Business owners who need to access their tax accounts online have been advised to get ready for an additional layer of HMRC online security that is set to become compulsory later this month.
The Association of Taxation Technicians (ATT), the trade body for providers of tax compliance services, has urged firms to address their online tax account protocols ahead of HMRC’s mandatory introduction of the Two Step Verification (2SV) procedure.
2SV is a new HMRC online security measure that is similar to those used in online banking and is intended to reduce the risk of online tax accounts being hacked.
Taxpaying business owners will be required to submit login details alongside a second verification element of something they own, like a mobile or landline number, to login to their HMRC account online.
Once these login details have been submitted, account holders will be issued with a security code, which must then be entered for full access to the account.
The security code will either be sent to the mobile or landline number used to login to the account, or it can be generated from a mobile or tablet via an HMRC app.
HMRC will introduce the 2SV procedure gradually from 25 September, but it could be many weeks or months before some business owners come across the new security measure, depending on how frequently they file tax accounts online.
Commenting on the introduction of 2SV, Yvette Nunn, the co-chair of ATT’s technical steering group, said: “Receiving the security code via a landline may work well for a small business, but probably would not for a larger business with a central switchboard. Businesses with poor mobile reception may need to use the HMRC app.
“Businesses must consider now what online HMRC accounts they have, who needs access and how their staff will receive the security code. There are various options and businesses should decide in advance of logging on which works best for them.”
There are many examples of tasks that require staff to have access to a business’s online HMRC tax account, including filing VAT receipts, corporation tax returns and company PAYE data.
Although it now faces major delays, the government’s Making Tax Digital initiative – its move to create a fully digitised tax system in the UK – puts additional pressure on business owners to ensure their internal online tax and accounting protocols are up to date.
The ATT has made clear that agents acting on behalf of businesses, such as professional accountants, use separate agent portals to access client details, and won’t be affected by the switch to the 2SV HMRC online security.
Nunn added: “For businesses with a number of staff needing online access to HMRC systems, there is a function which allows separate logins or delegate access to be given to individual employees. These employees will have to set up 2SV in turn on their own or company mobiles, landline or app.
“Some firms might choose to acquire a company mobile for the specific purpose of receiving [2SV] codes or running the HMRC app. With this approach, the device will need to be secured and someone given responsibility for keeping it charged – the modern equivalent of winding up the office clock.
“Where a business allows staff to use their own mobiles or tablets to receive codes or run the app, procedures should be introduced to ensure these devices are dissociated from the business account if the employee leaves.”
Government urged to unlock older entrepreneurship with tax-free pension access
Sign up to our newsletter to get the latest from Business Advice.