Showing posts with label Compliance. Show all posts
Showing posts with label Compliance. Show all posts

Sunday 4 July 2021

UK Tax - MTDfITSA

Update 21 December 2022:  MTD for ITSA delayed 2 years, will now start 5 April 2026, and applies to a way smaller base.   Theses are the key changes: 

Starting 6 April 2026 shall apply to roughly 740k users, people that need to register have a combined Self employment and property income of over £50k.  From April 2027, the threshold drops from £50k to £30K and will increase the user base to roughly 1.6 millions people.

  1. There is no plan for Partnerships to fall under MTD for ITSA.
  2. It's all subject to change, and it's likely the threshold will also be applied to lower threshold self employed people.
  3. HMRC are looking at the API's, no road map but will put it together at some point.  The Sandbox will be reviewed for API testing (let see what comes out).
  4. The new penalty points system only starts in 2026.
  5. MTDfCT does not have any dates i.e. the 2026 start has been scrapped and no new date set.  HMRC plan to do MTDfCT at some point.
  6. There is no change to the Basis Period Reform (BPR).

Making Tax Digital (MTD) for Income Tax Self Assessment (ITSA) is the replacement process to HMRC's Self Assessments (SA) that starts 6 April 2024 6 April 2025.  Of the 12 million UK people registered for Self-Assessment, roughly 40% are mandated to switch over to MTDfITSA on the 6th of April 2024 (circa 4.2 million individuals).  A combined gross income of over £10k from people with either a self employed business or a property business will need to register.

Are you or you self-employed client in?

Do you have over £10k income from self-employed businesses, then yes, from April 6 20224 you'll need to be using digital records to do quarterly submissions.  You first MTD for ITSA submissions are due submission for the quarter 6 July 2024 and 5 Aug 2024.  

What software options are the options?

There are approved vendors on HMRC's website for ITSA submissions, everyone has to submit via approved software vendors.  Anecdotally, Free Agent, Sage, Xero and QuickBooks are going to offer Quarterly self assessments submissions tied to their bookkeeping products.  Free agent is good for small customers, keep it simple.   I also quiet like what I have seen from Sage for accountants coupled with bookkeeping.  Personally, I've use QB for many years and played with Xero, both are excellent products and are strongly focuses on have MTDfITSA quarterly submissions.

There are software vendors that shall also look at bridging software solutions which will be more useful to self-employed businesses that support spreadsheets and are likely to be used by individuals to keep their costs down.  Accounts are likely to look at TR, Sage for Accountants, Capium, BTC, and WK for full practice management tooling including MTDfITSA, these vendors providing full suite solutions are likely to offer bridging and retrieve from source (booking and open banking) options for holding the digitally linked data.  Coconut looks interesting for individuals.

How do I enroll a client on MTDfITSA pilot?

Call HMRC and get client registered with HMRC for the pilot.  Software can be used to assign client to their accountants software. 

Is there a new penalty system coming in?

There is a new penalty and fining systems, the amounts of returns and work to complete an ITSA is significantly more than the single once a year SA.

Summary of comparison between ITSA & SA:

SA

ITSA

1 SA return done each year per person.

4 quarterly returns via approved software per business, required a digital record link to the underlying transactions per self-employed business

1 End of Period Statement (EOPS) per business.

Crystallization/Finalization using HMRC approved software per person

Paper submission due 31 Oct for previous year.

Online submissions due 31 Jan – 9 months after financial/tax year end.

Approved Digital Software to submit (no paper returns).

1 month after each quarter, submit the quarterly return, these can be revised later.

Each EOPS is due on 31 Jan the following year.  

The Crystallisation/Finalisation/Final Declaration is also due 31 Jan the following year.

MTDfITSA has been pushed back twice (although it is in pilot) and it's scoped changed.  ITSA follows on from Making Tax Digital for VAT (MTDfV) that is already live.  

HMRC use paper for self-assessments, then allowed XML submissions, and is starting MTDfIT to enable individuals to do their own Self-assessments.  Many people doing Self Assessments will be affected, and the associate costs & time shall be higher.  Just under 40% of people file SA themselves. If they need to be on MTDfITSA, it is highly likely that these smaller businesses will be severely impacted.  I believe Accountants that are doing small business self-assessment in the £400-£1,400 range will probably need to double or more these fees.  It all comes down to will the client do the quarters and the account just does the final submission, in which case there should not be much of a cost change.  Realistically, some clients will need booking to record the transactions and others will merely need guidance and year end adjustments from the accountant.  SA submissions start at about £120 (ex Vat) for simple Self-Assessments, these individuals, if they fall under ITSA shall probably be charged at least triple the amount compared to a TA doing all the work under self assessment or need to do considerably more work themselves.

MTDfVat took several years to implement (April 2022, all businesses, including those registered for MTDfVat but under the VAT threshold, must use MTDfV), and MTDfITSA is way more complicated than MTDfVat.

MTD for Corporation Tax (MTDfCT) is scheduled to start April 2026.  A pilot is scheduled to begin in April 2024 (unlikely).  Update earmarked for 2026, likely to be later.

MTD for ITSA (referred to as ITSA or MTDfITSA) 

  • Who is in - Individuals and Partnerships.  Require either trading income from self-employed businesses and/or property businesses (if you have either of these business types), if their combined revenue/income total is over £10K.  (To determine, need to look two years' back at the individual's self-assessment income).   If not trading in the two years previous means you are outside MTDfITSA.  I.e. new self-employed businesses would get two years grace before they need to file using MTDfITSA.  Unlikely to be enforced by penalties.  The mandatory start for quarters is 6 April 2024. Must have combined property and self-employed (unincorporated) business revenue over £10k combined. 
  • Partnerships are in if all partners are individuals (starts 6 April 2025).  I think there is a disconnect between the draft regulation and what HMRC are providing.  Partnerships declare income using SA800 for a partnership.  Then each individual partner has to do a self-assessment.  There is no way partnership income counts as self-employed income so partnerships are not a criteria for MTDfITSA.  Need to confirm what the "General partnerships with income over £10K that have individual partners need to join MTDfITSA" refers to, I suspect it is incorrect. 
  • Trusts/estates, LLP and Ltd are out at the start.  
  • 1.3 million landlords in the UK as of 2021.
  • Roughly 40% of Self Assessments are filed by individuals for themselves.  This is going to be tricky with MTDfIT.  If these individuals wish to file, they will need to do the quarters, have digital records, and use free software (HMRC are not providing MTDfIT free software).  They will also need to do MTDfIT EPOS and crystallisation.
  • Individuals doing Self Assessment can have ten or many self-employment businesses, 0 to 3 (4 - Foreign property is not clear) property businesses under MTDfITSA (Ord UK property, FHL UK, FHL EEA, Foreign property).
  • One can defer MTDfIT by changing year ends.  Individuals/practices also can apply for exclusion based on age, religion...
  • The HMRC ITSA service is only able to accept end clients who have accounting period aligned to the tax year (I believe this means 31 March or 5 April).  Basis period reform is coming and will sort out this issue.
  • Digital links/keeping digital records.  Can't re-key/copy and paste.   There is no requirement to use bank feeds/PDS2 data.  Some booking software firms are likely to file quarterly MTDfIT returns for each self-employed (and property) business.  Spreadsheets are an acceptable form of record keeping.   Excel and bridging software is sufficient for the source for filing.  If recording sales can use daily sales totals for the digital source but ideally link to the raw input system.  
  • PDS2/bank feed - unlikely to work, useful for bringing in data.  The issue is that the bank account would need to represent a single business; also, the mapping would be very rough into the MTDfIT categories.  Things like purchases from Tesco can't understand where to place the transaction.  As MTDfITSA quarterly is a rough estimate.  It is possible as an option.
  • Quarterly MTDfITSA is done per business and is due 1 month after quarter period ends.  Penalty points for late filing, missing 4 quarters in 24 months, is £200 penalty.  Record of last 24 months retained.  Property business quarters and year end run in the same cycles as personal tax namely start 6 April and end the following year 5 April.  As MTDfIT starts on 6 April 2024 (was 6 April 2023 but postponed again notice provide on 22 Sept 2021), the 4 quarterly submission for the 2024-2025 tax year and filling due dates are:

Qrt start date

Qtr end date

Qtr submission due date

6 Apr 2024

5 July 2024

5 Aug 2024

6 July 2024

5 Oct 2024

5 Nov 2024

6 Oct 2024

5 Jan 2025

5 Feb 2025

6 Jan 2025

5 Apr 2025

5 May 2025

  • Self Employed businesses with a year-end of 5 April or 31 Mar, are treaded as using the same period dates as property businesses'.  The majority of Self-employed businesses are already aligned with personal tax year ends and are "in".  If you tax year is outside of this i.e. 31 Dec each year you can't use MTDfITSA.  
  • Each property business for the individual needs to submit an End of Period Statement (EOPS) each year and also a declaration for each business attached to an individual.  
  • Lastly, the Final "Crystallisation" (basically the final Self-assessment) needs to be submitted covering the self-employed business, the property businesses and the personal tax affairs of the individual.
  • Late payment has interest penalties, basically no penalty for 15 days late, then 2% for 16-31 days and then 4% is paid after this. 4% is on the outstanding balance from day past due.  Payment is due following year 31 Jan.
  • MTDfITSA adjustments can be done after the quarter and resubmit or at the EOPS.
  • Quarterly submissions are estimates and can be adjusted per quarter or finalised at year-end for each business.  Revenue could ask for proof of digital linking, so you can't just throw in a rough estimate.
  • After every quarterly obligation is submitted, the response gets a CalculationID, that can be used to view the end clients "year to date tax estimate" for the business.
There are basically Two possible flows for completing ITSA Tax returns:
  1. Full Process/Accountant/Practice/TA has booking data and does the quarters for each trade/business, the practice then does the end of year pieces also, the issue is it will be expensive.
  2. Client Individual Driven Process is where the end user shall submit their ITSA quarterly returns, and then use a practice to submit the business/trades end of years and then the individuals end of year/Crystallization. 

High-Level Process for TA (full process):

  1. Clients sign up to MTDfITSA on HMRC using their Government gateway credentials, assuming they meet the criteria (Agent if authorised to act on the clients behalf can also sign the client up to MTDfITSA).
  2. Clients must maintain digital records/digital linking, and it must be digitally linkable (spreadsheets are acceptable, min req allows for daily totals in a spreadsheet).  Need to record the transaction date, category and amount.
  3. Perform quarterly submissions per registered unincorporated business.  It can be submitted up to 1 month after the period ends.
  4. EOPS submission per business.  Due 31 Jan following year.  HMRC will return the tax calc for the unincorporated business.  Also, a declaration for each business must be completed by the TA or individual.
  5. Final Crystalisation & Declaration (HMRC does the calculation for the individual) are due 31 Jan following year.
  6. The payment date remains the same for Tax liability due 31 Jan following year.

Note:  All opinions are my own, and I am not a personal tax expert.

Numbers:
  • 32 Million Income tax payers, 4.1 million people are higher rate tax payers.
  • 450k people on additional rate (45%).
  • Median income per UK individual is £25k (males £27,400 females £22,200)
  • +-35k Tax & Accounting Practices in the UK (rough estimate).
  • 12 million people do self-assessments in the UK.
  • MTD ITSA will impact around 4.3-4.7m people (Self employment & landlords).
  • MTDfITSA affects 1.3m individual landlord.
  • HMRC recon they will gather an extra £9 billion per year.
  • HMRC estimate 1 million MTDfITSA customers will quality for the free software from vendors (less than £85k turnover and using cash basis accounting).
  • of the 12.2 million SA's due for the year ending 2020/2021, 10.2 million were filed on time by 31 Jan 2022.  It gets pretty crazy in filing day see HMRC's info.
  • HMRC recon that +-8 million of the 12.2 million 2020/21 self assessment (SA) tax returns have been filed as of 24 January 2022 (1 week to 31 Jan deadline, with Feb no penalty extension in 2020/21 year).  Interestingly the year before 9 million we filed at the same point the year before.
  • The pilot ITSA HMRC sign up is extremely low.  With HMRC estimating 4.3 million ITSA user sign-ups for the year starting 6 April 2024.
My Thoughts 10 Sept 2021 on ITSA:
HMRC have a lot of open questions both on the mechanics of ITSA and the API for MTDfITSA.  The regulation should be finalised +-end of Sept/Oct.  There are very few people that are eligible for the Pilot 6 April 2022 and very few accountants wanting to put their client on MTD.  My personal opinion is that HMRC will end up delaying the start for ITSA as they did for MTDfVat until is if more flushed out.  The API sandbox is not fit for pre-production however, all the vendors are doing best endeavors.  So not impossible to keep the existing timelines but i do feel there will be huge changes to ITSA coming along shortly from Revenue.

Self Assessment filling options:
  1. Most people use the current XML online filing done 31 Jan after the personal tax year.
  2. Some people still use paper based self-assessment due Oct after tax year,
  3. MTD for ITSA will be due 1 month after each businesses quarter, EOPS and finalization/crystallization process due 31 Jan the year after the personal tax year.

Tuesday 3 December 2019

Microsoft Teams Governance

Update 2020/07/07:  I recently watch a presentation by Rupert Squires on MS Teams Governance that provides a good introduction into Team Governance and thoughts for your MS Teams projects: https://www.slideshare.net/RupertSquires/positive-governance-in-5-steps-for-microsoft-teams

Storage: MS Teams stores data in SharePoint, exchange and OneDrive for Business (OF4F).  Each team has it's own dedicate site per team.  Chats are stored in the senders OD4B, images stored in exchange.  The Teams will provision in the location where the tenant was setup.  In the O365 Admin centre, you can see where your instance of Microsoft Teams is located, mine is in the EU zone.


If location is important to you for compliance reasons, it's important you select the correct location.  I favour the EU zone as Europe is pretty strict on data, pretty central globally to my user bases.  But it does come down to your clients needs.

All data is encrypted at rest and encryption in transit and Teams data is stored in the Microsoft Data centre for your region

MS Teams Configuration: Team admin allows for a great degree of control in allowing different users different rights.  You can turn-off feature to groups of people easily to align with your companies governance.  There are a few dials to help you get granular control.

O365 Group Naming Policies is good for controlling access.  This allows for a common easy understanding of Groups, what the group has access to .

Sensitivity Labels/Azure Information Protection - very useful

Team Creation Thoughts - Should anyone be allowed to create your teams results in complex scenario that has be to governed and brought back under control.  Too much restriction results in people not using teams and potentially using shadow IT to achieve their goals.  Privacy must be appropriate, public vs private, don't allow people just to go for public because it sounds more open.  Each team should have a purpose, likely to have an end date (not always).  Don't just follow org structure.

Teams is not a replacement to all tools but it works best if you work out the right tool and often Teams can replace a variety of tools in large enterprises.

Teams should be using Teams instead of Email.  This is generally how one can tell if teams are being well implemented.  For me, I want to use teams for all communications and project related file store.  Email should be last resort.  Remove Skype if you have Teams.  Consider removing Zoom, WebEx, GoTo... you have teams, use this as the chat, calls or team meeting tool by default.  Schedule meetings from Teams if possible so it's in the correct team.  The meeting is therefore context based.
Don't allow people to add any app, think about it.  The exception is possibly small companies.

MS Teams ALM: Ensure that Teams are deleted when no longer needed.  ShareGate's Apricot tool is great for getting Teams under control.  Archive before deleting a MS team if you require the data or you have to be available.  Owners can delete a Team, the Team goes into the recycle bin for the default set period (30 days maybe).  It will be gone after this including the underlying storage data.

Note: When you delete a team all the underlying corresponding data is also deleted from SharePoint, Exchange and OneDrive.

MS Teams Series:
https://www.pbeck.co.uk/2019/12/microsoft-teams-governance.html
https://www.pbeck.co.uk/2020/05/microsoft-teams-overview.html
https://www.pbeck.co.uk/2020/06/multi-geo-for-ms-teams.html

Monday 3 December 2018

SharePoint Online Geo-Replication SPO/O365

Geo-replication/Multi-tenancy

Mid 2018 I outlined the state of Multi-geo on O365, the easier parts of Geo-Replication are already well handled and the changes are discussed in the the link.  This post focuses on SSO options today and the likely road-map.

O365 is moving towards multi-tenancy that will allow multinational companies to store data in compliance with country rules.  For instance EU data may not be allowed to be stored outside the EU but you already have your O365 tenancy based in the US.

Historically, most larger companies have chosen either the US or EU to base their data storage in.  If you wanted data to be stored in another region you had to buy another tenant with Microsoft strongly discouraged.

Microsoft, are working towards supporting O365 in multi geo-locations.  Basically, their are 2 parts: 1) User specific data (email, OneDrive) where we know where a user is based and their data is encrypted and stored in that country. and 2) group/team/country specific data (SharePoint) where the data itself may have residency rules.

This post looks at SharePoint data that is required to be stored in a specific country.

Options today:
1. On-Prem. : Have a SharePoint farm in each geo location, this requires a fair amount of thought to deal with SSO, Search, MMS, Content Types and UPA.
2. O365: Have multiple tenants (non are connected) in each location and connect your authentication up to each tenant.  The problem with option 2 is that each O365 tenant requires a separate Azure Active Directory.  This means that you will need to hook each O365 tenant up to a single MMS, Search service and poly-fill in the SSO process.  Imaging if you have 8 regional tenants for regulatory purposes.  To achieve SSO, you will need to create a central AAD, then connected each regional AAD to the central AAD.  Azure directory sync is needed, inviting members and guests, other companies AAD becomes and issue.  The image below outlines a possible pattern to solve this complex problem.


Coming Q1 2019 : Multi Geo tenant, that shall be the answer.  A lot of the multi-tenant is still in  preview so I shall be interesting to see mutil-geo tenancy when it goes into General Availability (GA) next year (+-Feb/March 2019).

MSIgnite tour London updates 27-Feb-19:
Brent Alinger

Sovereign geos:
US Gov
China (21Vianet)
Germany

Coming new geos: South Africa, UAE, Norway o365 data regions coming soon.  See office.com/datamaps

UK: Cardiff, London, Durham are 3 data centres in the UK.
Note: some services such as AAD, planner, yammer, Sway are not uk based either Europe or US based.

US has 8 data centres

Can get default region moved, it’s difficult.

Phase 1:  oneDrive and exchange April 2018 delivered
Phase 2: o365groups and SharePoint private preview Oct 2018.  Good feedback so far.  Keen ferry, Cott dimension data.

Multi-geo is not for solving:
GDPR
PERFORMANCE enhancer - rather align with MS Global Network.  
pining data to a specific country

Cost:  $2 per month extra per user in satellite locations, go thru account manager to set it up.  Once approved shows in admin centre and provisioned, take less than 30 days but can be 2 days.

Need a domain name per geo location for OneDrive and SPO e.g. https://emeia-radimaging.sharepoint.com

Preferred Data Location (PDL) - used to specify in AAD to show where a user is stored.  Not for travelling user but long term office assignment.  Users of exchange online are seemlessly moved.  ODfB requires a PS cod to move the user data.  

Phase 2: SPO March into GA by 30 March 2019 confirmed.  DLP per satellite geo.  Hub sites can span multi geos.  

Aka.ms/multi-geo

Update: 2020-06-30.  Multi-geo is available in
Australia, 
Asia Pacific, 
Canada, 
European Union, 
France, 
India, 
Japan, 
Korea, 
United Kingdom, 
United States, 
United Arab Emirates, 
South Africa, and 
Switzerland.





Sunday 14 February 2016

Notes on Compliance in Office365 & SharePoint

Also see: Data Protection Using SharePoint

Data Loss Prevention (DLP)
Historically used for email to identify, monitor and protect data.  This is the next step on from email policies/IT Policies where sent around and signed with the hope users would behave and only send appropriate information along.   DLP ensure that sensitive information such as patents, financial information, Payment Card Industry Data Security Standard (PCI DSS) , personally identifiable information (PII), or intellectual property (IP) are accidentally shared with external parties.  DLP can inform users before they send email or open access to OneDrive or SharePoint document libraries that the information being shared violates company policy (as configured in the DLP template).
https://blogs.office.com/2013/10/28/office-365-compliance-controls-data-loss-prevention/
https://blogs.office.com/2014/08/27/search-sensitive-content-sharepoint-onedrive-documents/

Information Rights Management (IRM)
IRM-Protect document libraries prevents sensitive information being copied, forwarded, printed

eDiscovery
Find related content with SharePoint, Exchange & files shares to assit with litigation and determining info on a topic ata point in time.

Records Management
Manage a documents life-cycle, stop key docs being amended or edited.

Information management policies
Enforce compliance such as expired content, usage auditing & retention policies

Office 365
All data is encrypted on the servers (encryption at rest) and TLS/SSL on all communications.

Other
DocAve can enhance IRM and archieving & they have a SharePoint Monitoring and Policy Enforcement module.

Reference:
https://support.office.com/en-us/article/Use-Office-365-to-help-comply-with-legal-regulatory-and-organizational-compliance-requirements-ce773cec-2151-4d06-9a4e-2818613bd7e0