On 19 January 2026, HMRC introduced a new security requirement for businesses enrolling for VAT through their Business Tax Account.
To complete enrolment, businesses must now provide the original VAT registration application reference number.
The change is designed to combat VAT fraud linked to unauthorised access and fraudulent enrolments. While intended to strengthen security, it has practical implications for businesses facing VAT account lockouts, disputed enrolments and wider VAT investigations.
For directors and finance teams, this is not simply an administrative adjustment. It affects compliance, digital access control and enforcement risk.
What has changed?
HMRC now requires the original VAT registration reference number before a business can enrol for VAT online via its Business Tax Account.
If that reference cannot be located, enrolment may not proceed.
The purpose is to reduce:
- fraudulent VAT enrolments
- account hijacking
- false repayment claims
- manipulation of VAT records
This forms part of HMRC’s broader enforcement focus on VAT fraud and tax investigation activity.
Why Has HMRC introduced this requirement?
HMRC has seen increasing attempts to:
- access Business Tax Accounts using compromised credentials
- amend VAT records without authority
- submit fraudulent VAT repayment claims
Requiring the original registration reference adds a historic verification layer that is difficult for third parties to fabricate.
This reflects a wider trend. HMRC is strengthening digital controls while simultaneously increasing scrutiny of VAT repayment claims, denied input tax and suspected carousel fraud.
What problems can this cause?
Although the intention is anti-fraud protection, the practical consequences can include:
1. VAT Account Lockouts
Where historic records cannot be located, businesses may find themselves unable to:
- file VAT returns
- access their VAT account
- amend VAT details
Delays in access can create compliance risk if filing deadlines are missed.
2. Disputed Enrolments
Many VAT registrations were completed years ago by former advisers or internal staff. Records may not be easily accessible.
Where uncertainty arises about historic enrolment details, HMRC may question:
- who had authority
- whether enrolment was valid
- whether changes have been made improperly
Wider VAT Investigation Risk
If irregularities are identified, HMRC may look beyond enrolment issues.
This can trigger:
- input tax denial
- Kittel challenges
- personal liability notices
- assessments connected to alleged VAT fraud
Search demand for VAT fraud and HMRC investigations reflects the enforcement environment businesses are operating in.
How does this connect to enforcement action?
VAT compliance rarely exists in isolation.
If enrolment problems coincide with:
- unpaid VAT
- time to pay arrangements
- prior investigation history
- irregular trading patterns
HMRC may escalate.
Escalation can include HMRC statutory demands or HMRC winding up petitions in serious cases.
Directors should understand that technical enrolment issues can become part of a broader compliance review.
What should directors do?
If your business cannot complete VAT enrolment due to the new requirement:
- Locate original VAT registration documentation and correspondence.
- Check whether former accountants or agents retain copies.
- Review archived digital records.
- Avoid repeated failed enrolment attempts without clarity.
If there are signs of:
- compromised account access
- disputed VAT claims
- HMRC queries or assessments
early specialist advice is recommended.
Structured engagement with HMRC at an early stage often reduces enforcement risk and protects the director’s position.
The Bigger Picture
This update reflects a broader enforcement strategy. HMRC is:
- increasing digital identity verification
- strengthening anti-fraud systems
- linking digital irregularities with compliance investigations
VAT compliance now extends beyond accurate returns. It includes secure digital governance and record retention.
Where issues arise, early advice can prevent administrative disruption from becoming enforcement action.
