Yes, HMRC can check your bank account, but it can’t just log in and browse your transactions whenever it fancies. It needs a legal reason, usually an open tax check, and it typically uses a Financial Institution Notice (FIN) to get the data straight from your bank, building society or other financial provider. HMRC doesn’t need a tribunal’s permission or your consent to issue one, though there are safeguards built into the law. Separately, banks and platforms already send HMRC certain data automatically, including interest earned, overseas account details and online selling income, so a lot of what HMRC “sees” arrives before any investigation even starts.
This guide covers exactly how each power works, what typically triggers a check, how HMRC’s Connect system fits in, and what to do if you get a nudge letter.
Can HMRC check your bank account without your permission?
Yes. Since June 2021, HMRC has been able to issue a Financial Institution Notice (FIN) that compels a bank to hand over specified information about a named taxpayer, and it doesn’t need your agreement or a tax tribunal’s approval first. This sits alongside HMRC’s older “third party notice” power, which does normally need tribunal or taxpayer consent.
That said, HMRC can’t fire off a FIN on a whim. The information requested has to be “reasonably required” either to check your tax position or to collect a tax debt, and an authorised, specially trained officer has to approve it. According to GOV.UK’s most recent report on FIN powers, covering 1 April 2024 to 31 March 2025, HMRC issued 1,307 FINs against 316,000 compliance checks that year, so it remains a small fraction of overall activity rather than a routine tool.
What is a Financial Institution Notice, exactly?
A FIN is a legal notice under Schedule 36 of the Finance Act 2008, as amended by section 126 of the Finance Act 2021. It lets an HMRC officer require a bank, building society, or similar institution to provide information or documents about a named taxpayer without going through the First-tier Tribunal.
The safeguards that still apply
The power isn’t unlimited. Under the legislation:
- The information must be reasonably required to check your tax position or collect a tax debt.
- It must not be onerous for the bank to provide (Condition A of the 2021 Act).
- An authorised officer, not just any caseworker, has to sign it off.
- You must normally be told why the notice was issued, unless HMRC persuades the tribunal that telling you would undermine the enquiry.
- If the bank refuses to comply, it can be fined, though it can appeal that penalty.
- You cannot appeal against a FIN yourself.
Why FINs exist at all
The FIN wasn’t invented to snoop on ordinary taxpayers. It came out of an OECD review that found the UK was taking around 12 months on average to respond to international information requests, against a 180-day global standard, largely because the old system needed tribunal or taxpayer sign-off first. GOV.UK’s 2024 to 2025 report shows the average international response time has since fallen to 116 days, and domestic FINs (used to chase UK taxpayers who won’t cooperate with a normal information request) now make up 86.8% of all FINs issued, up from 80.3% the year before.
Only four FINs were used specifically for debt collection in 2024 to 2025, and just one judicial review has ever been brought against a FIN, which the High Court refused.
Does HMRC see your bank account automatically, without asking?
In some respects, yes, well before any FIN is issued. This is the part most people miss.
Interest and account data
UK banks and building societies already report the interest they pay you to HMRC each year, which is one reason your Self Assessment often pre-populates with interest figures you didn’t type in yourself.
The Common Reporting Standard (HMRC financial institution data from abroad)
If you hold a bank, savings or investment account outside the UK, the Common Reporting Standard (CRS) almost certainly applies to you. Over 100 jurisdictions, including most of the places UK residents actually bank, automatically exchange account data with each other’s tax authorities every year. Foreign banks report your account balance, interest, and dividend or sale proceeds to their local tax authority, which passes it to HMRC if you’re UK tax resident.
The OECD’s first full review of CRS also widened the definition of a reportable financial institution from 1 January 2026 to include e-money products and central bank digital currencies, so HMRC’s data pool under CRS is only getting broader.
Digital platforms: does HMRC see eBay, Vinted, Airbnb or OnlyFans income?
Since 1 January 2024, digital platforms including eBay, Vinted, Etsy, Airbnb and gig-economy apps have had to collect and report seller data to HMRC annually, under rules based on the OECD’s Model Rules for Digital Platforms. The first report, covering the 2024 calendar year, went to HMRC by 31 January 2025, and the report covering 2025 income was due by 31 January 2026.
You’re generally excluded from reporting if you sold fewer than 30 items and made under roughly £1,700 (€2,000) in the year, and platforms don’t have to report casual sellers clearing out their own unwanted possessions. But if you’re above that threshold, or you’re providing a service (tutoring, delivery driving, freelance work) rather than selling goods, there’s no minimum threshold at all. This isn’t a new tax; it’s the tax rules that already existed becoming far easier for HMRC to check against.
What is HMRC Connect, and what does it actually do?
Connect is HMRC’s data-matching and risk-scoring system, built with BAE Systems and running since 2010. It cross-references your Self Assessment or company tax return against data pulled from more than 30 sources: bank and building society interest reports, CRS data on overseas accounts, PAYE records, VAT returns, Land Registry, Companies House, council tax records and digital platform reports, among others.
Connect doesn’t decide your tax bill and it isn’t, according to HMRC itself, an AI system in the way that’s often reported; it’s closer to a very large data-matching and pattern-spotting tool. When your return doesn’t line up with what a third party has told HMRC about you, that mismatch gets flagged for a human compliance officer to look at. HMRC has said Connect brought in roughly £4.6bn in extra tax during the 2024/25 year through cases it helped identify.
Important: Connect does not monitor your social media. HMRC has explicitly stated this isn’t part of the Connect system, though social media checks can still happen separately in criminal investigations with proper legal oversight.
What actually triggers an HMRC enquiry?
Most enquiries start because something doesn’t add up between your return and data HMRC already holds, not because of a random spot check. Common triggers include:
- A mismatch flagged by Connect, such as declared income that’s noticeably lower than what a bank, platform or letting agent reported.
- Filing errors or inconsistencies, including numbers that don’t follow expected patterns year to year.
- Persistent late filing or a pattern of amended returns.
- A tip-off, whether from a disgruntled ex-partner, business associate, or a whistleblower.
- Belonging to a group HMRC is actively targeting through a “one-to-many” campaign, such as landlords, crypto holders, or online sellers.
- Sudden, unexplained wealth relative to declared income, such as a large property purchase with no obvious funding source.
Being self-employed or a small business owner doesn’t automatically raise your risk, but HMRC does usually look at business bank accounts before personal ones, and it’s more likely to widen a check into your personal account if business records look incomplete or if you mix business and personal transactions through the same account, which many sole traders do without thinking twice about it.
What’s a nudge letter, and what should you do if you get one?
A nudge letter, which HMRC officially calls a “one-to-many” letter, is a standard letter sent to a large group of taxpayers on a particular theme, such as rental income, cryptoassets, or dividends. It’s not a formal enquiry and it isn’t proof you’ve done anything wrong; it’s HMRC flagging that its data suggests you might need to check your position.
Many nudge letters include a Certificate of Tax Position. Do not sign and return this without checking your figures carefully first. It’s a legally binding statement, and ticking the box to say your affairs are up to date when they aren’t can turn an honest mistake into something HMRC treats as deliberate fraud. There’s no legal requirement to complete the certificate at all.
Sensible steps if you receive one
- Read it carefully and work out which campaign it relates to.
- Review your tax affairs against what the letter is asking about, ideally with an accountant if the numbers are unclear.
- Respond within the deadline given, usually around 30 days, even if you conclude no disclosure is needed. Explain why in writing.
- If tax is owed, use the relevant disclosure route, such as the Let Property Campaign for rental income or the Digital Disclosure Service more generally, rather than waiting for HMRC to open a formal enquiry.
- Don’t ignore it. Ignoring a nudge letter doesn’t make the underlying data go away, and it materially increases the chance of a full enquiry with higher penalties, because a disclosure made after you’ve been prompted is treated less favourably than one you volunteer first.
Can HMRC take money directly from your bank account?
This is a separate power from checking your account, and it’s more restrictive. HMRC can use Direct Recovery of Debts to take money straight from your account, but only where you owe at least £1,000 in tax or tax credit debt, HMRC has contacted you multiple times about it, and it’s satisfied you have the means to pay. HMRC must leave a minimum amount across your accounts (guidance puts this at £5,000 in aggregate) to cover essential living costs, and there are further safeguards, including a 30-day window to object before funds are taken. This is a different legal power from a FIN and is reserved for confirmed, unpaid debts rather than for gathering information.
FAQs
Does HMRC see your bank account by default?
No. HMRC doesn’t have standing access to browse your bank account. It receives specific automated data, such as interest paid and, for overseas accounts, CRS reports, and it can request further specific information through a Financial Institution Notice when it has a legal reason to check your tax position or collect a debt.
What is a Financial Institution Notice?
A Financial Institution Notice (FIN) is a legal notice, introduced in June 2021 under the Finance Act 2021, that lets an authorised HMRC officer require a bank or similar institution to hand over specified information about a named taxpayer. Unlike older third-party notices, it doesn’t need tribunal approval or your consent, though several legal safeguards still apply.
Can I appeal against a Financial Institution Notice?
No, you cannot appeal a FIN directly. The financial institution that receives the notice can appeal against a penalty if it’s charged for non-compliance, but the taxpayer named in the notice has no direct right of appeal against the notice itself.
How does HMRC find out about undeclared income?
Mostly through data it already holds: bank interest reports, CRS data on overseas accounts, digital platform reports from sites like eBay and Airbnb, Land Registry records, and cross-checks run through the Connect system. A mismatch between what you declared and what a third party reported about you is the most common trigger for a check.
What does HMRC’s Connect system actually do?
Connect is a data-matching tool that cross-references your tax return against more than 30 external data sources, including banks, Land Registry, Companies House and digital platforms, to flag discrepancies for a human officer to review. It doesn’t make tax decisions itself; it identifies patterns that might warrant a closer look.
Is a nudge letter the same as a tax investigation?
No. A nudge letter is a general prompt sent to a group of taxpayers HMRC thinks might need to check a particular area, based on data it holds. It’s not a formal enquiry, but ignoring one significantly increases the chance that a formal enquiry will follow, usually with higher penalties than if you’d corrected things voluntarily.
Can HMRC check my personal account if I run a business?
Yes, but it usually starts with your business account. HMRC typically only extends a check to your personal account if the business records raise questions, income appears to be missing, or you regularly mix personal and business transactions through the same account.
Does selling on Vinted or eBay mean HMRC will investigate me?
Not automatically. Platforms only have to report sellers who cross roughly £1,700 in a calendar year from at least 30 items, and selling your own unwanted possessions generally isn’t taxable trading at all. If you’re above the threshold or running what amounts to a small business through the platform, HMRC will have the data to cross-check against your return, so it’s worth keeping simple records either way.
