Breach reporting obligations will apply to registered tax practitioners from 1 July 2024. There are two types of breach reporting obligations:  

• Self-reporting (new paras (ba) in section 30-35 TASA), and 
• Peer reporting (new section 30-40 TASA). 

The Tax Practitioners Board (TPB) has released the following draft guidance materials on the Breach reporting obligations: 

• a Draft information sheet (TPB(I) D53/2024)
• a Summary document including flowchart in paragraph 17, and  
• a High-level Decision tree.  

The draft guidance documents explain:

• the breach reporting obligations, including case studies
• when the obligations apply, including when “reasonable grounds to believe” exist
• what constitutes a “significant breach”
• the 30-day timeframe for reporting a significant breach
• the consequences for failure to report. 

Mr de Cure chair of the TPB said: ‘We aim to take a pragmatic and risk-based approach to implementing the additional breach reporting obligations. We welcome feedback on our draft guidance to help shape our final position to ensure the guidance is practical and useful for tax practitioners in helping them understand and meet their obligations.’  

CA ANZ will be making a submission, which is due on 28 May 2024, regarding this draft guidance.  CA ANZ is calling upon members to provide us with feedback on any issues or scenarios that create cause for concern regarding unintended outcomes, or anomalies, or uncertainties on how the obligations would apply in particular circumstances. Please send your feedback to the Tax Team by Friday 17 May 2024. 

When is there an obligation to report? 

The breach reporting measure was inserted into the Tax Agent Services Act 2009 (TASA) by a last minute incorporation into the Treasury Laws Amendment (2023 Measures No. 1) Bill 2023 (the Bill) and did not involve any consultation or explanatory memorandum guidance. 

Tax agents are required to self-report significant Code breaches. They are also required to report significant Code breaches by other tax agents to both the TPB and the other agent’s professional association (if that is reasonably known). In considering what is a Code breach, there will need to be consideration of the proposed changes in draft Tax Agent Services (Code of Professional Conduct) Determination 2023 (yet to be enacted), as well as what is currently in the Code.  

The proposed expanded Code obligations include: 

• Uphold and promote the ethical standards of the tax profession 
  • Uphold and promote the Code 
  • Protect public trust and confidence in integrity of the tax profession and tax system 
  • Work collectively to do this 
• No false or misleading statements to TPB or government agencies 
• Identify and avoid, disclose material conflict of interest re gov agencies 
• Maintain confidentiality in dealings with government (don’t use for gain) 
• Keep proper client records 
• Ensure tax agent services provided on your behalf are provided competently 
• Maintain adequate internal control procedures 
• Keep your clients informed of all relevant matters 

“Significant” is defined as a breach constituted by indictable offences, offences involving dishonesty, or resulting in material loss/damage to another (including the government) or which is otherwise significant considering frequency, impact on ability to provide tax services, or inadequate compliance. 

Much of the draft guidance issued by the TPB explains that common law definitions will be adopted and that there are State laws to consider as well. The draft guidance expects tax agents to use their common sense and judgement to interpret and understand these requirements.  The draft guidance also notes that tax agents may need to gain legal advice to assist them with interpretation and that they will need to carefully document their decision whether to report or not.  

What guidance is included in the draft guidelines? 

• You will be required to report partners or businesses that you are looking to acquire if you have evidence of significant breaches. 
• You are not required to report gossip as it is not substantiated – but if you check and find it is true, then you may need to report. 
• If you are aware that someone else has reported the significant breach, you don’t have to report it, but you do need to document that it has been reported. 
• If there are multiple significant breaches by the one entity, you don’t need to report multiple times but your single report needs to cover all of the multiple breaches. 
• You still need to self-report a significant breach if you have rectified it.  
• The breach reporting obligations are subject to Legal professional privilege (LPP) operating and claimed on behalf of a client which protects the information from disclosure. 

Help ensure that this guidance is practical

CA ANZ will be looking to ensure that the breach reporting guidance adequately addresses the critical interactions between these new reporting obligations and existing aspects of the TASA, such as (i) Code items 9 and 10  the existing Code duties of tax practitioners to take reasonable care in the provision of their taxation services (including the entitlement and requirement to appropriately scope their engagements); and (ii) Code item 6 – the duty not to disclose any information relating to a client’s affairs to a third party without the client’s permission, unless they have a legal duty to do so.  

The guidance must also provide relevant pragmatic guidance on how the important common law privileges of legal professional privilege (LPP) and the privilege against self-incrimination operate in relation to the reporting obligations. 

What would you like to see clarified in this draft guidance?