HMRC security for tax and serious defaulters explained (2026)

This is general information about how the rules work, not tax or legal advice. Individual cases turn on their own facts. Speak to a qualified adviser before acting.

When people worry about getting stamp duty wrong, they usually picture a bigger bill arriving months later. There is a separate power that sounds far more alarming: HM Revenue & Customs can, in defined circumstances, demand money up front — a cash deposit or a bond — as security against tax it fears will go unpaid. It is aimed squarely at serious and repeat defaulters, and carrying on trading after the demand without giving the security can be a criminal offence.

Yet the way this power is built means it almost never reaches an ordinary property purchase. The reason is structural, and it is worth understanding if you are mapping the full set of consequences that can follow a tax default.

What a "Notice of Requirement" actually is

The security regime works through a document called a Notice of Requirement (often shortened to NOR). Where HMRC judges there is a serious risk that a person's tax will go unpaid, it can serve a notice compelling that person to give security — money HMRC holds — against future liabilities. For VAT, the power sits in the Value Added Tax Act 1994, Schedule 11, paragraph 4(2): HMRC may require security "for the protection of the revenue" as a condition of a business making taxable supplies.

Security is not a penalty, and it is not the tax itself. It is a ring-fenced deposit that HMRC can draw on if the underlying returns go unpaid. If the business meets its obligations, the security is eventually returned.

Which taxes it covers

The security power was built around recurring liabilities — the taxes a trading business generates again and again:

• VAT — Value Added Tax Act 1994, Schedule 11, paragraph 4(2)
• PAYE — the income tax an employer deducts from wages (Income Tax (PAYE) Regulations 2003, Part 4A, in force since April 2012)
• Class 1 National Insurance — the employer and employee NIC collected alongside PAYE (Social Security (Contributions) Regulations 2001, Schedule 4)

The common thread is a forward stream of tax. A VAT-registered business files a return every quarter; an employer runs payroll every month. Each period generates a fresh liability, so there is always future tax for HMRC to protect. That design point is the key to everything below.

How HMRC works out the deposit

The amount demanded is an estimate of the tax HMRC considers to be at risk. In practice it is derived from the business's own figures — past returns, or projected liabilities for a new venture — and is broadly geared to several months' worth of the expected VAT or PAYE/NIC bill. HMRC sets the figure in the notice; the deposit can be provided in cash or, for some taxes, as a suitable bond. Exact amounts are fact-specific and set case by case.

The criminal-offence sting

This is what makes a security notice bite harder than an ordinary assessment. Carrying on the taxable activity after the notice, without giving the security, can be a criminal offence rather than merely a civil default. For VAT, making taxable supplies in breach of a security requirement is an offence under section 72 of the Value Added Tax Act 1994, punishable by a fine on summary conviction. The PAYE and National Insurance regimes carry parallel summary offences for failing to give required security.

In other words, the sanction is not "pay us later with interest" — it is "give the deposit, stop the activity, or face prosecution." That is why the power is reserved for cases HMRC regards as high-risk.

Appealing a security notice

A Notice of Requirement is an appealable decision. A recipient can generally appeal to the First-tier Tribunal (Tax Chamber) within 30 days of the notice, arguing that security is not in fact necessary for the protection of the revenue, or that the amount is excessive. The tribunal can confirm, vary or cancel the requirement. As with any tax appeal, the deadlines are strict and the grounds are specific — another reason specialist advice matters here.

Where security sits in the enforcement stack

For a deliberate default, HMRC has a layered set of tools. Security is one of three non-financial consequences — measures that go beyond simply recovering the tax and a penalty:

The first two are covered in our guides to deliberate-defaulter publication and the £25,000 threshold and serious-defaulter monitoring after a deliberate default. The full consequence stack of a deliberate stamp duty default ties all of them together.

Why a one-off stamp duty default sits outside it

Here is the structural point. Stamp Duty Land Tax is a one-off transaction tax. It is charged once, on a single land transaction, and the return and payment fall due within 14 days of completion. Across England and Wales there were 759,637 standard residential sales recorded on the HM Land Registry Price Paid file for 2025 (houses and flats; data fetched 29 July 2026) — and each of those generated exactly one SDLT charge, payable once and then finished.

There is no forward SDLT liability to protect. Security exists to guard a continuing stream of returns; a completed purchase produces no such stream. So if a buyer underpays SDLT, HMRC does not — and structurally cannot usefully — demand an advance deposit against it. Instead it recovers the tax retrospectively: a discovery assessment claws back the underpaid duty, a penalty is charged as a percentage of the tax lost, and interest runs from the original due date.

That is a real difference from the surcharge maths readers often focus on. Take the reclaim line that drives the naming threshold: at £490,000 the gap between the residential-plus-surcharge charge and the non-residential scale is exactly £25,000 (£39,000 versus £14,000; figures from Homecost's stamp duty calculation, verified 29 July 2026). That £25,000 is potential lost revenue — the number that matters for public naming. It has nothing to do with security, because security is about future tax, not a past transaction.

The one situation where the two meet

There is a narrow overlap, and it is worth stating plainly. If a person who defaulted on stamp duty also runs a business with recurring VAT, PAYE or NIC obligations, and HMRC judges those business taxes to be at serious risk, a security notice can be served — but it attaches to the business taxes, not to the property purchase. The stamp duty default might form part of the wider compliance picture HMRC builds of the person; the security itself protects the forward stream, which SDLT never has.

So the honest summary is this: like serious-defaulter monitoring, the security power follows the person and their ongoing business, not the single transaction. For the great majority of homebuyers, it is simply not in the frame.

What does apply to a stamp duty default

If you are trying to understand the real exposure on a property purchase, the relevant tools are the retrospective ones: the discovery assessment, the penalty regime for a mis-declared transaction, late-payment interest, and — for deliberate defaults only — public naming and monitoring. An error made despite taking reasonable care is a different matter again; the reasonable-care and reliance-on-adviser defence can mean no penalty is due, which in turn keeps the deliberate-only consequences out of reach.

To see how a stamp duty figure is built for a given price and buyer type, try Homecost's stamp duty calculator seeded at £490,000, or look up the all-in cost of any street with the Homecost postcode tool for a prime-market example like SW1A 1AA. You can also browse the rest of our cost-intelligence guides for the wider picture.

Based on 759,637 HM Land Registry residential transactions recorded for 2025 and current HMRC stamp duty rates.

Security for tax is a specialist area, and every case turns on its own facts. This article explains how the rules are structured; it is not tax or legal advice. Speak to a qualified adviser before acting.