HMRC Screen Scraping Policy Update 2026: What Changed?

Last updated: 21 September 2026

HMRC has provided an important new clarification on its approach to screen scraping, browser automation and other tools that interact automatically with Government Gateway services.

The issue first came into sharp focus on 27 May 2026, when HM Revenue and Customs published a policy paper clarifying its existing position on HMRC sign-in details and automated access to its online services.

HMRC said automation tools must not be used to enter data into or navigate Government Gateway where software effectively simulates the actions of a human user. The department specifically identified screen scraping, browser automation, scripted sign-in and robotic process automation as examples.

However, there has now been an important September development.

In Agent Update 147, updated on 18 September 2026, HMRC acknowledged concerns from tax advisers and software developers and clarified that enforcement will continue to focus on behaviour creating material security, fraud or service-integrity risks.

HMRC has also begun stakeholder engagement on the future of automation and intends to use discussions during September, October and November 2026 to help develop a draft safe automation framework.

For accountants, tax agents, payroll providers and software users, the important message is that HMRC has not withdrawn its May policy. Instead, it has provided greater clarity about enforcement while opening the door to a more detailed framework for safe automation.

What Is the Latest HMRC Screen Scraping Policy Update?

The latest development comes from HMRC’s September 2026 Agent Update.

HMRC recognised that automation is already an established part of the tax and software ecosystem and acknowledged that publication of its May policy had caused concern among tax advisers and software developers.

The department says the May paper was intended to clarify its long-standing policy rather than introduce a completely new ban.

HMRC has now confirmed that its enforcement approach will continue to concentrate on behaviours presenting material security, fraud or service-integrity risks. It also says it will work constructively with advisers and developers making genuine efforts to interact safely with HMRC systems.

This provides useful reassurance about HMRC’s enforcement priorities, but it should not be interpreted as permission to ignore the Government Gateway terms.

The underlying restrictions on automated access remain in place.

HMRC Screen Scraping Policy: May vs September 2026

The distinction matters because the September announcement supplements the May policy rather than replacing it.

What Did HMRC Actually Say About Screen Scraping?

HMRC’s 27 May policy focuses on two connected issues: the sharing of HMRC sign-in details and software that automatically interacts with Government Gateway.

HMRC says sign-in details should not be shared with another named account user or supplied to third-party software.

The department also states that its existing Government Gateway policy does not permit automation tools to enter information into or navigate Government Gateway.

HMRC defines these automation tools as software designed to simulate human interaction, including browser automation, screen scraping, scripted sign-in and robotic process automation.

The restriction applies whether the automated process is reading information from HMRC or writing information into the service.

That makes the access method more important than the software’s marketing description.

Two tax platforms might appear to provide almost identical dashboards. One could obtain information through an approved HMRC API, while another could automatically log into a webpage and extract information directly from it.

From HMRC’s perspective, those are fundamentally different methods of access.

Does HMRC Ban All Tax Automation?

No. This is one of the most important points for businesses to understand.

HMRC is not trying to remove automation from tax administration altogether.

Official HMRC APIs are specifically outside the scope of the May restriction. HMRC says APIs allow applications to interact directly with HMRC systems without requiring software developers to collect the customer’s HMRC password.

The distinction can be summarised as follows.

Method	HMRC Position
Official HMRC API	Supported where used in accordance with HMRC requirements
OAuth-based API authorisation	Supported
User manually signs into their own HMRC account	Permitted
Password stored on the user’s own browser or device	Not intended to fall within the automation restriction
Software requesting a customer’s Government Gateway password	Not permitted
Screen scraping after automated sign-in	Not permitted under the current Government Gateway policy
Automated browser navigation through Government Gateway	Not permitted
Scripted Government Gateway sign-in	Not permitted
RPA simulating a person’s actions within HMRC services	Falls within HMRC’s automation definition

The correct question for a business is therefore not simply, “Does our accounting software use automation?”

It is, “How does our software communicate with HMRC?”

What Is Screen Scraping in HMRC Software?

Screen scraping is a technique where software collects information from the visible interface of a website rather than retrieving structured information through an official API.

Imagine a person signing into an HMRC account, opening several pages, locating figures and copying those figures into an accounting system.

Screen-scraping software attempts to automate some or all of those steps.

A related technique is browser automation, where software automatically opens pages, clicks buttons, enters information or navigates through online services.

Robotic process automation can perform similar tasks across multiple systems.

These technologies can provide substantial efficiency benefits, particularly for accounting firms managing hundreds or thousands of clients.

However, HMRC’s concern is that software imitating a person’s actions within Government Gateway can create security and service-integrity problems that do not arise in the same way with structured API access.

Why Is HMRC Concerned About Credential Sharing?

Credential sharing is at the centre of HMRC’s policy.

HMRC sign-in credentials can give access to highly sensitive financial and taxpayer information.

The department therefore says requesting another named account user’s sign-in details is not allowed.

This includes a third-party application displaying its own login page and asking a customer to enter their HMRC credentials. HMRC treats that as the customer sharing the sign-in information with the software provider.

HMRC’s policy makes an important distinction between that situation and ordinary browser password management.

If an individual stores their own HMRC password on their own browser or device to help them sign into an account they legitimately access, HMRC says that is not intended to fall within the automation restriction.

The issue is therefore not simply whether a password is remembered electronically.

The concern is whether credentials are being given to another person or product and then used to access HMRC services.

Can Tax Agents Use a Client’s Government Gateway Details?

HMRC says they should not.

The May policy applies specifically to tax agents as well as individual taxpayers, organisations and software providers.

Authorised agents have their own HMRC credentials and should access authorised client information using their own agent arrangements rather than signing into the client’s account with the client’s credentials.

This is particularly important for practices managing large client portfolios.

One employee using a client’s Government Gateway login because it seems quicker could create a very different compliance position from accessing that client’s information through a properly authorised agent account.

Firms should therefore review both their software and their internal working practices.

Why Did Screen Scraping Become Common in the Tax Industry?

HMRC itself recognises that this issue developed partly because official APIs have not always provided every function needed by advisers and software companies.

Its May policy acknowledges that legacy and workaround approaches have emerged where organisations had a genuine need for automated access to data that was not available through an HMRC API.

This is an important part of the debate.

Accounting practices increasingly depend on consolidated dashboards, automated alerts and workflow tools to manage large numbers of clients.

Staff may need to identify outstanding liabilities, monitor filing statuses, check whether repayments have been issued or understand changes affecting client accounts.

For example, businesses already need to interpret online account statuses when following an HMRC repayment. Similar visibility is valuable for agents dealing with hundreds of cases at once.

Where APIs have not provided the required information, software companies have sometimes created alternative methods of obtaining it.

That does not override HMRC’s terms, but it does explain why removing unsupported automation is not always as straightforward as simply disabling a feature.

What Has Changed With Enforcement in September 2026?

The enforcement clarification is arguably the most important new information in the September update.

The May policy says HMRC may take steps to protect taxpayer information and its web services when unsafe access is detected.

Those steps can include blocking access to HMRC web-services accounts, which HMRC warns could disrupt activities such as filing tax returns.

However, Agent Update 147 now adds greater context.

HMRC says enforcement will continue to focus on behaviour that creates material security, fraud or service-integrity risks.

It also says it will work constructively with tax advisers and software developers that are making a genuine effort to interact safely with its systems.

This does not create a formal exemption for lower-risk automation.

Nor does it mean software using unsupported methods becomes compliant simply because it has operated without intervention so far.

Instead, it gives firms a better understanding of where HMRC says its enforcement attention will be concentrated.

Could HMRC Block an Agent Services Account?

HMRC lists the Agent Services Account among the web services covered by its policy and says unsafe access can result in security interventions, including blocking access to web-services accounts.

HMRC also warns that such restrictions could disrupt activities including tax-return filing.

For an accountancy practice, the operational consequences could therefore be significant.

A firm might use HMRC access for client authorisations, Making Tax Digital services, filing activity and other tax-administration functions.

If access to an important HMRC service is interrupted, the problem can quickly extend beyond the original software issue.

This is particularly relevant to businesses handling payroll. Employers and advisers already depend heavily on reliable digital reporting, and companies using external payroll services should also understand how their provider connects to HMRC.

Compliance with the screen-scraping policy should therefore be considered part of business continuity planning rather than simply an IT issue.

Are HMRC APIs the Safer Alternative?

For supported integrations, HMRC clearly favours APIs.

HMRC’s developer documentation uses OAuth 2.0 for user-restricted endpoints containing secure personal data.

Under that model, the customer signs into HMRC and gives an application permission to access specified information. HMRC then issues an access token to the application.

The customer does not have to provide their HMRC password directly to the software company.

That is the critical difference between API authorisation and a software product displaying its own HMRC-style sign-in box.

HMRC’s Developer Hub terms also say that implementing OAuth 2.0 means developers should not need to store customers’ HMRC sign-in details.

However, developers should not assume that they can automate every part of the OAuth process.

HMRC explicitly says it does not support software that automatically drives the web interfaces used during the OAuth grant flow. The department also warns that this journey can change and that automated login processes may stop working without advance notice.

Why Does the September Safe Automation Framework Matter?

The biggest longer-term development is HMRC’s decision to examine how safe automation could operate in future.

Agent Update 147 says HMRC is engaging with stakeholders through established forums during September 2026 to test evidence around the opportunities and risks associated with automation.

Further detailed discussions are scheduled throughout October and November.

HMRC says these discussions will help shape a draft safe automation framework and refine its future policy direction.

That wording matters.

HMRC is not saying that the current Government Gateway policy has disappeared.

Instead, it is recognising that automation has become an important part of modern tax administration and is looking at how appropriate forms of automation might be handled within a more sustainable framework.

Businesses should therefore distinguish between today’s rules and potential future policy.

Until HMRC publishes further guidance, firms should continue working from the existing May policy and the September enforcement clarification.

How Can You Tell Whether Your Software Needs Reviewing?

Software should be assessed according to what happens behind the interface rather than according to the type of product.

The previous approach of describing entire categories such as dashboards, payroll utilities or cloud platforms as inherently “high risk” or “low risk” can be misleading.

A better approach is to examine the actual integration method.

A business does not need to understand every technical detail of its software.

It does need enough information to understand how HMRC data is accessed.

Could Your Firm Be Using Screen Scraping Without Realising It?

Yes. One of the challenges identified in your previous compliance approach remains highly relevant: the end user may never see how information is retrieved.

A dashboard might simply display a client’s tax balance or filing status.

To the accountant using it, the process could look identical whether the data came from an HMRC API or an automated browser session.

This is why procurement teams should no longer judge HMRC-connected software only on features, price and ease of use.

Integration methods should also form part of the buying decision.

The same principle applies to plugins and specialist tools added to larger accounting platforms. A firm’s primary accounting software might use official integrations while an additional extension uses an entirely different method.

What Questions Should You Ask an HMRC Software Provider?

A strong vendor review should establish the software’s access method before the firm relies on it for important tax workflows.

Instead of asking a vendor simply whether its product is “HMRC compliant”, ask for concrete information.

Written vendor responses are preferable because they provide an audit trail showing what the firm understood when it made its technology decisions.

How Should Accounting Firms Conduct an HMRC Software Audit?

The most practical first step is to map every system that interacts with HMRC.

This should include obvious accounting software but also smaller tools introduced by individual departments or employees.

Browser extensions, spreadsheet plugins, workflow scripts, tax dashboards, specialist claim software and payroll add-ons can easily be overlooked.

The purpose is not to immediately remove every automated process.

The objective is to identify the access method behind each process.

Once systems are mapped, firms can separate applications using documented APIs from products requiring further investigation.

Particular attention should be given to software that asks users for Government Gateway details, performs automated portal logins or depends on pages displayed inside HMRC online services.

This also creates an opportunity to improve wider technology governance. Firms can introduce requirements for future software purchases so that HMRC integration methods are reviewed before a product is approved.

What Should You Do If Software Asks for Your HMRC Password?

Do not assume that a software provider asking for HMRC credentials is simply another form of API authorisation.

HMRC makes a clear distinction.

If a software product asks a customer to enter HMRC credentials into the software company’s own sign-in page, HMRC treats that as sharing the credentials with the product.

By contrast, with HMRC’s OAuth process, the user authenticates directly with HMRC and grants specified permissions to the application.

If you are uncertain which method is being used, ask the provider to explain the login journey and confirm whether the application ever receives, stores or processes the HMRC password.

Software developers themselves can seek clarification directly from HMRC where they are uncertain how the policy applies to a product.

What Should Firms Do If They Identify a Potential Problem?

Discovering questionable automation does not mean a business should make assumptions about whether HMRC has already identified a breach.

The immediate priority should be understanding exactly what the technology is doing.

Contact the software provider, obtain technical documentation and establish whether credentials, screen scraping, browser automation or other automated portal activity is involved.

Where the issue could affect significant client workflows, firms should also consider what alternative processes would be available if the integration stopped working.

Document the review, the evidence supplied by the vendor and any changes made.

If necessary, obtain professional advice appropriate to the organisation’s circumstances.

The aim should be to reduce both compliance exposure and operational dependency on unsupported access methods.

What Should Businesses Prioritise Over the Next 90 Days?

The three-month period from late September through the end of 2026 is particularly important because HMRC’s automation policy is still developing.

During the first stage, businesses should map HMRC-connected applications and obtain confirmation of how each product accesses HMRC systems.

The second stage should focus on products where the technical method remains unclear. Those vendors should be asked for written explanations, while businesses assess whether alternative API-based or manual processes are available.

The final stage should focus on governance: updating software procurement policies, restricting unnecessary credential sharing, documenting approved integrations and making sure staff understand the difference between HMRC authorisation and third-party credential collection.

At the same time, businesses should monitor HMRC’s October and November stakeholder discussions because the planned safe automation framework could provide additional guidance before firms make larger long-term technology changes.

How Does This Fit Into HMRC’s Wider Digital Strategy?

The screen-scraping debate does not mean HMRC is moving away from digital tax administration.

Quite the opposite.

HMRC continues to rely heavily on software integration, digital records and automated tax processes.

The policy is about how external software communicates with HMRC rather than whether technology should be used at all.

The direction is towards structured access where authentication, permissions and the identity of the application can be controlled.

For businesses, that means digital transformation is likely to continue, but security and integration design will become increasingly important.

This is also why companies should pay attention to related HMRC developments rather than treating screen scraping as an isolated technology issue.

Changes to digital tax accounts, repayment processes, payroll reporting and agent services increasingly depend on the same underlying question: how securely can taxpayers, advisers and software systems exchange information?

What Could Happen Next?

Three stages are now particularly important.

September 2026 is being used for stakeholder engagement through HMRC’s established forums.

October and November will include more focused discussions examining key policy questions.

HMRC then intends to consider the evidence and feedback gathered before determining the next steps for the draft safe automation framework and its wider policy approach.

That means this article may require another update when HMRC publishes the outcome of those discussions.

For now, organisations should avoid assuming either extreme.

It would be wrong to conclude that HMRC has abandoned its restrictions.

It would also be misleading to suggest that HMRC is trying to eliminate every form of automation from UK tax administration.

The department is drawing a distinction between secure, structured integration and methods that can expose credentials or imitate users inside Government Gateway.

Conclusion

The HMRC screen scraping policy update has moved into a new phase.

HMRC’s May 2026 policy made clear that customers should not share HMRC sign-in details and that automation tools should not be used to navigate or enter information into Government Gateway when they simulate human interaction.

The September 2026 clarification does not remove those rules.

Instead, HMRC has acknowledged the important role automation already plays in tax administration and confirmed that enforcement will focus on behaviour presenting material security, fraud or service-integrity risks.

At the same time, HMRC has started working with advisers and software developers to determine what a sustainable safe automation framework could look like.

For accountants, tax agents and businesses, the best response is therefore not to reject automation altogether.

It is to understand exactly how automation is being delivered.

Organisations should know which systems use HMRC APIs, which rely on direct website interaction, whether credentials are being passed to third parties and what would happen if an existing integration stopped working.

With further discussions scheduled for October and November 2026, HMRC’s final position is still developing. Businesses that review their systems now will be better placed to respond to the next policy update without unnecessary disruption.

FAQs About the HMRC Screen Scraping Policy Update

Has Hmrc Reversed Its Screen Scraping Policy?

No. HMRC’s September update has not withdrawn the policy published on 27 May 2026. It has clarified the department’s enforcement priorities and started a consultation process around the future of safe automation.

Is Screen Scraping Hmrc Allowed in 2026?

HMRC’s current Government Gateway policy says automation tools that sign in and simulate user behaviour are not permitted. HMRC specifically includes screen scraping within its definition of automation tools.

Has HMRC Introduced a New Ban?

HMRC says the May 2026 policy paper clarified its existing position rather than creating new online-services terms and conditions.

Does HMRC Ban All Automated Software?

No. Official HMRC APIs are outside the scope of the restriction and remain an important way for software to interact with HMRC.

What is HMRC Focusing on When Enforcing the Policy?

HMRC said in September that enforcement will continue to focus on behaviours creating material security, fraud or service-integrity risks.

Can an Accountant Use a Client’s Government Gateway Login?

HMRC says tax agents should use their own HMRC credentials and authorised agent access rather than another named account user’s sign-in details.

Can I Save My Hmrc Password in My Browser?

HMRC says tools that simply help a person sign into an account they legitimately access, such as credentials saved on their own browser or device, are not intended to be covered by the automation restriction.

Are HMRC APIs Compliant With the Policy?

HMRC APIs are outside the scope of the screen-scraping policy. Where an API requires customer authorisation, the user authenticates directly with HMRC and the software receives tokenised access instead of the customer’s HMRC password.

Can Developers Automate the OAuth Login Journey?

HMRC says it does not support software automatically driving the web interfaces of the OAuth grant flow. Developers should follow HMRC’s official authorisation process.

What is the HMRC Safe Automation Framework?

It is a framework HMRC plans to develop following stakeholder engagement about how safe, secure and appropriate automation could operate across HMRC services. Detailed discussions are scheduled for October and November 2026.

Should Firms Immediately Stop Using All Automation?

No blanket conclusion should be made about every automated tool. Firms should establish how each application connects to HMRC. A product using an official API is fundamentally different from one that collects Government Gateway credentials or automatically navigates HMRC webpages.

What Should Accounting Firms Do First?

The most useful starting point is a complete audit of HMRC-connected software, followed by written vendor confirmation of how each product handles authentication and data access.