HMRC Information Powers and Digital Records 2026

HMRC has published draft measures to modernise its civil information and inspection powers and update the legal definition of computer records. The proposals are aimed mainly at third parties that hold tax information — including financial service providers, cryptoasset service providers, software intermediaries and businesses using cloud systems — but some UK taxpayers and personal representatives could also be affected.

The measure does not create a new tax rate or a universal requirement for every taxpayer to file a new digital report. It updates how HMRC can request and inspect information when it already has a lawful tax-compliance or debt-collection purpose. The changes are proposed for Finance Bill 2026–27 and are intended to take effect from Royal Assent, subject to final legislation and guidance.

What is changing?

HMRC's policy paper describes several connected changes:

• the time limit for issuing an information notice about the tax position of a deceased person would be amended;
• Financial Institution Notices (FINs) would include cryptoasset service providers and payment service providers facilitating cryptoasset payments;
• the process for issuing identification notices would be updated, including the types of unique identifiers HMRC can request;
• the statutory requirement for HMRC's annual Parliamentary report on FIN use would be removed, while HMRC would continue publishing FIN data for transparency; and
• the definition of computer records would be updated so information held in digital, electronic, automated or cloud-based systems can be produced in a form that helps HMRC understand how tax figures were generated.

These changes are about information gathering and compliance administration. They do not by themselves change the tax treatment of income, gains, cryptoassets, employment or business sales.

Who could be affected?

The direct operational audience is wider than an ordinary self-assessment taxpayer. HMRC identifies the following groups:

Being in one of these categories does not mean that HMRC will automatically request information. The policy paper says that existing safeguards and the requirement that information be reasonably required to check a tax position will continue.

Digital records and cloud systems

The proposal responds to how modern businesses produce and store tax information. A relevant figure may be created by accounting software, an automated workflow, a payment platform or a cloud service rather than a paper ledger. The updated section 114 rule would clarify that, where HMRC already has a lawful basis to request information, the request can cover relevant information held or managed in those digital systems.

This is not permission for HMRC to demand every internal file without a compliance purpose. The published explanation says section 114 operates as a supporting provision and does not create a standalone information power. Existing statutory safeguards continue to apply, and the information must be relevant to a lawful check or tax-debt collection purpose.

Businesses should therefore know where their accounting, payroll, payment and crypto transaction records are held, who controls access, and how an important tax figure can be reproduced from the underlying system. That is sensible record governance even before the reform commences.

Deceased taxpayers and personal representatives

The draft measure would change the current rule that an information notice checking a deceased person's tax position cannot be issued more than four years after death. The proposed replacement would allow a notice later than four years, subject to tribunal approval in most cases. A Financial Institution Notice would continue to use HMRC's authorised-officer approval process.

Personal representatives would only be expected to provide information that is in their power and possession. The proposal is not a new tax on an estate and does not decide whether additional tax is due. It concerns how HMRC can obtain information needed for a compliance check.

What should businesses do now?

The measure is not described as creating a new routine filing obligation before Royal Assent. Businesses should not invent a new return or change a tax calculation solely because the draft policy exists. They can, however, improve the evidence trail around existing obligations.

For a live HMRC enquiry, compare the formal notice with the current HMRC tax investigations guide. This article covers the proposed information-power changes; it is not a substitute for responding to a specific notice or taking legal advice.

When would the changes start?

The policy paper says the measure is intended to have effect on and after Royal Assent to Finance Bill 2026–27. The technical consultation on the draft legislation closed on 7 September 2026, but final legislation, commencement details and updated HMRC guidance remain important. Until then, businesses should continue following the current information-notice, inspection, record-keeping and appeal rules.

How to handle a formal information notice

Do not treat an HMRC information notice as an informal data request. Check the taxpayer, tax period, information description, deadline, approving authority and any appeal or review instructions. Route it to the person responsible for tax compliance and preserve the original notice and delivery date. A notice addressed to a bank, cryptoasset service provider or software intermediary may require a different response from a notice addressed to the taxpayer or personal representative.

Make a request-to-records schedule before exporting data. For each requested item, identify the source system, owner, date range, transformation, format and person who checked the output. Explain fields that do not exist, records that are held by another provider and any access limitation. Do not silently edit a database export to make it look clearer. Provide an intelligible output with a read-only copy of the original export and a short data dictionary where needed.

The phrase computer records can cover more than an accounting ledger. A tax figure may depend on invoices, payroll inputs, payment-platform reports, inventory records, formulas, audit logs and a cloud workflow. The purpose of the reform is to make such records understandable where an existing lawful request reaches them; it is not a reason to hand over unrelated personal data or commercially sensitive material without checking relevance. If the request appears too broad, ask HMRC or an adviser to clarify it and use the formal appeal or review route where appropriate.

Controls for providers and intermediaries

Financial institutions and cryptoasset service providers should maintain a notice-response owner, secure disclosure channel, customer-identity matching control and legal-review process. A third-party notice can involve confidentiality and data-protection questions, but those questions do not permit an organisation to ignore a valid statutory notice. Record what was supplied, the date, the authority relied on and any redactions or limitations.

Software providers should distinguish customer data from the software's own technical records. If the requested information is generated by an automated rule, preserve the version of the rule and the input data for the requested period. This helps demonstrate how a return was produced and reduces the risk that a later system migration makes the result impossible to reproduce.

Personal representatives should keep estate records separate from their own tax records and answer only within the scope of the notice and the information in their power and possession. A request made after a person's death may be distressing or technically difficult, but the four-year proposal is subject to the stated approval safeguards and does not itself establish that further tax is due. Obtain advice where records are missing, privileged or held by a financial institution.

Finally, test the restore process rather than relying on a backup label. A record is useful only if it can be opened, dated, reconciled and explained to an independent reviewer.

Set a retention owner and review access rights regularly. When a provider changes, export the historic data before termination, preserve the contracts and record which system replaced it. These controls support ordinary tax record keeping as well as any future statutory request. They also help identify accidental gaps before a compliance notice arrives. Review the result with the finance owner each quarter. Document any unresolved exceptions.

Frequently Asked Questions

Prepare a controlled response file

If a formal notice arrives, save the notice, issue date, response deadline, named taxpayer or third party, information categories and delivery method. Record who searched each system, the date searched, the result and any technical limitation. Preserve cloud exports, audit logs, email instructions, accounting records and the original file metadata where relevant; do not silently overwrite or delete records while deciding what to provide.

Separate information that is requested from information that is merely useful. Map each requested item to its source, format, custodian and response status, then ask a professional adviser about scope, privilege, confidentiality and any appeal or extension route. A policy proposal is not the same as an enacted obligation, so identify whether the notice relies on current law or a future commencement rule. Keep a copy of the final response and proof of delivery.

If HMRC sends a formal information notice, follow the notice and its response or appeal instructions. This guide explains the published 2026 policy proposal and is not individual tax or legal advice.

Official sources

• HMRC: Reforming information powers and modernising computer records law
• HMRC: Detailed information powers and computer records policy paper
• HMRC: Finance Bill 2026–27 draft legislation and technical tax documents