UK Mandatory Disclosure Rules (MDR): HMRC publishes legislation guidance

HMRC has just unveiled its most recent guidance concerning the UK Mandatory Disclosure Rules (MDR). These rules introduce a fresh set of responsibilities for taxpayers and their advisors, compelling them to report Common Reporting Standard (CRS) Avoidance Arrangements and Opaque Offshore Structures. It’s crucial to note that the information gathered through these reports will be shared with other tax authorities that are also enforcing equivalent regulations.

CRS avoidance arrangements and Opaque Offshore Structures are defined in the Overseas for Economic Cooperation and Development (OECD) Model Mandatory Rules for CRS Avoidance and Opaque Offshore Structures (Model Rules). The legislation implements these Model Rules.

Background to the OECD’s MDR

The OECD Model Rules received approval on 8 March 2018. Subsequently, the UK’s legislation implementing the MDR was presented before Parliament on 17 January 2023 and officially took effect on the 28th of March 2023.

These new regulations serve as a replacement for earlier ones, which were set in motion in response to Council Directive (EU) 2018/822 (DAC6). The previous regulations, known as the International Tax Enforcement (Disclosable Arrangements) Regulations 2020 (SI 2020/25), were repealed when the MDR legislation was enacted.

What does the new guidance cover?

Who has to report?
CRS Avoidance Arrangements and Opaque Offshore Structures
Reporting obligations and triggers
Penalties
Commencement
Partner Jurisdictions

VinciWorks’ MDR reporting solution

VinciWorks’ MDR reporting solution provides firms and multinational businesses with the expertise, knowledge and technical infrastructure to comply with the MDR regulations in all relevant countries. The tool uses a built-in knowledge engine to guide users through the MDR process and recommends which transactions should be reported.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”