Published: 4 Apr 2024
The process for how a registered tax agent, BAS agent or payroll service provider (registered agent) can be appointed as an agent for a taxpayer and access the taxpayer’s information has changed. The Australian Taxation Office (ATO) now requires clients to securely nominate a registered agent through a process called ‘client-agent linking’ (CAL) when they:
A client must nominate their agent. The agent can assist their client, but they cannot complete the nomination process for them.
The new process was extended to all entities with an ABN other than sole traders from 13 November 2023. This followed:
It is intended that CAL will also be eventually deployed for individual taxpayers, including sole traders. However, a solution for individual taxpayers is not expected to be designed and implemented until the business transition is complete.
The progressive start dates are set out in the table below.
Progressive start dates — client-agent linking | |
19 June 2022 | Public and multinational businesses that are part of the Top 100 and Top 1,000. |
13 December 2022 |
|
24 February 2023 | Government entities |
13 November 2023 | All types of entities with an ABN excluding sole traders. This includes entity types such as:
|
To be advised | Individual taxpayers and sole traders |
The implementation of CAL has been subject to extensive confidential consultation for nearly two years with key stakeholders including the professional associations and practitioners in various forums.
Andrew Watson, ATO Deputy Commissioner, Individuals & Intermediaries, generously agreed to be interviewed for this article, so we put some questions to him. His responses are insightful and explain why the ATO has taken this approach to strengthen data security.
ANDREW: The introduction of CAL was not about questioning the ability or integrity of agents, as many have surmised. This was a necessary response to strengthen the system and stop fraud we were seeing where good agents had their identities stolen by criminals who then did bad things in the name of the good agent.
We saw increasing attempts, some successful, by criminals to take over an agent’s identity or practice details and use those credentials to commit fraud or harvest personal information. In particular, having compromised the agent’s credentials, criminals moved clients from other agents onto the compromised agent’s client list. This allowed criminals to access client information and commit fraud beyond the compromised agent’s client list.
No, the new CAL process applies only when a taxpayer first engages an agent or provides their existing agent with authorisation to provide additional services such as doing the income tax returns. All existing client links remain unchanged and the existing clients do not need to do anything.
The process does not currently extend to individuals and sole traders.
A key principle to strengthen the system and mitigate the fraud we were seeing was for the client to commence the linking to a new agent through a secure channel, providing their authorisation for the agent to access their information and tax records.
Our secure digital service for interacting with businesses is Online services for business (OSB). OSB is a secure authenticated channel for business to access their information. To ensure a person is authorised to access and act for an entity, we use myGovID and Relationship Authorisation Manager (RAM) which are the whole-of-government systems to verify the connection between an individual and the entity they represent.
We considered other options proposed by the professional associations, such as the agent initiating the linking process with prompts or codes sent to the client or the client completing the process in RAM. These proposals were investigated for viability to meet the system strengthening requirements. The assessment was completed and we determined that the solutions offered were not technically viable, were not in pattern with existing ATO systems and would not address the fraud risk within the timeframes the ATO determined we had to act.
During the pilot, we started with the larger public and multinational groups. We then included a larger group from December 2022. Despite the perceptions that this was only large, sophisticated businesses, this group contained a mix of entities and client demographics such as small and even micro businesses, not-for-profit organisations, partnerships, foreign entities and trusts. The churn of agents in this group and the usage of OSB were similar to the SME market.
The feedback and observations from this group along with broader consultation helped inform some of the changes that were made to the process such as:
We undertook extensive consultation with the professional associations, tax practitioners and business associations. We also established a working group with representatives from the agent community, businesses and professional associations.
Some of these discussions were confidential due to the sensitive nature of the fraud environment but were open and robust in discussing the concerns that were raised by the stakeholders.
The ATO acknowledges the strong advocacy of the professional associations on behalf of their members and the concerns they raised from the outset. While good consultation does not always achieve consensus, the ATO continues to listen to and work with the associations to improve the experience of businesses and agents with CAL.
We know that not all consultation results in consensus and the ATO made the decision to deploy this solution in the interests of protecting client information and strengthening the system from criminal fraud activity.
We investigated the option for an agent to initiate the nomination process. This approach focused on agents initiating the process by submitting an add client request via OSfA or the Practitioners Lodgment Service (PLS), mirroring the current process. However, the client would not be added to the agent’s client list until the ATO prompted the client to log into an online channel to validate the nomination.
This option was not viable for the following reasons:
Clients can call us on the business line, 13 28 66, to get assistance with the process and our staff will help people to undertake the nomination. To do this, however, you need to ensure that your ABR details and contact details with the ATO are up to date to pass the proof of identity process.
It is important for all taxpayers to ensure their information is kept up to date, not just for the purposes of nominating an agent.
We use the whole-of-government digital identity, myGovID, to verify a client. myGovID uses encryption and cryptographic technology as well as the security features in your device, such as fingerprint, face or password. This protects your identity and helps stop other people from accessing your information.
Once it is set up, you can use your myGovID to access many of the government’s online services without having to prove your identity each time or remember passwords for each service.
We will continue to explore technology options that will protect client information from criminals and may be used in the CAL process.
While clients need a Strong myGovID to nominate and link with an agent digitally, or to verify their identity with the ATO if linking manually, this does not remove the need for agents to complete proof of identity steps as part of your normal process (in line with TPB Practice Note 5/2022 and our agent client verification methods).
What are some of the concerns and issues that the ATO is receiving by way of feedback?
We continue to listen to feedback and are working to address concerns on CAL. Some of the common feedback includes:
After each phase of the deployment, we have undertaken feedback sessions with users of the process to listen to the experience and identify opportunities for enhancements. We have delivered a number of enhancements as a result of this feedback.
We will soon deploy nudge messages in the ‘Add client and Maintain authorisations’ screen. These messages will remind agents:
These nudge messages further support information we have published on our website on how to add a client in OSfA where there is another agent and client support material.
We continue to listen to feedback and assess any additional enhancements that we can deliver that will not undermine fraud prevention. Some improvements based on feedback from the professional associations and their members are being designed for rollout soon (20 April 2024).
An Australian passport is currently required to obtain a Strong myGovID. You need a Strong myGovID to complete the link to your business in RAM.
If your client does not have a passport and therefore cannot obtain a Strong myGovID, they can still do the nomination online and access OSB with a Standard myGovID but they need to contact us directly to link to their business in RAM. Your client will need to complete proof of identity and we will carry out checks to confirm they are associated with the business. Once they have set up the RAM link, then they can access OSB online with a standard strength myGovID.
We have a troubleshooting guide on our website that outlines what to do in scenarios such as this.
We are also working with other government departments to implement the recent government announcement that a driver’s licence[1] can be used to obtain a Strong myGovID. While this is not a short-term change, it will potentially help clients who are not yet able to get a Strong myGovID and link their businesses online without needing to call the ATO.
We are investigating options to better support both agent and client calls. We know there are peak periods where we are unable to take all calls. We recommend trying different times to call such as early in the morning. Lunchtime is a very popular time for people to call and is a high-demand time.
We recognise the fraud challenge facing us all is difficult, and we are partnering with the agent community to make the system harder for fraudsters. To make the system stronger to protect client information, we had to change the way agents access client information and ensure a verified client is authorising an agent. We would like to thank the tax professionals community, who have continued to work with us to add CAL protection into their business practices.
We continue to engage with the tax professionals community and look for opportunities to enhance the process and further capitalise on any changes to the technology that will improve the process for agents and clients.
We thank those who have taken the opportunity to talk with us about their experiences, positive and negative. We will continue to review our support material and process to ensure our staff can support agents and clients over the phone when they are having difficulties.
We thank the professional associations and the agent community who are working with us to address the concerns that are being raised. We are definitely receiving your feedback and we are listening.
We have valuable information on our webpages about CAL and encourage agents and businesses to review this information if you have not already seen it. We will work with you to engage in this process further and work on any enhancements that are viable.
Maintaining the security and integrity of the data that the ATO manages is crucial, and it is important that the ATO, the professional associations and tax practitioners continue to be the guardians of the tax and superannuation systems. However, it is equally important that processes to guard against fraudulent behaviour and conduct of an errant few are well-designed and well-implemented to ensure they are workable, practicable and as efficient as possible. We acknowledge getting this balance right can be a challenge and we look forward to continuing to work with the ATO to improve the experience for all stakeholders.
We thank Andrew for his time with this interview and for sharing his insights with us.
The information below has been sourced and collated from the ATO website to assist practitioners with the linking process.
The steps set out below are required before a registered agent can link to a taxpayer’s account and act on their behalf. The information below is sourced from the ATO website.
Client-agent linking steps | |
Before the client starts Steps 1–2 | To complete Steps 1–2, the client must be the principal authority. This is the person responsible for the business and must be the first person to set up access to OSB. If the client is not sure what role they have, they can find more assistance at Get started. |
Step 1 Set up the Digital ID (myGovID) | The client needs to download the myGovID app, available from the App Store or Google and follow these instructions on how to set up your myGovID. The client then chooses their identity strength:
Importantly, myGovID (and the associated email address used to set up the myGovID) is unique to the client, using their personal information — they cannot share their myGovID with anyone else. |
Step 2 Link the myGovID to the ABN | The client needs to link their myGovID to the entity’s Australian Business Number (ABN) using the ATO’s Relationship Authorisation Manager (RAM). If the client has a Strong myGovID, they should go to RAM, log in, select Link your business and follow the prompts. The client needs to contact the ATO to complete this step if they:
More information can be found at How to link your business online. Note: The data in the RAM is drawn from the ABR and it is the client’s responsibility to maintain their ABN details. Details on the ABR are required to be updated within 28 days of becoming aware of changes. |
Step 3 Log in to OSB | The client uses their myGovID to log in to OSB. |
Step 4 Nominate the authorised agent | To complete this step, the client will need their agent’s (or payroll service provider’s) registered agent number (RAN). From the OSB home page:
The agent’s details will be listed under Agent nominations. More information about this can be found at Agent nomination. |
Step 5 Let your agent know you have nominated them | The agent nominated by the client will not receive an automated system notification, so it is important to let them know when the nomination step has been completed. The agent has 28 days to action the nomination before it expires. Extending a nominationIf the agent who has been nominated needs more time to add the client, the client can use the Extend feature which will add another 28 days to the nomination from the day it is extended. The Extend feature will become available the day after submitting a nomination. It remains available to select anytime during the 28 calendar days of the original nomination period. To extend a nomination:
A nomination cannot be extended if it has expired. A new nomination will need to be submitted. |
Step 6 Link the client | Once the client has completed the agent nomination, the agent has 28 calendar days (see above) to add them to their client list in OSfA or their practice software. |
Confusion has arisen for clients and agents when selecting the right account access. When a client nominates an agent, if the agent adds them to their client list using:
If you authorise the income tax account (adding the entity to your client list using the TFN), you will have access to all your client’s accounts and do not have to separately add the activity statement account.
If an entity is added to your client list using an ABN, only the activity statement account can be added. You will then need to ask your client to complete an additional nomination so you can also add the income tax account.
If you will be acting for their client for income tax and activity statements, and there is currently another BAS or tax agent authorised at the activity statement account, they will need to be removed by unselecting the check box. Ensure you do this only if your client has told you that the other agent is no longer representing them in any capacity.
The ATO advises tax agents not to add clients to your client list using an ABN if you are representing them only for income tax. Doing so may remove any existing agent listed for the activity statement account and will require the client to re-nominate that agent so that agent can re-link.
Removing an existing agent may also result in that agent missing deadlines on behalf of their client including frequent lodgments, such as Single Touch Payroll (STP) reporting or BASs.
Where a client has been added to the wrong account type and removed another agent, this will need correcting by contacting your client and asking them to re-nominate:
If a client wants a tax agent to represent them for income tax and fringe benefits tax (FBT), the client does not need to complete separate nominations for each. Only one nomination is required.
The income tax account needs to be added first then the FBT account can be added without your client completing a second nomination. The FBT account can be added through the Maintain authorisations function in OSfA.
If your client is any of the following:
Use these practice mail categories:
Include the following details in your request:
The service standard for these requests is 14 days.
A practice with multiple RANs linked to the same ABN may need to transfer clients between these RANs. You can transfer clients between RANs linked to the same ABN without the need for client nominations.
A whole-of practice transfer of clients from one practice to another may arise as a result of a sale or merger of two or more practices where bundles of clients linked to a RAN and practice ABN need to be transferred to another RAN and practice ABN.
The ATO can process a bulk transfer without the need for client nominations.
Either the acquiring agent or the agent who is transferring their client list can start the request through OSfA. Both agents need to provide a signed authority for the transfer to take place, sign the request and confirm that all clients have agreed to transfer to the new agent. A sample request template can be found on the ATO website.
Further information is available on the ATO website, including what both agents (the one acquiring the client list and the one selling or transferring their client list) need to provide to request the whole-of-practice transfer.
The ATO is also exploring options for a partial practice transfer and will engage stakeholders as it works through this process. Updates will be posted to the CAL webpage.
Further guidance and information on client-agent linking are available from the ATO website.
If you have any specific concerns that have not been outlined above, please email taxpolicy@taxinstitute.com.au.erests.