HMRC VAT compliance check: what triggers one and how to prepare (2026)

QUICK ANSWER

A VAT compliance check is HMRC’s review of whether your VAT returns are accurate and the right amount of VAT has been paid or reclaimed. It is a civil review, not a criminal investigation, and most checks are routine. HMRC normally gives seven days’ notice, asks for the records behind one or more VAT periods, and can assess up to four years back — or twenty years where the VAT loss was deliberate, or where you failed to notify a liability to register. Answering in scope, on time, and disclosing any error before HMRC finds it is what keeps a check small and a penalty low.

If a letter from HMRC has just landed with the words ‘compliance check’ in the opening line, the instinct is to assume the worst. Most of the time that instinct is wrong. HMRC opens thousands of VAT compliance checks every year and the large majority close with no change, or with a modest correction.

What decides the outcome is not usually whether your returns were perfect. It is whether you can show your working. A check answered promptly, strictly within its scope, with a clean evidence trail behind every figure, tends to stay small. One answered late, or with records reconstructed from memory eighteen months after the event, tends to widen.

This guide sets out what a VAT compliance check is, what triggers one in 2026, exactly what HMRC will ask for, what your rights are during the process, and what to do if you find an error before they do. It is written with cross-border sellers in mind — businesses whose evidence trail runs through marketplaces, freight forwarders and customs systems as well as an accounting package.

What is a VAT compliance check?

A VAT compliance check is an examination by an HMRC officer of your VAT records, carried out to confirm that you have charged, reclaimed, reported and paid the correct amount of VAT. HMRC’s guidance on VAT visits and inspections describes it as officers inspecting your VAT record keeping and, where relevant, your business premises.

You will see the same process called several different things. They are not interchangeable, and the wording HMRC uses is a useful signal about how broad the review is likely to be.

Compliance check or investigation: why the difference matters

A compliance check is a civil process. HMRC is testing whether your figures are right; it is not alleging fraud. The distinction is worth holding on to, because business owners who respond to a routine check as though they are already accused tend to make one of two mistakes — they over-disclose material nobody asked for, or they go quiet. Both make the check longer.

‘Investigation’ is the word to take seriously. If HMRC’s correspondence refers to Code of Practice 9, or to a criminal investigation, stop and take specialist legal advice before you respond to anything at all. That is a different process with different rules, and it is not what this guide covers.

What triggers a VAT compliance check?

Selection is overwhelmingly risk-based. HMRC runs your returns against its own data, against your filing history, and against the profile of comparable businesses, then looks for the things that do not reconcile. The most common triggers are:

• A repayment return. Where a return claims money back — particularly a first repayment, or a repayment from a business that has always paid — HMRC will often verify the claim before releasing the funds. For import-heavy and export-heavy e-commerce sellers this is by far the most common trigger.
• Figures that do not reconcile. Net sales and net purchases that do not correlate with the VAT declared, or returns that sit at odds with your filed accounts.
• A sharp change in pattern. A large movement in turnover, margin, or the ratio of input tax to output tax, without an obvious explanation.
• Late, amended or estimated returns. A repeated pattern of late filing is a visible risk marker — see our guide to VAT return deadlines and payment dates.
• Sector risk. Cash-intensive businesses, construction, and cross-border e-commerce are all reviewed more frequently than average.
• Third-party data. Information from marketplaces, payment processors, banks, customs systems or other tax authorities that does not match what you have declared.
• A recent registration or restructure. First returns after registration, a change of legal entity, or a late registration all attract attention. If you are still working out where you stand, start with the UK VAT registration threshold.
• Random selection. A proportion of checks are genuinely random quality control. Being selected does not, on its own, mean HMRC thinks anything is wrong.

The 2026/27 one-to-many letters

Through the 2026/27 financial year HMRC has been running a ‘one-to-many’ campaign — a standard letter issued to a whole population of taxpayers rather than to one business. As reported by several UK advisory firms, the campaign targets mid-sized businesses (broadly £10m to £200m turnover, or 20 or more employees) that have had no VAT review in the previous five years, and tells recipients that roughly half of them can expect a compliance check during the year.

If one of these letters has arrived, treat it as a prompt rather than a formality. The practical risk is not the letter itself; it is that a business files it, does nothing, and is later found to have errors in exactly the areas the letter flagged. At that point the ‘we took reasonable care’ argument is considerably harder to make.

What HMRC already knows before it writes to you

This is the question most business owners actually want answered, and almost nobody publishes it. By the time an opening letter is drafted, HMRC will typically already hold:

• Marketplace transaction data. Online marketplaces report seller data to HMRC and, under the deemed supplier rules, account for VAT on certain sales themselves — which means HMRC can compare what the marketplace reported against what you declared.
• Bank and payment processor data, including settlement records that show gross receipts.
• Customs and import records — every import declaration, every C79 certificate and every postponed VAT accounting statement in your name.
• Platform reports under the DAC7 rules, where you sell through EU-facing marketplaces.
• Your filed accounts, your previous VAT returns, and your registration history.

The practical consequence is straightforward: reconcile your marketplace and settlement reports to your VAT returns before you reply, not after HMRC points out the difference. Sellers on Amazon in particular should also read our note on HMRC’s additional information requests for Amazon sellers, which covers the same data-matching logic at the registration stage.

Who inside HMRC runs the check

The letterhead tells you something useful. Most small and owner-managed businesses are handled by Individuals and Small Business Compliance (ISBC). Mid-sized businesses — including those receiving the 2026/27 VAT letters — sit with the Wealthy and Mid-sized Business Compliance (WMBC) directorate. The largest groups have a named Customer Compliance Manager (CCM) who owns the relationship year-round. HMRC is restructuring its compliance directorates during 2026, so the team name on your letter may not match these exactly — what matters is the customer group it points to.

Knowing which team has written matters because it indicates likely scope. An ISBC letter about one repayment return is a narrow enquiry. A mid-sized business letter following a one-to-many campaign is usually the start of a broader look at process and controls, not just at figures.

You’ve received a letter: the first seven days

What you do in the first week shapes the rest of the check. Work through it in this order.

What HMRC will ask for

The officer’s aim is to trace every figure on a return back to a real transaction and real evidence. In practice the request list is fairly predictable. What is less predictable — and where cross-border sellers lose time — is where those records actually live.

Input tax evidence: the most common finding

The single most frequent outcome of a VAT compliance check is not a complicated technical dispute. It is a reclaim with no valid VAT invoice behind it — a card receipt instead of an invoice, an invoice in a director’s name rather than the company’s, or a supplier document missing one of the required particulars. If you are not certain your purchase records would survive that test, start with what a valid VAT invoice must contain.

Import VAT, PVA and C79: where cross-border sellers get caught

Import VAT is the area where non-UK sellers most often cannot produce a clean trail. Three points decide it. First, ownership: import VAT can only be recovered by the business that owns the goods at the point of import — a logistics or fulfilment provider named on the declaration cannot reclaim VAT on goods it does not own. Second, evidence: a reclaim must be supported by a C79 import VAT certificate or, where you use postponed VAT accounting, by the monthly PVA statement — not by a freight invoice. Third, timing: the period in which import VAT is recovered must match the statement it sits on.

Where declarations were made by an agent, get the underlying entries from your customs and import compliance provider early. Reconstructing twelve months of import data during a live check is the slowest part of the whole process.

Marketplace, OSS/IOSS and stock-location records

If you sell through a marketplace, stock location drives liability. Goods held in a UK fulfilment centre and sold to a UK customer are a UK supply regardless of where your business is established — and a non-established taxable person has no registration threshold at all. Expect HMRC to ask for stock movement and inventory reports, not just sales reports. Where sales into the EU are being reported through OSS or IOSS, keep those returns and their workings with your UK records; the two systems have to tell the same story.

How long you must keep VAT records

VAT records must be kept for six years. Under Making Tax Digital they must also be kept digitally, with a digital link between the source records and the figures submitted. HMRC is explicit that copying and pasting is not a digital link — a point that carries the force of law in VAT Notice 700/21. A broken digital link is something an officer can test directly, and it is one of the few findings that is entirely avoidable.

One trap worth knowing: certain documents must be kept in their original form even where the data has been captured digitally, and HMRC names the C79 import VAT certificate specifically. Scanning it into your accounting system does not discharge the obligation to keep the original.

What actually happens during the check

Most VAT compliance checks now run remotely. HMRC asks for reports and documents digitally, reviews them, and comes back with follow-up questions. An on-site visit is more likely where the officer wants to see systems and stock in operation, or where the business is complex.

Expect sampling rather than a full read of every transaction. A common approach is for HMRC to take your detailed VAT report for the periods under review and then select a sample of sales and purchase invoices from it. If the sample requested is disproportionate to the size of the business, it is entirely reasonable to say so and propose an alternative — for example the highest-value items per quarter plus a random selection — and agree it before you start scanning.

On timing, there is no statutory limit and HMRC publishes no service standard. Based on what advisers consistently report, a narrow aspect enquiry commonly resolves in three to six months, while a full check across several periods typically runs nine to eighteen months. What extends a check is almost always the same two things — incomplete records, and slow responses.

How far back HMRC can go

The standard assessment window for VAT is four years. It extends to twenty years in two situations: where the loss of VAT was brought about deliberately, and where a business failed to notify a liability to register. That second one catches sellers out, because it applies whether or not the failure was deliberate — a business that crossed the threshold years ago without realising is exposed for the whole period of unregistered trading, not just the last four years. It is also why record retention and contemporaneous notes matter: a decision made in good faith three years ago is hard to defend if the only surviving explanation is someone’s memory of it.

Your rights during a compliance check

Cooperation reduces penalties, but cooperation is not the same as unlimited access. You have specific rights and it is worth knowing them before the first exchange.

• Professional representation. You may appoint an adviser to deal with HMRC on your behalf, provided you have formally authorised them.
• A clear explanation of scope. HMRC should tell you what is being checked and why, and give you a reasonable period to respond.
• Notice before a visit. HMRC normally gives seven days’ notice of a VAT visit, confirms what it wants to see and how long it is likely to take, and you may ask for the visit to be delayed. Unannounced visits are possible but are the exception.
• Meetings are usually voluntary. Unless a formal notice has been issued, you are generally not obliged to attend a meeting. Many issues are better handled in writing, where the record is unambiguous.
• Limits on what can be compelled. A formal information notice under Schedule 36 of the Finance Act 2008 is legally binding and carries penalties for non-compliance — but it has to specify what is required, and certain categories of document are protected.

HMRC also publishes a set of factsheets that are handed out at the start of a check and are worth reading properly rather than filing — they set out its powers, your rights, and how penalties are decided. They sit on the HMRC compliance checks help and support page, alongside the wider guidance on tax compliance checks.

Found an error before HMRC did? Disclose it

This is the most commercially important section on this page. Penalties for VAT errors are driven by behaviour and by disclosure, not simply by the amount involved.

Under VAT Notice 700/45, how you correct an error depends on its size. A net error under £10,000 can normally be adjusted on your next return. So can an error between £10,000 and £50,000, provided it does not exceed 1% of your box 6 figure. Anything above those limits — and any deliberate error, at any value — must be reported to HMRC separately.

What happens after the check

HMRC ends a check by writing to you. Depending on what was found, that letter will confirm the position as filed, set out corrections you must make to your VAT account, or issue an assessment for additional VAT due. Where VAT was underpaid, interest runs from the original due date.

Penalties are assessed against behaviour under Schedule 24 of the Finance Act 2007, which distinguishes between an error made despite reasonable care, a careless error, a deliberate error, and one that was deliberate and concealed. The range is wide and the reduction for disclosure and cooperation is significant — the detail is set out in our guide to how VAT penalties are calculated.

If you disagree with a decision you have 30 days to act. For VAT, the decision letter will normally offer a statutory review — an independent look at the case by an officer outside the original decision-maker’s management chain. The review period is 45 days unless a longer period is agreed, and HMRC must write to you if it cannot meet it. You can accept the review or go straight to the First-tier Tribunal (Tax Chamber); if you take the review and still disagree, you get a further 30 days from the review conclusion letter. One VAT-specific point worth planning for: the tribunal will generally not hear a VAT appeal unless the disputed VAT has been paid, although you can apply on hardship grounds. Missing the 30-day window is a costly and entirely avoidable mistake.

How to be permanently inspection-ready

The businesses that come through a compliance check quickly are not the ones with the cleverest VAT position. They are the ones who can produce the evidence without a scramble. HMRC has actually published its own view of what good looks like — the Guidelines for Compliance on VAT compliance controls (GfC8) — and it is the benchmark against which ‘reasonable care’ is measured. Eight practical habits cover most of it.

That is a meaningful amount of monthly discipline, which is precisely why most growing sellers automate it. AVASK’s compliance platform pulls transaction data directly from Amazon, Shopify, eBay and 20+ other channels, validates it before submission, and keeps a complete audit trail behind every return — so the evidence an officer asks for is already assembled rather than reconstructed.

Frequently asked questions