# getsorted.today

> Free UK compliance checker for micro-businesses. Answer around 12 yes/no questions and get a report across UK regulations: ICO registration, GDPR, employers' liability, pensions, consumer law and more. Guidance based on ICO and GOV.UK sources, not legal advice. A product of XGR Labs Ltd.

## Tools

- [Compliance checker](https://www.getsorted.today/checker/): interactive check, free, no account, nothing stored
- [Director ID verification deadline tool](https://www.getsorted.today/idv/): enter a Companies House number to find the exact confirmation-statement-linked deadline for verifying director identity, with an optional emailed calendar reminder
- [MCP server](https://www.getsorted.today/mcp/): run compliance checks from Claude, Cursor or any MCP client. Endpoint: https://api.getsorted.today/mcp (streamable HTTP, no auth)
- [REST API](https://www.getsorted.today/api/): partner API documentation. OpenAPI spec: https://api.getsorted.today/api/openapi.json

## Guides (full content)

Each guide answers one question about a UK regulation. Reviewed dates are per guide. This is guidance, not legal advice.

### What business details must you display?

Regulation: Companies Act 2006 & Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015
Guide: https://www.getsorted.today/guides/companies_act_disclosures/
Reviewed: 2026-06-25

Limited companies must display their registered name, company number, and registered office address on all business correspondence including websites, emails, and invoices. This is a legal requirement regardless of business size. When it does not apply: Companies Act disclosure requirements apply specifically to limited companies. Sole traders and partnerships have separate (lighter) trading name disclosure obligations. What is at stake: Criminal offence for directors. Fines and Trading Standards enforcement. What to do: Display your full registered company name, company number, and registered office address on your website, emails, letters, and invoices. The registered office must be a geographic address.

Official guidance: https://www.gov.uk/running-a-limited-company/company-and-accounting-records

### Do you need terms and conditions on your website?

Regulation: Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 & Consumer Rights Act 2015
Guide: https://www.getsorted.today/guides/consumer_contracts/
Reviewed: 2026-07-10

Selling online to consumers likely requires compliant terms of sale, pre-contract information, and a 14-day cancellation right. These are statutory minimums, contract terms cannot remove them. A general website terms of use page is sensible but not legally required, it is the terms of sale and pre-contract information that the law mandates. Consumer rights obligations apply to distance and off-premises sales. If you sell by phone, mail order, or at a customer's home, these rules likely apply. When it does not apply: Consumer Contracts Regulations apply to B2C sales. If you sell only to businesses, these specific rules likely do not apply, though contract law still governs your agreements. What is at stake: Consumers may cancel contracts, claim refunds, or bring claims if statutory rights are not met. Trading Standards can investigate. What to do: Ensure your terms cover the statutory 14-day cancellation right for online/distance sales, provide required pre-contract information, and do not exclude statutory consumer rights.

Official guidance: https://www.gov.uk/accepting-returns-and-giving-refunds

### UK GDPR: Data Processor Contracts: does it apply to you?

Regulation: UK GDPR, Article 28
Guide: https://www.getsorted.today/guides/data_processor_contracts/
Reviewed: 2026-06-25

You likely need a Data Processing Agreement with each third-party tool that handles personal data (e.g. Mailchimp, Google Analytics, Stripe, Shopify). Many providers offer a standard DPA, check your account settings or terms. When it does not apply: If you do not use third-party tools that process personal data on your behalf, this requirement likely does not apply. What is at stake: Using a processor without a compliant contract is a breach of UK GDPR. Fines up to £17.5M or 4% of global turnover. What to do: Ensure you have a Data Processing Agreement (DPA) or have accepted the processor's standard DPA terms with each third party that processes personal data on your behalf.

Official guidance: https://ico.org.uk/for-organisations/

### DMCCA 2024: Customer Reviews: does it apply to you?

Regulation: Digital Markets, Competition and Consumers Act 2024, Part 4 (in force 6 April 2025)
Guide: https://www.getsorted.today/guides/dmcca_customer_reviews/
Reviewed: 2026-06-25

The DMCCA 2024 (in force April 2025) prohibits fake or misleading customer reviews. If you display reviews on your website or ask customers to leave reviews, you must have reasonable processes to ensure they are genuine. When it does not apply: DMCCA customer review provisions target consumer-facing businesses. Likely not applicable if you sell only to other businesses. What is at stake: CMA enforcement action. Unfair commercial practice. Fines up to £300,000 or 10% of global turnover for businesses, plus up to £30,000 for individuals. What to do: Do not publish fake reviews, commission fake reviews, or suppress negative reviews. If you display reviews, ensure you have reasonable steps to verify they are genuine.

Official guidance: https://www.legislation.gov.uk/ukpga/2024/13/contents

### DMCCA 2024: Drip Pricing: does it apply to you?

Regulation: Digital Markets, Competition and Consumers Act 2024, Part 4 (in force 6 April 2025)
Guide: https://www.getsorted.today/guides/dmcca_drip_pricing/
Reviewed: 2026-06-25

The DMCCA 2024 (in force April 2025) prohibits drip pricing, adding mandatory fees (e.g. booking fees, service charges) only at checkout that should have been included in the advertised price. Review your pricing display. When it does not apply: Drip pricing rules target consumer-facing businesses. Likely not applicable to B2B-only operations. What is at stake: CMA enforcement. Fines up to £300,000 or 10% of global turnover. Prohibited as an unfair commercial practice. What to do: Display the full price, including all mandatory fees and charges, at the first point where the price is shown. Do not add unavoidable charges at checkout.

Official guidance: https://www.legislation.gov.uk/ukpga/2024/13/contents

### DMCCA 2024: Subscription Contracts: does it apply to you?

Regulation: Digital Markets, Competition and Consumers Act 2024, Part 4, Chapter 4 (Autumn 2026)
Guide: https://www.getsorted.today/guides/dmcca_subscriptions/
Reviewed: 2026-06-25

The DMCCA 2024 subscription contracts regime is expected to come into force Autumn 2026. If you offer consumer subscriptions, you will need a simple cancellation mechanism, reminder notices before renewal, and a cooling-off period. Prepare now. When it does not apply: Subscription contract rules only apply to businesses offering recurring subscription products or services to consumers. What is at stake: CMA enforcement. Requirements include exit mechanisms, reminder notices, and cooling-off periods. What to do: Prepare now, review your subscription flows and ensure you have a simple cancellation mechanism, pre-renewal reminders, and a 14-day cooling-off period for new subscribers.

Official guidance: https://www.legislation.gov.uk/ukpga/2024/13/contents

### European Accessibility Act 2025: does it apply to you?

Regulation: European Accessibility Act (EU Directive 2019/882), in force 28 June 2025
Guide: https://www.getsorted.today/guides/eaa_2025/
Reviewed: 2026-06-25

The EAA came into force 28 June 2025 and may apply if you sell digital products or services to customers in the EU. Micro-businesses (under 10 employees AND under €2M revenue) are exempt in most member states. Verify whether your business exceeds these thresholds. When it does not apply: The European Accessibility Act applies to businesses selling to EU customers. If you do not sell to EU-based customers, this regulation likely does not affect you directly. What is at stake: Applicable EU member state enforcement for non-compliant products/services sold to EU customers. What to do: If you sell to EU customers and exceed the micro-business threshold, review EAA requirements for your products/services. Products placed on the market before 28 June 2025 have until 2030 to comply.

Official guidance: https://ec.europa.eu/social/main.jsp?catId=1202

### Do directors need to verify their identity?

Regulation: Economic Crime and Corporate Transparency Act 2023, Identity Verification (mandatory from 18 November 2025)
Guide: https://www.getsorted.today/guides/ecct_director_id/
Reviewed: 2026-06-25

Director Identity Verification became mandatory on 18 November 2025. All new directors must verify at appointment. Existing directors must verify when their company next files a Confirmation Statement. Failure risks a fine of up to £5,000 per director. When it does not apply: Director Identity Verification applies to directors and PSCs of limited companies registered with Companies House. Not applicable to sole traders or partnerships. What is at stake: Fine up to £5,000 per unverified director. Company could be struck off the register for continued non-compliance. Unverified directors commit a criminal offence. What to do: Verify your identity with Companies House via the GOV.UK One Login service. Existing directors must complete verification when their company files its next Confirmation Statement.

Official guidance: https://www.companieshouse.gov.uk/

### E-Commerce Regulations 2002: does it apply to you?

Regulation: Electronic Commerce (EC Directive) Regulations 2002 (retained UK law)
Guide: https://www.getsorted.today/guides/ecommerce_regulations/
Reviewed: 2026-06-25

Selling online to consumers likely requires you to display specific business information on your website, including a geographic address (not just a PO box), email address, and clear identification of any commercial communications. E-commerce regulations apply to information society services generally, not just B2C. B2B online businesses should review whether these disclosure requirements apply. When it does not apply: E-commerce regulations apply to online services. Not applicable if you have no website. What is at stake: Failure to provide required information may render contracts unenforceable and could attract Trading Standards attention. What to do: Ensure your website clearly displays your business name, geographic address, email, and (if VAT registered) VAT number. Commercial communications must be clearly identified as such.

Official guidance: https://www.which.co.uk/consumer-rights/

### Do you need employers' liability insurance?

Regulation: Employers' Liability (Compulsory Insurance) Act 1969
Guide: https://www.getsorted.today/guides/employers_liability/
Reviewed: 2026-06-25

Employers' Liability insurance is compulsory if you employ anyone, including part-time and casual workers. Cover must be at least £5 million. Failure to hold valid insurance risks fines of up to £2,500 per day. When it does not apply: Not required if you have no employees. If you take on staff, even one part-time worker, this becomes a legal requirement from day one. What is at stake: Fine of up to £2,500 per day for operating without valid Employers' Liability insurance. Fine of £1,000 for failure to display the certificate. What to do: Obtain Employers' Liability insurance with at least £5 million cover from an authorised insurer. Display the certificate in the workplace (physical or digital).

Official guidance: https://www.hse.gov.uk/pubns/hse40.pdf

### Do staff need a written statement of employment terms?

Regulation: Employment Rights Act 1996, section 1
Guide: https://www.getsorted.today/guides/employment_particulars/
Reviewed: 2026-07-10

Everyone you employ, including workers and part-timers, has a day-one right to a written statement of their main employment terms. Check that every person on your team has one, and that it covers all the required particulars, not just pay and hours. When it does not apply: This only applies when you employ staff. If you hire anyone, prepare a written statement or employment contract before their first day, it is a day-one legal right. What is at stake: A tribunal can award an extra 2 to 4 weeks' pay per person on top of any other successful claim if you failed to provide a compliant written statement. It also weakens your position in any dispute about terms. What to do: Give every employee and worker a written statement of their main terms (pay, hours, holiday, place of work, notice periods and more) on or before their first day. A compliant employment contract covers this. Use the GOV.UK employment contract guidance to check the required particulars.

Official guidance: https://www.gov.uk/employment-contracts-and-conditions/written-statement-of-employment-particulars

### Employment Rights Act 2025: does it apply to you?

Regulation: Employment Rights Act 2025 (provisions rolling out from 2026)
Guide: https://www.getsorted.today/guides/employment_rights_2025/
Reviewed: 2026-06-25

The Employment Rights Act 2025 is introducing new day-one rights for employees rolling out through 2026, including parental and paternity leave from the first day of employment. Existing employment contracts may need reviewing to ensure compliance. When it does not apply: Employment Rights Act 2025 obligations apply to employers. Not applicable if you have no employees. What is at stake: Employment tribunal claims from day one of employment. Existing contracts may need updating. What to do: Review employment contracts to ensure they reflect day-one rights including parental leave and paternity leave. Seek legal advice if you have existing staff contracts that predate the Act.

Official guidance: https://www.acas.org.uk/

### Does your website need to be accessible?

Regulation: Equality Act 2010, Section 29 (provision of services)
Guide: https://www.getsorted.today/guides/equality_act_accessibility/
Reviewed: 2026-06-25

The Equality Act 2010 likely requires your website to be accessible to disabled users. While there is no specific technical standard mandated for private businesses, courts use WCAG 2.1 AA as the benchmark. An inaccessible website could constitute discrimination. The Equality Act applies to service providers generally. B2B websites should also consider accessibility, particularly if your services could be accessed by disabled individuals. When it does not apply: Web accessibility obligations apply to websites and digital services. Not applicable without a website. What is at stake: Discrimination claims from disabled users. No specific fine structure, enforced through county court claims. Reputational risk. What to do: Aim to meet WCAG 2.1 AA accessibility standards. Provide alt text for images, ensure keyboard navigation works, use sufficient colour contrast, and avoid content that relies solely on colour.

Official guidance: https://www.gov.uk/guidance/accessibility-requirements-for-public-sector-websites-and-apps

### UK GDPR: CCTV: does it apply to you?

Regulation: UK General Data Protection Regulation (UK GDPR)
Guide: https://www.getsorted.today/guides/gdpr_cctv/
Reviewed: 2026-06-25

CCTV footage constitutes personal data under UK GDPR. You likely need clear signage, a retention policy, access controls, and a reference to CCTV in your privacy notice. When it does not apply: CCTV obligations do not apply if you do not operate cameras that capture identifiable individuals. What is at stake: Operating CCTV without proper compliance is a UK GDPR breach. ICO can issue enforcement notices and fines. What to do: Display clear signage informing people CCTV is in operation. Complete a DPIA if high-risk. Retain footage only as long as necessary and restrict access. Add CCTV to your privacy notice.

Official guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/

### UK GDPR: Data Breach Response: does it apply to you?

Regulation: UK General Data Protection Regulation (UK GDPR), Article 33
Guide: https://www.getsorted.today/guides/gdpr_data_breach/
Reviewed: 2026-06-25

If you suffer a data breach (e.g. a hack, accidental disclosure, or lost device), you may need to report it to the ICO within 72 hours. You should document a basic response procedure before a breach happens, not after. When it does not apply: Data breach reporting obligations apply to controllers of personal data. Not applicable if you do not hold personal data. What is at stake: Failure to report a notifiable breach within 72 hours is itself a breach. Fines up to £17.5M or 4% of global turnover. What to do: Document a basic breach response procedure. Know that personal data breaches likely to result in risk to individuals must be reported to the ICO within 72 hours.

Official guidance: https://ico.org.uk/for-organisations/

### Can customers request their data?

Regulation: UK General Data Protection Regulation (UK GDPR), Articles 15–22
Guide: https://www.getsorted.today/guides/gdpr_individual_rights/
Reviewed: 2026-06-25

Anyone whose data you hold can submit a Subject Access Request (SAR). You must respond within 30 days, for free. Ensure you have a process, even informally, to handle these requests. When it does not apply: Individual rights obligations are unlikely to apply if you do not collect personal data. What is at stake: Failure to respond to subject access requests within 30 days is an ICO-enforceable breach. Fines up to £17.5M or 4% of global turnover. What to do: Ensure you have a process to respond to Subject Access Requests (SARs) within 30 days at no charge. Know how to handle requests to erase, rectify, or restrict data.

Official guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/

### Do you need a privacy notice?

Regulation: UK General Data Protection Regulation (UK GDPR), Articles 13 & 14
Guide: https://www.getsorted.today/guides/gdpr_privacy_notice/
Reviewed: 2026-06-25

A privacy notice is likely required on your website. It must explain what personal data you collect, why, how long you keep it, and people's rights over it. Even without a website, you likely need a privacy notice if you collect personal data offline. It should be provided at the point of collection, e.g. on a form or by email. When it does not apply: A privacy notice is likely not required if you do not collect personal data. What is at stake: Fines up to £17.5M or 4% of global turnover under UK GDPR What to do: Publish a privacy notice on your website and provide it to anyone whose data you collect. Templates available via the ICO.

Official guidance: https://ico.org.uk/for-organisations/

### Health & Safety at Work: does it apply to you?

Regulation: Health and Safety at Work etc. Act 1974 & Management of Health and Safety at Work Regulations 1999
Guide: https://www.getsorted.today/guides/health_and_safety/
Reviewed: 2026-06-25

Employers have a legal duty to ensure the health, safety, and welfare of employees. This requires a risk assessment, written health and safety policy (if 5+ employees), and in many cases registration with relevant authorities. Even without employees, self-employed people and business owners have health and safety duties, particularly if customers or members of the public visit your premises. When it does not apply: Health and safety employer duties primarily apply when you have employees or a premises. Sole traders working alone from home have minimal obligations. What is at stake: HSE prosecution, unlimited fines, and imprisonment for serious breaches. Improvement and prohibition notices. What to do: Carry out a written risk assessment covering significant hazards. If you have 5 or more employees, the assessment must be written down. Register with your employer's liability insurer and display the HSE law poster.

Official guidance: https://www.hse.gov.uk/simple-health-safety/

### Do you need to register with the ICO?

Regulation: Data Protection (Charges and Information) Regulations 2018
Guide: https://www.getsorted.today/guides/ico_registration/
Reviewed: 2026-06-25

Most businesses that process personal data must register with the ICO and pay an annual fee of £52. Failure to register is a criminal offence with fines up to £4,350. When it does not apply: Registration is likely not required if you do not collect or process any personal data. This is rare, verify you have no contact forms, employee records, or customer lists. What is at stake: Fine up to £4,350 for failure to register or renew What to do: Register at ico.org.uk/for-organisations/data-protection-fee, £52/year for micro-organisations (under 10 staff or under £632,000 turnover)

Official guidance: https://ico.org.uk/for-organisations/data-protection-fee/

### Does Making Tax Digital apply to you?

Regulation: Finance Act 2021, Making Tax Digital for Income Tax Self Assessment (MTD ITSA)
Guide: https://www.getsorted.today/guides/making_tax_digital/
Reviewed: 2026-06-25

Sole traders and landlords with qualifying income over £50,000 must use Making Tax Digital-compatible software and file quarterly updates from 6 April 2026. The threshold drops to £30,000 in April 2027. Check whether your income exceeds the current threshold. When it does not apply: MTD for Income Tax applies to sole traders and landlords filing Self Assessment, not to limited companies. Corporation Tax MTD is planned separately. What is at stake: Penalties for late or incorrect quarterly submissions. HMRC may issue penalty points under the new penalty regime. What to do: If your qualifying income exceeds £50,000, you must use MTD-compatible software from 6 April 2026 and file quarterly updates to HMRC. The threshold drops to £30,000 from April 2027.

Official guidance: https://www.gov.uk/guidance/use-making-tax-digital-for-income-tax

### PCI DSS: Payment Card Security: does it apply to you?

Regulation: Payment Card Industry Data Security Standard (PCI DSS v4.0)
Guide: https://www.getsorted.today/guides/pci_dss/
Reviewed: 2026-06-25

Any business that accepts card payments must comply with PCI DSS. If you use a hosted payment provider (Stripe, Square, PayPal), your scope is minimal, but you still need to complete an annual Self-Assessment Questionnaire via your acquirer. When it does not apply: PCI DSS applies only to businesses that accept, process, or store card payment data. What is at stake: Card scheme fines, bank penalties, and liability for fraudulent transactions if non-compliant. Breaches can result in losing the ability to accept card payments. What to do: Complete your annual PCI DSS Self-Assessment Questionnaire (SAQ) via your payment provider. Using Stripe, Square, or similar hosted solutions significantly reduces your PCI scope.

Official guidance: https://www.pcisecuritystandards.org/

### Do you need a cookie consent banner?

Regulation: Privacy and Electronic Communications Regulations 2003 (PECR)
Guide: https://www.getsorted.today/guides/pecr_cookie_consent/
Reviewed: 2026-06-25

Websites using analytics, advertising, or any non-essential cookies likely need a compliant consent mechanism. The ICO has updated its storage and access technologies guidance, implied consent is not sufficient. When it does not apply: Cookie consent rules apply to websites and apps. Not applicable if you have no website. What is at stake: Fines up to £17.5M or 4% of global turnover (raised from £500K in 2024) What to do: Implement a cookie consent banner that blocks non-essential cookies until the user accepts. Strictly necessary cookies (e.g. login sessions) do not require consent.

Official guidance: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/

### Do you need consent to send marketing emails?

Regulation: Privacy and Electronic Communications Regulations 2003 (PECR)
Guide: https://www.getsorted.today/guides/pecr_email_marketing/
Reviewed: 2026-07-10

Opt-in consent is likely required before sending marketing emails to individuals. Soft opt-in may apply for existing customers if you're promoting similar products. Bought-in lists are almost always non-compliant. Emails to corporate addresses (B2B) sit outside the consent rule, but sole traders and partnerships count as individuals under PECR, so cold outreach to them still needs consent. When it does not apply: PECR email marketing rules do not apply if you do not send marketing emails or texts. What is at stake: Fines up to £17.5M or 4% of global turnover. ICO issued 119 PECR fines totalling ~£10.5M between 2019 and 2025. What to do: Ensure you have valid opt-in consent before sending marketing emails to individuals. Keep records of consent. Provide an unsubscribe mechanism in every message.

Official guidance: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/

### Do you need to set up a workplace pension?

Regulation: Pensions Act 2008 & Pensions (Extension of Automatic Enrolment) Act 2023
Guide: https://www.getsorted.today/guides/pension_auto_enrolment/
Reviewed: 2026-06-25

If you employ anyone aged 18–74 earning above the lower earnings threshold, you must auto-enrol them into a qualifying workplace pension and make minimum contributions. From April 2026, the age threshold drops to 18 and the lower earnings limit is removed. When it does not apply: Pension auto-enrolment obligations only apply when you employ staff. No action required if you have no employees. What is at stake: Fines from The Pensions Regulator (TPR): fixed penalty £400, escalating penalties up to £10,000 per day for continued non-compliance. What to do: Enrol all eligible employees into a workplace pension scheme. Minimum employer contribution is 3% of qualifying earnings. From April 2026, the age threshold drops to 18 and contributions begin from the first pound earned.

Official guidance: https://www.thepensionsregulator.gov.uk/en/employers

### Do you need to check employees' right to work?

Regulation: Immigration, Asylum and Nationality Act 2006
Guide: https://www.getsorted.today/guides/right_to_work/
Reviewed: 2026-07-10

Every employer must check that each employee has the right to work in the UK before employment starts, including British citizens. Penalties apply per worker, and checking correctly before day one gives you a statutory excuse against a civil penalty. Make sure you have a consistent process and keep records. When it does not apply: Right to work checks only apply when you employ people. If you take on staff, check their right to work before their first day, the check itself is free and takes minutes online. What is at stake: Civil penalty of up to £45,000 per illegal worker for a first breach, rising to £60,000 per worker for repeat breaches within three years. Knowingly employing someone without the right to work is a criminal offence with up to 5 years' imprisonment and an unlimited fine. What to do: Check every new hire's right to work before their first day, using the Home Office online check for those with a share code, an IDVT identity provider for British and Irish citizens with valid passports, or an in-person document check. Keep a copy of each check for the duration of employment plus two years.

Official guidance: https://www.gov.uk/check-job-applicant-right-to-work

### Do you have to pass on 100% of tips to staff?

Regulation: Employment (Allocation of Tips) Act 2023
Guide: https://www.getsorted.today/guides/tips_act/
Reviewed: 2026-07-10

In force since 1 October 2024, if your workers receive tips, gratuities or service charges more than occasionally, you must pass them on in full, allocate them fairly, keep a written policy, and hold records for three years. If tips never feature in your business, this does not affect you. When it does not apply: The Tips Act only applies to employers whose workers receive tips. With no staff, there is nothing to allocate. What is at stake: Workers can bring a tribunal claim within 12 months of a breach. Tribunals can order you to revise your allocation, order payments to workers, and award up to £5,000 per worker for financial loss. What to do: If your staff receive tips more than occasionally, pass on 100% of tips, gratuities and service charges to workers by the end of the month after they were received, with no deductions except tax. Keep a written tips policy available to all staff and records of allocations for three years. Follow the statutory Code of Practice on fair and transparent distribution.

Official guidance: https://www.gov.uk/government/publications/distributing-tips-fairly-statutory-code-of-practice

### Do you need to register for VAT?

Regulation: Value Added Tax Act 1994
Guide: https://www.getsorted.today/guides/vat_registration/
Reviewed: 2026-07-10

You likely need to register for VAT. Registration is mandatory once VAT-taxable turnover passes £90,000 in any rolling 12-month period, or as soon as you expect to pass it within the next 30 days. Once registered you must charge VAT, file returns digitally under Making Tax Digital, and can reclaim VAT on purchases. When it does not apply: Below the £90,000 threshold VAT registration is not required. Keep checking your rolling 12-month turnover at each month end, the test is not your accounting year. Voluntary registration is possible and can make sense if your customers are VAT-registered businesses. What is at stake: Late registration penalties of 5% of the VAT owed (up to 9 months late), 10% (9 to 18 months) or 15% (over 18 months), with a £50 minimum. You must also account for VAT on all sales back to the date you should have registered, even though you did not charge it to customers at the time. What to do: Check your rolling 12-month VAT-taxable turnover at the end of every month. If it passed £90,000, register with HMRC within 30 days of the end of that month. Register immediately if you expect to pass £90,000 in the next 30 days alone. Registration is at gov.uk/register-for-vat.

Official guidance: https://www.gov.uk/register-for-vat