I've been contacted by Chris by e-mail, but I'll respond to his points above.
Two completed illegal moves, as defined in the Laws of Chess, lose the game. "Completed" in this context means "pressed the clock". If the clock isn't pressed, there hasn't been an illegal move.
If your Megafinal isn't using clocks, then you can't impose any penalties for the illegal move other than to go back to the position before the illegal move and play on from there, with touch move/touch take applying as appropriate. You have to do that in games with clocks as well, of course, but the time/loss of game penalties are in addition to that.
If your Megafinal is using clocks, and it is not ECF-graded, then it can set whatever rules it wishes with regard to illegal moves. These rules should be made clear to players either at the start of the Megafinal, or in advance of it in writing to the entrants.
If your Megafinal is using clocks, and is ECF-graded, then it must comply with the rules Ray has provided a link to. For the secondary school age groups, there is no flexibility from the Laws. For younger age groups, the organisers may increase the number of illegal moves that lose from 2 to some other number of their choosing, which again should be communicated with players either in advance or at the venue.
I can't comment on the status of Chess Scotland, Welsh Chess Union or Ulster Chess Union rating in the case of the Megafinals held outside of England, if those are being rated by those Federations.
The time penalty for illegal moves is 2 minutes in a Rapidplay competition, which is what the Megafinals are where clocks are being used.