Guidance: Apply to receive non-financial VAT registration data from HMRC

Overview

If you’re a UK-based credit reference agency or similar financial organisation you can apply for authorisation to get non-financial VAT registration data for the purpose of:

• credit scoring
• anti-fraud checking
• compliance with other financial regulations

It may help small businesses and new startups gain access to credit and finance for the first time, and give increased access to credit and finance to established VAT-registered businesses.

Data file to be shared

The data file will cover all VAT-registered businesses, not individual businesses or grouped by trade sector or geographical location.

In addition to the VAT registration number and available contact information (such as the business address), the data for each registered business includes the:

• effective date of registration
• overseas trader indicator
• group or divisional registration indicator
• organisational name
• trading name and trading style
• standard industrial classification code (trade class)
• legal entity status
• company number and incorporation date

Where applicable, this will also include the date of:

• deregistration
• transfer of a going concern

No financial or payment data is included.

Software you will need to receive data

You’ll need systems and software that allows data to be transmitted securely and protected by encryption. You’ll need to use HMRC Secure Data Exchange Services which can be accessed in one of the following ways, through:

• a suitable browser such as Internet Explorer, Chrome or Firefox
• an automated connection using File Transfer Protocol-Secure software using version 1.2 of the Transport Layer Security encryption protocol

The file shared with you will be updated weekly to make sure it is accurate.

Who can apply

HMRC will only share non-financial VAT registration data with you if your business has a genuine need to use it for the purposes set out in section 8(1) of the Small Business Enterprise and Employment Act (SBEEA) 2015.

HMRC will decide if you’re eligible to get this data.

Your security management systems need to be accredited to ISO/IEC 27001 standards and certified by an independent accreditation body.

Potential users include credit providers, credit reference agencies, banks and other financial services providers.

You’ll need to be authorised to receive the data.

How to apply

You can only apply in the period from 1 April to 31 October to get the relevant data from 1 April the following year.

Register your interest in applying to receive non-financial VAT registration data by emailing: vat.datasharing@hmrc.gov.uk, quoting ‘VAT Data Sharing’ in the subject line.

HMRC will then tell you how to:

• register to use the eSourcing tool ‘SAP Ariba Sourcing Pro’
• access an online application questionnaire

You can only apply in the period from 1 April to 31 October.

Completing the online application questionnaire

Once HMRC has given you access to the questionnaire within the SAP Ariba eSourcing tool you’ll be asked to:

• describe the nature of your business and explain why you need the data
• say how you’ll use the data in your processes and what products or services will result from those processes
• explain the benefits the data will bring to your business
• confirm your accreditation to ISO/IEC 27001 standards by an independent accreditation body and give details of any regulatory framework you operate under, for example, the Financial Conduct Authority or Prudential Regulatory Authority
• give details of your business and any group members within your organisation that you would like to be covered by your authorisation to receive VAT registration data
• give details of key personnel who will have access to the data and their roles
• indicate where and how data shared with you will be stored and give details of the arrangements that you have in place to make sure the security of the data, including to make sure that your employees will protect data shared with you and will only use it as permitted by the SBEEA2015
• tell us about any previous occasions of tax non-compliance, criminal convictions for tax related offences and any previous occasions of loss or misuse of data

This list is not exhaustive.

You will not get VAT registration data unless you’re approved by HMRC. You need to make your application in good time and make sure it’s accurate and complete.

Fees payable for data

You’ll need to pay a fee to HMRC to cover the costs for administering the process and sharing the information. The fees payable are as follows:

• application fee: £265, when you apply
• data usage agreement fee: £135 if your application is successful and you sign the agreement with HMRC
• an annual data transfer fee — you can get details of the current fee by contacting: vat.datasharing@hmrc.gov.uk

The data transfer fee will be reviewed annually to make sure this continues to cover the cost for HMRC sharing the data. Authorised recipients will be advised in advance of any changes to the fee by 31 May, which may go up or down.

What happens next

Your application will be checked for the information asked for and in the case of a company, checks may be made with Companies House and other government departments and agencies.

HMRC may visit your premises and ask you for details about (but not limited to) your customers, business plans, and information security management system.

More information may be requested. Until this information is received, your application will be put on hold.

If approved, you’ll get a Data Sharing Agreement to sign, which will include the start and end date for your authorisation.

All successful applicant applying between the period of 1 April to 31 October will be registered from 1 April of the following year.

You’re unlikely to get authorisation if the business, or the applicant, or anyone with an important role or interest in the business has:

• any unspent criminal convictions for any offence of dishonesty or for any offence linked to terrorism or organised crime (an ‘unspent’ conviction is one that has not expired under the terms of the Rehabilitation of Offenders Act 1974)
• previously had their authorisation or application to receive VAT registration data withdrawn or refused
• been involved in any significant incidence of mishandling or misuse of confidential data
• a history of fraudulent behaviour, including misrepresentation or identity theft

This list is not exhaustive.

It will take up to 45 days to process the application and set up the necessary procedures for sharing data.

If HMRC discover at any time that the information you’ve given to us is untrue or incomplete, your application may be denied or withdrawn.

If it’s refused, HMRC will tell you in writing and explain the reasons for our decision.

Conditions of use

Where HMRC agrees to share non-financial VAT registration data with you, HMRC may impose specific conditions or restrictions relating to your use of the data.

HMRC will advise you of our decision and outline any conditions or restrictions.

Your Data Sharing Agreement will give details of the obligations that apply to you as an authorised recipient.

These include:

• protecting the information HMRC shares with you
• maintaining up-to-date and accurate records, sufficient to enable our officers or any independent assessor or inspector to confirm your compliance with your obligations under your Data Sharing Agreement and the SBEEA

Your Data Sharing Agreement may be cancelled if:

• you advise us at any time that you do not want to continue receiving VAT registration data
• HMRC decide to end the agreement in response to misuse or loss of VAT registration data shared with you
• HMRC identify that you no longer have a requirement to receive VAT registration information for any of the purposes set out in section 8(1) of the SBEEA 2015
• HMRC decide to withdraw from the agreement for any other reason

Length of term

All contracts are 5 years.

You’ll get an email reminder 12 months before your term expires.

If you do not ask for an extension to your contract within the final 12 months of your term, but no later than 6 months before the expiry of the term, then your contract will end and you will stop getting data.

Changes to report

You must tell HMRC if any information on your application or in your Data Sharing Agreement changes. You must do this by emailing: vat.datasharing@hmrc.gov.uk without delay, if the:

• status of your business or the company changes
• business’s need for access to VAT registration data no longer applies
• business’s intended use of VAT registration data changes (but this does not include changes or additions to your products and services where these relate to a permitted use already notified to us)
• authorised or recipient is transferred to a business which is not authorised to receive VAT registration data
• information in your application changes in any other way

Requests to transfer data to a third party

The data may not be passed to any other parties, except with HMRC consent. You may only ask for consent once you’re authorised to receive the data.

There are sanctions for data misuse, including a criminal sanction for unlawful disclosure of information relating to identifiable businesses.

HMRC will only grant consent where HMRC are satisfied that the person with whom you wish to share VAT registration data:

• will not be charged a fee by you for sharing data with them
• will use it only for purposes set out in section8(1) of SBEEA 2015
• will not share the information with any other party (except with our consent)
• has security management systems in place to exercise due care over the storage of the data

You must also satisfy us that you have policies and agreements in place to maintain the security of information transferred outside your organisation.

You’ll need to request our consent by emailing: vat.datasharing@hmrc.gov.uk, giving details of the data you want to disclose, your intended recipient, and their reason for needing access to VAT registration data.

HMRC will only agree to the sharing of specified data items. HMRC will not consent to the onward sharing of the full VAT registration data that HMRC shares with you, except where HMRC are satisfied the third party is a contractor carrying out a process to facilitate use of the data by you. HMRC may attach conditions and restrictions in respect of sharing that information and may ask to see any agreement or contract you have in place with the third party.

In cases where HMRC decide not to consent to the transfer of specific data, or if the third party (other than a contractor acting on your behalf) would like access to the full VAT registration data, they may apply to get information directly from us.