Can HMRC Check Your Bank Account? Triggers, Notices, and Penalties

Yes, HMRC can check your bank account, but not by logging in and watching it. It uses formal legal notices under Schedule 36 of the Finance Act 2008 to require your bank to hand over account data when there is a legitimate reason to review your tax position. It also receives a steady stream of financial information about you automatically, from UK banks, overseas tax authorities, and online platforms, without ever issuing a request about you specifically.

What HMRC Already Knows Before Any Letter Arrives

HMRC runs a data-matching system called Connect that cross-references information from its own records, other government databases such as the Land Registry and Companies House, banks and financial institutions, international tax data shared under the Common Reporting Standard, and online marketplace and property platforms. When Connect spots a mismatch between what you have reported and what your financial footprint suggests, it generates a risk profile.

That risk profile is usually what prompts HMRC to request bank records directly. The picture is built first; the formal check comes second. If your declared income looks low next to property purchases, overseas account balances, or marketplace sales data, the gap is what gets the file opened.

What Triggers a Bank Account Check

Most investigations are not random, although random checks do happen. Common triggers include incorrect figures on a tax return, noticeable drops in reported income from one year to the next, working in an industry with high levels of cash transactions, and filing returns late on a regular basis. Tips from informants and data from third-party platforms also feed in. If bank activity contradicts what your tax return says, that discrepancy alone can justify HMRC asking your bank for full transaction history.

The Three Notices HMRC Uses

Schedule 36 of the Finance Act 2008 gives HMRC three main routes to your bank records. Each one works slightly differently and carries different safeguards.

Taxpayer Notice

A taxpayer notice goes directly to you, requiring you to produce documents or information relevant to your tax position. HMRC needs the approval of the First-tier Tribunal or a senior HMRC officer before issuing one, unless you agree to it. You then have at least 30 days from the date of the notice to comply.¹

Third-Party Notice

A third-party notice goes to your bank rather than to you. HMRC normally needs tribunal approval, and you are usually sent a copy of the notice along with a summary of why the information is needed. The tribunal can waive the requirement to notify you if doing so might undermine the assessment or collection of tax.² The bank can appeal the notice on the ground that compliance would be unduly onerous, but it cannot refuse because the request is inconvenient.¹

Financial Institution Notice

Since July 2021, HMRC has had an extra power that bypasses both your consent and tribunal approval. A Financial Institution Notice (FIN) requires a bank to hand over account information, and HMRC does not have to tell you first if a tribunal agrees that notification could undermine the investigation. In the year ending March 2025, HMRC issued 1,307 FINs.³

FINs still have limits. The information must be reasonably required to check a known taxpayer’s tax position or collect a debt. An authorised and trained HMRC officer must approve each notice. The officer must also be satisfied that compliance would not be unduly onerous for the financial institution. If a bank is penalised for non-compliance with a FIN, it can appeal that penalty.³

What the Bank Will Hand Over

A valid notice can produce account balances, full transaction histories covering deposits, withdrawals, and transfers, and details identifying you as the account holder. HMRC uses this data to verify whether your declared income matches your actual financial activity, to identify income that was never reported, and to trace money flows connected to a tax liability.⁴

The power is not limited to current accounts. It extends to building society accounts, cash ISAs, and investment accounts held with financial institutions.

Overseas Accounts and Crypto

A UK bank is not the only place HMRC can see. Under the Common Reporting Standard, financial institutions in over 100 participating countries automatically report data on accounts held by non-residents to their local tax authority, which then forwards it to the account holder’s home country. If you hold an account overseas, HMRC receives your name, address, date of birth, tax identification number, account number, year-end balance, and income such as interest, dividends, and proceeds from the sale of investments.⁵ This exchange happens annually, with no investigation needed to trigger it.

Crypto is going the same way. From 1 January 2026, the UK’s implementation of the Cryptoasset Reporting Framework (CARF) requires crypto service providers to collect identifying information from users and report aggregate transaction data to HMRC each year. If you buy, sell, transfer, or exchange crypto through a UK platform, that platform must collect your name, date of birth, address, and National Insurance number or Unique Taxpayer Reference, then report your activity to HMRC.⁶ HMRC already had the power to request crypto exchange data under its existing information notices; CARF simply makes reporting routine.

Can HMRC Take Money Straight From the Account

Checking is one power. Taking is another. Under the Direct Recovery of Debts (DRD) scheme, HMRC can remove money directly from your bank account or cash ISA to settle an established tax debt of £1,000 or more. The power was paused during the COVID-19 pandemic, and HMRC announced in 2025 that it would restart using it.⁷

DRD has strict safeguards. HMRC must always leave at least £5,000 across your accounts. It can only act on debts that have passed the appeal deadline where you have repeatedly ignored contact attempts. Before any funds are held, an HMRC officer must visit you in person. Once a hold is placed, you get a 30-day window to object, and no money is transferred until that period expires. Anyone identified as vulnerable during the face-to-face visit is excluded from DRD entirely.⁷

Penalties for Ignoring a Notice

Ignoring an HMRC information notice carries escalating financial penalties:

An initial penalty of £300 for failing to comply.
A daily penalty of up to £60 for every day the failure continues after the initial penalty has been assessed.
An increased daily penalty of up to £1,000 per day where someone continues to ignore a notice and daily penalties have already been charged.

The daily and increased daily penalties cannot be charged unless the initial £300 penalty has already been assessed, so HMRC moves through the structure in order.⁸ Beyond fixed penalties, HMRC can also charge a tax-related penalty based on the amount of tax it believes you owe. For undeclared offshore income, penalties can reach up to 200% of the tax due depending on the country involved.

Your Right to Appeal

If you receive a taxpayer notice, you can appeal to the First-tier Tribunal within 30 days of receiving it. The appeal must be in writing and sent to the HMRC officer who issued the notice. There is one important exception: you cannot appeal a requirement to hand over statutory records, meaning the records that tax law already requires you to keep, such as VAT records or the documents needed to complete an accurate return.¹ You also cannot appeal a taxpayer notice that has already been approved by the tribunal.

When your bank receives a third-party notice, it can appeal on the ground that compliance would be unduly onerous, within the same 30-day deadline. For FINs, the financial institution can appeal any penalties imposed for non-compliance, though it cannot challenge the notice itself in the same way.³

If Your Account Would Show Something You Haven’t Declared

Coming forward voluntarily almost always produces a better outcome than waiting for HMRC to find it. HMRC offers several disclosure routes, including the Digital Disclosure Service for most domestic taxes and a Contractual Disclosure Facility for cases involving deliberate behaviour. A separate service exists for unpaid tax on cryptoassets.⁹

The reduction is substantial. If you come forward, fully disclose, and pay what you owe within 90 days of HMRC acknowledging your notification, you earn the maximum reduction on any penalty. Where you have taken reasonable care but simply made an error, you may owe no penalty at all. If HMRC gets there first through your bank records, you lose the benefit of voluntary disclosure and face penalties starting at a higher floor.⁹

1
Legislation.gov.uk. Finance Act 2008, Schedule 36
2
GOV.UK. CH24180 – Information and Inspection Powers: Information Notices: Tribunal Approval: Third Party Notice – Disapplying Conditions
3
GOV.UK. Report on HM Revenue and Customs Financial Institution Notice Powers 2024 to 2025
4
Legislation.gov.uk. Finance Act 2008
5
GOV.UK. Automatic Exchange of Information if You Have an Account
6
GOV.UK. Domestic Reporting of UK Resident Cryptoasset Users Under the Cryptoasset Reporting Framework
7
GOV.UK. Issue Briefing: Direct Recovery of Debts
8
GOV.UK. CH26620 – Information and Inspection Powers: Penalties: What Is the Penalty: Overview
9
GOV.UK. Make a Voluntary Disclosure to HMRC