An interview with the ATO: Client-agent linking

Background

What is client-agent linking?

The process for how a registered tax agent, BAS agent or payroll service provider (registered agent) can be appointed as an agent for a taxpayer and access the taxpayer’s information has changed. The Australian Taxation Office (ATO) now requires clients to securely nominate a registered agent through a process called ‘client-agent linking’ (CAL) when they:

• change an agent; or
• change the authorisations they give their existing agent.

A client must nominate their agent. The agent can assist their client, but they cannot complete the nomination process for them.

Staggered implementation

The new process was extended to all entities with an ABN other than sole traders from 13 November 2023. This followed:

• a pilot in mid-2022 that involved about 40,000 entities and 800 agents;
• the expansion of CAL on 13 December 2022 to the next group which included public and multinational businesses, and the Top 500 wealthy privately owned groups.

It is intended that CAL will also be eventually deployed for individual taxpayers, including sole traders. However, a solution for individual taxpayers is not expected to be designed and implemented until the business transition is complete.

The progressive start dates are set out in the table below.

Interview with the ATO

The implementation of CAL has been subject to extensive confidential consultation for nearly two years with key stakeholders including the professional associations and practitioners in various forums.

Andrew Watson, ATO Deputy Commissioner, Individuals & Intermediaries, generously agreed to be interviewed for this article, so we put some questions to him. His responses are insightful and explain why the ATO has taken this approach to strengthen data security.

ROBYN: What circumstances led to the ATO wanting to implement a new process for linking clients and agents?

ANDREW: The introduction of CAL was not about questioning the ability or integrity of agents, as many have surmised. This was a necessary response to strengthen the system and stop fraud we were seeing where good agents had their identities stolen by criminals who then did bad things in the name of the good agent.

We saw increasing attempts, some successful, by criminals to take over an agent’s identity or practice details and use those credentials to commit fraud or harvest personal information. In particular, having compromised the agent’s credentials, criminals moved clients from other agents onto the compromised agent’s client list. This allowed criminals to access client information and commit fraud beyond the compromised agent’s client list.

Does CAL apply to all clients who use an agent?

No, the new CAL process applies only when a taxpayer first engages an agent or provides their existing agent with authorisation to provide additional services such as doing the income tax returns. All existing client links remain unchanged and the existing clients do not need to do anything.

The process does not currently extend to individuals and sole traders.

Why was the process designed in the way it has been implemented?

A key principle to strengthen the system and mitigate the fraud we were seeing was for the client to commence the linking to a new agent through a secure channel, providing their authorisation for the agent to access their information and tax records.

Our secure digital service for interacting with businesses is Online services for business (OSB). OSB is a secure authenticated channel for business to access their information. To ensure a person is authorised to access and act for an entity, we use myGovID and Relationship Authorisation Manager (RAM) which are the whole-of-government systems to verify the connection between an individual and the entity they represent.

We considered other options proposed by the professional associations, such as the agent initiating the linking process with prompts or codes sent to the client or the client completing the process in RAM. These proposals were investigated for viability to meet the system strengthening requirements. The assessment was completed and we determined that the solutions offered were not technically viable, were not in pattern with existing ATO systems and would not address the fraud risk within the timeframes the ATO determined we had to act.

The success of the pilot was not unexpected, given that most multinationals and large businesses regularly use OSB and change agents less often than smaller businesses. What consideration was given to how the approach used in the pilot would be readily adaptable to the SME market?

During the pilot, we started with the larger public and multinational groups. We then included a larger group from December 2022. Despite the perceptions that this was only large, sophisticated businesses, this group contained a mix of entities and client demographics such as small and even micro businesses, not-for-profit organisations, partnerships, foreign entities and trusts. The churn of agents in this group and the usage of OSB were similar to the SME market.

The feedback and observations from this group along with broader consultation helped inform some of the changes that were made to the process such as:

• increasing the nomination expiry period from seven days to 28 days;
• developing a nomination ‘on demand’ report in Online services for agents (OSfA) to allow visibility of the nominations to agents;
• allowing agents to transfer clients between registered agent numbers (RANs) associated with the same practice ABN without a nomination;
• enabling income tax agents to add the FBT account without a nomination; and
• identifying the groups that would need to provide additional information when requesting assistance through the process and setting up a practice mail support process for them. These groups include foreign entities, strata titles, bulk groups (including partial practice transfers), entities without an ABN from the pilot group, foreign entertainers and sportspeople who use an entity for tax.

What engagement and consultation did the ATO undertake with the professional associations and key stakeholders?

We undertook extensive consultation with the professional associations, tax practitioners and business associations. We also established a working group with representatives from the agent community, businesses and professional associations.

Some of these discussions were confidential due to the sensitive nature of the fraud environment but were open and robust in discussing the concerns that were raised by the stakeholders.

The ATO acknowledges the strong advocacy of the professional associations on behalf of their members and the concerns they raised from the outset. While good consultation does not always achieve consensus, the ATO continues to listen to and work with the associations to improve the experience of businesses and agents with CAL.

We know that not all consultation results in consensus and the ATO made the decision to deploy this solution in the interests of protecting client information and strengthening the system from criminal fraud activity.

Most clients engage an agent because they don’t want to handle administrative tasks. Why can’t the agent initiate the nomination to link with the client?

We investigated the option for an agent to initiate the nomination process. This approach focused on agents initiating the process by submitting an add client request via OSfA or the Practitioners Lodgment Service (PLS), mirroring the current process. However, the client would not be added to the agent’s client list until the ATO prompted the client to log into an online channel to validate the nomination.

This option was not viable for the following reasons:

1. Client contact details are not regularly updated with the ATO or the Australian Business Register (ABR) which prevented us from identifying the authorised contact and sending them to a system to verify the person. This already exists with myGovID and RAM.
2. Agents often update client contact details with their practice details, so notifications prompting clients to validate the nomination would result in the ATO contacting the previous agent.
3. Due to the widespread issues involving scams and phishing, the ATO does not send links embedded in email or SMS and this approach would have undermined our cyber strategy to educate the community not to click on links in emails and text messages.
4. Other technical and legal considerations with this option had to be considered, including our legislative privacy provisions.

Not everyone is comfortable in the digital space. How can agents link with their clients who cannot or struggle to obtain a myGovID or will not willingly undertake the steps necessary to link with their agent successfully?

Clients can call us on the business line, 13 28 66, to get assistance with the process and our staff will help people to undertake the nomination. To do this, however, you need to ensure that your ABR details and contact details with the ATO are up to date to pass the proof of identity process.

It is important for all taxpayers to ensure their information is kept up to date, not just for the purposes of nominating an agent.

Why can’t a solution be adopted that instead involves the use of multifactor authentication, such as that used by banks and other organisations that store and deal with sensitive client data?

We use the whole-of-government digital identity, myGovID, to verify a client. myGovID uses encryption and cryptographic technology as well as the security features in your device, such as fingerprint, face or password. This protects your identity and helps stop other people from accessing your information.

Once it is set up, you can use your myGovID to access many of the government’s online services without having to prove your identity each time or remember passwords for each service.

We will continue to explore technology options that will protect client information from criminals and may be used in the CAL process.

Does CAL remove the need for agents to undertake proof of identity checks when taking on a new client?

While clients need a Strong myGovID to nominate and link with an agent digitally, or to verify their identity with the ATO if linking manually, this does not remove the need for agents to complete proof of identity steps as part of your normal process (in line with TPB Practice Note 5/2022 and our agent client verification methods).

What are some of the concerns and issues that the ATO is receiving by way of feedback?

We continue to listen to feedback and are working to address concerns on CAL. Some of the common feedback includes:

• not being able to set up myGovID without a smartphone;
• lack of an Australian passport to obtain a Strong myGovID and having to call the ATO to get set up;
• outdated data on the ABR that feeds into RAM;
• corporate trustees of trusts and SMSFs that require manual connection over the phone — this is an existing process and exists because the ABR does not allow a non-individual to be listed as an authorised person for an entity;
• BAS agents being inadvertently delinked by tax agents — when an agent is inadvertently removed by another agent then the client needs to make another nomination to allow them to add the client back to their list. In most cases, multiple agents can link to a client for their different roles;
• tax agents inadvertently linking to an ABN-only account — we are seeing agents who need access to the income tax account trying to add using an ABN only and then having the option to select only the activity statement account. This means another nomination is needed to add the income tax account and potentially another nomination for the BAS agent to link again;
• hours spent on the phone with the ATO trying to link clients;
• clients ultimately giving up on the process and choosing to remain with their existing agent, which we acknowledge is not an ideal outcome.

What is the ATO doing in response to the feedback received from the profession to improve the experience for clients and agents?

After each phase of the deployment, we have undertaken feedback sessions with users of the process to listen to the experience and identify opportunities for enhancements. We have delivered a number of enhancements as a result of this feedback.

We will soon deploy nudge messages in the ‘Add client and Maintain authorisations’ screen. These messages will remind agents:

• how to search and add a client in OSfA when authorised for income tax; and
• that adding a client to an account with an existing agent link will remove that agent’s access to that account.

These nudge messages further support information we have published on our website on how to add a client in OSfA where there is another agent and client support material.

We continue to listen to feedback and assess any additional enhancements that we can deliver that will not undermine fraud prevention. Some improvements based on feedback from the professional associations and their members are being designed for rollout soon (20 April 2024).

If someone doesn’t have an Australian passport, is there a workaround?

An Australian passport is currently required to obtain a Strong myGovID. You need a Strong myGovID to complete the link to your business in RAM.

If your client does not have a passport and therefore cannot obtain a Strong myGovID, they can still do the nomination online and access OSB with a Standard myGovID but they need to contact us directly to link to their business in RAM. Your client will need to complete proof of identity and we will carry out checks to confirm they are associated with the business. Once they have set up the RAM link, then they can access OSB online with a standard strength myGovID.

We have a troubleshooting guide on our website that outlines what to do in scenarios such as this.

We are also working with other government departments to implement the recent government announcement that a driver’s licence[1] can be used to obtain a Strong myGovID. While this is not a short-term change, it will potentially help clients who are not yet able to get a Strong myGovID and link their businesses online without needing to call the ATO.

Will the ATO increase the resourcing of its call centres to reduce lengthy wait times for taxpayers and agents in relation to CAL issues?

We are investigating options to better support both agent and client calls. We know there are peak periods where we are unable to take all calls. We recommend trying different times to call such as early in the morning. Lunchtime is a very popular time for people to call and is a high-demand time.

What do you say to those agents who have expressed their disappointment and frustration with the inefficiencies and difficulties experienced in trying to link with their clients, in some cases, unsuccessfully? What are the next steps to improve the experience and what additional support will be provided?

We recognise the fraud challenge facing us all is difficult, and we are partnering with the agent community to make the system harder for fraudsters. To make the system stronger to protect client information, we had to change the way agents access client information and ensure a verified client is authorising an agent. We would like to thank the tax professionals community, who have continued to work with us to add CAL protection into their business practices.

We continue to engage with the tax professionals community and look for opportunities to enhance the process and further capitalise on any changes to the technology that will improve the process for agents and clients.

We thank those who have taken the opportunity to talk with us about their experiences, positive and negative. We will continue to review our support material and process to ensure our staff can support agents and clients over the phone when they are having difficulties.

Closing comments from the ATO

We thank the professional associations and the agent community who are working with us to address the concerns that are being raised. We are definitely receiving your feedback and we are listening.

We have valuable information on our webpages about CAL and encourage agents and businesses to review this information if you have not already seen it. We will work with you to engage in this process further and work on any enhancements that are viable.

Closing comments from us

Maintaining the security and integrity of the data that the ATO manages is crucial, and it is important that the ATO, the professional associations and tax practitioners continue to be the guardians of the tax and superannuation systems. However, it is equally important that processes to guard against fraudulent behaviour and conduct of an errant few are well-designed and well-implemented to ensure they are workable, practicable and as efficient as possible. We acknowledge getting this balance right can be a challenge and we look forward to continuing to work with the ATO to improve the experience for all stakeholders.

We thank Andrew for his time with this interview and for sharing his insights with us.

Further information

The information below has been sourced and collated from the ATO website to assist practitioners with the linking process.

Client-agent linking steps

The steps set out below are required before a registered agent can link to a taxpayer’s account and act on their behalf. The information below is sourced from the ATO website.

Guidance on selecting the correct account

Confusion has arisen for clients and agents when selecting the right account access. When a client nominates an agent, if the agent adds them to their client list using:

• an entity’s TFN — the agent will be able to access both the client’s income tax account and activity statement account;
• an entity’s ABN — the agent will be able to access only the client’s activity statement account. The income tax account will not be displayed as an option.

Acting for income tax and activity statement

If you authorise the income tax account (adding the entity to your client list using the TFN), you will have access to all your client’s accounts and do not have to separately add the activity statement account.

If an entity is added to your client list using an ABN, only the activity statement account can be added. You will then need to ask your client to complete an additional nomination so you can also add the income tax account.

If you will be acting for their client for income tax and activity statements, and there is currently another BAS or tax agent authorised at the activity statement account, they will need to be removed by unselecting the check box. Ensure you do this only if your client has told you that the other agent is no longer representing them in any capacity.

Acting for income tax but not activity statement

The ATO advises tax agents not to add clients to your client list using an ABN if you are representing them only for income tax. Doing so may remove any existing agent listed for the activity statement account and will require the client to re-nominate that agent so that agent can re-link.

Removing an existing agent may also result in that agent missing deadlines on behalf of their client including frequent lodgments, such as Single Touch Payroll (STP) reporting or BASs.

Where a client has been added to the wrong account type and removed another agent, this will need correcting by contacting your client and asking them to re-nominate:

• the agent you have removed so that agent can re-link to the correct account they are authorised for; and
• you so that you can access the correct role.

Acting for income tax and FBT

If a client wants a tax agent to represent them for income tax and fringe benefits tax (FBT), the client does not need to complete separate nominations for each. Only one nomination is required.

The income tax account needs to be added first then the FBT account can be added without your client completing a second nomination. The FBT account can be added through the Maintain authorisations function in OSfA.

Specific scenarios in which the ATO can be contacted for support

If your client is any of the following:

• a foreign resident entity without any Australian authorised persons who can get a Standard or Strong myGovID identity strength to access OSB;
• a foreign entertainer or sportsperson who uses an entity with an ABN for Australian tax purposes;
• a group consisting of 20 or more entities moving to a new agent or changing the authorisation of their current agent and needs help completing the nominations;
• an entity without an ABN (there are a small number of entities without an ABN that were part of the CAL pilot. If you try to add one of these clients to your client list you may receive the CAL error message); or
• representing a strata title entity, and the authorised representative is unable to complete the online nomination, you can contact the ATO through practice mail for support to add your client to your client list.

Use these practice mail categories:

• General questions, problems, and help
• Submit client agent linking exception request.

Include the following details in your request:

• client name;
• client TFN or ABN;
• reason why the client has been unable to complete the nomination;
• what account access is needed to act for the client (i.e. income tax, activity statement, FBT account or other account);
• your RAN;
• your contact details, including name, phone and email;
• confirmation that you have completed proof of identity requirement steps as part of your normal process (in line with TPB Practice Note 5/2022 and the ATO’s agent client verification methods)
• name of the authorised representative of the business and their position title — this could include their director ID if applicable;
• evidence of authority to act:
• attach evidence the client has given your practice authority to act for them and be linked to access their information;
• this evidence would align with the current TPB requirements and might include a signed engagement letter or signed authority to act declaration from the client;
• the authorised representative could complete the nomination for the head entity or controlling entity online to assist with the process (if the client is a large entity group).

The service standard for these requests is 14 days.

Additional guidance on transferring clients

Transfers of clients between RANs in the same practice

A practice with multiple RANs linked to the same ABN may need to transfer clients between these RANs. You can transfer clients between RANs linked to the same ABN without the need for client nominations.

Whole-of-practice transfers

A whole-of practice transfer of clients from one practice to another may arise as a result of a sale or merger of two or more practices where bundles of clients linked to a RAN and practice ABN need to be transferred to another RAN and practice ABN.

The ATO can process a bulk transfer without the need for client nominations.

Either the acquiring agent or the agent who is transferring their client list can start the request through OSfA. Both agents need to provide a signed authority for the transfer to take place, sign the request and confirm that all clients have agreed to transfer to the new agent. A sample request template can be found on the ATO website.

Further information is available on the ATO website, including what both agents (the one acquiring the client list and the one selling or transferring their client list) need to provide to request the whole-of-practice transfer.

The ATO is also exploring options for a partial practice transfer and will engage stakeholders as it works through this process. Updates will be posted to the CAL webpage.

Further guidance and information

Further guidance and information on client-agent linking are available from the ATO website.

If you have any specific concerns that have not been outlined above, please email taxpolicy@taxinstitute.com.au.erests.

Footnotes

1. The Identity Verification Services Act 2023, enacted on 14 December 2023, allows an Australian driver’s licence to be used as an alternative form of identity verification. In particular, the Bill ensures Australians can have their identity verified against their driver’s licence to establish a Strong myGovID which is needed to access certain government services, such as those provided by Centrelink and the ATO.  Without the National Drivers Licence Facial Recognition Solution (NDLFRS), only persons with an Australian passport, which accounts for approximately 50% of the population, would be able to create a Strong myGovID and access critical services. Systems are still being designed to enable a driver’s licence to be used to obtain a Strong myGovID.