The envelope is open. The words “Code of Practice 9” or “Contractual Disclosure Facility” are sitting on your kitchen table. Your stomach has dropped. Before you do anything else, read this: the first seven days set the tone for the next eighteen months and the most common mistakes happen in the first 48 hours.
On this page
Step 1: Breathe. Do not reply yet.
The letter feels urgent because the 60-day clock has started, but 60 days is not 60 hours. There is no advantage to responding in the first week and considerable risk in doing so. HMRC has spent months preparing the letter; you are entitled to take a few days to assemble the right team before saying anything.
The single most important early decision is to stop interacting with HMRC directly. From the moment you decide to instruct a specialist, all correspondence flows through your adviser. That includes any phone messages, emails or letters that have already arrived.
What NOT to do this week
In our experience the early-stage mistakes that damage cases most are predictable. Avoid all of the following:
- Do not call HMRC. The inspector will be polite and professional. They will also take a contemporaneous note of everything you say and that note is later evidence on the question of whether your behaviour was deliberate.
- Do not post on online forums. Anonymous tax forums and social media threads are crawled by HMRC’s open-source intelligence team. Even oblique references (“asking for a friend”) have been linked back to live investigations.
- Do not tell a wide circle of family or colleagues. Confide in your spouse and any business co-owner who is materially involved, nobody else. The fewer people who know, the lower the risk of an inadvertent disclosure or rumour reaching a third party HMRC may later interview.
- Do not start “tidying up” records. Altering, destroying or backdating any document at this stage is a separate criminal offence and will be discovered. Leave records exactly as they are.
- Do not move money. Transferring funds offshore, to family members or out of business accounts after receipt of a COP9 letter triggers anti-money-laundering flags and is interpreted by HMRC as concealment.
- Do not file an amended return without advice. A unilateral amendment in the middle of a COP9 process is rarely the right move and can prejudice the disclosure scope.
- Do not assume the letter was sent in error. COP9 letters are not issued speculatively. The Fraud Investigation Service has signed off the case before it leaves HMRC.
The 60-day deadline, reality check
The 60 days runs from the date on the letter, not the date you opened it. If the letter sat for a week on a hall table, you have lost a week. If you were abroad when it arrived, the clock kept running.
Within those 60 days, you must either accept the Contractual Disclosure Facility (signing the Acceptance Letter and submitting an Outline Disclosure) or formally deny that any fraud has occurred. Doing nothing is treated as denial, with the additional inference that you have something to hide.
Practically, this means you have about 50 working days to: instruct a specialist, conduct an initial scoping review, decide which route to take and draft a competent Outline Disclosure. Tight but achievable, provided the first ten days are not wasted.
Quietly gather your records, confidentially
Once you have appointed a specialist, you will be asked to pull together documents. Start a mental list now of where things are kept:
- Personal and business bank statements for the period the letter covers, plus a few years either side
- Credit card statements, including any cards used for business purchases
- Accounting records, ledgers and prior tax returns
- Property purchase documents, mortgage statements, rental income records
- Offshore account statements, foreign property documents and any structures (trusts, foundations, nominee arrangements)
- Investment accounts, crypto wallet exports, broker statements
- Correspondence with previous accountants, scheme promoters or advisers
Do not start handing material to anyone until your specialist is instructed and legal professional privilege (or its tax equivalent through a solicitor-led engagement) is in place. Until that point, anything you send to a third party can in principle be compelled.
What HMRC already knows, probably more than you think
By the time a COP9 letter is issued, HMRC’s Fraud Investigation Service has typically built a profile from multiple data sources:
- Connect , HMRC’s big-data engine cross-references over 30 billion data points, flagging mismatches between declared income and lifestyle, property holdings and bank activity.
- Common Reporting Standard (CRS) , over 100 jurisdictions automatically share data on UK-resident account holders with HMRC. Offshore accounts in “secret” jurisdictions are routinely reported.
- Suspicious Activity Reports (SARs) , banks, accountants and other regulated professionals are legally required to file SARs when they suspect tax evasion or money laundering.
- Land Registry and letting agent data , via the Let Property Campaign data feeds.
- Crypto exchange data , UK exchanges share customer transaction data with HMRC.
- Third-party reports , former spouses, ex-business partners, disgruntled employees and competitors are a common source of intelligence.
The implication is important: under-disclosing is not just unethical, it is strategically unwise. The CDF immunity only covers what you actually disclose. If HMRC later identifies undisclosed deliberate conduct, the contract is void for those matters and prosecution becomes very likely. For a deeper treatment of the underlying procedure, see our pillar guide on Code of Practice 9.
Choosing specialist representation
Your existing accountant may be excellent. They may also be the wrong person to lead a COP9. The procedural rules around CDF, the language HMRC expects in the Outline Disclosure, the penalty negotiation and the strategic decisions about scope are a specialism, not a sideline.
The usual arrangement is that a specialist tax investigations firm takes the lead, working alongside your existing accountant who provides the historic context and bookkeeping continuity. Look for:
- A team that handles COP9 work routinely, not occasionally
- Ex-HMRC investigators on the team, ideally including former Fraud Investigation Service personnel
- A clear written engagement letter, fee estimate and scope
- Willingness to give you an honest, sometimes unwelcome, assessment of your position
- A fixed first-call policy, the initial confidential conversation should be free
Outline Disclosure vs Disclosure Report, what’s the difference?
Many clients confuse the two documents. They are very different in scope and timing.
The Outline Disclosure is a short document, typically 2–5 pages, submitted with the Acceptance Letter within the 60-day window. Its purpose is to set out the “heads of fraud”, i.e. the broad categories of deliberate behaviour being disclosed (for example: “undeclared cash sales in the takeaway business between 2014 and 2023”). It does not require detailed figures, but it must accurately capture the scope.
The Disclosure Report is the detailed forensic document, commonly 50 to 200 pages including appendices, that quantifies the tax loss across every relevant year and tax head. It takes 3–9 months to prepare and is the spine of the eventual settlement. For a detailed breakdown of the CDF process see our CDF guide.
What the next 18 months look like
Most COP9 cases run between 9 and 18 months from acceptance to settlement. A realistic sequence:
- Weeks 1–8: Instruct specialist, scoping review, draft Outline Disclosure, submit Acceptance Letter
- Months 2–4: Opening meeting with HMRC (often attended by your adviser only or with you present but largely silent), records gathering, forensic reconstruction
- Months 4–10: Drafting the Disclosure Report, computing the tax loss, interest and penalty model
- Months 10–14: Submit Disclosure Report; HMRC review and request further information
- Months 14–18: Penalty negotiation, settlement letter, time-to-pay arrangement if required
The opening meeting is rarely the ordeal clients fear. It is structured, formal and your adviser handles almost all of the substantive discussion. The questions are predictable: how the business operates, who handles records, when the conduct began, why. You will be coached on what to say and not say.
Fees: what to expect
Specialist fees for a COP9 vary by complexity. A typical owner-managed business case, single trade, UK-only, 10–15 years of records, falls between £15,000 and £40,000 in professional fees across the whole life of the matter. Complex cases involving offshore structures, multiple entities, marketed avoidance schemes or partner disputes will run higher.
Set against this, the penalty saving from correctly categorised behaviour and well-presented disclosure quality is routinely measured in tens of thousands of pounds, sometimes hundreds. You can model the rough penalty range on our HMRC penalty calculator.
Frequently asked questions
Should I call HMRC straight away after receiving a COP9 letter?
No. Anything you say to the inspector before instructing a specialist becomes part of the record and can be used to characterise your behaviour as deliberate. The correct first step is to engage a specialist adviser who will manage all contact with HMRC on your behalf.
Is 60 days really enough time to respond?
Sixty days is sufficient to make the accept-or-deny decision and submit a competent Outline Disclosure, but only if specialist work begins promptly. The full Disclosure Report itself is prepared later, usually over 3 to 9 months. The 60-day deadline is for the initial response, not for the entire investigation.
Will my existing accountant be able to handle a COP9?
Most general accountants do not handle COP9 investigations regularly. The procedural rules are technical, the penalty negotiation specialised and the consequences of a mishandled disclosure severe. A specialist tax investigation team, often working alongside the existing accountant, is the standard arrangement.
What does a COP9 case typically cost in professional fees?
Fees vary with the complexity, number of years and number of tax heads involved, but a straightforward owner-managed business COP9 typically falls between £15,000 and £40,000 in professional fees across the life of the case. Complex offshore or multi-entity cases run higher. Most specialist firms will provide a written fee estimate after an initial confidential review.