HMRC consulted on amending its civil information powers in July 2018. One of its proposals was that it should be allowed to demand information from a taxpayer’s bank and other financial institutions, without the taxpayer’s prior permission (or without a tribunal’s prior approval instead, where HMRC was concerned that warning the taxpayer might prejudice its information request of the bank, etc.).
HMRC’s justification for being so empowered was that it needed to be more agile to comply with international requests from other jurisdictions, under information exchange protocols. “It is important that the UK acts to address this issue. International standards have increased rapidly in recent years, and those standards are expected to rise, therefore the UK must also adapt to meet this challenge.”
In its initial Consultation in July 2018, HMRC argued that “from 1 April 2016 to 31 March 2017 there were 215 requests for tribunal approval of a third party notice. This shows that third party notices are not issued in large numbers” and in its July 2020 policy paper, HMRC reckoned “this measure is expected to have a negligible impact on around 20 financial institutions, such as banks and building societies”.
We noted in our September 2020 MIM that the Consultation’s respondents had expressed concerns about the proposed removal of safeguards, and the consequent imbalance in favour of HMRC. HMRC nevertheless pressed ahead with the introduction of Financial Institution Notices (FINs) under FA 2021 s 126 & Sch 34, extending its existing information powers under FA 2008 Sch 36 – but with the assurance that HMRC would report annually to Parliament on its use of this new device.
We also reported in November 2021 MIM that STEP had warned of suspicions that FINs were being used more widely and/or enthusiastically than might have been supposed.
HMRC published its first Corporate Report on its FIN Powers at the end of January 2023. The report covers the first 9 months of the FIN regime, from 1 July 2021 to 31 March 2022. The report also confirms that “the FIN [regime] was introduced to allow the UK to meet international minimum standards on the exchange of information for tax purposes”.
Within those first 9 months, HMRC issued 355 FINs, which is almost double the rate of 215 tribunal approval requests in the year to 31 March 2017. However, it is more in line with the 426 such requests made in 2019/20, according to the House of Lords’ December 2020 report New Powers for HMRC: Fair and Proportionate? (and as an aside, it may surprise nobody outside of HMRC to discover that the Lords’ conclusions were, broadly, “no”). It is also important to acknowledge that FINs were issued to cover a wider set of scenarios than historic tribunal approval requests.
However, only 141 of those FINs were actually issued to for the purposes of dealing with international information requests, which is less than 40% of the total issued. That is rather strange, given that the main reason for the FIN regime was supposed to be so that it could deal with the surging demand for international information requests.
Perhaps of more concern is that HMRC had originally asked for location data – the taxpayer’s whereabouts when accessing the bank’s systems either online or using mobile banking. This would seem quite aggressive and unlikely to have been requested by other jurisdictions. The fact that, “on further consideration HMRC has decided not to use the FIN to obtain this information” also suggests to me that this was HMRC operating under its own steam.
So, does it appear that HMRC has used FINs more widely than one might reasonably have expected, given HMRC’s stated reasons for needing FINs? One might well infer so, given that comfortably more than half of the FINs issued in this initial period were not issued in response to international information requests.
And have the FINs been used more enthusiastically than one might reasonably have supposed? Erm, HMRC admitted that it had been asking for the taxpayer’s location data whenever they interacted with their bank. That is asking for much more than the financial information that one might naively have assumed that HMRC should have been interested in, although I can see that in some cases – for example concerning tax residence – such information might be relevant. Perhaps HMRC believed that by saying “don’t worry, because we’ve decided not to ask for that particular detail in future”, readers might be reassured. (And it might well be the case that FINs have been used much more stupidly than one might have supposed, given how easy and commonplace it is for online locations to be spoofed, such as by using a Virtual Private Network).
The fact that HMRC mentioned this (and only this) while saying that it was not going to bother asking for it any more, might instead lead one to wonder what other metadata has HMRC requested, and does it continue to request? If HMRC genuinely believes that such granular detail is necessary to establish a person’s tax position, and demands it from data holders as a matter of course, then next time I am struggling to remember what I was doing three weeks ago last Saturday, I might do worse than call HMRC to ask for a detailed timeline.
