Credit and debit card 2015–16 and 2016–17 financial years data matching program protocol

At a glance

The ongoing credit and debit card data matching program is designed to obtain data on credit and debit card payments received by business through their merchant accounts. This protocol covers the 2015–16 and 2016–17 years. From 1 July 2017 providers will be required to report this detail to the ATO as part of the Government’s legislated compliance measure on improving compliance through third party reporting that was announced in the 2013–14 Budget.

Details will be requested from 12 Australian financial institutions annually of all credit and debit card payments received by merchants who hold a merchant facility account. The ATO will match the data provided by reporters against our records to identify businesses that may not be meeting their taxation registration, reporting, lodgment and/or payment obligations. This information will be cross referenced with other data the ATO holds.

This protocol has been prepared to meet requirements of the Office of the Australian Information Commissioner’s Guidelines on Data Matching in Australian Government Administration (2014) (the Guidelines).

Program objectives

The objectives of this data matching program are to:

• Promote voluntary compliance with taxation obligations and increase awareness in the community of the ways the ATO uses data matching to address non-compliance, by publishing this program protocol.
• Assist in building intelligence about businesses including broader risk, trend and strategic analysis.
• Ensure compliance with registration, lodgment, correct reporting and payment of taxation obligations.

How the data will be used

The data will be used to:

• detect unreported income through discrepancy matching
• identify those operating a business but failing to meet their registration, lodgment or payment obligations
• identify liquidated or de-registered businesses that are continuing to trade (phoenix operators)
• identify ‘cash only’ businesses, by exception
• support analytical models to detect high risk activity and cases for administrative action.

Learn more about what we will do before amending a return.

Previous programs

The merchant credit and debit card data has been collected since the 2008–09 financial year. Since 2013–14 the data has been supplemented with specialised payment systems data.

The data collection has promoted awareness in the community of our data matching capabilities. Publication of the data matching protocol has generated some media interest in the past.

The ongoing merchant credit and debit card data has revealed discrepancies between electronic payments received and information declared in businesses' tax returns. These discrepancies are being investigated. Revenue has been raised in relation to income tax and GST from taxpayer audits, voluntary disclosures and lodgments received based on the merchant credit and debit card data. However, due to the broad and diverse use of this data it is difficult to attach a dollar value to the program.

Data related matters

Data matching and user agency

We are the matching agency and the sole user of the complete data set obtained in the course of this data matching program. The data matching program will be conducted on our secure systems in accordance with approved policies and procedures.

In very limited and specific circumstances we may be permitted by law to disclose individual records to other government agencies.

Learn more about our on-disclosure provisions.

Data providers

Data will be obtained from:

• American Express Australia Limited
• Australia and New Zealand Banking Group Limited
• Bank of Queensland Limited
• Bendigo and Adelaide Bank Limited
• First Data Merchant Solutions Australia Pty Ltd (previously BWA Merchant Services Pty Ltd)
• Commonwealth Bank of Australia
• Diners Club Australia
• National Australia Bank Limited
• St George Bank
• Suncorp-Metway Limited
• Tyro Payments Limited
• Westpac Banking Corporation

A principle based approach has been adopted to ensure that inclusion as a source entity is fair and transparent.

Inclusion of data providers in the program is based on the following principles:

• The data owner or its subsidiary operates a business in Australia that is governed by Australian law.
• The data owner provides merchant facilities for its clients and maintains records of electronic payments received by those clients. The data owner provided these facilities for the period in focus.
• Where the client base of a data owner does not present an omitted income risk or the administrative or financial cost of collecting the data exceeds the benefit the data may provide, the data owner may be excluded from the program.

Data elements

We will obtain the following information from the data providers for the 2015–16 and 2016–17 financial years:

Merchant record fields:

• Unique merchant reference number
• Name of primary account owner
• Birth date of primary account owner
• Merchant's legal business and trading names
• Merchant's business and postal addresses
• Merchant’s Australian Business Number or Australian Company Number
• Bank-State-Branch and account number of the merchant's settlement account
• Merchant contact name and phone number
• Merchant business category code and description
• Merchant’s facility start date.

Transaction record fields per merchant – monthly transaction totals:

• Unique merchant reference number
• Monthly credit amounts and counts for each merchant
• Monthly debit amounts and counts for each merchant
• Monthly refund amounts and count for each merchant
• Monthly sale amounts and counts where card was not present
• Y/N cash out included indicator
• Monthly cash out only amounts and counts for each merchant
• Monthly cash out component amounts of a combined purchase with cash out for each merchant

See the full data dictionary.

Number of records

It is estimated that the total number of records obtained annually will be approximately 950,000. It is expected that around 90,000 of those matched will relate to individuals.

Data quality

We expect that the data acquired will be of a high quality as it has been in previous collections. This data is fundamental to effective business operations for merchant acquirers. We have also developed quality assurance processes in conjunction with the data providers to ensure the integrity of the data.

Data will be transformed into a standardised format and validated to ensure that it contains the required data elements prior to loading to our computer systems.

Learn more about:

• How we undertake data matching
• How we protect your personal information
• Our quality assurance framework
• Why we undertake data matching
• The costs and benefits of data matching

Data retention

We are seeking to have the Information Commissioner exercise his discretion and allow the ATO to vary from the data destruction requirements contained in the Guidelines.

The collection of data under this program protocol is expected to start in the second half of the 2016 calendar year.

We are seeking to retain the data for a period of five years from receipt of all verified data files for each relevant financial year. The retention is required for the protection of public revenue.

Current Guidelines allow data to be retained for 12 months. Destroying the data in the timeframes contained in the Guidelines would hinder our ability to protect public revenue because:

• Businesses identified as not meeting their taxation obligations, including being partly or wholly outside the taxation system, may have been operating that way for multiple years. A retention period of five years will enable the ATO to cross reference taxpayer records retrospectively.
• The nature of the discrepancy matching that occurs under this program will be, in some instances, iterative. This includes the data being used to generate lodgment reviews with subsequent lodgments then being compared to the transactional data for accuracy. This process can occur over multiple years.
• It would hinder our ability to conduct long term trend analysis in the fast evolving electronic payments market.

See the submission to the Information Commissioner setting out the basis for seeking the variation to the data destruction guidelines and its impacts on individual privacy.

Public notification of the program

We will notify the public of our intention to undertake this program by:

• publishing a notice in the Federal Register of Legislation – Gazettes in the week commencing 24 October 2016 – view the content of the gazette notice
• publishing this data matching program protocol on our website at www.ato.gov.au/dmprotocols
• advising the data providers they
  • can notify their clients of their participation in this program and providing written materials to assist with this
  • should update their privacy policies to note that personal information is disclosed to us for data matching purposes.
   

Gazette notice content

Commissioner of Taxation

Notice of a data matching program

The Australian Taxation Office (ATO) will continue to acquire annually data relating to credit and debit card payments to merchants. Data will be acquired for the 2015–16 and 2016–17 financial years from the following sources:

• American Express Australia Limited
• Australia and New Zealand Banking Group Limited
• Bank of Queensland Limited
• Bendigo and Adelaide Bank Limited
• First Data Merchant Solutions Australia Pty Ltd (previously BWA Merchant Services Pty Ltd)
• Commonwealth Bank of Australia
• Diners Club Australia
• National Australia Bank Limited
• St George Bank
• Suncorp-Metway Limited
• Tyro Payments Limited
• Westpac Banking Corporation.

The data items that will be obtained are:

• details of merchants with a credit and debit card merchant facility, such as name, address and contact information
• the amount and quantity of the transactions processed.

It is estimated that around 950,000 records will be obtained, including 90,000 matched to individuals.

These records will be electronically matched with ATO data holdings to identify non-compliance with registration, lodgment, reporting and payment obligations under taxation laws.

The objectives are to:

• Ensure compliance with registration, lodgment, correct reporting and payment of taxation obligations.
• Promote voluntary compliance with taxation obligations and increase awareness in the community of the ways the ATO uses data matching to address non-compliance, by publishing this program protocol.
• Assist in building intelligence about businesses including broader risk, trend and strategic analysis.

A document describing this program has been prepared in consultation with the Office of the Australian Information Commissioner. A copy of this document is available at www.ato.gov.au/dmprotocols

Legal matters

Learn more about:

• Our privacy policy
• Making a privacy complaint
• Our lawful role
• Our legal authority to undertake a data matching program

Data Dictionary

Merchant record file

Merchant transactional file

Go back