national identity are safe. For me, the Bill will be a terrific bit of legislation that will help me with that—if that makes sense.

    Hansard source
19. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q I want to make sure I have understood exactly. Is the regulator going to tell you who your operators of essential services are, or are you going to tell the regulator? Brian Miller: I think we would work with the regulator, but we are looking for more detail in any secondary legislation that comes along. We have read what the designation of critical suppliers would be. I would look to work with the Scottish Health Competent Authority and colleagues in National Services Scotland on what that would look like. Stewart Whyte: On how we would make that decision, from our perspective we are looking at what the supplier is providing and what sort of data they are processing on our behalf. From the NHS perspective, 90% of the data that we process will be special category, very sensitive information. It could be that, from our side, a lot of the people in the supply chain would fall into that designation, but for some other sectors it might not be so critical. We have a unique challenge in the NHS because of the service we provide, the effect that cyber-crime would have on our organisations, and the sensitivity of the data we process.

    Hansard source
20. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Brian, from your side, what about, say, PPE, gloves or blood? There must be other things that are non-data that are, nevertheless, essential services. Brian Miller: I do not want to step out of my lane. There will be clinical stuff that absolutely would be essential. I would not be able to speak in any depth on that part of it; I purely look at the cyber element of it. As an organisation, we would be identifying those kinds of aspects. In terms of suppliers, you are absolutely right. We have suppliers that supply some sort of IT services to us. If we are procuring anything, we will do a risk assessment—that might be a basic risk assessment because it is relatively low risk, it might be a rapid risk assessment, or it may be a really in-depth assessment for someone that would be a critical supplier or we could deem essential—but there are absolutely suppliers that would not fall under any of that criteria for the board. The board is large in scale, with 40,000 users. It is the largest health board in the country.

    Hansard source
21. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q I want to come back to that point. Chris, you said something like, “SMEs find it very difficult, if not impossible, to bear the regulatory burden, so we have to be very careful when designating SMEs as operators of essential services.” To me, that says that you think the Bill, as currently drafted, will place too much of a regulatory burden on SMEs. Is that correct? Chris Parker: I was referring to strategic and critical suppliers, which is a list of Government suppliers. We are advocating that the level of governance and regulatory requirement inside an organisation is difficult, and it really is. It requires quite a lot of work and resource, and if we are putting that on to too small a supplier, on the basis that we think it is on the critical path, I would advocate a different system for risk management of that organisation, rather than it being in the regulatory scope of a cyber-resilience Bill. The critical suppliers should be the larger companies. If we start that way in legislation and then work down—the Bill is designed to be flexible, which is excellent—we can try to get that way. As a last point on flexibility—this is perhaps very obvious to us but less so to people who are less aware of the Bill—there is a huge dynamic going on here where you have a continuum, a line, at one end of which you have the need for clarity, which comes from business. At the other you have a need for flexibility, which quite rightly comes from the Government, who want to adjust and adapt quite quickly to secure the population, society and the economy against a changing threat. That continuum has an opposing dynamic, so the CRB has a big challenge. We must therefore not be too hard on ourselves in finding exactly where to be on that line. Some things will go well, and some will just need to be looked at after a few years of practice—I really believe that. We are not going to get it all right, because of the complexities and different dynamics along that line. Carla Baker: This debate about whether SMEs should be involved or regulated in this space has been around since we were discussing GDPR back in 2018. It comes down to the systemic nature of the supplier. You can look at the designation of critical dependencies. I am sure you have talked about this, but for example, an SME software company selling to an energy company could be deemed a critical supplier by a regulator, and it is then brought into scope. However, I think it should be the SMEs that are relevant to the whole sector, not just to one organisation. If they are systemic and integral to a number of different sectors, or a number of different organisations within a sector, it is fair enough that they are potentially brought into scope. It is that risk-based approach again. But if it is just one supplier, one SME, that is selling to one energy company up in the north of England, is it risk-based and proportionate that they are brought into scope? I think that is debatable.

    Hansard source
22. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Going back to our conversation with the head of IT security and compliance at NHS Greater Glasgow and Clyde and what could be designated an operator of essential services, and our subsequent conversation with Palo Alto, how do you envision that bit of the Bill working? Taking Glasgow as an example, while neither of us are doctors, we both broadly know what happens in hospitals—and there is also a doctor sitting to my right on the Committee, should we need one. On the example that I gave, given what is written in the Bill, how do you think it should work? Kanishka Narayan: Do you mean operators of essential services, or critical suppliers, as in the third party element?

    Hansard source
23. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    I meant operators of essential services. Kanishka Narayan: The Bill effectively specifies operators of essential services as large participants in the essential services sectors. I think that that definition is very straightforward. The hospital in this question would be an operator of an essential service. If the question extends to critical third party suppliers—

    Hansard source
24. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q Sorry, I misspoke. I mean an SME that is deemed a critical supplier. Who is going to deem them so? Which of the many regulators at play in that hospital is going to decide who is a critical supplier? Kanishka Narayan: There are two things to say on this. There is at least a four-step test on the face of the Bill for what would qualify as a critical supplier. First, a critical supplier has to supply to an operator of an essential service, in this case the hospital. Secondly, the supplier itself must engage with important network and information systems. Thirdly, the disruption to that third party supplier would have to cause a material disruption to the operator in question—in this case, if the third party supplier falls over from a cyber-security point of view, there would be material and business continuity disruption to the hospital. Fourthly, not only that, but that disruption would have to be sufficiently severe in its impact to be in scope. That is one set of things. Underlying that is a further test in the Bill, whereby alternative provision of that third party supply could not be secured in a practicable way. The combination of those tests means that the scope set out for the critical third party suppliers is extremely tight and robust. Then there is still the question, having gone through that five-step test, of the particular burden placed on relevant suppliers in scope. My expectation and hope would be that regulators take a much more proportionate approach there than to set the precise same conditions on those suppliers as they do on the operator in question; in particular, that the burden on them is placed specifically in sight of the directional risk that they pose to the operator, rather than the risk in sum for that third party supplier. The first thing is therefore that the Bill clearly specifies a very tight scope. The second is that it does not seem to me, as a relative novice to both the medical world and cyber-security, unusual to have a specification of this nature in a Bill. Given my professional context, I am particularly conscious of the very clear and critical third party comparable requirement in the Financial Services and Markets Act 2000, which focuses on both cyber-security and supply chain risks. That has worked relatively proficiently in that context, so I hope that there are some good lessons to learn from that.

    Hansard source
25. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q That is a very clear answer on the steps that have to be followed. Do you envisage that each regulator in, for example, the NHS Greater Glasgow and Clyde will follow the steps from their perspective? The first one might produce 20 SMEs that need to be in scope, and the next one might produce another 20, and so on. There might be a bit of overlap. Is that the way it is meant to work, or are all the regulators meant to get together and say that they have looked at it holistically, done the step test, and now have the answer? Kanishka Narayan: The way in which I would envisage it is that each individual regulator assesses the critical nature of the risk posed to its regulated operators. If a hospital has a third party supplier, and the presence and nature of its supply means that there is a critical risk exposure for the hospital, that would be in scope for some degree of regulation in the Bill. To your question, if there is a comparable but separate hospital in a part of England that is separately regulated, but has the same third party supplier, there is obviously a question of whether that third party supplier would end up being regulated twice if the criticality threshold is met. In that instance, and in other similar instances of multiple regulators covering the same third party supplier, I would expect a high degree of co-ordination. In fact, the provisions in the Bill, as well as my hopes for subsequent guidance, are focused on our efficiency and proportionality when there are multiple regulators. However, I think the assessment has to be undertaken by each regulator on a separate basis, because the question being assessed is not the nature, the sum risk, of the third party supplier in itself, but the risk posed by its relationship to the operator it is providing to—if that makes sense.

    Hansard source
26. 3 Feb 2026·Parliament·Lincoln Jopp

    Cyber Security and Resilience (Network and Information Systems) Bill (Second sitting)

    Q To be very clear, the three regulators we had here today were the Information Commissioner, Ofgem and Ofcom. If they thought that they had a locus because of something that that hospital did, all three would do the step test, they would come up with their bucket of SMEs that they wanted to bring into scope, and those would be added together and that would be the impact. Kanishka Narayan: Yes, I guess, added together in the sense that they would be separately regulated, but they would all come within the scope of the regulations. Where there is an overlap in the party being regulated, my hope is that the Bill provides for individual regulation, but is very much open to the prospect of a lead regulator engaging in a softer way with the other regulators, as long as each regulator feels that that has assured them of the risk.

    Hansard source
27. 3 Feb 2026·Parliament·Kit Malthouse

    Iran

    I join others in expressing horror at the stories coming out of Iran and the enormous death toll. I hope the Minister will take advantage of those international institutions, in which he has previously expressed confidence at the Dispatch Box, to bring a case to the International Criminal Court, particularly against the leaders in Iran. My secondary question is that, if the Iranian people, through their courage, are able to throw off their oppressors, are we able to say that there is a plan to support whatever may emerge after that event?

    Hansard source
28. 3 Feb 2026·Parliament·Kit Malthouse

    Universal Credit (Removal of Two Child Limit) Bill

    As my hon. Friend the Member for Solihull West and Shirley (Dr Shastri-Hurst) said, no one in this House doubts the importance of supporting children. Labour Back Benchers are feeling good about the fact that they have organised themselves to deliver what they see as a simple moral good, but as they know and we know, things are much more complicated than that. I know they think they have delivered a simple moral good because not a single one of them has mentioned the rate. None of them has questioned why the additional rate is set at £17.25, rising to £17.90. They have not asked whether that is enough to address poverty. They have not sought to get under the skin of whether this is a more complicated and nuanced argument than it might at first appear. Just the simple act is enough, without contemplating the unintended consequences. I am concerned that the Government are stumbling into a “Careful what you wish for” measure. First, a number of Opposition Members—and, indeed, the Secretary of State—mentioned the demographic time bomb that we face. There has been no discussion of this measure in the context of the overall fiscal problem that our children will face. At the moment, we have about 3.6 workers per pensioner in this country. By 2050, that will have fallen to two. How will we pay for all of this in the future? How will we fund it all without enormous debt? We have only to look across the channel at France to see what a fiscal eruption can look like, with civic disruption and unrest on the streets, when the necessary correction is made to a welfare state that is running out of control. I am afraid that that is exactly the situation we find ourselves in. No one is pretending that decisions about welfare are easy—they are not easy. Having worked briefly as a Minister in the Department for Work and Pensions, I know that these are difficult decisions, yet no one is questioning the micro-decisions that are made. It is simply enough to say to people, “We’re pumping money out there. Let’s hope for the best.” Why is the standard rate for the mobility section of the personal independence payment set at £30.30? I do not know. Does anybody else know? Is there an argument for it? These are the decisions that Ministers have to make on a daily basis, not just about whether we pay welfare but how much we pay. One of my concerns about this measure is that none of that is part of a wider conversation about the massive demographic steam train that is coming down the tunnel towards us. The second issue I have is that this legislation treats children as a burden to be somehow mitigated, necessarily because it includes them in the welfare bill, rather than as a bonus to be encouraged. As my hon. Friend the Member for Hinckley and Bosworth (Dr Evans) said, we on the Conservative Benches would much rather there were work incentives that came alongside children. When I was briefly the Secretary of State for Education, I was inundated with correspondence and approaches from lots of highly productive and ambitious women who wanted assistance in work. They wanted some kind of bonus, relief or package to encourage them to have children, rather than a safety net that rescued women if they had children. For a country that needs more children, we need a tilt in our mentality and approach to move from mitigation towards encouragement; that is my concern about embedding the notion that people should have more children in the welfare system. The final issue I will raise is the legitimacy of the system, which has been raised by a number of Members. We often pretend that we do things for the first time in this country, whereas we can in fact look overseas for lessons, and we do not have to look very far. In France, where successive Governments increased family-related welfare with weak links towards work or contribution, it has created a wider resentment in society. Any successful welfare system must have an eye to legitimacy and consent from the wider population for it to exist.

    Hansard source
29. 3 Feb 2026·Parliament·Kit Malthouse

    Universal Credit (Removal of Two Child Limit) Bill

    I am glad that the hon. Gentleman is paying attention to my entries in the Register of Members’ Financial Interests, but, as he will know, I have not been forced out to get a job. I founded my business 30 years ago; I am one of the few people in this House who has created jobs by the sweat of my own hands, rather than just talking about it. Frankly, I pay the Sainsbury’s bill, the mortgages and all the rest of it for all my employees every single month, and I am proud to do so. Maybe he could learn some lessons, by spending time with some businesspeople, about what it is to make true fiscal and economic decisions. Let me return to my third point, which is about legitimacy. One thing that was found in France was a rise in resentment, which resulted in President Macron taking specific steps to means-test the access to family welfare. French political scientists will point to the rise of the National Rally in France directly stemming from a mishandling of the welfare system and a growth in resentment in those who did not participate in it. I am afraid that today we see that writ large in the Order Paper in the Reform party’s reasoned amendment, which was not selected. It calls for open discrimination in our welfare system against those who do not have parents born entirely in this country. I must declare an interest as I am afraid that includes two of my children, who were not born to a British citizen. It also includes the children of Members of Parliament who sit for the Reform party. There is something grotesque about seeking legislation that would downgrade the citizenship of one’s own children.

    Hansard source
30. 3 Feb 2026·Parliament·Joy Morrissey

    Universal Credit (Removal of Two Child Limit) Bill

    Does my hon. Friend agree that it is an issue of fairness for the taxpayer if people are working hard in a job but being rewarded less than someone else getting benefits? That is why we need to keep the two-child benefit cap.

    Hansard source
31. 3 Feb 2026·Parliament·Joy Morrissey

    Universal Credit (Removal of Two Child Limit) Bill

    It is an issue of fairness. The people of Beaconsfield, Marlow and the south Bucks villages have seen their taxes go up and they are seeing those taxes being given to people who are not working. It is unfair.

    Hansard source
32. 3 Feb 2026·Parliament·John Cooper

    Finance (No. 2) Bill (Fifth sitting)

    The Minister talks about people being better off, but my farmers are very concerned about the fertiliser impact. Four or five years ago, fertiliser was around £180 a tonne; today it is about £400 a tonne, and the introduction of CBAM might put another £100 on top of that. Farmers’ margins are so narrow that they simply have to pass that on, which will have a direct effect on food prices in this country. The Minister says that there will be talks about that. Farmers should be front and centre of those talks, because this is really worrying.

    Hansard source
33. 3 Feb 2026·Parliament·John Cooper

    Fish and Chip Sector

    It is good to see so many right hon. and hon. Members in their plaice as we skate through the choppy waters that are the fish and chip sector. The chips are down for fish suppers. While the word “iconic” is overused, surely fish and chips warrant that label. At Heathrow airport, visitors are greeted with signs extolling the virtues of what is, or was, our national dish. Welcome to Britain: land of drizzle, warm beer, warm welcomes and fabulous fish suppers.

    Hansard source
34. 3 Feb 2026·Parliament·John Cooper

    Fish and Chip Sector

    I thank the hon. Member for his intervention—a fascinating history lesson. Staying with history, during the war fish and chips were deemed so vital to the nation’s morale that Prime Minister Winston Churchill insisted they be exempt from rationing. If the ingredients were available, fish suppers were on the menu and chip shops got extra cooking fat to keep the home friers burning.

    Hansard source
35. 3 Feb 2026·Parliament·John Cooper

    Fish and Chip Sector

    I thank my near neighbour for his intervention. He presages some of what I am going to touch on now. Today all is not well. Romano Petrucci, proprietor of the Central Café in my home town of Stranraer, is just one of many business people warning that this staple is fast becoming an unaffordable luxury. Data from the Office for National Statistics indicates that the average price of a portion of takeaway fish and chips was £10.96 in December, up from £9.99 the year before—an increase of 10%. That was higher than average price increases for other takeaway meals or carry-outs, as we call them in Scotland. Over the same period, the average price of a Chinese takeaway main course increased by 4% and an Indian takeaway main course by 3%, while a takeaway pizza increased by just 2%. That £10 barrier is hugely significant, for customers generally have a ceiling on what they regard as reasonable—perhaps £6 for a coffee or £7 for a pint of beer. Above that, sales dip, and no wonder at £40 or more for a fish dinner for a family of four, and so, sadly, it has proved: the ONS says that sales of fish and chips fell by 21% in 2024 compared with the previous year.

    Hansard source
36. 3 Feb 2026·Parliament·John Cooper

    Fish and Chip Sector

    I certainly would not pay £6 myself for a coffee. If I can find a pint cheaper than £7, I think I will be there.

    Hansard source
37. 3 Feb 2026·Parliament·John Cooper

    Fish and Chip Sector

    I thank the hon. Lady for her interesting intervention. Her chip challenge sounds like a lot of fun, and I defer to Madam Deputy Speaker about the question of proper parliamentary language—I am sure what she said is perfectly acceptable. Fish and chip shops accounted for 60% of the fall in sales, with 36 million fewer portions of fish and chips sold in fish and chip shops in 2024 compared with 2023. Something has gone drastically wrong. Worse, it is not just one thing but a series of issues. I have some sympathy with the Minister because the Department for Environment, Food and Rural Affairs is not directly responsible for all these matters, but of all Departments, it should realise that government must not work in silos and instead should work across Whitehall.

    Hansard source
38. 3 Feb 2026·Parliament·John Cooper

    Fish and Chip Sector

    I feel like I am swimming upstream here, but I am happy to give way.

    Hansard source
39. 3 Feb 2026·Parliament·John Cooper

    Fish and Chip Sector

    The hon. Gentleman makes a good point, and I will touch on the question of skills in a few moments. A key reason for prices leaping like a salmon is an increase in the price of fish itself. Incredibly for an island nation, we are a net importer of fish. Previously, a high proportion of fish used in the UK was imported from Russia, though in March 2022 the Government rightly imposed a 35% tariff on Russian seafood imports following the illegal invasion of Ukraine. That invasion also hit the price of flour and sunflower oil—both major Ukrainian exports. There was also a reduction in the North sea cod quota, mentioned by the hon. Member for Strangford (Jim Shannon), who is no longer in his place.

    Hansard source
40. 3 Feb 2026·Parliament·John Cooper

    Fish and Chip Sector

    The hon. Lady makes an important point. We should of course support businesses of all kinds, and pedestrianisation can be a double-edged sword. One of the difficulties is the weather in this country, and there is nothing better than pulling up right outside the shop that you want to go to, so decisions have to be balanced. The reduction in the North sea cod quota for 2025 reduced supply, and, of course, increased prices. I am more a haddock man myself, but cod is one of the top five imported and consumed species in the UK. Labour’s failed “mackerel for missiles” deal gave the EU further rights in our waters, but did not give us access to Europe’s multibillion-pound Security Action for Europe defence fund. The EU now takes seven times more fish, by value, from our waters than we take from its waters. Fish and chip shops have also faced challenges from increased electricity prices due to the use of energy-intensive cooking appliances. Increased energy costs have also contributed to higher potato prices, with more to come as the carbon border adjustment mechanism is effectively a fertiliser tax, adding perhaps an extra £100 per tonne. Even changes to reliefs on double-cab pick-ups—the farmers’ workhorse—have increased potato prices. Let us hear no nonsense about the people behind the counter being low-skilled; today’s fish-frier could be tomorrow’s FTSE 100 chief executive officer, or the founder of a €1 billion unicorn start-up. They work with cash and high-value stock, and, crucially, learn communication skills through dealing with the public. Increases to the minimum wage, which is paid not by the Government—although Labour likes to pretend that it is—but by hard-pressed businesses, are also an issue. Add the increase in employer national insurance, which puts a bounty of about £900 on the head of each employee: no wonder youth unemployment is rising.

    Hansard source