HMRC shuts down tax agency after AML breaches

Tax Credits Ltd (TCL), a company that charged taxpayers to make claims for tax refunds, has been barred by HM Revenue and Customs (HMRC) from operating.

What happened?

HMRC found TCL had committed serious anti-money laundering breaches. As a result, the agency declared that it is now a criminal offence for TCL to trade as a tax repayment agent. 

Significantly, the move comes just weeks after HMRC outlined greater protections for customers using repayment agents. The regulations are predominantly designed to prevent businesses from being exploited by criminals to launder money.

“TCL have ignored their responsibilities under the anti-money laundering measures designed to protect us all from financial crime. We will not allow a small number of bad actors to tarnish the reputation of the whole tax agent sector,” said Angela MacDonald, HMRC’s Deputy Chief Executive and Second Permanent Secretary. “It is crucial taxpayers understand the entitlements they can claim directly from HMRC and are properly protected from the misleading tactics used by some repayment agents. The greater protections we’re bringing in will help to stop people unwittingly losing their hard-earned money to misleading agents.”

The red flags

Taxpayers can use repayment agents to make claims for repayment of tax. But many taxpayers complained that there was a lack of transparency in agents’ processes for signing up clients and high charges for using their services.

In response to public concern, HMRC recently consulted on how to protect taxpayers using repayment agents and unveiled a package of measures. These include stopping the use of legally-binding ‘assignments’ as part of claiming an Income Tax repayment, improving agent standards and a requirement for repayment agents to register with HMRC.

What happens now?

Around 11,000 TCL clients, whose claims had been paused during investigations into TCL, will now receive their tax refund directly from HMRC.

In addition, HMRC advises anyone thinking of using a tax repayment agent to carefully consider their options when appointing a tax adviser to act on their behalf. Ultimately, it is the taxpayers, not the tax agent, that is ultimately responsible for their own tax affairs.

What you should know

  1. Taxpayers should be careful when clicking on online ads. Some unscrupulous repayment agents have made their customer sign-up pages appear to be mere requests for more information.
  2. AML regulations require tax repayment agents to carry out risk assessments, have the correct policies, controls and procedures in place, carry out appropriate staff training and provide registration information.
  3. HMRC published the consultation, Raising standards in tax advice: Protecting customers claiming tax repayments, to consider ways to better protect taxpayers. 
  4. The government intends to legislate to render void assignments of income tax repayments. The use of legally binding assignments, which transfer any repayment of income tax to a taxpayer’s agent rather than directly to the person who has overpaid, will be stopped as these can only be cancelled when the agent and taxpayer agree. This meant that customers unhappy with their agent could not decide to end the agreement on their own.
  5. A taxpayer may still choose to use a repayment agent to reclaim overpaid income tax by making a nomination instead, which they can cancel at any time. Using this process will make it easier for taxpayers to stay in control of their repayments.

Read more

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.