Client-to-agent linking in online services – From the ATO

Client-to-agent linking in online services – From the ATO

We’re further strengthening the security of our online services to help protect you and your clients against fraud and identity-related theft.

From 13 November 2023, the client-to-agent linking process will apply to all types of entities with an ABN excluding sole traders.

Entities included in the process will need to nominate you as their agent before you can add them to your client list. They will need to use the new agent nomination feature in Online services for business when they:

• engage a new tax or BAS agent, or payroll service provider to represent them
• provide extra authorisation to you as their existing authorised agent (for example, you start representing them for a new obligation, such as activity statements or a new entity in their group).

After your client completes the agent nomination, you’ll have 7 calendar days to add them to your client list in Online services for agents or your practice software.

From 13 November, we’ll be extending this period, from 7 calendar days to 28 calendar days. This is a result of agent feedback through consultation.

You won’t get an automated notification advising you that your client has completed the nomination. So, make sure you tell your client to let you know.

You can generate the Client nominations on demand report in Online services for agents. This report provides a real-time view of nominations that have been completed by your clients (including the expiry date of the nomination) that can be added to your client list.

Existing client links are not affected. You do not need to do anything if your client doesn’t change their existing arrangements.

Rollout Schedule

The following businesses and organisations are currently included in the rollout or soon will be:

• Public and multinational businesses who are part of the Top 100 and Top 1,000 – effective from 19 June 2022.
• Most public and multinational businesses – effective from 13 December 2022.
• Businesses in the Top 500 privately-owned wealthy groups, where that group has a significant level of ownership of the business – effective from 13 December 2022.
• Government entities – effective from 24 February 2023.
• All types of entities with an ABN excluding sole traders – effective from 13 November 2023. This includes entity types such as
  • companies including strata title bodies
  • partnerships
  • trusts
  • not-for-profits
  • joint ventures
  • cooperatives
  • self-managed super funds (SMSFs)
  • APRA-regulated superannuation funds.

As we roll out each phase, we’ll update this list. The process does not currently apply to individual taxpayers or sole traders.

Why we’re making this change

We need to strengthen the security of the client-to-agent linking process so all parties – including you, your clients and the ATO – can have confidence the client has authorised you to:

• have access to their information
• act for them.

This will help us to defend against increasingly sophisticated criminal attempts to defraud the system.

Reducing identity theft

Identity theft and fraud can occur to taxpayers and registered agents. Criminals may pose as:

• taxpayers and engage an agent to help them (unknowingly) commit fraud (for example, they get the agent to make fraudulent lodgments that result in refunds)
• agents to gain access to client information and services available on our digital platforms (such as Online services for agents).

Reducing your workload

We’ve worked with agents where they or their clients, or both, have been the victim of identity crime. In these instances, there was a significant and disruptive impact on the agent, which took extensive time to resolve.

If you or your clients are affected by identity crime, you may have to:

• arrange to have your identity documents re-issued and apply for a new myGovID (in instances where the agent has been targeted)
• contact your client to explain that they have been the victim of identity fraud and manage the client’s next steps
• notify clients that you have been a victim of identity fraud and that client information has been compromised
• work with us to correct the tax position for each affected client
• undertake security reviews of your practice and IT systems, which can sometimes also involve external contractors
• deal with the consequences of employee fraud, including engaging with relevant law enforcement agencies
• notify the Office of the Australian Information Commissioner of a data breach.

What we are doing

To counter the increased risk, we’re strengthening our front-end controls to:

• help protect you and your clients
• give you confidence about the identity of a new client
• bring our processes more into line with best practice and community expectations.

This is part of a broader program of work to strengthen the security of our systems and data. It complements enhanced security measures such as client verification practices and Relationship Authorisation Manager (RAM).

We recognise this security enhancement will change your processes when engaging a new client who needs to interact with us. We’ve provided support information to assist with this change. We understand that this may add some time and effort to the client-to-agent linking process. However, this is necessary to balance the greater need for security in today’s environment.

We’ll work with you to make improvements to the process where we can, based on your feedback.

Phased rollout

We ran a successful pilot for this new process in mid-2022. From December 2022 we’ve progressively expanded the new process, starting with most large businesses and some private groups.

We’re consulting with agents, industry representatives and businesses to ensure we take taxpayer and agent needs into account as we put this process in place. We’ll seek input about what support information you and your clients need.

We’ll provide communication on timing for further rollouts in advance of any changes.

How to know if your client is included

Businesses and organisations in each phase will see the new Agent nomination feature in Online services for business when we apply this change to them. To see this feature, select Profile then Agent details.

If your client is included in the process and you try to add them in Online services for agents or your practice software without them completing the nomination, you’ll receive an error message.

What you need to do

When you take on a new client or change authorisations for an existing client, follow these steps:

1. Complete Proof of Identity (POI) requirement steps. As part of your normal process (in line with TPB Practice Note 5/2022 and our Agent client verification methods), verify a client’s identity. When your client nominates you in Online services for business, we accept it as an approved client verification method. If your client is unable to access our online services, you’ll still need to do a separate POI.
2. Provide your client with your registered agent number (RAN) and practice name as this will help them find you in Online services for business.
3. Provide your client with a copy of the linking steps or direct them to our website. Refer them to our support information, or send them to Client-agent linking steps.
4. Remind your client to tell you when they’ve completed the nomination, because you won’t receive an automated system notification telling you it’s been completed. You can generate the Client nominations on demand report in Online services for agents to view a real-time list of your pending nominations.
5. Once your client completes the agent nomination, you’ll have 7 calendar days to add or update the client in Online services for agents or your practice software, as normal.

Your client can extend the nomination if you’re unable to complete the linking step before the nomination expires.

Linking at the right level

It’s important when onboarding a new client that you’re linked at the right level, depending on the needs of your client.

For example, some clients have a:

• tax agent to look after income tax matters
• BAS agent to manage their GST affairs
• payroll service provider to manage their employee’s payroll function.

If you link at the wrong level or to levels that result in a duplication of access, you may remove a currently-linked agent. If that happens, your client will need to re-nominate the other agent before they can re-link.

If you’re a tax or BAS agent with only STP reporting authorisation, you need to link to the Activity statement – STP reporting level. For this authorisation, agents must use the add payroll only client menu in Online services for agents.

If you receive an error message

Once a client has been added to this process, they must complete the agent nomination first before you can link the client in Online services for agents or your practice software.

If you try to link to a client in online services and you receive an error message, check that your client has completed the agent nomination.

The nomination is valid for 7 calendar days. You’ll receive an error message if you try to link beyond that time and you’ll need to ask the client to complete the nomination again.

What your clients need to do

What your clients need to do to complete the agent nomination process will depend on whether they’re:

• already set up to use our online services
• not set up to use our online services, but could be
• unable to get a myGovID or don’t have an ABN

You can’t complete the agent nomination process on behalf of your client. However, you can help them understand what to do using these linking steps.

Already set up to use our online services

Many businesses and organisations are already set up to use our online services. If your client is already set up, the agent nomination process only involves 3 steps. The client will need to:

1. Log in to Online services for business
2. Nominate you as their agent
3. Let you know they’ve completed the agent nomination.

You can now use the client-to-agent linking process, where your client completes the agent nomination through our online services, as one of the approved client verification methods.

Not set up to use our online services

If your client is not yet set up to use our online services but they already have a myGovID, or are able to get one, they’ll need to do these 3 steps first:

1. Set up their myGovID
2. Link their myGovID to their ABN
3. Authorise others to act on their behalf in Relationship Authorisation Manager (RAM).

Once they are set up, they can complete the nomination in their online services.

If your client isn’t already set up to use Online services for business, we have detailed information available at Online services – business to help them get started.

If your client needs more support, they can speak with a customer service representative on 13 28 66 and we’ll help them through the process.

Can’t get a myGovID or doesn’t have an ABN

We know there may be clients who can’t get a myGovID or whose business doesn’t have an ABN. For those exceptions, your clients can speak with a customer service representative on 13 28 66 and we’ll help them through the process.

Support information

We’re committed to supporting agents and clients through this change. For more information, see:

• agent nomination information for your clients
• summary of the linking steps you can use to help your clients
• instructions for adding a client in Online services for agents, including a short video (you’ll also find details of the error message you’ll see if the nomination hasn’t been done or has expired)
• instructions for adding a client in Practitioner Lodgment Service, including details of the error messages you’ll see if the nomination hasn’t been made or has expired.