Credit reference agencies and other qualifying applicants can apply for VAT registration data for use in making financial assessments.
If you’re a UK-based credit reference agency or similar financial organisation you can apply for authorisation to receive non-financial VAT registration data for the purpose of:
- credit scoring
- anti-fraud checking
- compliance with other financial regulations
It may help small businesses and new startups gain access to credit and finance for the first time, and give increased access to credit and finance to established VAT-registered businesses.
Data file to be shared
The data file will cover all VAT-registered businesses, not individual businesses or grouped by trade sector or geographical location.
In addition to the VAT registration number and available contact information (such as the business address), the data for each registered business includes the:
- effective date of registration
- overseas trader indicator
- group/divisional registration indicator
- organisational name
- trading name and trading style
- standard industrial classification code (trade class)
- legal entity status
- company number and incorporation date
Where applicable, this will also include the date of:
- transfer of a going concern
No financial or payment data is included.
Software you will need to receive data
You’ll need systems and software that allows data to be transmitted securely and protected by encryption. You’ll need to use HMRC Secure Data Exchange Services which can be accessed in one of the following ways, through:
- a suitable browser such as Internet Explorer, Chrome or Firefox
- an automated connection using File Transfer Protocol-Secure software using version 1.2 of the Transport Layer Security encryption protocol
The file shared with you will be updated weekly to ensure accuracy.
Who can apply
HMRC will only share non-financial VAT registration data with you if your business has a genuine need to use it for the purposes set out in section 8(1) of the Small Business Enterprise and Employment Act (SBEEA) 2015.
Your security management systems need to be accredited to ISO/IEC 27001 standards and certified by an independent accreditation body.
Potential users include credit providers, credit reference agencies, banks and other financial services providers.
You’ll need to be authorised to receive the data.
How to apply
You’ll need to register your interest in applying to receive non-financial VAT registration data by emailing: email@example.com, quoting ‘VAT Data Sharing’ in the subject line.
HMRC will then tell you how to:
- register to use the eSourcing tool ‘SAP Ariba Sourcing Pro’
- access our online application questionnaire
You can only apply in the period December to February.
Completing the online application questionnaire
Once HMRC has given you access to the questionnaire within the SAP Ariba eSourcing tool you’ll be asked to:
- describe the nature of your business and explain why you need the data
- say how you’ll use the data in your processes and what products or services will result from those processes
- explain the benefits the data will bring to your business
- confirm your accreditation to ISO/IEC 27001 standards by an independent accreditation body and give details of any regulatory framework you operate under, for example, the Financial Conduct Authority or Prudential Regulatory Authority
- give details of your business and any group members within your organisation that you would like to be covered by your authorisation to receive VAT registration data
- give details of key personnel who will have access to the data and their roles
- indicate where and how data shared with you will be stored and give details of the arrangements that you have in place to ensure the security of the data, including to ensure that your employees will protect data shared with you and will use it only as permitted by the SBEEA\2015
- tell us about any previous occasions of tax non-compliance, criminal convictions for tax related offences and any previous occasions of loss or misuse of data
You won’t get VAT registration data until you’re approved by HMRC. You need to make your application in good time and make sure it’s accurate and complete.
Fees payable for data
You’ll need to pay a fee to HMRC to cover the costs incurred in administering the process and sharing the information. The fees payable are as follows:
- application fee: £265, when you apply
- data usage agreement fee: £135, when you sign the agreement between you and HMRC
- data transfer fee: £10,000 per year, payable when you receive the first data transfer and each year whilst the data usage agreement is in place
The data transfer fee will be reviewed annually to ensure this continues to cover the cost to HMRC of sharing the data. Authorised recipients will be advised in advance of any changes to the fee, which may go up or down.
What happens next
Your application will be checked for the information above and, in the case of a company, checks may be made with Companies House and other government departments and agencies.
HMRC may visit your premises and ask you for details about (but not limited to) your customers, business plans, and information security management system.
Further information may be requested. Until this information is received, your application will be put on hold.
Once approved you’ll receive a Data Sharing Agreement to sign, which will include the start and end date for your authorisation. Where the agreement is for more than 2 years, HMRC will evaluate the benefits of the agreement at the end of the first 2 year period.
You’re unlikely to get authorisation if the business, or the applicant, or anyone with an important role or interest in the business has:
- any unspent criminal convictions for any offence of dishonesty or for any offence linked to terrorism or organised crime (an ‘unspent’ conviction is one that has not expired under the terms of the Rehabilitation of Offenders Act 1974)
- previously had their authorisation or application to receive VAT registration data withdrawn or refused
- been involved in any significant incidence of mishandling or misuse of confidential data
- a history of fraudulent behaviour, including misrepresentation or identity theft
The list above is not exhaustive.
It will take up to 45 days to process the application and set up the necessary procedures for sharing data.
If HMRC discover at any time that the information you’ve given to us is untrue or incomplete, your application may be denied or withdrawn.
If it’s refused, HMRC will tell you in writing and explain the reasons for our decision.
Conditions of use
Where HMRC agrees to share non-financial VAT registration data with you, HMRC may impose specific conditions or restrictions relating to your use of the data.
HMRC will advise you of our decision and outline any condition(s) or restrictions.
Your Data Sharing Agreement will give details of the obligations that apply to you as an authorised recipient.
- protecting the information HMRC shares with you
- maintaining up-to-date and accurate records, sufficient to enable our officers or any independent assessor or inspector to confirm your compliance with your obligations under your Data Sharing Agreement and the SBEEA
- participation in a review after the initial 2 year period to evaluate the economic benefits of sharing non-financial VAT registration data
Your Data Sharing Agreement may be cancelled if:
- you advise us at any time that you don’t wish to continue receiving VAT registration data
- HMRC decide to terminate the agreement in response to misuse or loss of VAT registration data shared with you
- HMRC identify that you no longer have a requirement to receive VAT registration information for any of the purposes set out in section 8(1) of the SBEEA 2015
- HMRC decide to withdraw from the agreement for any other reason
Changes to report
You must tell HMRC if any information contained in your application or in your Data Sharing Agreement changes. You must notify us by emailing: firstname.lastname@example.org without delay, if the:
- status of your business or the company changes
- business’s need for access to VAT registration data no longer applies
- business’s intended use of VAT registration data changes (but this does not include changes or additions to your products and services where these relate to a permitted use already notified to us)
- authorised\recipient is transferred to a business which is not authorised to receive VAT registration data
- information in your application changes in any other way
Requests to transfer data to a third party
The data may not be passed to any other parties, except with HMRC consent. You may only request consent once you’re authorised to receive the data.
There are sanctions for data misuse, including a criminal sanction for unlawful disclosure of information relating to identifiable businesses.
HMRC will only grant consent where HMRC are satisfied that the person with whom you wish to share VAT registration data:
- will not be charged a fee by you for sharing data with them
- will use it only for purposes set out in section8(1) of SBEEA 2015
- will not share the information with any other party (except with our consent)
- has security management systems in place to exercise due care over the storage of the data
You must also satisfy us that you have policies and agreements in place to maintain the security of information transferred outside your organisation.
You’ll need to request our consent by emailing: email@example.com, giving details of the data you wish to disclose, your intended recipient, and their reason for needing access to VAT registration data.
HMRC will only agree to the sharing of specified data items. HMRC will not consent to the onward sharing of the full VAT registration data that HMRC shares with you, except where HMRC are satisfied the third party is a contractor carrying out a process to facilitate use of the data by you. HMRC may attach conditions and restrictions in respect of sharing that information and may ask to see any agreement or contract you have in place with the third party.
In cases where HMRC decide not to consent to the transfer of specific data, or if the third party (other than a contractor acting on your behalf) would like access to the full VAT registration data, they may apply to receive information directly from us.