Financial Institution Notices & HMRC’s Five-Type Information Notice Framework

Schedule 36 of the Finance Act 2008 is the primary source of HMRC’s civil information-gathering powers. Most practitioners know the basic taxpayer notice and third-party notice, but the framework has five distinct types, each with different approval requirements, different scope and crucially different appeal rights. The Finance Act 2021 added the Financial Institution Notice (FIN), which allows HMRC to demand bank records from financial institutions without Tribunal approval or taxpayer consent. The Finance Act 2024 then added further employer reporting obligations. This guide analyses the full five-type framework and the implications for advisers.

The Schedule 36 Framework Overview

Schedule 36 to the Finance Act 2008 (FA 2008) is the principal civil information-gathering code for HMRC in England, Wales and Northern Ireland (with equivalent provisions for Scotland). It empowers HMRC to require the production of information and documents to check a person’s tax position. The Schedule was extensively amended by the Finance Act 2021 (which added Financial Institution Notices) and by the Finance Act 2024 (which expanded employer and self-assessment reporting requirements). We analysed the FA 2024 changes in our guide on HMRC information powers FA 2024.

Schedule 36 currently provides for five distinct types of information notice, each serving a different purpose and carrying different procedural safeguards. The critical variables between them are: who is served with the notice; whether Tribunal approval is required before HMRC can issue it; and whether the recipient can appeal against it. Understanding these differences is essential for advising a client who has received a notice or whose bank has received one.

Type 1: Taxpayer Notices

A taxpayer notice (Schedule 36, paragraph 1) is issued directly to the taxpayer whose tax position HMRC wishes to check. It requires the taxpayer to provide information and/or documents that HMRC reasonably requires for the purpose of checking that taxpayer’s tax position.

• Tribunal approval: Generally not required. HMRC can issue a taxpayer notice without prior Tribunal approval in most cases.
• Appeal rights: The taxpayer can appeal the notice to the First-tier Tribunal on the grounds that it is unduly onerous, that the information or document is not reasonably required or that the notice infringes a statutory protection (privilege, personal records, etc.).
• Pending appeals: If the taxpayer appeals the notice, compliance is suspended pending the Tribunal’s determination, a significant tactical advantage over the FIN (below).

HMRC often seeks Tribunal approval for taxpayer notices even when not required, because Tribunal approval removes the taxpayer’s right to appeal the notice: the approval itself constitutes the Tribunal’s determination that the information is reasonably required. This is a standard HMRC tactic in cases where it anticipates a challenge.

Type 2: Third-Party Notices

A third-party notice (Schedule 36, paragraph 2) is issued to a third party, an accountant, a financial institution, a counterparty, to obtain information or documents about a named, identified taxpayer. The key difference from a taxpayer notice is that the taxpayer whose affairs are under investigation is not served with the notice; a third party who holds relevant material is.

• Tribunal approval: Generally required, unless the taxpayer consents. HMRC must apply to the Tribunal, which will approve the notice if satisfied that HMRC has reasonable grounds for believing the information is reasonably required. The Tribunal can attach conditions.
• Taxpayer notification: HMRC must normally notify the taxpayer that it is seeking Tribunal approval, although the Tribunal can waive this where notification would prejudice the investigation.
• Appeal rights: Once Tribunal approval has been granted, neither the third party nor the taxpayer can appeal against the notice itself. The Tribunal approval is the safeguard.

Type 3: Financial Institution Notices (Finance Act 2021)

Financial Institution Notices (FINs) were introduced by the Finance Act 2021 (ss 127–130, amending Schedule 36 FA 2008). They represent a significant expansion of HMRC’s information-gathering powers and, uniquely among the five notice types, operate without any Tribunal approval and without any appeal right.

A FIN is issued directly to a financial institution (broadly, a bank, building society, credit union or other person carrying on a financial services business) and requires the production of information and documents about a named, identified taxpayer. No prior Tribunal approval is needed. No notification to the taxpayer is required. The financial institution cannot appeal and, critically, the taxpayer also has no right of appeal against the FIN.

• Scope: The FIN is limited to checking the tax position of an identified taxpayer or collecting a tax debt. The financial institution must hold the information in the course of business and the information must be “reasonably required.”
• Senior officer authorisation: A FIN must be authorised by a senior HMRC officer (not just any compliance officer) and must be approved by the First-tier Tribunal in the narrow sense that a judicial commissioner must confirm HMRC has reasonable grounds. However, this is an ex parte process with no adversarial hearing.
• No appeal: Unlike third-party notices (where the Tribunal approval is the adversarial safeguard), a FIN operates without any right of appeal by either the financial institution or the taxpayer. The financial institution can apply to the Tribunal to vary or quash a FIN only on limited grounds (that compliance is not reasonably practicable), but this is not the same as a substantive appeal.

Type 4: Identity-Unknown Notices

An identity-unknown notice (Schedule 36, paragraph 5, as amended) is a bulk data-gathering notice issued to a data-holder where HMRC wishes to obtain information about a class or category of person whose individual identities are not yet known. This is how HMRC obtains, for example, information about all UK customers of a particular offshore bank or all users of a particular online platform.

• Tribunal approval: Required. HMRC must obtain Tribunal approval for identity-unknown notices. The Tribunal will approve if satisfied that HMRC has reasonable grounds for suspecting that a class of persons has not complied with tax obligations and the information requested is reasonably required.
• Appeal rights: The data-holder can appeal before giving the information; individuals subsequently identified cannot appeal the original data-gathering.

Identity-unknown notices are how HMRC built much of its offshore data-gathering capability before the Common Reporting Standard automated bulk exchange of information.

Type 5: Identification Notices

An identification notice (Schedule 36, paragraph 5A) is issued to a third party to require them to provide the name, address and/or date of birth of a person or class of persons, where HMRC needs this information in order to check the relevant person’s tax position. It is essentially a preliminary step, used where HMRC knows there is a tax compliance issue but does not yet have enough identifying information to issue a more substantive notice.

• Tribunal approval: Required in most cases.
• Appeal rights: Limited, as with identity-unknown notices.

Approval and Appeal Rights Compared

What HMRC Can and Cannot Demand

The “reasonably required” standard governs all five notice types. HMRC can only demand information and documents that are reasonably required for the purpose stated in the notice. In practice, what this means is:

• Documents in existence: HMRC can only demand documents that exist. It cannot require the creation of new documents or the production of analyses that do not already exist.
• Business records: All books of account, records and documents held in the ordinary course of business are within scope.
• Personal records: HMRC cannot demand certain “personal records” relating to a person’s physical or mental health or personal welfare. These are explicitly excluded by Schedule 36, paragraph 25.
• Old documents: HMRC can generally only require documents for the six years before the notice, unless the notice is given for the purpose of a criminal investigation or checking deliberate under-assessment (where the 20-year window applies).

Legal Professional Privilege and Other Protections

Items subject to legal professional privilege (LPP) are absolutely protected from any information notice. Schedule 36, paragraph 23 expressly excludes LPP items. HMRC cannot override this even with a FIN: a bank cannot be required to disclose legal advice provided to its client by a solicitor, nor can a solicitor be required to produce communications falling within LPP.

Practitioners should also be aware of the “auditor working paper” and “tax adviser” protections. Tax advisers cannot be compelled to produce documents that contain a client’s tax advice or that were created in the course of advising the client, subject to the exception that HMRC can compel the disclosure of accounts, returns and supporting documents that the client has submitted or could be required to submit. The distinction is between advice documents (protected) and accounting and factual records (not protected). We analyse these protections in detail in our guide on legal professional privilege in HMRC investigations.

Penalties for Non-Compliance

Schedule 36 sets out a penalty regime for failure to comply with information notices without reasonable excuse:

• Initial penalty: £300 fixed penalty (paragraph 39);
• Daily penalties: Up to £60 per day for continuing failure after the initial penalty (paragraph 40);
• Tax-related penalties: Where the failure continues after a determination, a further tax-related penalty can be imposed of up to the tax at stake, designed to remove any financial incentive to withhold information;
• Inaccurate information: Providing information known to be false or misleading carries a penalty of up to £3,000 (paragraph 40A).

We cover these in more detail in our resource on penalties for non-compliance with HMRC notices.

Finance Act 2024: Expanded Data Gathering

The Finance Act 2024, analysed in our guide on HMRC information powers FA 2024, introduced new data requirements from 2025–26 that operate alongside Schedule 36. Employers are required to report employee hours paid through PAYE. Self-employed individuals and company directors face additional reporting requirements on dividend income and trading period data. These requirements expand the data flowing to HMRC’s Connect system and increase the volume of information available to compliance officers before any formal notice is issued.

Practitioner Strategy

Identify the Notice Type First

When a client receives or reports a notice, the first question is: which of the five types is this? The type determines whether there are appeal rights, who received the notice and what Tribunal approval (if any) was obtained. A notice served on a financial institution without Tribunal approval and marked as a “Financial Institution Notice” is a FIN, no appeal is available. A notice served directly on the taxpayer without prior Tribunal approval is a taxpayer notice, an appeal is available.

Challenge Taxpayer Notices Promptly

For taxpayer notices, the appeal suspends compliance pending the Tribunal’s determination. Act quickly: there is a 30-day window to appeal a taxpayer notice. Challenge notice on grounds that information is not reasonably required, that the notice is unduly onerous (s7 Schedule 36) or that protected items are included.

Identify Whether Approval Was Obtained for Third-Party Notices

Where a third-party notice has been served on an accountant, business counterparty or other third party, establish whether Tribunal approval was obtained. If not and if the taxpayer did not consent, the notice may be challengeable. Challenge the third party’s compliance if the approval procedure was not followed.

Monitor FINs Through Other Routes

Because FINs cannot be appealed, the only routes for challenging HMRC’s use of a FIN are: (a) judicial review if HMRC acted unlawfully or the preconditions for a FIN were not met; and (b) challenge to any assessment or penalty that results from the FIN on the basis that the information obtained was wrong or misinterpreted. Monitor via Subject Access Requests under UK GDPR to identify whether HMRC has obtained bank data about your client.

Practitioner Checklist

1. Identify the notice type (taxpayer, third-party, FIN, identity-unknown or identification), this dictates approval requirements and appeal rights.
2. For taxpayer notices: consider an appeal within 30 days if any items are unreasonably required or protected. The appeal suspends compliance.
3. For third-party notices: confirm that Tribunal approval was obtained (unless the taxpayer consented). Challenge if not.
4. For FINs: no direct appeal; consider Subject Access Request to monitor what has been obtained; challenge any downstream assessment based on the data.
5. Assert LPP for any advice documents , correspondence with solicitors, legal opinions and any legal-advice communications are absolutely protected regardless of notice type.
6. Assert tax-adviser protection for advice documents (as opposed to the underlying accounts and records).
7. Check the penalty position if a client has failed to comply, is there a reasonable excuse?
8. Note the FA 2024 data-reporting expansion – increased PAYE, dividend and trading data now flows to HMRC automatically, expanding the information available before any Schedule 36 notice is required.

Frequently Asked Questions