ATO compliance

The ATO publishes an Operational Framework for Digital Service Providers that sets minimum security and operational requirements for software that interacts with ATO systems. The framework distinguishes between providers that consume ATO-supplied data (for example, through SBR) and those that do not.

ReconLink does not currently interact directly with ATO systems and is therefore not required to be whitelisted under the DSP framework. Where customers ask us to integrate with an ATO channel in the future — for example, pre-fill BAS values via SBR — we will undertake the DSP onboarding process, including the relevant security assessment (currently the Australian Government Information Security Manual (ISM) and the DSP security questionnaire), before enabling that functionality.

Our BAS workflow respects per-tenant GST codes (GST, FRE, INP, N-T, CAP). Where a practice integrates with an external accounting platform (for example, Xero, MYOB or QuickBooks), our roadmap is to fetch the tenant’s actual tax rates dynamically rather than hardcoding the standard 10% GST rate, so that variations and out-of-cycle rates are reflected correctly.

Australian tax law requires businesses to retain records relating to GST, BAS and income tax for at least five years (see, for example, section 262A of the Income Tax Assessment Act 1936 (Cth) and the equivalent provisions of A New Tax System (Goods and Services Tax) Act 1999 (Cth)). We support this by:

• Retaining the original PDF, CSV or Excel source document linked to every committed statement import for the longer of (a) five years from the end of the relevant financial year, or (b) the active life of the subscription;
• Generating an immutable audit trail of every coding decision and every change to a BAS worksheet, exportable on demand;
• Allowing source-document export on subscription termination for at least 60 days, and longer where the ATO retention period has not yet expired.

We do not solicit Tax File Numbers (TFNs) from individuals or businesses through the Service. Where a TFN appears in an uploaded source document, it is treated as confidential and subject to the additional handling rules in the Privacy (Tax File Number) Rule 2015. ABNs and ACNs are not subject to those rules but we still treat them as confidential business information.

Auto-coding accuracy on the ReconLink platform is high but is not 100%. Low-confidence rows are flagged for review, but the practitioner remains responsible for checking and signing off on every reportable figure before relying on it for lodgement. We provide tools to make that review fast and auditable; we do not replace professional judgement.

Bank transaction data sourced through Basiq is delivered under the Consumer Data Right regime in Part IVD of the Competition and Consumer Act 2010 (Cth). Basiq is an Accredited Data Recipient and operates under the CDR Privacy Safeguards. When you authorise ReconLink to retrieve a client’s transactions through Basiq, you are confirming that you have your client’s consent and that the use case (preparation of bookkeeping and BAS outputs) is consistent with that consent.

For compliance questions or to request artefacts (security questionnaires, sub-processor lists, architecture diagrams), email info@reconlink.com.au. We aim to respond within five business days.