poi_-_slides.pdf

Proof of identity requirements Presented by Nadja Harris (Tax Practitioners Board) and Ken Kua (Australian Taxation Office) What we will cover today Verifying a client’s identity Client verification guidelines Evidence needed Tak...

Proof of identity requirements Presented by Nadja Harris (Tax Practitioners Board) and Ken Kua (Australian Taxation Office) What we will cover today Verifying a client’s identity Client verification guidelines Evidence needed Taking reasonable care Document verification checks ATO verification methods Identifying discrepancies Q&A Access the slides and resource document: tpb.gov.au/webinar-resources-hub 2 Meet your presenters  Nadja Harris  Ken Kua  Acting TPB Director  ATO Director  Tax Practitioners Board  Australian Taxation Office Why client verification is important Taking steps to verify your clients’ identity is important to protect: your business the Australian community; and our tax and superannuation systems. This is especially relevant with remote working and reliance on technology as identity theft has increased. 4 Relevant TASA provisions If you fail to take appropriate POI steps you may breach: Code item 1 – acting honestly and with integrity. Code item 7 – ensuring tax agent services are provided competently. Code item 9 – taking reasonable care to ascertain a client’s state of affairs. The fit and proper requirement. Section 50-20 of the TASA – which may be breached if you make statements or lodge documents with the ATO that are false, incorrect or misleading. 5 Minimum requirements – individuals We expect you to undertake POI prior to providing services. For individual clients, you need to verify the client’s full name and either their residential address or date of birth. For individual clients using a representative, you need to verify: both the client’s and their representative’s full names and either their residential addresses or dates of birth; and the authority of the representative to engage you on behalf of the client. 6 Minimum requirements – non-individuals For non-individual clients with an individual representative verify the: Representative’s full name and either their residential address or date of birth. Non-individual client’s full name and either its ABN, ACN or any other details that will help to assess their identity. Authority of the representative to engage on behalf of the non-individual client. 7 Evidence to validate a client’s identity For individual clients and representatives, one primary photo ID will be sufficient. If there is no photo ID, both a primary non- photographic ID and a secondary ID will need to be sighted. 8 Evidence to validate a client’s identity Primary non-photographic ID will include a: birth or citizenship certificate pensioner or health care card Secondary IDs could include a: medicare card council rates notice or utilities bill government agency notice a letter from a school for under 18s electoral roll details 9 Evidence to validate an individual representative To verify the authority of individual representatives, use an enduring power of attorney or a letter of authority. To verify a parental or guardianship relationship, you can sight a: birth certificate adoption paper court order letter of authority; or signed doctor’s letter. 10 Evidence to validate a non-individual representative To verify the authority of individual representatives to act for a non-individual clients use a: certificate of incorporation of a company current ASIC company extract identifying the individual representative as a public officer trust deed; or partnership agreement. 11 Document verification checks When sighting documents ensure the photo matches the details of the client and/or their representative. Make sure the name, address and date of birth all match the information provided. Where you have followed ATO guidance, you should generally meet our requirements too. 12 Electronic and remote verification We strongly recommend you don’t use email for communicating sensitive information, unless you use an encrypted or password protected attachment. Use secure websites, secure online mailboxes or secure messaging. When engaging remotely use webcam or videoconferencing to sight documents – record a note of the checks done. In circumstances where you engage with clients online and without a visual medium, refer to the ATO’s requirements. 13 Identifying discrepancies If you identify discrepancies, you should: ask additional questions ask for documentation or evidence; or see if you can independently verify the information. If you are still unable to verify or are not satisfied, you should decline the engagement. You should also consider notifying us or other relevant authorities. 14 Clients without conventional identity documents Take a flexible approach if a client doesn’t have the standard identification documents, for example if they: come from remote areas have documents that have been destroyed came to Australia as refugees; or have identity documents that have recently expired. Maintain records outlining the client’s circumstances and details of the steps you have taken. 15 Well-established clients Assess the need to conduct POI checks on well-established clients by considering: The extent of your relationship with the client. Is a change in details or an amendment being requested? Has there been a change in circumstances? Are there discrepancies in their identity or other affairs? 16 Record keeping We do not require you to keep copies or originals of IDs. We do require a record for POI checks done, including: Date and time the checks were done. Type of IDs sighted. How the documents were sighted – in person or electronically. Who performed the checks. Confirmation that the IDs were clear. 17 Consequences for failing to comply Termination Suspension Order Written caution 18 Case study 1 A tax agent, engaged a client online without undertaking POI checks. After lodging the client’s tax return, the ATO contacted the agent advising the identity of the taxpayer his client claimed to be had been compromised. The agent continued to lodge tax returns on the taxpayer’s behalf. They breached: Code item 1 – honesty and integrity. Code item 7 – provide services competently. We suspended their registration for six months and issued orders. 19 Case study 2 Mr Kim, a tax agent was asked to prepare 79 income tax returns based on information provided by representatives he had not met. The documents were false and had resulted from identity theft. Many of the returns lodged included irregular claims which Mr Kim should have identified. It was found that he breached multiple Code items and subsection 50-20 of the TASA. The TPB terminated his registration imposing a three-year ban on reapplying. The Federal Court also ordered him to pay $4,000 in addition to the TPB’s costs for contravening section 50-20 158 times. 20 AUSTRALIAN TAXATION OFFICE ATO – Strengthening client verification guidelines The guidelines are intended for registered tax and BAS agents using online services for agents or practitioner lodgment services through software. It outlines how you undertake client identity verification. In following this guideline, you will also be meeting the requirements prescribed by the TPB. 22 Reasonable care You should apply reasonable care when applying the minimum standards. In some circumstances you may need to go beyond what the guidelines prescribe. Whilst undertaking client verification checks: do not confirm or deny specific information do not give the client any private information do not share or confirm pre-fill information. 23 ATO verification methods Visual Source ATO Source Document Verification Service (DVS) Visually checking a client’s Comparing data provided by the identification document. client against data on ATO Comparing a client’s details on systems. government issued identity Suitable when you are interacting documents against details held by with the client in person or by Suitable for in person (including a DVS provider. video. video) interactions, remote interactions and digital interactions Suitable for in-person (including For most clients, a visual check of through software (for example video) and remote interactions. a drivers licence will be all that is online customer portals). needed. Can be used to prove the identity Cannot be used to prove the of an individual representative of Can be used to prove the identity identity of an individual your client. of an individual representative of representative of your client unless your client. the authorised representative is also your client. Note: You must verify two separate proof of identity documents using one or a combination of the above methods. Exception is when a primary photographic proof of identity document can be verified using the visual method i.e. drivers licence. 24  Using a combination of methods Combinations Two separate proof of identity documents Visual + Verify at minimum two visual identity documents Visual Visual Visually verify one original non-photographic identity document or secondary identity document + and Source ATO Verify at minimum two pieces of information verified using Source ATO Visual Visually verify one original non-photographic identity document or secondary identity document + and Source DVS Name and DOB or address on a primary or secondary document verified through DVS Source ATO Verify at minimum two pieces of information verified using Source ATO + and Source DVS Name and DOB or address on a primary or secondary document verified through DVS 25 Visual method Ask for your client’s name, TFN or ABN along with their Step 1 address or DOB. Sight client’s identity document ensuring photos match the Step 2 person and details on documents match those given by your client. Obtain written or electronic authority from the client to act Step 3 on their behalf and link them to client record using their TFN and DOB or ABN and name. Once linked confirm your client’s name, TFN or ABN, Step 4 address or DOB matches ATO records. 26 Source ATO method Obtain written or electronic authority from the client to act Step 1 on their behalf and link them to client record using their TFN and DOB or ABN and name. Once linked, verify the name your client gave matches the Step 2 name on ATO systems. Verify at minimum two further pieces of information against Step 3 ATO systems. You can only use information listed in the guidelines e.g. bank account details, ATO account details. 27 Source DVS Step 1 Begin by asking your client for their name and DOB or address. Access via your DVS provider and verify the client’s name and DOB or address against two separate government identity Step 2 documents (at least one must be a primary identification document). Note: You will need to have an arrangement with an appropriate provider to use this method. 28 Relationship verification (individuals and entities) Verify the identity of the representative using either Visual or Source DVS methods. Step 1 Source ATO method can only be used if the representative is also your client. Verify that the authorised relationship exists using one or more of the evidence prescribed by the TPB. You can also verify the authorised relationship by looking at the authorised Step 2 associates/contacts listed on the ATO individual client record in which you are authorised to act on behalf of. You can only access the client’s record after verifying the identity of the authorised representative. 29 Online agents Online agents who provide services through a web, cloud/software-based customer portal must adopt stronger and more stringent client verification processes. The verification methods must meet the following: Ensure that client details match ATO records (full name, TFN, DOB). Verify two additional pieces of information using a combination of verification methods (visual, source ATO or Source DVS). Contact the Digital Partnership Office for further advice on security requirements for Digital Service Providers 30 Potential fraud Do not confirm specific incorrect Do not give the client any private information or provide correct information. information. Importantly do not share or Instead ask for additional confirm pre-fill information. information to verify their identity. In the event you suspect a If you used Source ATO method breach or identity theft, contact and suspect potential fraud, our Client Identity Support Centre delink the client immediately and on 1800 467 033. contact us. 31 Questions  Stay in touch with the TPB tpb.gov.au facebook.com/TPB.gov tpb.gov.au/contact linkedin.com/tax-practitioners-board 1300 362 829 twitter.com/TPB_gov_au (Mon-Fri 9am-5pm AEDT) youtube.com/TPBgov  Stay in touch with the ATO ato.gov.au facebook.com/atogovau ato.gov.au/About-ATO/Contact-us/ twitter.com/ato_gov_au 13 28 66 youtube.com/user/AusTaxOffice (Mon-Fri 8am-6pm AEST) (Sat 10am-2pm AEST) linkedin.com/company/ 1800 806 218 Australian-taxation-office Natural Disaster hotline 34