The card machine on your counter has always known exactly what you took. From 6 April 2028, so will HMRC, on an automatic feed, every reporting period, without anyone asking.
That is the effect of the draft legislation HMRC published on 20 to 21 July 2026 under a package it calls "Better use of new and improved third-party data" (GOV.UK, 2026). Here is what I actually think, before the detail: the fraud end of the market is finished, and I won't mourn it. The people who need to pay attention are the honest ones, because card takings and declared turnover almost never tie up cleanly, and a mismatch nobody has explained is what generates the letter.
Disclosure up front: I work at Xero. Read this as field notes from someone who uses the platform daily, not a neutral review. It matters here only because clean bookkeeping, on any decent platform, is about to be the difference between a five-minute reply and a three-week panic.
TL;DR: From April 2028, merchant acquirers must report your card takings to HMRC automatically, and HMRC will match that figure to the turnover you declare. Under-declaring becomes impossible. The real risk lands on honest businesses whose card data never reconciles cleanly to their accounts. Start reconciling the acquirer statement to your ledger now.
What did HMRC actually publish, and when does it bite?
Draft legislation, out for technical consultation until 20 August 2026, with a hard start date of 6 April 2028 (GOV.UK, 2026). It uses data-gathering powers in Schedule 23 of the Finance Act 2026.
Two data streams come in. Merchant acquirers and payment facilitators, the firms that process your card payments, must report card-sales data; banks and building societies must report cleaner interest data. Those data-holders must register with HMRC, verify your tax references, and submit the data at a set frequency without HMRC issuing a notice first. HMRC's stated aim is to "match third party data to taxpayer records" and support "digital prompts and nudges". Read plainly: HMRC gets an independent reading of your card takings and lines it up against your return.
This is an old power, newly automated
HMRC has been able to pull card-sales data from merchant acquirers since 1 September 2013, when the Finance Act 2013 added them as a data-holder under Schedule 23 (Pinsent Masons, 2013). Those requests were periodic and reached back up to four years.
So the ability to see your card takings is over a decade old. What changes in 2028 is the mechanism: a notice-based request HMRC had to trigger becomes a standing, automatic feed, pre-populated against your record. That is why I don't buy the "shock new surveillance" framing. HMRC always held the number. From 2028 it holds it in real time and checks it by default.
Why don't my card takings match the turnover in my accounts?
Because a gross card settlement and your declared turnover are two different numbers, even when nobody is doing anything wrong, and this is what trips honest businesses up.
Gross card takings include VAT, which your turnover figure may not. They include tips and service charges that might not be your income at all. They are stated before the acquirer nets off its fees. Refunds and chargebacks land in a different period from the sale, and a sale rung up on 31 December can settle in January. When I reviewed a hospitality client's books last year, the card statement and the sales ledger were out by nine percent for one month, entirely explained by tips and late refunds, and nothing was wrong. The gap is normal. HMRC's clean third-party number will not know that.
Does this mean HMRC is coming for cash businesses?
For the dishonest end, yes: you cannot under-declare a number a third party is independently reporting. The business quietly banking card income and declaring less is out of road from April 2028.
But that is not who I worry about. The tax gap is mostly ordinary error rather than fraud, a point I made in my piece on the £59bn tax gap. The exposure that keeps me up is the straight trader who gets a nudge letter because HMRC's tidy card figure does not obviously tie to the turnover, and nobody has done the reconciliation that explains the gap. Right business, honest return, scary letter, three weeks proving a negative. That is the failure mode worth preventing.
What should you actually do before 2028?
Start reconciling now, so the working already exists when HMRC starts matching. Your duty to declare the right turnover has not changed. What changes is that you now need to reconcile that turnover to the card data on demand.
Every month, tie the acquirer statement, gross settlements, fees, refunds, tips, back to the sales in your ledger, and keep the note that shows how they bridge. This is trivial in a live cloud bookkeeping setup where the bank feed and sales data already sit together, whether that is Xero, QuickBooks or FreeAgent, and painful from a carrier bag of receipts. One question clients always ask is whether there's a deadline. There isn't, just a habit worth building. Do it in 2026 and a 2028 query becomes a routine email.
The economics: a second number changes behaviour more than any penalty
The part a typical accountant won't mention: compliance responds to the probability of being caught far more than to the size of the penalty. Economists have measured it: the tax evasion rate is about 0.3% on income reported by a third party, against roughly 37% on income people report themselves (Kleven et al, Econometrica, 2011).
That 0.3% versus 37% gap is the entire logic of what HMRC just did. Moving card takings from self-reported to third-party-reported does more to change behaviour than any rate rise or bigger fine could, because it lifts the odds of an understatement being spotted from "if HMRC happens to look" to "automatically". ICAEW broadly backs the direction, agreeing better third-party data should improve accuracy (ICAEW, 2025). The scale is why it bites: UK cardholders made 2.15 billion card payments worth £71.7bn in November 2025 alone (UK Finance, 2025).
How does this fit HMRC's bigger direction?
It is the same move, again. HMRC pushed everyone digital, then banned me from automating my way through the Gateway, and is now wiring in automatic third-party feeds. The direction is a tax system where HMRC increasingly already knows the answer and is checking whether yours agrees, which cuts both ways: its own pre-populated figures have been wrong before, so the matched card number is a prompt to reconcile, not gospel. Treat client income as something to reconcile and evidence cleanly and you have nothing to fear. Run on estimates and good faith, and you've been told, two years early, that good faith is about to stop being enough.
Frequently Asked Questions
Is HMRC going to see my card sales data, and when does that start?
Yes. From 6 April 2028, the merchant acquirer or payment facilitator that processes your card payments must report your card-sales data to HMRC automatically, at a set frequency, without HMRC issuing a notice (GOV.UK, 2026). HMRC will match that figure against the turnover you declare. It has been able to request this data since 2013; 2028 turns it into an ongoing automatic feed.
Why don't my card takings match the turnover in my accounts, and is that a problem?
It is normal, as long as you can explain it. Gross card takings include VAT, tips and service charges, and are stated before the acquirer's fees. Refunds, chargebacks and settlement timing push amounts into different periods. HMRC's clean third-party figure won't know why the numbers differ, so you need the reconciliation ready to show how the two bridge.
What should my business do now to prepare for HMRC matching card and bank data?
Reconcile monthly. Tie your acquirer statement, gross settlements, fees, refunds and tips, back to the sales in your ledger, and keep the working. There is no filing deadline and nothing to register for. The goal is that when HMRC starts matching in 2028, the explanation for any gap already exists, turning a potential enquiry into a quick reply.
Does this affect me if I only take a few card payments?
The reporting duty sits with the acquirers, not you, and there is no carve-out for small traders, so if you take card payments through a processor your takings are in scope. The impact scales with how messy your reconciliation is, not how large you are. A sole trader with one card reader and clean monthly bookkeeping has very little to do.
If you take card payments and you're not sure your turnover would reconcile cleanly to what your acquirer reports, get in touch. I'm happy to look at a few months of card statements against your ledger and tell you honestly whether there's a gap worth tidying before 2028, or whether you're already fine.