CAR Audit S17 S18 Returns Security Bulletin no 3

5286956

Informations

• Publié par: Istey
• Nombre de lectures: 30
• Langue: English

Extrait

Number 3

April 2009

S17/S18 Returns Bulletin

The S17/S18 Bulletins keep Financial Institutions & Local Authorities informed

of any new developments relating to the S17/S18 reporting requirements.

Please ensure the appropriate people in your organisation read it.

We suggest that you keep Bulletins at the front of your copy of the S17 or S18

Magnetic Media Specifications.

What this Bulletin contains

1.

Section 17/18 TMA 1970 & SI 03/3297 Return notices

2.

Magnetic Media Specification

3.

Spreadsheet/Paper Returns

4.

Submission Document

5.

Delivery of Return Media

6.

Packaging

Security Update

7.

Which data submissions does this update cover?

8.

Preferred Encryption and transfer methods

9.

Secure Electronic Transfer

10.

Removable desktop media: CD, Floppy, USB, DVD

11.

Public certificate

12.

Passwords

13.

IBM Tapes and Cartridges

14.

Electronic transfer using Connect Direct Secure plus

15.

Additional Notes

16.

Where to send your return (including Named Contacts)

17.

Who to contact with a query

Enquiries about this bulletin should be addressed to:

HM Revenue & Customs

CAR (Savings & Audit)

Returns Team

St Johns House

Merton Road

LIVERPOOL

L75 1BB.

Telephone

0151 472 6129

1 - Section 17/18 TMA 1970 & SI 03/3297 Return notices

You will have recently received a notice to make your annual return.

If you are unsure about

what should be reported, or unsure about whether a return needs to be made, please contact

CAR (Savings & Audit) Returns Team.

If the notice is no longer appropriate to you, please

pass it onto the person with responsibility for the return.

2 - Magnetic Media Specification

The format of the magnetic media specification has been refined.

The new version, which will be posted on the HMRC website very shortly, incorporates the

requirement to provide a TYPE 3 record for Corporates (covered in previous bulletins),

otherwise the technical content remains the same.

3 - Spreadsheet/Paper Returns

The introduction of the Excel spreadsheet option for the 2007/08 S17/S18/ SI 03/3297 returns

was a big success.

Over 200 spreadsheets were received and as a consequence the number

of OCR forms was reduced significantly.

General feedback from the industry has been very

positive.

FIs who used OCR forms for 2007/08 may wish to consider adopting the spreadsheet option

for their 2008/09 returns.

The spreadsheet template can be downloaded from the HMRC website, where guidance on

completion is also available.

Data cannot be accepted on other templates.

Only one spreadsheet return is allowed per sub return.

For sub-returns that contain data that

will not fit onto one spreadsheet the customer must report using the standard magnetic media

file specifications as published on the HMRC website.

The spreadsheet must be written to removable desktop media and sent to Cardiff in the

normal way. It must not be emailed. We strongly recommend that that the spreadsheet be

password protected using WinZip as described in sec 10 below.

We process your spreadsheet returns separately from the magnetic media specification

returns.

To help us identify them more easily and avoid processing delays, please write,

‘Spreadsheet’, using a permanent marker, on any disc you send us containing a spreadsheet.

4 - Submission Document

The submission documents are required to help identify the sender and package contents.

The document for use from April 2009 has been redesigned to fit onto one page.

2

The new version also asks for the number of SI 03/3297 (ESD) cases included on the return.

If the exact figure is not readily available, a reasonable estimate will suffice.

If you are unable

to provide this information, your return will not be failed and you will not be penalised.

5 - Delivery of Return Media

Please ensure that couriers are instructed to deliver media to Centre for Research and

Intelligence (CRI) during normal office hours. Monday to Friday 8.00am to 4.30pm.

6 - Packaging

HMRC strongly recommends the use of secure tamper proof packaging for transporting the

media.

Security Update

7 - Which Data Submissions does this update cover?

This update relates to the following data returns which customers submit to the HMRC

Financial Institutions Returns Management Team in Cardiff:

Section 17 & 18 TMA 1970

ESD

ISA

Registered Pension Schemes

VCT

Chargeable Events

8 - Preferred Encryption and transfer methods

HMRC would like to thank all those organisations and early adopters who have helped us

develop and implement our movement to secure data transfer solutions.

Work continues to improve our secure transfer solutions and as a result HMRC are pleased to

confirm that the following, in preference order, are how we are able to accept encrypted data.

9 - Secure Electronic Transfer

This is the HMRC preferred method for encrypted transfer.

It will form the basis for cross-

government secure electronic transfer.

If you have registered for this service as an early

adopter, please use it.

If you would like to know more about Secure Electronic Transfer (SET) please contact

[e-mail]

10 - Removable desktop media: CD, Floppy, USB, DVD

•

PGP encrypted using the HMRC public certificate

•

Password protected using Winzip v9 or higher.

•

PGP self decrypting files.

3

HMRC encourages the use of PGP with our public certificate; this removes the need for

customers to send us separate passwords and is easier for us all to handle, without

compromising security.

If you do need to use WinZip V9 or higher we recommend that you use the 256bit AES option

together with the Mask Password Option (see below).

We would additionally recommend that the password selected is at least 20 characters long,

contains upper and lower case characters, at least one special character, and contains no

dictionary words.

To help avoid ambiguity where your password contains ambiguous characters such a 0 (Zero)

and O (as in Oscar) please make sure that these are clearly identified when the password is

sent using numbers and the phonetic alphabet as above. This will help us speed up the

process and avoid the need to contact you.

11 - Public certificate

If the PGP certificate is required this can be obtained by contacting the HMRC Security

Control Centre at:

Email:

[e-mail]

Telephone number:

0195 223 3257

The certificate is valid until 28

th

February 2010

The public certificate cannot be used with non-PGP.

12 - Passwords

Passwords must be sent separately to the mailbox –

[e-mail]

The email subject should be populated with the customer return type and return reference

number. For example an email containing a password for a S17 return for A9999 sub return

01 should be titled :-

S17 A9999/01

4

Would you also please include a contact name and phone number to help in case of difficulty

using the supplied password.

13 - IBM Tapes and Cartridges

HMRC can now accept:

•

Files encrypted using IBM Zip390 and password protected.

•

Files encrypted using IBM DFDSS and password protected.

We can’t currently accept files encrypted using IBM DFDSS and the HMRC Public Certificate.

We are looking at implementation of additional hardware to facilitate this but have no

implementation date at the moment.

Passwords should be sent to the DCDM mailbox in paragraph 12.

14 - Electronic transfer using Connect Direct Secure plus (CDS+)

HMRC can accept files over the internet using CDS+.

However, this requires the correct

version of the product and the correct transfer protocols to be used.

For those institutions

currently using CDS+ to send us data we will continue to support this transfer mechanism in

2009/10 as part of the transition to SET.

15 - Additional Notes

HMRC cannot currently accept any of these data returns by email/secure email.

HMRC cannot currently accept any of these returns by secure FTP.

HMRC has a programme of continual improvement with regard to security and the methods

used within this document are under continual review.

If you have a suggestion that you feel

we might like to consider please email us via:-

[e-mail]

16 - Where to send your return

All returns should be sent to Centre for Research & Intelligence (CRI) in Cardiff, at the

address below.

DO NOT SEND YOUR RETURN ANYWHERE ELSE IN HMRC.

HM Revenue & Customs

FI Returns Management Team.

CRI, Ground Floor

Government Buildings

Ty Glas Road

Llanishen

CARDIFF

CF14 5ZG

Telephone:

0292 032 7373

Named Contacts

If you wish to send your return media to a named contact in Cardiff, please email Jackie

Evans at

[e-mail]

to make the necessary arrangements.

5

6

17 - Contact Details for queries

Queries relating to

encryption solutions

and requests for the

HMRC public key

should be

directed to the TSCC as below.

TSCC

Email:

[e-mail]

Telephone number:

0195 223 3257

Queries relating to

data content, submission dates and testing

should be referred to

CAR(Savings & Audit) as below.

HM Revenue & Customs

CAR (Savings & Audit)

Returns Team

St Johns House

Merton Road

LIVERPOOL

L75 1BB

Telephone

0151 472 6129