Digital platforms are now a central part of the UK economy, providing routes to market for sellers of goods and services across sectors from retail to transport to accommodation. HMRC has introduced new rules, based on the OECD’s DAC7 framework and implemented domestically through The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023 (as amended), requiring digital platform operators to collect and verify seller information as part of their due diligence responsibilities.
What this article is about: This guide explains HMRC’s guidance for digital platform operators. It outlines the legal basis and scope of the rules, the requirements for collecting and verifying seller information, penalties for non-compliance, the broader reporting obligations and seller notification duties, and the practical implications for SMEs and platform operators. It concludes with immediate and long-term steps to achieve and sustain compliance.
Section A: HMRC Guidance for Digital Platform Operators
1. Background to the rules
The UK has implemented the OECD Model Rules commonly referred to as “DAC7” through The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023, updated in 2024. These rules are intended to improve tax transparency by ensuring HMRC receives accurate data about income generated by individuals and entities selling goods or services via digital platforms.
Who is in scope: The regime applies to “reporting platform operators” that are UK tax resident, incorporated or managed in the UK, or otherwise within scope due to facilitating activity of UK resident sellers or the rental of UK real property. It applies to a wide range of business models, including:
- Online marketplaces where goods are sold directly to consumers
- Ride-hailing and delivery platforms
- Short-term accommodation booking platforms
- Apps or websites that connect service providers with customers for consideration
Who is out of scope as sellers: Certain categories are not “reportable sellers”, including government entities, listed companies and related entities, and occasional sellers below de minimis thresholds (for example, where an individual makes a very small number of transactions with low consideration). Platform operators must build logic to identify and exclude these from reports while retaining evidence of the determination.
2. Overview of HMRC’s guidance
HMRC’s guidance clarifies that operators must establish and maintain proportionate due diligence systems to: (i) collect specified seller information, (ii) verify that information using acceptable methods, and (iii) report defined data annually to HMRC. Non-UK platforms with UK reportable sellers or with rentals of UK property are also captured. Passive collection without verification is not sufficient; platforms must demonstrate active checks, clear exception handling, and robust record-keeping.
3. Collection of seller information
Platforms must collect, at onboarding for new sellers and retrospectively for existing sellers, the following as applicable:
- Full legal name and primary address
- Date of birth (individuals) or business registration/incorporation details (entities)
- Tax identification number(s) and country/countries of tax residence
- VAT registration number where relevant
- Bank account details where payments are made
Operators should map their seller base to identify reportable versus excluded sellers, track missing data, and chase outstanding items to avoid reporting failures. Terms of service and privacy notices should be updated to reflect the collection and onward disclosure to HMRC.
4. Verification procedures
Seller information must be verified using acceptable methods, which typically include:
- Documentary checks (e.g., passports, driving licences, utility statements)
- Company and VAT checks via official registers (e.g., Companies House)
- Electronic verification tools and reputable data sources
Deadlines: Due diligence (including verification) has to be completed by 31 January following the end of the reportable period. Platforms must retain evidence of the checks performed, decisions made (including exclusions), and any remediation undertaken. If data cannot be verified, operators should follow an escalation path that can include temporary suspension of payouts or access until the seller becomes compliant.
5. Penalties for non-compliance
HMRC may impose financial penalties where platforms fail to collect, verify, or report required information. The framework includes fixed penalties (commonly £300 per failure) and daily penalties (commonly up to £60 per day for continuing failures), with higher penalties possible for deliberate or concealed inaccuracies. Beyond fines, non-compliance can trigger HMRC enforcement action, create operational disruption (e.g., forced remediation programmes), and cause reputational harm with sellers and partners.
Key timeline context: The first full reporting covered activity in the 2024 calendar year, with the initial submission and seller notifications by 31 January 2025. Thereafter, the annual cycle repeats each year, reinforcing the need for always-on compliance rather than year-end sprints.
Section A Summary: HMRC’s guidance confirms that platform operators must implement end-to-end due diligence: collect defined seller data, verify it to an acceptable standard by 31 January after the period, and maintain audit-ready records. The legal basis is DAC7 as implemented by the UK Regulations, with clear scope rules and specific seller exclusions. Penalties apply for failures, so platforms should prioritise systemised, evidence-based controls.
Section B: Reporting Obligations for Digital Platforms
1. Annual reporting requirements
Each year, reporting platform operators must submit an electronic report to HMRC for the prior calendar year covering all reportable sellers. As a rule of thumb, the filing deadline is 31 January following the end of the reportable period (for example, activity in 2025 is reported by 31 January 2026). Reports must follow HMRC’s technical schema and include, for each reportable seller and, where applicable, each permanent establishment:
- Seller identification details (full name, primary address, date of birth for individuals; legal name and registration number for entities)
- Tax identification number(s) and country/countries of tax residence
- Total consideration paid or credited in the period, broken down by quarter if required by the schema
- Number of relevant transactions facilitated
- Bank account identifiers where payments are made
- For rental of immovable property: address and, where available, land registry or local identifier of each property
Operators must implement quality controls to ensure completeness, accuracy, and deduplication. Where corrections are needed post-filing, amended or correction reports should be made promptly in line with HMRC guidance.
2. Seller notification duties
Platforms must notify each reportable seller, by 31 January following the period, of the information that will be or has been disclosed to HMRC. Best practice is to provide a seller-facing statement or dashboard export that mirrors the core data elements in the HMRC report, with a clear route to raise queries or corrections before submission where practicable.
Notifications should be retained as evidence (including timestamps and delivery status). Where a seller disputes accuracy, platforms should triage the dispute, remediate data where justified, and record the rationale and outcome for audit purposes.
3. Data protection and GDPR considerations
Platforms act as data controllers for the collection, verification, and preparation of seller data for reporting. Once submitted, HMRC becomes the controller of the information it receives. Operators must ensure:
- Lawful basis: Processing is grounded in legal obligation under the UK Regulations
- Transparency: Privacy notices explain the categories of data collected, verification methods, recipients (HMRC and relevant foreign competent authorities), and retention periods
- Data minimisation & security: Only required data is processed; appropriate technical and organisational measures protect personal and financial data
- International transfers: Any onward exchange under DAC7 occurs via competent authority channels; platforms should avoid unnecessary cross-border transfers outside the HMRC pipeline
- Retention: Records of due diligence, determinations, reports, notifications, and remediation are retained for audit for the statutory period set out in the Regulations and guidance
Operators should embed data governance into their compliance operating model, including data lineage, access control, incident response, and regular internal audit of reporting accuracy.
Section B Summary: Platforms must file an annual return by 31 January with a defined dataset for each reportable seller, notify sellers by the same deadline, and manage personal data lawfully and securely. Evidence of notifications, data quality controls, and remediation is integral to demonstrating compliance.
Section C: What Does This Mean for Businesses?
1. Impact on SMEs using digital platforms
For SMEs, digital platforms are often the primary sales or service channel. The new regime means SMEs must provide accurate, verifiable information to continue trading. Failure or delay in supplying required data could result in:
- Suspension of platform accounts until verification is complete
- Delayed or withheld payments from platforms
- Additional HMRC scrutiny where discrepancies exist between platform reports and self-assessment filings
SMEs should ensure that they have essential documents readily available, including proof of identity, tax references (UTR, VAT, or NINO), and valid bank account details. SMEs operating cross-border must also determine their tax residency status accurately to avoid misreporting.
2. Obligations for platform operators
For platform operators, the obligations are extensive. They must design, implement, and maintain due diligence and reporting systems that can handle potentially large and complex seller populations. Practical measures include:
- Building or procuring compliance technology capable of capturing, validating, and storing seller data
- Hiring or training staff with specialist knowledge of tax transparency and data protection
- Updating onboarding flows and user agreements to include data collection and verification requirements
- Maintaining remediation pathways for incomplete or unverifiable sellers
Large operators will need scalable processes to deal with thousands of sellers, while smaller operators must still ensure proportionate but compliant systems are in place despite limited resources.
3. Practical steps for compliance
HMRC’s guidance and the Regulations expect operators to take proactive steps, including:
- Mapping the seller base: Categorise sellers into reportable, excluded, or non-reportable
- Updating onboarding: Integrate data collection and verification into signup workflows
- Retrofitting compliance: Collect and verify information for legacy sellers before deadlines
- Establishing reporting workflows: Build or align systems capable of generating reports in HMRC’s schema
- Training staff: Provide clear policies and technical training on seller due diligence
By preparing early, operators can reduce the risk of operational disruption and avoid both HMRC penalties and strained relationships with their seller base.
Section C Summary: SMEs must engage with these rules to preserve trading continuity, while platform operators carry the burden of building and maintaining compliant systems. Early action, systematised processes, and internal training are critical to meeting HMRC’s requirements and avoiding penalties.
Section D: Preparing for Future HMRC Compliance
1. Anticipating further HMRC updates
HMRC has acknowledged that further guidance and clarifications may be issued as practical issues arise. Operators should monitor HMRC updates and be prepared to adjust their systems quickly. In addition, international alignment may evolve as the OECD expands global standards for digital economy taxation. Platforms with global reach must anticipate changes in multiple jurisdictions and ensure interoperability of their compliance systems.
2. Managing cross-border sellers
Many platforms have cross-border seller populations, requiring careful management of residency and property reporting. HMRC’s rules extend to:
- UK resident sellers, regardless of where the platform is headquartered
- Rental of UK immovable property, even by non-UK resident sellers
Challenges for operators include verifying tax residency, preventing duplicate reporting across jurisdictions, and adapting to DAC7 information exchanges between tax authorities. Scalable processes, reliable residency checks, and harmonised data collection are vital for cross-border compliance.
3. Building long-term compliance strategies
Compliance cannot be treated as a one-off exercise. Platforms should embed DAC7 compliance into broader risk and governance frameworks by:
- Investing in automated tools that integrate with onboarding and account management
- Implementing regular internal audits of due diligence and reporting accuracy
- Maintaining strong data governance, including access controls and breach response plans
- Documenting compliance decisions to provide an audit trail for HMRC review
These measures will not only meet current obligations but also position operators to respond efficiently to future changes in tax transparency requirements.
Section D Summary: The compliance environment for digital platforms is dynamic. Operators should anticipate ongoing HMRC updates, address cross-border seller complexities, and embed compliance into long-term business strategy. Proactive investment in systems and governance will help sustain compliance and protect platform integrity.
FAQs
Which digital platforms are covered by HMRC rules?
HMRC’s rules apply to reporting platform operators that facilitate the sale of goods or services in return for payment. This includes online marketplaces, ride-hailing and delivery apps, and short-term accommodation booking platforms. Both UK-based platforms and non-UK platforms with UK sellers or UK property rentals fall in scope under the Regulations.
What seller information must be collected?
Operators must collect full legal name, primary address, date of birth (for individuals), registration details (for entities), tax identification numbers, country of residence, bank account details, and, for property rentals, details of the property.
How often must seller data be verified?
Verification is required when information is first collected and must be completed by 31 January following the end of the reportable period. Operators should also re-verify if data changes or discrepancies arise.
What are the penalties for not complying?
HMRC can impose a fixed penalty of £300 per failure, daily penalties of up to £60 for continuing breaches, and higher penalties for deliberate inaccuracies or concealment. Non-compliance also risks HMRC enforcement action and reputational damage.
Do SMEs selling on platforms need to take action?
Yes. SMEs must provide accurate and verifiable data to continue using platforms. Failure to do so could result in account suspension, withheld payments, or HMRC scrutiny of tax returns.
Conclusion
HMRC’s guidance for digital platform operators represents a major step in the UK’s implementation of international tax transparency standards. Operators are now legally responsible for collecting, verifying, and reporting seller information under The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023, aligned with the OECD’s DAC7 framework.
For operators, this means building robust compliance systems, updating onboarding processes, and training staff to meet due diligence, verification, and reporting requirements. For SMEs and individual sellers, it means providing accurate data on time to avoid account suspension and tax authority scrutiny.
The first reporting deadline of 31 January 2025 set the tone for ongoing annual compliance. Penalties are significant, and HMRC will expect platforms to demonstrate proactive governance, record-keeping, and remediation processes. Compliance must be embedded into business operations as an ongoing obligation, not a once-a-year task.
In summary: Platforms should act early, invest in scalable compliance solutions, and integrate DAC7 reporting into broader risk management. This approach reduces regulatory risk, maintains seller trust, and ensures alignment with both UK and international tax transparency standards.
Glossary
| Term | Definition |
|---|---|
| DAC7 | The OECD’s Directive on Administrative Cooperation (Model Rules), setting global standards for reporting by digital platform operators. |
| Digital Platform | An online marketplace, app, or website that facilitates sales of goods or services in return for payment. |
| Due Diligence | The process of collecting and verifying seller information such as identity, tax status, and financial details. |
| Verification | The validation of seller information using official documents, registers, or electronic tools, completed by 31 January following the reporting period. |
| Reporting Obligations | The annual requirement for platform operators to provide HMRC with seller identity, residency, and income information. |
| Reportable Seller | A seller that meets the criteria under the Regulations, excluding entities such as government bodies, listed companies, and small occasional sellers below thresholds. |
Useful Links
| Resource | Link |
|---|---|
| HMRC – Reporting rules for digital platforms | https://www.gov.uk/guidance/reporting-rules-for-digital-platforms |
| OECD – DAC7 framework | https://www.oecd.org/tax/exchange-of-tax-information/ |
| Taxoo – National Insurance guide | https://www.taxoo.co.uk/national-insurance/ |
Author
Gill Laing is a qualified Legal Researcher & Analyst with niche specialisms in Law, Tax, Human Resources, Immigration & Employment Law.
Gill is a Multiple Business Owner and the Managing Director of Prof Services Limited - a Marketing & Content Agency for the Professional Services Sector.
