Still Using Spreadsheets for VAT? Here's Why That's a Legal Risk in the UK

Most UK business owners who use a spreadsheet for VAT believe they are compliant. They keep their income and expenses in Excel, calculate their VAT figures at the end of each quarter, and submit them through software or their accountant. It feels organised. It feels controlled. For the purposes of HMRC’s Making Tax Digital rules, it is almost certainly not compliant — and the specific reason why is a detail that most of those businesses have never been told.

HMRC opened 110,300 VAT investigations in 2024–25, up from 103,790 the year before. Late payment fines totalled £302 million, issued across 582,000 separate penalty notices. One in three large companies had a VAT investigation opened against them. The VAT gap — the difference between what HMRC believes it is owed and what it actually collects — widened to £11.9 billion in 2024–25, up from £8.9 billion the year before. HMRC has responded by adding 5,500 new compliance staff and intensifying its enforcement activity across all business sizes. If your VAT process involves a spreadsheet and any manual step between it and your submission, this is the environment you are operating in.

The Rule That Most Spreadsheet Users Are Breaking

Making Tax Digital for VAT has been mandatory for all VAT-registered businesses since April 2022. The rule is not simply that you must submit VAT returns digitally — that requirement has existed for years. The specific and frequently misunderstood element of MTD for VAT is the digital link requirement. Under HMRC’s rules, there must be an unbroken digital chain from your source transaction data to the figures that appear on your VAT return. No manual step is permitted anywhere in that chain.

A digital link is defined by HMRC as a transfer of data between software programs or products that does not involve human intervention at any point. Automated exports, API integrations, CSV imports triggered by software, and XML transfers all qualify. What does not qualify — and this is the part that catches most spreadsheet users — is any form of manual transcription, including copy and paste. The VAT Notice 700/22 is explicit: manually re-typing figures from one system into another, or using copy and paste to transfer data between an Excel spreadsheet and another system, constitutes a broken digital link and makes the business non-compliant with MTD for VAT regardless of whether the final submission goes through approved software.

The copy-paste trap

If your process is: record transactions in Excel → copy the VAT totals → paste them into accounting software or an online submission → submit — that copy-paste step is a broken digital link. Your submission reaches HMRC through approved software. Your record-keeping does not meet MTD requirements. Both conditions must be satisfied. Most spreadsheet users satisfy only one.

The Exact Penalties for Non-Compliance

HMRC’s penalty regime for MTD VAT non-compliance is specific, graduated, and actively enforced. Understanding the precise figures matters because the penalties are not vague threats — they are defined amounts per return, per day, and per error, all of which accumulate independently of each other.

The daily digital record-keeping penalty is the one that surprises businesses most. At £5 to £15 per day, a business that has maintained a broken digital link for a full quarter — 90 days — faces a potential penalty of £450 to £1,350 for that quarter alone, before any late submission or payment penalties are applied. Across a year, a business operating with a consistently broken digital link could accumulate £1,800 to £5,400 in daily penalties for this single non-compliance, independent of whether its VAT figures are correct.

What HMRC Counts as a Digital Link — and What It Does Not

The digital link definition from HMRC’s VAT Notice 700/22 is precise enough that it is worth understanding concretely rather than in general terms. A significant number of businesses that believe they are compliant are non-compliant specifically because of the way data moves between their spreadsheet and their submission system. The following examples are taken directly from HMRC’s published guidance and enforcement precedent.

Valid digital links ✓

• API integration between a sales platform (e.g. Shopify) and accounting software, where transaction data flows automatically without manual entry

• CSV export from one system automatically imported into another — provided the import is automated and not manually triggered by re-keying

• XML transfer between software packages with no human intervention at the data transfer point

• Linked cells in Excel where one cell references another using a formula — the link is digital as long as no manual re-entry occurs

• Bridging software that pulls figures directly from spreadsheet cells via an automated connection and submits them to HMRC

• Emailing a spreadsheet to another system for automated import (the email is the digital link, not a manual transcription)

Broken digital links ✗

• Copying a figure from Excel and pasting it into accounting software or an HMRC submission portal — copy-paste is explicitly a broken link

• Reading a total from one spreadsheet and manually typing it into another spreadsheet or system

• Printing a report from one system and keying the figures into another

• Emailing figures from one team member to another for manual entry into the submission system

• Extracting data from accounting software, modifying it manually in Excel, and re-uploading

• Any step at which a human reads a number from one source and enters it into another without an automated transfer between the two

HMRC’s Enforcement Is Accelerating

The enforcement context matters because some businesses have operated with technically non-compliant processes since 2022 without receiving a penalty notice and have concluded, incorrectly, that the rules are not being enforced or that their process is acceptable. HMRC’s compliance activity data for 2024–25 suggests that conclusion is increasingly dangerous.

Total VAT investigations across all business sizes rose from 103,790 to 110,300 in the year to March 2025 — a 6.3% increase. Investigations into large and medium-sized businesses specifically surged 31%, from 9,071 to 11,894. Those completed investigations yielded £5.3 billion for the Treasury at an average of £8.6 million per case. The government has committed a further 5,500 compliance staff and 2,400 debt management officers to HMRC specifically to close the VAT gap, which widened to £11.9 billion in 2024–25. HMRC opened 12,000 more investigations than it closed last year, meaning the pipeline of open cases is growing, not contracting.

85% of suspected underpayments by large businesses are attributed to “legal interpretation” or “pushing the boundaries” of VAT rules — not deliberate fraud or accounting errors. The digital link requirement sits squarely in this category for businesses that are using spreadsheets with manual transfer steps: the VAT figures may be entirely correct, but the process by which they were produced does not meet the statutory definition of compliance.

The Bridging Software Workaround — and Why It Is Not a Long-Term Answer

HMRC permits the use of bridging software as a method of achieving MTD VAT compliance for businesses that use spreadsheets. Bridging software connects directly to spreadsheet cells and extracts the VAT return figures automatically, then submits them to HMRC without any manual transfer step. That automated connection constitutes a valid digital link because the data flows from the spreadsheet to HMRC through the software without human intervention.

For businesses that are currently non-compliant because of a copy-paste step, bridging software is a fast route to technical compliance. It typically costs £10 to £25 per quarter and requires a specific setup to ensure the software is reading the correct cells. However, it solves only the submission problem. It does not provide the underlying digital record-keeping system that MTD requires — the individual transaction-level records with dates, amounts, VAT rates, and supplier or customer details kept digitally throughout the period. A business using bridging software but maintaining those underlying records in a disconnected or partially manual system is still partially non-compliant, and that exposure remains.

Bridging software is best understood as a transition tool rather than a permanent solution. It converts a compliant spreadsheet into a compliant submission but does not address the record-keeping quality, the reconciliation accuracy, or the ongoing compliance monitoring that an integrated accounting platform provides as standard. For a business planning to remain VAT-registered — which is to say, for nearly every trading UK business above the £90,000 threshold — the long-term answer is software that handles VAT at the transaction level from the moment a sale or purchase is recorded.

What Full MTD VAT Compliance Actually Requires

HMRC’s MTD for VAT rules require businesses to satisfy two distinct obligations simultaneously. Most businesses are aware of the second and unaware of the first, which is exactly where non-compliance enters. Both are subject to separate penalty regimes and both are inspected during a VAT compliance check.

• Digital record-keeping — every individual sale and purchase must be recorded digitally with the date, value, VAT rate applied, and the name of the supplier or customer. These records must be kept for six years from the end of the relevant VAT period. A summary spreadsheet of monthly totals does not meet this requirement. Individual transaction-level records are required.

• Digital links throughout — the transfer of data at every point in the process, from source transaction to VAT return submission, must be digital with no manual intervention. This applies even within a spreadsheet: figures manually copied between tabs in the same Excel file using copy-paste rather than cell references constitute a broken digital link.

• Submission through functional compatible software — the VAT return must be submitted directly to HMRC through HMRC-recognised software. Submission through the old HMRC online VAT account is no longer available for most businesses. Submissions through software that is not on HMRC’s approved list attract the £400 per-return penalty.

• Accurate VAT calculation at transaction level — VAT must be calculated correctly at the point of each transaction, not estimated at the end of the period. Partial exemption, reverse charge, and mixed-rate transactions all require precise per-transaction treatment.

How Sage Satisfies Every Requirement Automatically

The reason Sage eliminates VAT compliance risk rather than merely reducing it is that compliance is built into the transaction workflow, not bolted onto the submission step. When a sale is recorded in Sage, the VAT rate is applied at that point, the transaction is stored with all the required fields, and it enters the digital record that will feed the VAT return. There is no separate process to run at quarter-end to achieve compliance. The compliance is already present in every transaction as it is entered.

Sage’s digital link runs from the first transaction entered in the system through to the VAT return submitted directly to HMRC via the MTD API. No step in that chain involves manual data transfer. The bank feed imports transactions automatically. Sage Copilot categorises them. The VAT calculation applies to each transaction at the point of categorisation. The VAT return is generated from the transaction data and submitted through Sage’s direct HMRC connection. The audit trail is complete, unbroken, and automatically stored for the required six years.

The VAT Gap Is Growing — and HMRC Knows Where to Look

The £11.9 billion VAT gap for 2024–25 represents an increase of £3 billion on the previous year. HMRC’s response has not been to issue general warnings. It has been to add 5,500 compliance staff, expand its digital audit capabilities, and systematically work through the backlog of businesses whose digital records do not satisfy the MTD requirements. The 110,300 investigations opened last year, combined with a 12,000 case backlog that did not close in the same year, represent a compliance checking programme of unprecedented scale for UK VAT.

The practical implication is that the businesses most at risk are not those with the largest VAT liabilities or the most complex returns. They are the businesses whose digital record-keeping is weakest — because those are the businesses where HMRC’s compliance checks are most likely to identify irregularities. A business with clean, complete, transaction-level records in Sage and an unbroken digital link from source data to submission presents almost nothing for a compliance check to find. A business with a spreadsheet, a copy-paste step, and no individual transaction records presents precisely the kind of digital link breach that HMRC’s expanded compliance team is structured to identify.

The Bottom Line

Using a spreadsheet for VAT is not wrong in principle. The wrong is in the process — specifically, in any manual step between the spreadsheet and the submission. That step, which feels insignificant and has been standard practice for years, is a broken digital link under HMRC’s MTD rules. It attracts a penalty of £5 to £15 per day, it renders the business non-compliant even if the VAT figures are entirely correct, and it is exactly the kind of non-compliance that HMRC’s expanded 5,500-strong compliance team is now specifically resourced to identify.

With 110,300 VAT investigations opened last year, £302 million in late payment penalties already issued, and the VAT gap widening to £11.9 billion, the enforcement environment is not the lenient one that many businesses experienced in the early years of MTD. HMRC is closing cases, recovering billions, and building a compliance pipeline. The businesses that are not in that pipeline are the ones whose records are already in order.

Sage is not an upgrade to VAT compliance. It is the implementation of it. Every transaction recorded in Sage is a digital record. Every connection to HMRC is a valid digital link. Every VAT return submitted through Sage is compliant with functional compatible software requirements. The six-year audit trail is automatic, cloud-stored, and accessible on demand. For a business currently running VAT through a spreadsheet with any manual step in the process, moving to Sage does not just reduce risk. It removes the specific legal exposure that the current process creates — permanently and automatically, from the day the switch is made.