Home secretary Shabana Mahmood has updated MPs after counter-terrorism police took over the investigation into Ann Widdecombe’s death. In the same Parliament sitting, the government also announced that it is effectively proscribing the Islamic Revolutionary Guard Corps (IRGC), using new powers under the National Security (State Threats) Act 2026.

The headline policy decision is the part that should land hardest with decision-makers: designation creates new criminal offences related to supporting, assisting, or obtaining material benefit from a designated body. And if someone engages in espionage, sabotage or foreign interference for, on behalf of, or with the intention to benefit the designated body, they may be charged under the National Security Act 2023. The maximum penalty for these offences reaches life imprisonment, per the government explanation.

To understand why this matters now, you have to see the political and legal knot the government is cutting. Ministers have been under pressure for years to proscribe the IRGC, which backs terrorist activity outside Iran. The last Conservative government, and Labour when it took power, had argued that it would be difficult to use laws intended to target terrorist organisations against a state-run organisation. The 2026 “State Threats” framework changes the legal posture: it is designed to deal with foreign power threat activity, not just traditional “terrorist group” categories.

The criteria for designation are also spelled out. For a body to be designated, the home secretary must reasonably believe it is, or has been, involved in foreign power threat activity and must consider that designation is necessary to protect the safety or interests of the United Kingdom. The UK says it has identified activity linked to the IRGC involving threats to life and intimidation on UK soil. In January 2024, the UK announced sanctions targeting Iranian officials responsible for threats to kill on UK soil and criminal gangs who do the regime’s bidding overseas. Those Iranian officials designated under the sanctions were members of IRGC Unit 840, which was exposed in relation to plots to assassinate two Iran International TV journalists in the UK.

There is also a cyber angle, and it connects dots that companies often only learn about after something goes wrong. In 2022, the National Cyber Security Centre issued an advisory alongside international partners exposing malicious activity. The advisory highlighted the threat from cyber proxy actors affiliated with the IRGC targeting a broad range of entities. Those entities included organisations across multiple US critical infrastructure sectors as well as Australian, Canadian and UK organisations. In other words, this is not only about direct intimidation or arson. It is also about intermediaries, contractors, and proxy actors operating in the gray zone that regulators and boards have to account for.

The government also points to a specific escalation window on the ground. Between March and May 2026, there were a series of attacks and attempted attacks targeting Jewish communities, journalists and Israeli interests in the United Kingdom and across Europe. The incidents included acts of arson and intimidation, and the source emphasizes that they caused real fear and distress and had a profound impact on affected communities. The Islamic Movement of Companions of the Right (IMCR), also known as Harakat Ashab al-Yamin al-Islamiyah, has publicly claimed seven attacks at UK locations linked to Jewish and Israeli communities, and Persian-language media. Those claims include the antisemitic arson attack on four Hatzola ambulances in Golders Green on 23 March.

So what happens to real-world decision-making when a state-linked organization gets proscribed? First, compliance risk shifts from “could this be terrorism financing?” to “could any support, assistance, or material benefit cross into a new criminal offence?” Second, the scope of concern expands. Under the National Security Act 2023 framing, the behaviour set includes espionage, sabotage, and foreign interference carried out for, on behalf of, or with the intention to benefit the designated body. That is a wider net than many organizations have historically designed controls for.

There is also the operational reality that investigations can move quickly. The same live updates thread that carried the Widdecombe investigation also carries this IRGC announcement, framed alongside counter-terrorism police taking over. While the source does not connect the two cases directly, the juxtaposition is a reminder: governments are prepared to use security resources and updated legal tools in parallel.

Finally, look past the immediate legal effect and think about second-order governance. Once designation introduces offences with life imprisonment as a maximum penalty, boards and senior compliance leaders have to assume regulators will test edges. The practical pressure point is not just domestic actors. The source repeatedly references cyber proxy actors and overseas activity, plus sanctions targeting IRGC Unit 840 linked to plots involving journalists. For executives in finance, media, critical supply chains, and anything touching UK critical interests, that means enhanced due diligence on counterparties, vendors, and “intermediaries,” plus tighter controls around material benefit and assistance.

And there is a bigger political subtext for executives too: the source notes it will be hard to “wrestle” a head-turning policy announcement from structural reforms to the state, and that allies are discussing a potential “big bang” early on. In that same discussion, the quoted comments about pulling power out of London suggest a continuing theme: policy is becoming more forceful, more decentralised, and more execution-focused. For leaders reading this, the strategic stake is simple. Proscription under the National Security (State Threats) Act 2026 raises the baseline for what counts as unacceptable support to a designated foreign power threat actor. If you operate anywhere near the seams of cross-border cyber, intimidation campaigns, or complex supply and financing chains, you should treat compliance as a live system, not a tick-box document.