Guidance

Apply to receive non-financial VAT registration data from HMRC

Credit reference agencies and other qualifying applicants can apply for VAT registration data for use in making financial assessments.

Overview

If you’re a UK-based credit reference agency or similar financial organisation you can apply for authorisation to receive non-financial VAT registration data for the purpose of:

  • credit scoring
  • anti-fraud checking
  • compliance with other financial regulations

It may help small businesses and new startups gain access to credit and finance for the first time, and give increased access to credit and finance to established VAT-registered businesses.

Data file to be shared

The data file will cover all VAT-registered businesses, not individual businesses or grouped by trade sector or geographical location.

In addition to the VAT registration number and available contact information (such as the business address), the data for each registered business includes the:

  • effective date of registration
  • overseas trader indicator
  • group/divisional registration indicator
  • organisational name
  • trading name and trading style
  • standard industrial classification code (trade class)
  • legal entity status
  • company number and incorporation date

Where applicable, this will also include the date of:

  • deregistration
  • transfer of a going concern

No financial or payment data is included.

Software you will need to receive data

You’ll need systems and software that allows data to be transmitted securely and protected by encryption. You’ll need to use HM Revenue and Customs (HMRC) Secure Data Exchange Services which can be accessed in one of the following ways, through:

  • a suitable browser such as Internet Explorer, Chrome or Firefox
  • an automated connection using File Transfer Protocol-Secure software using version 1.2 of the Transport Layer Security encryption protocol

The file shared with you will be updated weekly to ensure accuracy.

Who can apply

HMRC will only share non-financial VAT registration data with you if your business has a genuine need to use it for the purposes set out in section 8(1) of the Small Business Enterprise and Employment Act (SBEEA) 2015.

Your security management systems need to be accredited to ISO27001 standards and certified by an independent accreditation body.

Potential users include credit providers, credit reference agencies, banks and other financial services providers.

You’ll need to be authorised to receive the data.

How to apply

You’ll need to register your interest in applying to receive non-financial VAT registration data by emailing: vat.datasharing@hmrc.gsi.gov.uk, quoting ‘VAT Data Sharing’ in the subject line.

We’ll then tell you how to:

  • register to use the eSourcing tool ‘SAP Ariba Sourcing Pro’
  • access our online application questionnaire

You can only apply in the period December to February.

Completing the online application questionnaire

Once we’ve given you access to the questionnaire within the SAP Ariba eSourcing tool you’ll be asked to:

  • describe the nature of your business and explain why you need the data
  • say how you’ll use the data in your processes and what products or services will result from those processes
  • explain the benefits the data will bring to your business
  • confirm your accreditation to ISO27001 standards by an independent accreditation body and give details of any regulatory framework you operate under, for example, the Financial Conduct Authority or Prudential Regulatory Authority
  • give details of your business and any group members within your organisation that you would like to be covered by your authorisation to receive VAT registration data
  • give details of key personnel who will have access to the data and their roles
  • indicate where and how data shared with you will be stored and give details of the arrangements that you have in place to ensure the security of the data, including to ensure that your employees will protect data shared with you and will use it only as permitted by the SBEEA\2015
  • tell us about any previous occasions of tax non-compliance, criminal convictions for tax related offences and any previous occasions of loss or misuse of data

You won’t get VAT registration data until you’re approved by HMRC. You need to make your application in good time and make sure it’s accurate and complete.

Fees payable for data

You’ll need to pay a fee to HMRC to cover the costs incurred in administering the process and sharing the information. The fees payable are as follows:

  • application fee: £265, when you apply
  • data usage agreement fee: £135, when you sign the agreement between you and HMRC
  • data transfer fee: £10,000 per year, payable when you receive the first data transfer and each year whilst the data usage agreement is in place

The data transfer fee will be reviewed annually to ensure this continues to cover the cost to HMRC of sharing the data. Authorised recipients will be advised in advance of any changes to the fee, which may go up or down.

What happens next

Your application will be checked for the information above and, in the case of a company, checks may be made with Companies House and other government departments and agencies.

We may visit your premises and ask you for details about (but not limited to) your customers, business plans, and information security management system.

Further information may be requested. Until this information is received, your application will be put on hold.

Once approved you’ll receive a Data Sharing Agreement to sign, which will include the start and end date for your authorisation. Where the agreement is for more than 2 years, we will evaluate the benefits of the agreement at the end of the first 2 year period.

You’re unlikely to get authorisation if the business, or the applicant, or anyone with an important role or interest in the business has:

  • any unspent criminal convictions for any offence of dishonesty or for any offence linked to terrorism or organised crime (an ‘unspent’ conviction is one that has not expired under the terms of the Rehabilitation of Offenders Act 1974)
  • previously had their authorisation or application to receive VAT registration data withdrawn or refused
  • been involved in any significant incidence of mishandling or misuse of confidential data
  • a history of fraudulent behaviour, including misrepresentation or identity theft

The list above is not exhaustive.

It will take up to 45 days to process the application and set up the necessary procedures for sharing data.

If we discover at any time that the information you’ve given to us is untrue or incomplete, your application may be denied or withdrawn.

If it’s refused, we’ll tell you in writing and explain the reasons for our decision.

Conditions of use

Where HMRC agrees to share non-financial VAT registration data with you, we may impose specific conditions or restrictions relating to your use of the data.

We’ll advise you of our decision and outline any condition(s) or restrictions.

Your Data Sharing Agreement will give details of the obligations that apply to you as an authorised recipient.

These include:

  • protecting the information we share with you
  • maintaining up-to-date and accurate records, sufficient to enable our officers or any independent assessor or inspector to confirm your compliance with your obligations under your Data Sharing Agreement and the SBEEA
  • participation in a review after the initial 2 year period to evaluate the economic benefits of sharing non-financial VAT registration data

Your Data Sharing Agreement may be cancelled if:

  • you advise us at any time that you don’t wish to continue receiving VAT registration data
  • we decide to terminate the agreement in response to misuse or loss of VAT registration data shared with you
  • we identify that you no longer have a requirement to receive VAT registration information for any of the purposes set out in section 8(1) of the SBEEA 2015
  • we decide to withdraw from the agreement for any other reason

Changes to report

You must tell HMRC if any information contained in your application or in your Data Sharing Agreement changes. You must notify us by emailing: vat.datasharing@hmrc.gsi.gov.uk without delay, if the:

  • status of your business or the company changes
  • business’s need for access to VAT registration data no longer applies
  • business’s intended use of VAT registration data changes (but this does not include changes or additions to your products and services where these relate to a permitted use already notified to us)
  • authorised\recipient is transferred to a business which is not authorised to receive VAT registration data
  • information in your application changes in any other way

Requests to transfer data to a third party

The data may not be passed to any other parties, except with HMRC consent. You may only request consent once you’re authorised to receive the data.

There are sanctions for data misuse, including a criminal sanction for unlawful disclosure of information relating to identifiable businesses.

We’ll only grant consent where we’re satisfied that the person with whom you wish to share VAT registration data:

  • will not be charged a fee by you for sharing data with them
  • will use it only for purposes set out in section8(1) of SBEEA 2015
  • will not share the information with any other party (except with our consent)
  • has security management systems in place to exercise due care over the storage of the data

You must also satisfy us that you have policies and agreements in place to maintain the security of information transferred outside your organisation.

You’ll need to request our consent by emailing: vat.datasharing@hmrc.gsi.gov.uk, giving details of the data you wish to disclose, your intended recipient, and their reason for needing access to VAT registration data.

We’ll only agree to the sharing of specified data items. We’ll not consent to the onward sharing of the full VAT registration data that we share with you, except where we’re satisfied the third party is a contractor carrying out a process to facilitate use of the data by you. We may attach conditions and restrictions in respect of sharing that information and may ask to see any agreement or contract you have in place with the third party.

In cases where we decide not to consent to the transfer of specific data, or if the third party (other than a contractor acting on your behalf) would like access to the full VAT registration data, they may apply to receive information directly from us.

Published 11 December 2017