HMRC Card Sales Reporting Rules 2028: What Acquirers, PayFacs and Merchants Need to Know

New UK regulations will change how merchant acquirers and certain payment facilitators report card sales information to HM Revenue & Customs (HMRC).

The Data-gathering (Ongoing Data: Interest and Payment Card Transactions) Regulations 2026 were laid before Parliament on 3 November 2026.

The regulations introduce ongoing reporting requirements, more frequent data submissions and additional obligations relating to merchant identification and information verification.

For payment providers, this creates operational requirements around data collection, reporting and compliance. For UK merchants, it may mean being asked to confirm information already associated with their merchant account.

What Are the New HMRC Card Sales Reporting Rules?

HMRC already receives card-sales information from certain acquiring organisations under existing information-gathering powers.

The new regulations modernise this process by moving to standing reporting obligations for in-scope organisations, rather than relying on individual information notices.

The main changes include:

• Monthly reporting of relevant card-sales data.
• Standardised electronic reporting requirements.
• Additional collection of merchant tax identifiers.
• Verification of information supplied by merchants.
• Advance notification to HMRC by in-scope providers.
• Record-keeping and due diligence requirements.
• Penalties for certain reporting and compliance failures.

HMRC intends to use more accurate and timely data to match card-sales activity with taxpayer records, improve tax administration and identify discrepancies requiring further investigation.

Which Acquirers, Payment Facilitators and PSPs Are Affected?

The reporting requirements apply to organisations meeting the definition of a relevant merchant acquirer under the legislation.

Broadly, this includes qualifying merchant-acquiring businesses with the relevant UK corporation-tax connection. The legal definition and the activities undertaken by the entity determine whether it falls within scope.

Payment facilitators (PayFacs) may also be affected, depending on their operating model, contractual arrangements and role in settling card transactions.

However, not every organisation describing itself as a payment service provider, payment gateway or PayFac necessarily has the same reporting obligation.

Businesses wanting to understand these different roles can read our guides to payment facilitators and ISOs, PSPs and merchant acquirers.

What Information Will Acquirers Report to HMRC?

Schedule 4 of the regulations identifies the information relevant merchant acquirers must provide for reportable retailers.

The requirements apply to relevant retailers with a UK address to whom the acquirer has been contractually obliged to make settlement payments during the reporting month.

Merchant Identification

• Merchant name and address.
• Telephone number and email address.
• Relevant merchant and account identifiers.
• Trade classification identifiers, where allocated.

Tax Identification Information

• VAT registration number, where applicable.
• Company registration number for companies.
• National Insurance number, or the relevant confirmation, for individuals.

Card Transactions and Settlement

• Specified details of card transactions recorded against the merchant account during the month.
• The currency in which relevant transactions were made.
• Settlement account reference and branch information.
• Relevant acquiring identifiers.

The precise technical submission format is set out separately in HMRC's card sales data schema and associated guidance.

Importantly, the regulations concern payment-card data within their defined scope. They should not be interpreted as requiring every unrelated payment method to be reported under the same card-sales rules.

How Will the Rules Affect Merchant Onboarding and KYB?

One of the most important operational implications concerns the quality of information collected when a merchant account is opened.

Acquirers already undertake Know Your Business (KYB), Know Your Customer (KYC) and merchant underwriting checks.

The HMRC requirements add more specific obligations around collecting and verifying reportable tax identifiers and other information.

Under HMRC's published due diligence guidance, relevant providers are expected to:

• Verify the merchant information required under the reporting rules.
• Check company registration numbers against Companies House information.
• Use appropriate checks for VAT registration numbers.
• Check the format and reliability of National Insurance numbers where relevant.
• Investigate material discrepancies or unreliable information.
• Maintain records of the verification work undertaken.

These requirements could lead providers to update their application forms, onboarding systems, internal compliance procedures and merchant information records.

Our existing guide to merchant account underwriting and company ownership structures explains why the legal entity, trading activity, ownership and settlement arrangements already matter during provider selection.

What Do the New Rules Mean for UK Merchants?

Most merchants will not be responsible for preparing the monthly card-sales return. That responsibility sits with the relevant reporting payment organisation.

However, merchants may be contacted to provide, confirm or correct information associated with their acquiring arrangement.

This can be particularly relevant for businesses with several companies, multiple merchant identification numbers (MIDs), different trading brands or more complex payment flows.

For example, a group operating three UK companies may need to ensure that each acquiring arrangement correctly identifies the entity receiving settlement and the associated reportable details.

These arrangements also matter during underwriting, but the new reporting obligations reinforce the importance of accurate, consistent merchant records.

What About Platforms, Marketplaces and Complex Payment Structures?

Complex payment businesses may need to pay particular attention to which organisation has the relevant contractual and settlement responsibilities.

A marketplace might involve a platform operator, individual sellers, a payment facilitator and an acquiring partner.

The presence of several organisations within the payment chain does not automatically mean that every organisation has a separate monthly reporting obligation.

Instead, the legal structure, contractual arrangements and activities of each entity should be assessed against the regulations.

This is particularly important where:

• A platform processes payments involving multiple sellers.
• A PayFac operates with an underlying acquiring partner.
• Several legal entities operate under one brand.
• Businesses use multiple acquirers or merchant accounts.
• Settlement arrangements differ from the customer-facing trading structure.

For further background, see our Merchant of Record guide and Payment Facilitator overview.

What Should Acquirers and PayFacs Prepare Before 2028?

For organisations within scope, implementation is likely to involve more than adding a new reporting function to an existing system.

Providers should review the full requirements against their operating models and existing merchant data.

Reporting Deadlines, Record Keeping and Compliance

Relevant merchant acquirers must provide monthly ongoing data no later than 21 days after the end of each reportable month.

The regulations also impose requirements relating to verification, notifications and retention of relevant records.

Under Regulation 16, the specified data and associated verification records must generally be preserved for five years after the end of the relevant reporting period.

Failure to comply with certain obligations can result in penalties under the applicable legislative framework.

Reporting organisations should review the regulations and HMRC's published due diligence and notification guidance when planning implementation.

Will These Rules Change Merchant Account Applications?

The regulations do not prescribe a single merchant application process or require every payment provider to adopt identical onboarding systems.

However, where new data requirements apply, payment providers may need to adjust the information they collect and the checks they perform.

Merchants switching providers, opening additional accounts or establishing more complex acquiring arrangements may therefore encounter additional verification requests.

That does not mean a business with a complex ownership structure is unsuitable for acquiring. It means the correct legal entity, relevant identifiers and payment arrangements need to be understood.

Key Takeaways

• New HMRC reporting regulations were laid on 3 November 2026.
• The regulations commence on 1 March 2028, with monthly card-sales reporting from April 2028.
• Relevant acquirers must report within 21 days of each month-end.
• Additional merchant identification and verification requirements apply.
• Payment facilitators and other payment organisations should assess their precise legal and contractual responsibilities.
• Merchants may be asked to confirm company and tax identification information.
• The legislation does not impose a new tax on card transactions.