Guidance

Pension schemes Scottish rate of Income Tax newsletter – May 2017

Updated 12 May 2017

1. Introduction

The introduction of the Scottish rate of Income Tax means that pension scheme members receive tax relief on their contributions based on their residency tax status. For scheme administrators operating relief at source pension schemes, if the Scottish rate of Income Tax differs from the rest of UK rate, this affects the amount of tax relief given to each member.

From January 2018, we’ll tell pension scheme administrators operating relief at source pension schemes your individual scheme members’ residency tax status.

As you know, if you’re a scheme administrator operating a relief at source pension scheme, you must submit an annual return of individual information by 5 July each year. This annual return contains information about each member, the contributions made and tax relief given.

HM Revenue and Customs (HMRC) will use the data submitted on the previous year’s annual return of individual information to tell you the correct relief at source rates to apply to your scheme members in the following tax year. This is so that your scheme members receive the correct amount of tax relief.

The 5 July filing deadline gives us time to tell you the correct relief at source rates for each member so that you can operate these from start of the new tax year. We’ll do this electronically and will do this in January each year, from 2018 onwards.

As we explained in Pension Schemes Newsletter 85 we are introducing a new electronic service, the Secure Data Exchange Service (SDES) for the submission of the annual return of individual information.

From April 2018 the new electronic submission service will run alongside existing submission methods. From 2019 you’ll only be able to submit your annual return of individual information electronically. You’ll do this using SDES.

This newsletter provides more information for pension scheme administrators about submitting the annual return of individual information to HMRC from 2018 onwards.

2. Using the Secure Data Exchange Service

If you submit your annual returns of individual information via Secure Electronic Transfer (SET), you don’t need to enrol, we’ll automatically migrate you to SDES from August 2017 so that you can submit your return using SDES from April to July 2018.

We’ve issued guidance to scheme administrators who use SET about migrating from SET to SDES and you can find this at Appendix A.

2.1 Guidance for pension scheme administrators who are not already enrolled onto SET

As we explained in section 1, HMRC will use the new SDES to notify pension scheme administrators of the correct residency tax status of their scheme members.

If you’re a pension scheme administrator who doesn’t currently use SET, as we start to move to the new SDES service in summer 2017 you must enrol onto SDES. You’ll have until January 2018 to do this. We’ll provide more information and support to help you enrol, in due course.

Once you’ve enrolled onto SDES, your first interaction with the service will be to receive a file from HMRC which will tell you of your individual scheme members’ residency tax status in January 2018.

From April 2018 all pension scheme administrators will be able to submit their annual returns of individual information using SDES.

2.2 About SDES

SDES is a secure online service that allows businesses and HMRC to send and receive bulk information via the internet. We’ve designed this service to replace existing submission methods for example SET, storage devices, disks, CDs and paper.

SDES:

• is a simple, easy to use browser based service
• works through your Business Tax Account on the Government Gateway
• is designed so that scheme administrators can transfer up to 1 GB of data in a single file in line with the current process
• is free of charge to HMRC business customers
• is a secure and reliable way of transferring data transfer to and from HMRC without the need for encryption

2.3 Enrolling for SDES

From August 2017, if you’ve not been automatically migrated onto SDES we’ll help you to enrol onto SDES in time for us to send you the report notifying you of the residency status of your scheme members in January 2018.

We’ll contact you for specific information so that we can enrol you onto the service and provide you with a unique reference number.

All SDES users must be signed up to the Government Gateway. If you’re not signed up you’ll need to go to GOV.UK to create a Government Gateway account however, you should note that your account must be a Business Tax Account not a Personal Tax Account.

Once you’ve created your Business Tax Account on the Government Gateway you’ll be able to use your unique reference number and “known fact” to complete enrolment and access SDES.

You’ll have to provide an email address after completing enrolment for all email notifications from HMRC. It’s important that the address you give us is monitored frequently. We recommend that this address should be a central mailbox or distribution list so that email notifications aren’t missed. Once you’ve provided this, your enrolment will be complete.

2.4 Requirements for using SDES

To use SDES you’ll need:

• an internet connection and a browser
• a single point of contact to work with our On-Boarding Team who will support you through the sign up process

2.5 Technical aspects of SDES

Once you’ve enrolled onto SDES you can then exchange data with HMRC in one of the following ways:

• Internet Browser – This is currently used and will be the default option
• Automated (currently under development) - This option will enable automated transfer via File Transfer Protocol Secure (FTPS), and you must configure this with the HMRC SDES technical support team before you can use this method for data transfer. We’ll issue further technical information separately to this newsletter. Whilst we develop the automated option you should use the Internet Browser option

Using SDES via a browser

The ‘browser’ option is the default option for using SDES. To use the browser option you’ll need:

• a Government Gateway Business Tax Account
• to have completed SDES enrolment
• a device with access to the Internet
• appropriate internet connection to upload/download files

To use the SDES system using the browser option you’ll need to follow the high level steps below:

1. Access SDES on GOV.UK

2. Log into your Business Tax Account using Government Gateway Credentials and you’ll see the following options:

Option one: Select to download one or more files – this is how you’ll receive the notification from HMRC of the residency status of your scheme members in January 2018. You can find more information on this in part 4 of this newsletter.

Option two: Select to upload one or more files – this is how you’ll submit your annual return of individual information to HMRC. You’ll be able to submit your 2017 to 2018 annual return using SDES from April 2018 and the deadline for submitting this is 5 July 2018.

Note: you’ll need to keep the browser open during upload or download.

Through the new service, we’ll issue you with automatic email notifications to:

• to tell you that we received the file
• to tell you that the file was delivered
• to tell you that the file failed to upload
• to tell you that antivirus failed
• to tell you that a new file is available for download
• to warn you that downloaded file(s) will be deleted

Note: these are file confirmation messages. You can find more information on the advisory reports on annual returns of individual information in part 3 of this newsletter.

We’ve successfully tested the SDES webpages on the latest versions of the following browsers:

• Internet Explorer - version 9 and above
• Chrome - latest version at release
• Firefox - latest version at release
• Safari - latest version at release
• Opera - latest version at release

Using SDES via an automated connection

We’re developing the automated option for users with high transfer volumes. If you choose to use SDES via the automated option, once this is available, you must contact HMRC to request this and for advice on how to configure this. HMRC technical support teams will then work with you to enable this option. The automated option means that you can:

• upload and download files via File Transfer Protocol Secure (FTPS)
• receive notifications via the GOVTALK messaging service – so that you can receive automated messages directly to your system in addition to the default email notifications

We’ll tell you when this option is available and provide contact details for requesting this option in due course (via the Pension Schemes Newsletters).

To use the automated option, you’ll need:

• a Government Gateway Business Tax Account (these will be used by FTPS software)
• to have completed SDES Enrolment
• software to enable transfer via FTPS using Transport Layer Security (TLS v1.2)
• a network with access to the Internet
• a static IP address for whitelisting (an extra layer of security – to allow HMRC to record the IP address of the PC you use to contact HMRC)
• appropriate internet connection to upload and download files (size varying on type of transfer)

To use the SDES system using the automated option you’ll need to follow the high level steps below:

1. Contact the HMRC technical team to set up FTPS and exchange IP addresses
2. Set up the GOVTALK messaging service – this is optional

Using this option lets you add additional automated steps of your own to reduce the need for manual intervention. You’ll be able to specify trigger events, for example on notification of a new file available for download, you can tell the service to automatically download the file. When a trigger event happens, FTPS software will automatically authenticate with SDES service and upload or download files depending on software configuration.

We’ll provide you with updates on the progress of the automated option and let you know when this becomes available via the Pension Schemes Newsletters.

2.6 General information

SDES registration process

The Government Gateway Business Tax Account is easy to set up online and you’ll be able to do this straight away, however because we send your unique reference number and “known fact” by post, the full set up process can take longer.

It may also take a little longer if you want to use the SDES automated option because you’ll need to contact HMRC to set this up and make sure that your IT system is ready to use this option. If your IT system is not ready to use the automated service by January 2018 you can still use the browser option.

File format

You can submit any file formats using SDES except:

• Executable files (.exe) - these will be immediately rejected
• Encrypted files - you should not encrypt files, SDES will do this for you

You’ll only be able to transfer files to HMRC using SDES so you should make sure your annual information return files are in a submittable format and structure.

Downloading files from SDES

SDES keeps files for 6 days (144 hours) starting from when the file is made available to you for download. SDES will send you an email to warn you when the file will be deleted. After 6 days you’ll be unable to recover the file on SDES because the file is securely deleted for security purposes. If SDES has deleted the file, you’ll need to request the file again through SDES.

File security

All connections to SDES use the following industry standard encryption:

• HTTPS for browser transfers – this is industry standard encryption and will ensure a secure connection with HMRC
• TLS for automated transfers – TLS1.2 this is industry standard encryption and will ensure a secure connection with HMRC

SDES always encrypts files in transit or on the system. In addition, there is no direct access to any files as they move through SDES until the file is successfully received by the service, meaning that even HMRC technical support teams cannot access files while they’re in transit. There are also additional approvals within HMRC to ensure data protection.

3. Advisory reports

When file submissions have been successfully accepted into HMRC, the data for each individual scheme member will be subject to validation and matching checks before continuing to the processing stage.

For submissions that do not pass validation/matching checks because the information for one or more members is incorrect, SDES will produce an advisory report and return this to you. You’ll start to receive advisory reports when you submit your annual return of individual information from April 2018 onwards.

4. Notification of individual scheme members’ residency tax status - January 2018

We’ll tell you the residency tax status of your individual scheme members for the first time in January 2018 so that you can apply the correct rate of relief at source to your scheme members in 2018 to 2019. From 2018 onwards we’ll tell you this information in January each year.

We’ll use the data you submitted on the annual return of individual information for the previous tax year to create an output file in line with the standard format in which you submit your annual returns of information.

We’ll provide you with correct National Insurance numbers if we identify that the National Insurance numbers you submitted are incorrect. We’ll give you more guidance on this in due course.

The corrected National Insurance number field will be formatted in line with the guidance link as above (for example QQ123456C). The original National Insurance number you submitted will be included so that you can identify the scheme member from your original submission data.

We’ll tell you the residency tax status of each of your members by adding an additional field:

• with an S for Scottish tax status or
• or we’ll leave it blank for rest of the UK

New scheme members who were not included on your 2016 to 2017 annual return of individual information won’t be included on the January 2018 residency tax status notification that you’ll receive from us. So some scheme members may not have the correct residency status applied for some time.

The information in part 5 explains how you’ll be able to find the residency tax status for those customers not included in the January residency tax status notification.

5. Residency tax status look up service

We’ve been working closely with pension scheme administrators to develop a residency tax status look up service.

We aim for this to be available for pension scheme administrators to use before the start of the 2018 to 2019 tax year. You’ll be able to use this service in real time to check the residency status of scheme members when:

• a new member joins your scheme in-year
• a member re-commences contributions to your scheme after a period of inactivity

Access to the residency tax status look up service will be via one of the following ways:

• via GOV.UK
• Application Programme Interface (API)

This will allow a single look up function for a single scheme member or multiple scheme members at one time.

We expect to publish the API technical information at the end of June 2017 and will update you when this is available via the pension schemes newsletters.

Using the look up service will mean that you’ll be able to claim the correct tax relief for your scheme members immediately.

This will:

• prevent under or overpayments for individual scheme members
• reduce the number of scheme member reconciliations

6. Further help and information

We’ll provide more information and help through the Pension Schemes Newsletters, however if you have any questions or concerns about the new SDES services you can email the SDES Product Manager matthew.walker@digital.hmrc.gov.uk.

For any other questions or concerns about relief at source, you can email HMRC at pensions.businessdelivery@hmrc.gsi.gov.uk and put ‘relief at source’ in the subject line of your email.

The information and timelines we’ve provided in this newsletter are correct at the time of publication. However as you’ll appreciate we’re still developing these new services so we’ll tell you if there are any changes as soon as possible.

7. Appendix A - Guidance on Migrating from SET to SDES

Introduction

As outlined in previous communications, the existing SET Service will be replaced by SDES.

This communication will provide clarity and guidance on the migration from SET to SDES, and how this will impact users.

The initial release for SDES, currently targeting 31st July 2017, will be very similar to the existing processes for SET. Users will be able to access and use the service in one of 2 ways:

• manually via browser, this process involves using Government Gateway credentials to login and manually upload and/or download via a user interface
• automatic Machine-to-Machine connection, this process involves setting up a connection via an FTP client, from the user’s server directly to an SDES server. This connection also allows direct system notifications, in order to facilitate automatic uploads / downloads

The sections below focus on each method and provide further clarification on what changes will be implemented.

Using SDES via a browser

What do I need to know if I interact manually via the browser?

The process of using the service via the browser will remain similar to the SET process, with the main differences being that certificates and encryption will be removed to enhance usability.

Area	SET	SDES	Impact
Certificate	TLS browser certificate required	TLS certificate not required	Users will no longer need to obtain and import certificates
Encryption Keys	Encryption keys / file encryption / decryption required	Encryption keys / file encryption / decryption not required	* file encryption is no longer required * users will not need to purchase certificates to generate keys * users must not encrypt files for submission
Website Address	SET service accessed via specific URL	SDES service accessed via specific URL	Users will be redirected to the new URL for SDES
User Login	Identification of user through Government Gateway credentials	Identification of user through Government Gateway credentials	No change
Enrolment	Authorisation to use SET via enrolment	Authorisation to use SDES via enrolment	* no change * users enrolled for SET will automatically be enrolled onto SDES
Notifications	Notifications via email	Notifications via email	* no change * existing types of notifications will remain the same, with future improvements planned
Browser Support	Internet Explorer - version 9 and above	* Internet Explorer - version 9 and above * Chrome - latest version at release * Firefox - latest version at release * Safari - latest version at release * Opera - latest version at release	Enhanced compatibility
Security	HTTPS	HTTPS	* no change * HTTPS is industry standard encryption and will ensure a secure connection from the user to HMRC

In summary, the main change for users interacting via the browser will be to remove the process steps for encryption and decryption, with the remaining steps of logging in using Government Gateway credentials and ensuring you’re enrolled in the service remaining the same.

Using SDES via an automatic “Machine-to-Machine” connection

What do I need to know if I automatically upload via a “machine-to-machine” connection?

The main change to users connecting via this method will be internal configuration changes, with the protocol of transferring via FTP remaining as per the current process. Similar to the manual process, certificates will no longer be required.

Area	SET	SDES	Impact
Certificate	TLS FTP certificate required	TLS FTP certificate not required	Users will no longer need to obtain and import certificates
Encryption Keys	Encryption keys / file encryption / decryption required	Encryption keys / file encryption / decryption not required	* file encryption is no longer required * users will not need to purchase certificates to generate keys * users must not encrypt files for submission
Website Address	SET service accessed via specific IP address	SDES service accessed via specific IP address	Users will be provided with the updated IP and must update this in their FTP configuration
User Login	Identification of user through Government Gateway credentials	Identification of user through Government Gateway credentials	No change
Connection Security	User IP address entered on SET whitelist	User IP address entered on SET whitelist	* no change * users will need to re-confirm their static IP address for whitelisting
Enrolment	Authorisation to use SET via enrolment	Authorisation to use SET via enrolment	* no change * users enrolled for SET will automatically be enrolled onto SDES
Standard Notifications	Notifications via email	Notifications via email	* no change * existing types of notifications will remain the same, with future improvements planned
Automatic Notifications	Notifications via ‘GOVTALK’	Notifications via ‘GOVTALK’	* no change * machine to machine option only * existing types of notifications will remain the same, with future improvements planned
Security	TLS 1.0 or higher	TLS 1.2	* no change * adherence to latest TLS version * TLS 1.2 is industry standard encryption and will ensure a secure connection from the user to HMRC

The main impact to users on the automatic connection, will be to any of those currently connecting over TLS 1.0 or 1.1, as it will be mandatory to be able to use connect over TLS 1.2 with SDES.

General Changes and Migration

Changes that impact the file you send or receive

In addition to the removal for encryption / decryption, the SDES solution will also provide additional enhancements in 2 areas:

• File size - SDES will increase the maximum file size from the existing 1.96GB to 10GB
• Retention Period - The file retention period will be increased from 72 hours (3 days) to 144 hours (6 days) There will be no initial impacts to accepted file formats or additional validation, however it is intended to look at these features as possible future improvements

How you’ll be migrated from SET to SDES

The SDES project team aims to implement a “dual running” deployment. This means that SET and SDES will initially run alongside one another, which will then allow scheduled migration of users over a specified time period.

The details around this deployment are still being finalised, however users can expect the following:

• migration will be planned based on user needs, such as those with immediately expiring certificates and capability
• users will continue to use SET until a specified switchover date, which will be advised by the SDES project team
• users will only be able to use one service, it will not be possible to use both the SET and SDES service. Once a user is migrated to SDES, they will no longer have access to SET
• there will be rollback functionality, to enable us to return users to SET in the case of any unforeseen issues during the SDES migration
• users will be provided with all the relevant details such as the new website address for SDES at the appropriate time
• users will not need to register / enrol again, this will be managed internally by the SDES team.
• users will be provided with updated terms and conditions for the new SDES service, which will require acceptance before using the new SDES solution

8. Disclaimer and Further Questions

Disclaimer

The information presented in this document is correct at the time of publication. Due to the nature of the iterative delivery approach, however, it may be subject to change where feedback during the process recommends design changes. Notification of any such changes will take place as soon as possible.

In addition, whilst target delivery dates have been provided, these dates are based on current known facts, resources and planning. Therefore, there is the potential for delivery dates to change. Where possible this will be avoided, however, if and when this becomes necessary, users will be informed as soon as possible.

Questions

If you have any questions or concerns, contact the Product Manager for the Secure Data Exchange Services:

matthew.walker@digital.hmrc.gov.uk