How we verify your identity — and why we don't keep your ID

Before a registered tax agent can act for you — look at your ATO records, prepare a return, lodge anything — the law requires the agent to be sure you are who you say you are. This page sets out exactly how SMT Accounting does that, what we record, what we deliberately do not keep, and the authority we hold before we lodge. It is written for clients, and it is the same process a TPB or ATO reviewer would see.

Why this is required

Two sets of rules apply. The Tax Practitioners Board's practice note TPB(GS) 42/2022 — Proof of identity requirements for client verification (issued as Practice Note 5/2022, mandatory since 1 July 2022, renamed a Guidance Statement in April 2026 and last updated July 2026) requires every registered tax and BAS agent to take proof-of-identity steps before providing tax agent services, and on an ongoing basis as appropriate. It is backed by the Code of Professional Conduct in the Tax Agent Services Act 2009 — honesty and integrity (item 1), competence (item 7) and reasonable care to ascertain a client's state of affairs (item 9) — and by the 2024 Code Determination's record-keeping obligation (section 30). Alongside it, the ATO's agent client verification methods set the minimum checks before an agent uses Online services for agents to access a person's tax information; an agent who follows both is treated as meeting the requirements of both agencies. The purpose is practical: identity theft and refund fraud, where someone impersonates a taxpayer to lodge a return and redirect the refund.

Who we verify

• Every new individual client before we add you to our ATO client list or access your records — and each related client separately: spouses, each partner in a partnership, each director of a company, each trustee of a trust.
• The representative of every new non-individual client — the director, public officer, trustee, partner or authorised officer who deals with us on behalf of a company, trust, partnership, SMSF or other entity — together with a check that the entity exists and that the person has authority to act for it.
• Existing clients where we have not previously verified them, where details no longer match the ATO's records, where a new person begins acting on a client's behalf, after a long break in the engagement, or where anything suggests a client's details have been compromised. For long-standing clients the TPB lets us judge whether a fresh check is needed, but requires us to record that assessment — so every client file carries one.
• Anyone instructing us to change bank, address or contact details, which we confirm through a channel we already hold for the client rather than the channel the request arrived on.

How we verify — the methods we use

1. Video call — original documents sighted preferredA short Zoom, Teams or WhatsApp video call. You hold up the original document; we check the photo against you, the name, date of birth and expiry, and that the details match what you gave us and what the ATO holds. Nothing is uploaded and no copy is made.
2. In person — original documents sighted preferredAt our Shepparton North office by appointment, the same checks on the original document.
3. Certified copies through our secure onboarding formWhere you cannot attend by video or in person, you upload copies certified by an authorised person (a Justice of the Peace, solicitor, pharmacist, police officer, CA/CPA/IPA accountant or bank officer) through the encrypted onboarding form — never by email. The TPB strongly recommends copies sent electronically be destroyed once the check is recorded, and that is what we do. An uncertified upload is accepted only as a starting point and is followed by a video call or an ATO data check before we rely on it.
4. ATO data check or the Document Verification ServiceFor an individual client who is already linked to us, the ATO's "Source ATO" method lets us compare details you give us — for example your name plus two items such as a notice of assessment number or bank account held by the ATO — against the ATO's own records. A Document Verification Service check confirms a document is genuine against the issuing agency without us retaining it. The ATO does not allow the Source ATO method to verify an entity's representative unless that person is also our client.

Which documents count

One current primary photographic document is sufficient. Otherwise, one primary non-photographic document plus one secondary document.

Documents must be originals or certified copies, current, clear and legible, and consistent with each other — we check that the photo matches you and that the name, address and date of birth agree across documents and with what you have told us. If a name differs (marriage, change of name) we also sight the linking certificate.

Companies, trusts, partnerships and SMSFs

An entity cannot show us a driver's licence, so verification has two parts:

1. The person. The director, public officer, trustee, partner or other authorised officer dealing with us is verified as an individual using the methods above.
2. The entity and the authority. We confirm the entity exists and that this person is entitled to act for it:
   • Company — ASIC current company extract showing the person as a director or secretary; ABN record; director identification number held.
   • Trust — the trust deed (and any variation) naming the trustee; where the trustee is a company, the ASIC extract for that company; ABN and TFN records.
   • Partnership — the partnership agreement, or the ABN record listing the partners.
   • SMSF — the trust deed and the fund's details on Super Fund Lookup; each trustee or director of the corporate trustee is a representative.

Since 13 November 2023 every entity with an ABN other than a sole trader must also nominate SMT Accounting as its agent in ATO Online services for business (client-to-agent linking) before we can be added; the nomination lasts 28 days. Only a person already authorised in the ATO's systems for that entity can do this, which is a useful additional check — although both the ATO and the TPB are clear that linking does not replace identity verification. Our step-by-step guide is at nominate your tax agent.

What we record — and what we don't keep

For every verification we record, in the client's file:

• the date and time;
• the method used (video, in person, secure upload with ATO match, certified copies, ATO records or DVS);
• the type of document sighted and whether it was an original or a certified copy — for example "Victorian driver's licence (original), current" — but not the document itself and not its full number (at most the last few digits);
• that the documents were clear and legible, identified the client and gave no reason for doubt;
• for entities, the authority evidence checked (ASIC extract, trust deed, partnership agreement);
• the name and title of the person in the practice who carried out the check, and any notes (for example, a name difference explained by a marriage certificate, or our assessment that a long-standing client did not need re-verification and why).

This record is kept for at least five years after the engagement ends, as the TPB requires, and is what a reviewer would be shown.

We do not keep copies of identity documents. In the TPB's words, it "does not require or recommend" that practitioners retain copies or originals of identification documents, because holding them "may increase the risk of registered tax practitioners being targeted by criminals undertaking identity theft"; the ATO says the same. Images of passports and licences serve no purpose once the check is recorded. Where a client uploads a copy through the onboarding form, it is stored encrypted in a private area outside the web server's public folders, used only for the verification, deleted automatically when the verification is recorded, and deleted in any case 30 days after upload. ID images are never appended to engagement letters or any document we produce, and are never forwarded.

The authority we hold before we lodge

The per-lodgment declaration is a legal requirement: before an agent lodges any return, activity statement or other approved form, the client must declare in writing that the information is true and correct and that the agent is authorised to lodge it. A bulk or standing declaration is not enough, and neither is a phone call. An email reply is acceptable and does not need a scanned signature. For a company the public officer signs; for a trust or SMSF a trustee or a director of the trustee company; for a partnership a partner. We obtain it before each lodgment, keep a copy for five years, and ask you to keep yours. If you have not given a declaration, we have not lodged. An ongoing authority to deal with the ATO on your behalf — which your engagement letter gives us — covers contact and linking, but never replaces the per-lodgment declaration.

Privacy and the TFN

Everything collected for verification is personal information handled under the Privacy Act 1988, the Australian Privacy Principles and, for tax file numbers, the Privacy (Tax File Number) Rule 2015. We collect your TFN only because taxation law requires it to act for you; it is stored in the same private area as the rest of your onboarding details, never sent by email, and never shown in full on any document we produce. If we ever became aware of a data breach likely to cause you serious harm we would notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires. Our privacy policy has the detail.

What you can do

• Use the secure onboarding form or a video call — never email — for anything that identifies you.
• Set up a strong myGovID / myID and keep your myGov sign-in details private; no accountant needs them.
• Tell us promptly if you change your name, address, bank account or phone — and expect us to confirm the change with you.
• If something looks wrong — an ATO letter about a return you didn't lodge, a refund you weren't expecting — call us and the ATO's Client Identity Support Centre on 1800 467 033.

Sources

• Tax Practitioners Board — TPB(GS) 42/2022 Proof of identity requirements for client verification (PDF) and the client verification process summary
• Tax Practitioners Board — Obligation to keep proper client records and Confidentiality of client information
• Australian Taxation Office — Agent client verification methods
• Australian Taxation Office — Does client-to-agent linking apply to you and Client declarations and lodgment online
• Office of the Australian Information Commissioner — Privacy (Tax File Number) Rule 2015 and the Notifiable Data Breaches scheme

This page describes SMT Accounting Pty Ltd's own procedures as at 27-10-2026. It is reviewed when the TPB or ATO guidance changes and at least annually.

Frequently asked questions