Introduction
Every UK business faces an unforgiving reality: tax compliance is not a one-time registration checkbox. It is a continuous legal obligation covering registration, accurate record-keeping, timely filing, and payment to HMRC. With HMRC's Connect system now generating a record £4.6 billion annually through automated data-matching—a 35% increase on previous years—non-compliance is increasingly difficult to hide.
Businesses that fall short trigger investigations, incur escalating penalties, and risk reputational damage that affects lender relationships and investor confidence.
This article covers the essential documents UK businesses must maintain, how HMRC compliance checks actually work, what triggers an investigation, and the proactive steps needed to stay on the right side of UK tax law.
TLDR:
- UK tax compliance requires maintaining specific documents for at least six years, covering corporation tax, VAT, and PAYE
- HMRC's Connect system cross-references over a billion data items annually, making discrepancies easy to spot
- Compliance checks — random or risk-triggered — can require immediate document production and on-site visits
- Penalties scale from £100 fixed fees to 100% of lost revenue depending on behaviour and disclosure type
- Proactive record-keeping and professional advisory support are the most effective defences against investigations
What Is UK Tax Compliance and Why It Matters
UK tax compliance is the structured, ongoing process of meeting all legal tax obligations with HMRC. This includes corporation tax, VAT, PAYE, and income tax—far beyond one-time company registration. Compliance means accurate reporting, timely payment, and continuous documentation across multiple tax cycles throughout the year.
The scale of oversight is vast. As of March 2025, 4,872,293 companies were on the active UK register, each within HMRC's digital surveillance reach. The UK tax gap—representing lost revenue from non-compliance—stands at 5.3% of total theoretical liabilities, approximately £46.8 billion for 2023-24.
HMRC's enforcement capability has accelerated sharply. The Connect system, launched in 2010, pulls data from a wide range of sources to cross-reference against filed returns:
- Banks and financial institutions
- Companies House and the Land Registry
- DVLA vehicle records
- Online marketplaces including eBay and Airbnb
- Foreign tax authorities via the Common Reporting Standard
This automated cross-referencing makes it nearly impossible to hide discrepancies between what businesses report and what third parties record. HMRC estimates £48 billion in tax "protected" through compliance activity in 2024-25, backed by 5,500 additional compliance staff hired over five years.
On top of enforcement activity, Making Tax Digital adds a structural layer of accountability — requiring businesses to maintain digitally linked records that eliminate manual re-keying errors and generate an automatic audit trail for HMRC.
Essential Legal Documents for UK Tax Compliance
UK businesses must proactively maintain specific legal documents—not just to file returns, but to survive any HMRC scrutiny. These documents fall into clearly defined categories and must be retained for at least six years from the end of the relevant accounting period under UK law. Failure to keep sufficient records can result in a £3,000 fine and potential director disqualification.
Corporation Tax Documents
Every limited company must maintain comprehensive corporation tax records:
- Company Tax Return (CT600): The primary corporation tax filing submitted to HMRC, due 12 months after the accounting period ends
- Tax computations: Detailed calculations showing how taxable profit was derived from statutory accounts
- Statutory annual accounts: Accounts filed with Companies House that reconcile with tax filings
- Supporting evidence for claims: Documentation for R&D tax credits, capital allowances, group relief, or loss carry-forwards
The CT600 must be filed even if the company made a loss, broke even, or conducted no trading activity (unless formally confirmed dormant with HMRC). Corporation tax payment is due earlier than filing—nine months and one day after the accounting period ends.
VAT Records
VAT-registered businesses face strict documentation requirements:
- VAT invoices issued and received: All sales and purchase invoices meeting HMRC's prescribed format
- Import and export records: Documentation for cross-border transactions including customs declarations
- VAT account and return workings: The calculations supporting quarterly VAT return figures
- Evidence of adjustments: Documentation for reverse charge transactions, bad debt relief, or error corrections
Since April 2022, Making Tax Digital (MTD) requires all VAT-registered businesses to maintain these records digitally using HMRC-compatible software. The "digital links" requirement means data must transfer electronically between systems—manual re-keying or copy-pasting between spreadsheets is not permitted.
PAYE and Payroll Records
Employers must retain detailed payroll documentation:
- Real Time Information (RTI) submissions: Full Payment Submissions (FPS) filed each pay period and Employer Payment Summaries (EPS) when needed
- Payslips: Issued to every employee for each pay period
- P60 and P45 forms: End-of-year certificates (P60) and leaving documentation (P45)
- Benefits in kind records (P11D): Annual returns for company benefits like company cars or private medical insurance
- National Insurance calculations: Detailed records of employee and employer NIC payments
HMRC cross-references PAYE records with corporation tax filings to identify discrepancies in reported salary costs. Unexplained gaps between payroll costs and corporation tax deductions can trigger a formal compliance check.
General Financial Records and Retention Rules
Tax records don't exist in isolation. HMRC expects them to reconcile with the broader financial picture, which means retaining:
- Bank statements for all business accounts
- Sales invoices and receipts
- Purchase invoices and receipts
- Contracts and agreements
- Asset registers
- Loan agreements and financing documentation
The six-year retention rule applies to most records, calculated from the end of the financial year they relate to. Records must be kept longer when they show transactions spanning multiple accounting periods or relate to assets expected to last more than six years (equipment, property, long-term investments).
HMRC Compliance Checks: Process and What to Expect
An HMRC compliance check—sometimes called an enquiry—is HMRC's formal process of verifying that a business has paid the correct amount of tax. Checks can be triggered randomly through HMRC's risk profiling programme, or by specific discrepancies identified through data-matching.
They can cover any or all taxes: corporation tax, VAT, PAYE, or Self Assessment.
Initial Contact and Rights
HMRC initiates compliance checks by calling or writing to the business (or its authorised tax agent) to explain what they want to check and why. This initial communication specifies the tax periods under review and the types of documents required.
Businesses have clear rights during compliance checks:
- Right to professional representation: Bring a tax agent, adviser, accountant, or voluntary organisation representative to all interactions
- Right to refuse in-person meetings: Meetings are not compulsory; all interactions can be handled by correspondence
- Right to request more time: Extensions can be granted for illness, bereavement, or other serious circumstances
- Right to challenge the check: If the business believes the check should be stopped, formal objections can be raised
Document Requests and Visits
During a compliance check, HMRC can request any records relevant to the taxes under review:
- Tax returns and supporting computations
- Statutory accounts and management accounts
- VAT records including invoices and return workings
- PAYE records and RTI submissions
- Bank statements (personal and business)
- Contracts, invoices, and correspondence related to the period under review
HMRC may request a visit to business premises to inspect records or conduct interviews. Refusing to provide information or obstructing a visit can result in financial penalties. Businesses have the right to bring legal or tax advisers to any visit.
Outcomes and Appeals
After completing their review, HMRC writes with one of three outcomes:
- No discrepancy found: The filed position is confirmed correct and no further action is required
- Overpayment identified: A repayment is issued with interest added to the refund
- Underpayment identified: Additional tax is due within 30 days, along with any applicable interest and penalties
Businesses have 30 days to respond by providing new information, requesting a review by a different HMRC officer, or appealing to an independent tribunal. Alternative Dispute Resolution (ADR) is available through an impartial HMRC mediator and does not affect legal appeal rights.
These rights matter—HMRC's enforcement activity is substantial. In 2024-25, HMRC brought 310 criminal prosecutions with a 91% conviction rate, and tax under consideration in active cases reached £52.6 billion for large businesses and £14.2 billion for wealthy and mid-size businesses.
What Triggers an HMRC Investigation?
HMRC compliance checks combine automated risk profiling with human judgement. Knowing the common triggers lets businesses address vulnerabilities before they attract scrutiny.
Primary Triggers
- Connect data mismatches: HMRC's Connect system cross-references filed returns against banks, Companies House, Land Registry, DVLA, online marketplaces, payment providers (PayPal, Stripe), and foreign tax authorities — flagging discrepancies automatically
- Unexplained profit or turnover drops: A sharp decline compared to prior years, without corresponding changes in business activity, raises red flags
- Late or amended returns: Repeated late filing signals poor controls; multiple amendments suggest initial inaccuracy
- Random selection: HMRC can check any return for accuracy under routine risk profiling, even without specific suspicion
Industry and Activity Risk Factors
Certain business characteristics increase investigation likelihood:
- Cash-heavy industries (retail, hospitality, construction, personal services) face higher scrutiny due to limited electronic audit trails
- Expense claims disproportionate to turnover or out of line with industry norms
- Cross-border transactions, which trigger transfer pricing reviews and foreign exchange compliance checks
- Turnover figures that don't align between VAT and corporation tax returns
- Related-party transactions, especially those crossing borders
Not every compliance check signals wrongdoing — many are routine. What determines the outcome is documentation: businesses with complete, well-organised records typically close checks within weeks, while those with gaps risk escalation to a formal enquiry.
Key Regulatory Obligations: VAT, PAYE, and Making Tax Digital
Beyond document retention, UK businesses face specific ongoing compliance obligations that vary by tax type and business structure.
VAT Registration and Compliance
Businesses must register for VAT once taxable turnover exceeds £90,000 in any rolling 12-month period, effective from 1 April 2024 (increased from the previous £85,000 threshold). The deregistration threshold is £88,000.
VAT rates and application:
| Rate | Percentage | Applies to |
|---|---|---|
| Standard | 20% | Most goods and services |
| Reduced | 5% | Children's car seats, home energy |
| Zero | 0% | Most food, children's clothes, books |
Some items are exempt from VAT entirely, including postage stamps and most financial and property transactions.
VAT returns are filed quarterly, with payment due one calendar month and seven days after the period ends. For example, a period ending 31 March requires return and payment by 7 May.
Making Tax Digital Requirements
MTD for VAT: Mandatory for all VAT-registered businesses since April 2022, requiring digital record-keeping and submission via HMRC-compatible software with digital links between all data sources.
MTD for Income Tax Self Assessment (ITSA): Becomes mandatory from 6 April 2026 for sole traders and landlords with qualifying income above £50,000. This requires quarterly digital updates using compatible software, replacing the current annual Self Assessment return with four quarterly updates plus a final end-of-period submission.
PAYE Compliance
Employers must register with HMRC and submit two key payroll reports on a regular basis:
- Full Payment Submissions (FPS): Filed on or before each pay date, detailing pay, tax, and National Insurance for every employee
- Employer Payment Summaries (EPS): Submitted monthly when no payments are due or to report statutory payment recoveries
PAYE obligations run alongside corporation tax compliance. HMRC cross-checks reported payroll costs against corporation tax deductions to identify discrepancies.
Cross-Border and International Obligations
Businesses with complex international structures face additional requirements:
Transfer pricing documentation: For MNE groups with consolidated revenue of €750 million or more (approximately 3,500 UK businesses), transfer pricing documentation following the OECD three-tiered approach (Master File, Local File, Country-by-Country Report) has been mandatory for accounting periods starting on or after 1 April 2023.
Common Reporting Standard (CRS): UK financial institutions must collect and report information for exchange with partner jurisdictions, ensuring HMRC receives data on overseas financial holdings.
Annual tax strategy publication: UK groups or companies with turnover above £200 million or balance sheet totals over £2 billion must publish an annual tax strategy covering risk management, tax planning attitude, and approach to dealing with HMRC.
For UK businesses with Indian or other international operations, these obligations stack quickly. Meeting transfer pricing documentation requirements, dual reporting obligations, and FEMA compliance simultaneously demands specialist knowledge of both UK and foreign tax systems. VJM Global has worked with 250+ UK businesses managing exactly these cross-border complexities, covering everything from OECD-aligned transfer pricing documentation to UK tax conformity.
Consequences of Non-Compliance: Penalties and Risks
UK tax penalties operate on two tracks: systematic, cumulative penalties for late filing and payment, and behaviour-based penalties for inaccuracies.
Late Filing and Payment Penalties
Corporation Tax late filing:
| Timeline | Penalty |
|---|---|
| 1 day late | £100 |
| 3 months late | Another £100 |
| 6 months late | 10% of unpaid Corporation Tax |
| 12 months late | Another 10% of unpaid Corporation Tax |
If a Company Tax Return is late three times consecutively, the £100 penalties increase to £500 each.
VAT penalty points system (from 1 January 2023):
Each late VAT return earns one penalty point. Once the threshold is reached (2 points for annual filers, 4 for quarterly, 5 for monthly), each subsequent late submission triggers a £200 financial penalty. Points reset to zero only after submitting all returns on time for 24 months (annual), 12 months (quarterly), or 6 months (monthly).
VAT late payment penalties:
- Up to 15 days late: no penalty if paid in full or payment plan agreed
- 16 to 30 days late: 2% of VAT owed
- 31+ days late: 2% at day 15, plus 2% at day 30, plus daily interest at 4% per annum on outstanding balance
Inaccuracy Penalties
Penalties for inaccurate returns scale based on behaviour and disclosure type:
| Behaviour | Unprompted Disclosure | Prompted Disclosure |
|---|---|---|
| Careless | 0% to 30% | 15% to 30% |
| Deliberate (not concealed) | 20% to 70% | 35% to 70% |
| Deliberate and concealed | 30% to 100% | 50% to 100% |
Unprompted disclosure—admitting errors before HMRC identifies them—results in considerably lower penalties across all categories. If reasonable care was taken, no penalty applies even if a mistake occurred.
Serious Consequences of Persistent Non-Compliance
Beyond financial penalties, deliberate non-compliance carries reputational and operational risks:
- HMRC publishes names on the Deliberate Tax Defaulters list where additional tax exceeds £25,000 — including name, address, tax period, and penalty amount, visible publicly for around 12 months
- Multi-year HMRC investigations can follow, involving detailed document requests and interviews
- Public listing affects eligibility for government contracts and can damage relationships with lenders and investors
The most effective defence against penalties is proactive compliance. Keep documentation organised year-round, respond promptly to HMRC communications, and get professional advice early — before a concern becomes a formal enquiry.
Frequently Asked Questions
What documents can HMRC ask for?
HMRC can request any records relevant to the taxes under review, including the Company Tax Return, statutory accounts, VAT records, PAYE records, bank statements, sales and purchase invoices, and correspondence. HMRC specifies what it needs in its initial written notice.
What triggers an HMRC investigation?
Common triggers include discrepancies between filed returns and third-party data from Connect, unusually high expense claims, late or amended returns, and operating in cash-heavy industries. Random selection through HMRC's risk profiling system also applies, as do cross-border transactions and related-party dealings.
What is the HMRC compliance process?
HMRC contacts the business or its accountant in writing to open a compliance check, specifying what is under review. The process may include document requests, a premises visit, or a meeting. HMRC then issues a written decision, which the business can accept or appeal.
How long must businesses keep tax records in the UK?
Most businesses must keep records for at least six years from the end of the relevant accounting period. Records relating to fixed assets or property may need to be kept longer, and records covering transactions spanning multiple periods require extended retention.
What is a tax compliance certificate in the UK?
There is no single formal tax compliance certificate in the UK — HMRC issues specific confirmations as needed. One key document is the Certificate of Residence, which helps businesses avoid double taxation on foreign income under applicable tax treaties.
What happens after an HMRC compliance check?
HMRC issues a written outcome confirming the return is correct, issuing a repayment with interest if tax was overpaid, or requesting additional tax plus interest. Penalties may also apply depending on the nature of any underpayment found.
