What
WHAT IS HMRC VERIFY?
HMRC Verify is a DiligenceHub feature that lets you prove, month by month, that the PAYE, National Insurance and VAT you owe HMRC has actually been paid – not just deducted on payslips, but received by HMRC.
It works through a small browser extension. When you log into your own HMRC Business Tax Account and open your PAYE statements or VAT pages, the extension reads the figures HMRC shows you and sends them to DiligenceHub. DiligenceHub compares what HMRC says you were charged with what HMRC says you paid, and records a simple result for each month: Verified or Unverified.
The result appears as a status on your DiligenceHub profile, visible to you and – depending on the settings described below – to the recruiters and other organisations you have authorised a connection to.
Why
WHY DOES THIS EXIST?
Recruiters, end clients and their banks are under growing pressure to show that the umbrella companies in their supply chains are paying their tax. HMRC’s own guidance on payslip fraud makes the point plainly: a correct payslip proves that tax was deducted, not that it was paid over.
Until now the only ways to demonstrate this were screenshots (easy to select or alter) or third-party audits that ask for your HMRC login details. Neither is satisfactory. HMRC does not offer an interface that would let DiligenceHub check for you.
HMRC Verify takes a different approach:
- You stay in control. You log into HMRC yourself, in your own browser. DiligenceHub never sees your Government Gateway user ID or password and cannot log in as you.
- The evidence is taken at source. The figures come straight from the pages HMRC shows you, at the moment you view them, and are stamped with the time and a fingerprint of the page.
- The result is simple. A recruiter does not need to read your accounts; they see Verified or Unverified.
- You decide how much detail others can see. The pass/fail status is one thing; the actual pounds and pence are another, and those are only shared if you choose to allow it – we recommend that you do because many of your competitors will.
For FCSA members it also feeds directly into the FCSA assessment record, so an assessor can see twelve months of payment compliance without asking you for anything.
How
HOW IS THE RESULT WORKED OUT?
PAYE
Each tax month is Verified if the amount HMRC shows as still due is £50 or less. The £50 tolerance exists so that timing differences and rounding never count against you. If the amount due is more than £50 the month is Unverified.
VAT
Each VAT return period is Verified unless HMRC shows an outstanding charge of more than £50 that is past its due date. A charge that is not yet due is not a failure. Periods where HMRC repaid you are Verified.
Payment plans
If HMRC shows that you have a payment plan (Time to Pay) in place, that is flagged for FCSA to review rather than automatically counted for or against you.
FCSA review
FCSA staff can see every result and can override an automated result in either direction, always with a written reason that is kept on record. If you believe a result is wrong, contact FCSA.
WHEN DO I NEED TO DO THIS?
Once a month. HMRC Verify looks for a capture covering the previous calendar month.
- From the 22nd of each month, if nothing has been captured for the previous month, your account owner receives a reminder email.
- Reminders continue daily until the 28th.
- After the 28th, a missing PAYE capture is recorded as a non-submission for that month, and both you and FCSA are notified.
- For VAT, a missed month shows as “VAT check overdue” until you next visit your VAT account.
In practice: open your HMRC Business Tax Account once a month, look at your PAYE annual statement and your VAT payment history, and you are done. Most people do this when they make their monthly PAYE payment.
Set-up
HOW DO I SET IT UP?
Step 1 – Install the extension
- Chrome and Edge: install “DiligenceHub HMRC Verify” from the Chrome Web Store (Edge users first switch on “Allow extensions from other stores” in Edge’s extensions page).
- Safari on a Mac: install from the Mac App Store [coming soon], or from the installer FCSA provides during the pilot, then enable it in Safari’s Extensions settings.
Separate guides for each browser are available from FCSA and your internal technical support team can help you.
Step 2 – Generate a token
Log into your DiligenceHub portal and open the hmrc verify page in your account area. Click “access tokens“. Give it a label such as “Finance laptop” and copy the token – it is shown once only so be careful to copy it to somewhere safe. The page also shows the DiligenceHub web address you will need next.
TIP: Use one token per computer. If a laptop is lost or a member of staff leaves, you can revoke just that token from the same page and the others keep working.
Step 3 – Connect the extension
Click the DiligenceHub icon in your browser toolbar, open Settings, enter the DiligenceHub web address and paste the token, then Save. The popup will show “EPAYE: Pending” and “VAT: Pending”.
Step 4 – Capture
Log into your HMRC Business Tax Account. Open PAYE for employers, then Annual statements. Then open VAT, then Payment history (and What you owe). The extension captures automatically as each page loads; the popup changes to “Captured — Pass” or “Captured — Fail” and your DiligenceHub profile updates within seconds.
WHAT IF I HAVE MORE THAN ONE PAYE SCHEME?
Each PAYE scheme has its own reference and, at HMRC, its own Government Gateway login. Log into each in turn and open its Annual statements page. HMRC Verify records each scheme separately and shows your company’s overall status as the worst of them – one scheme behind means the company is Unverified until it is put right. The number of schemes seen is shown alongside your status.
DiligenceHub cannot know about a scheme it has never seen, so make sure every scheme is captured – if FCSA becomes aware that you operate PAYE Reference that is not being Verified here, we reserve the right to terminate your DiligenceHub account.
data that's captured
WHO CAN SEE WHAT?
You
Everything: your monthly results, the figures behind them, and the full history, on your own DiligenceHub dashboard under “hmrc obligations”.
FCSA
Everything, including the ability to review and override results.
Recruiters, end clients, neutral vendors and banks you are connected to
Only organisations that already hold an access grant to your company on DiligenceHub can see anything at all. What they see depends on two settings:
- FCSA’s system-wide setting, which is one of: nothing at all; Pass/Fail status only; or Pass/Fail status plus the detail tables.
- Your own choice. Even when FCSA allows detail tables, the actual figures are only shown to connected organisations if you have ticked “Allow linked organisations to see my HMRC detail tables” below. Until you do, they see your Pass/Fail status and the message “Detail access not granted by umbrella”. You can change this at any time and it takes effect immediately.
Whatever the settings, connected organisations never see the figures behind your status unless you have allowed it, and nobody outside DiligenceHub sees anything.
WHAT DO THE STATUSES MEAN?
EPAYE Verified / VAT Verified — the most recent period passed.
EPAYE Unverified / VAT Unverified — the most recent period failed, or no capture has been received.
EPAYE Arrangement / VAT Arrangement — passed, but HMRC shows a payment arrangement in place; FCSA will review.
VAT check overdue — nothing has been captured from your VAT account this month and the deadline has passed.
“HMRC checks not yet run” — you have not yet connected the extension or made a first capture.
TROUBLESHOOTING
- “not configured – press Save” in the popup: open Settings in the popup and save your token and web address.
- “no figures found”: the extension ran but could not read the page. Make sure you are on the Annual statements page (PAYE) or Payment history / What you owe (VAT), then reload. If it persists, tell FCSA – HMRC occasionally changes its pages and FCSA can update the extension’s settings remotely without you reinstalling anything.
- “token rejected”: the token has been revoked or belongs to another company. Generate a new one.
- “error network”: your computer could not reach DiligenceHub. Check your connection or any corporate firewall, then reload the HMRC page.
- The result says Unverified but you have paid: HMRC can take a few days to show a payment. Capture again once it appears. If HMRC’s own page still shows an amount due that you believe is wrong, take it up with HMRC and let FCSA know.
set visibility for details
This page is only available to umbrella company accounts.
what its a token and why do I need one
creating a token
CREATING A TOKEN
- Near the top of the page you will see a line that reads “Enter this as the DiligenceHub URL in the extension”, followed by a web address (for example https://diligencehub.co.uk). Make a note of that address – you will need it in a moment.
Click the purple button “Generate new token”.
A small box will ask you for a label. Type something that tells you which computer this token is for – for example “Sarah’s laptop” or “Payroll PC”. Click OK.
Your new token now appears in a grey box on the page. It is a long code of letters and numbers (64 characters). Select all of it and copy it (Ctrl+C on Windows, Cmd+C on a Mac).
IMPORTANT: the token is shown once only. If you close the page or move away before copying it, it is gone. That is not a problem – just generate another one and revoke the one you lost (see below).
Now click the DiligenceHub HMRC Verify icon in your browser toolbar. It is a small icon to the right of the address bar. If you cannot see it, click the puzzle-piece icon and pin “DiligenceHub HMRC Verify” so it stays visible.
In the popup, click “Settings”.
In the box labelled “DH endpoint URL”, type or paste the web address you noted in step 3.
In the box labelled “API token”, paste the token you copied in step 6 (Ctrl+V or Cmd+V).
Click “Save”. The popup should say “Saved. Selectors refreshed.” and show “EPAYE: Pending” and “VAT: Pending”.
That’s it. The extension is connected. The next time you log into your HMRC Business Tax Account and open your PAYE annual statement or VAT payment history, it will capture automatically.
IF YOU USE MORE THAN ONE COMPUTER
Create a separate token for each computer, with a label that says which one it is. Do not share one token between machines. If a laptop is lost or someone leaves, you can then switch off just that one token and the others keep working.
SWITCHING OFF (REVOKING) A TOKEN
Go back to the “HMRC Verify — Extension Tokens” page on DiligenceHub.
In the table you will see every token your company has created, with its label, the date it was created, when it was last used, and whether it is Active or Revoked.
Find the token you want to switch off and click the red “Revoke” button on that row.
Confirm when asked.
The token stops working immediately. The extension on that computer will show “token rejected” until someone enters a new token. Revoking cannot be undone — if you revoke the wrong one, simply generate a new token for that computer.
COMMON QUESTIONS
I closed the page before copying the token. Generate a new one. You can revoke the one you lost so it is not left lying around – it never worked on any computer anyway.
The popup says “URL must be an https diligencehub.co.uk origin”. The web address must be exactly as shown on the token page – starting with https:// and with nothing after the address (no /account or other words on the end).
The popup says “token rejected”. Either the token was revoked, or it was pasted with a missing or extra character. Generate a fresh token and paste it again carefully.
Can I see the token again later? No. DiligenceHub stores only a scrambled version of it, so nobody – including FCSA – can read it back. That is deliberate.
Does the token give anyone access to my HMRC account? No. It only lets your browser send figures to DiligenceHub. It cannot log into HMRC, and DiligenceHub never receives your Government Gateway details.
Who can create or revoke tokens? Anyone with a DiligenceHub login for your umbrella company can create and revoke tokens for that company.
switching off (revoking) a token
Go back to the “token generator”.
In the table you will see every token your company has created, with its label, the date it was created, when it was last used, and whether it is Active or Revoked.
Find the token you want to switch off and click the red “Revoke” button on that row.
Confirm when asked.
The token stops working immediately. The extension on that computer will show “token rejected” until someone enters a new token. Revoking cannot be undone — if you revoke the wrong one, simply generate a new token for that computer.
faqs
I closed the page before copying the token.
Generate a new one. You can revoke the one you lost so it is not left lying around – it never worked on any computer anyway.
The popup says “URL must be an https diligencehub.co.uk origin”.
The web address must be exactly as shown on the token page – starting with https:// and with nothing after the address (no /account or other words on the end).
The popup says “token rejected”.
Either the token was revoked, or it was pasted with a missing or extra character. Generate a fresh token and paste it again carefully.
Can I see the token again later?
No. DiligenceHub stores only a scrambled version of it, so nobody – including FCSA – can read it back. That is deliberate.
Does the token give anyone access to my HMRC account?
No. It only lets your browser send figures to DiligenceHub. It cannot log into HMRC, and DiligenceHub never receives your Government Gateway details.
Who can create or revoke tokens? Anyone with a DiligenceHub login for your umbrella company can create and revoke tokens for that company.
Install the extension for your browser Chrome and MS Edge from Chrome Web store | macOS Safari from the App Store
Awaiting Mac App Store Approval
This page is only available to umbrella company accounts.
This page is only available to umbrella company accounts.
Safari and App Store and Mac and macOS are trademarks of Apple Inc., registered in the U.S. and other countries and regions.
Chrome And Chrome Web Store are trademarks of Google LLC
Edge is a trademark of Microsoft Corporation
