A UK practice that sends bookkeeping, tax return preparation, or year-end work to an offshore team is not entering unregulated territory. It is also not following a single rulebook. The obligations are spread across the professional body’s ethics code, data protection law, anti-money laundering rules, and HMRC’s expectations of agents. Each is manageable, and none is optional. This is what a firm needs to have in place, set out against the sources.
There is no outsourcing rulebook, and that is the point
Neither the ICAEW nor the ACCA publishes a standalone rule on outsourcing. ACCA states plainly that it does not have specific regulations on outsourcing and offshoring, and that the general provisions of the code apply. The ICAEW’s practical guidance sits in a members’ helpsheet on using subcontractors, not in a dedicated outsourcing regime.
That does not reduce the obligations. It means they have to be assembled from provisions written for wider purposes: confidentiality, supervision, due diligence on the people a firm relies on, and the firm’s continuing responsibility for the client service.
Confidentiality under the ICAEW Code
The ICAEW Code of Ethics 2026, which has applied since 1 July 2026, carries forward the confidentiality provisions of the previous edition. Three parts matter for outsourcing.
The duty extends to the people you use. R114.1(d) requires an accountant to take reasonable steps to ensure that personnel under their control, and individuals from whom advice and assistance are obtained, comply with the accountant’s duty of confidentiality. An offshore team falls squarely within that.
The duty covers the whole life of the data. The application material at 114.1 A1 refers to protecting confidential information through its collection, use, transfer, storage or retention, dissemination, and lawful destruction. Sending client records to another country is a transfer, and the firm has to be able to show how the information is protected at each stage.
Disclosure needs a basis. R114.3 allows confidential information to be disclosed where there is a legal or professional duty or right to do so, or where the client authorises it and the law does not prohibit it. The code does not contain a rule saying “obtain consent before outsourcing”, but client authorisation is the route the code provides, and 114.3 A2 identifies the privacy law of the jurisdiction where disclosure might take place as a relevant factor.
Two further provisions complete the picture. R113.2 requires appropriate training and supervision for those working in a professional capacity under the accountant’s authority. R220.7 and its application material ask the accountant, when relying on the work of others, to consider their reputation, expertise, resources, and whether they are subject to professional standards. That is the code’s basis for due diligence on a provider.
The ACCA position is stricter on disclosure
ACCA members apply the ACCA Code of Ethics and Conduct, which is built on the same international code. ACCA’s supplementary requirements go further on confidentiality: a member should not disclose client information to third parties without first obtaining permission from the client.
In practice, the engagement letter is where that permission is obtained. The engagement letter templates for tax practitioners published jointly by ACCA, CIOT, ATT, and AAT, updated in March 2026, include wording that the firm may on occasion subcontract work on the client’s affairs to other tax or accounting professionals, who will be bound by the firm’s confidentiality and security terms. The accompanying guidance is clear that the practitioner remains responsible for confidentiality where work is subcontracted or outsourced, and the template privacy notice lists subcontractors among the recipients of client data.
A firm using an offshore team should check that its engagement letters and privacy notice say so, in terms a client would recognise, before the first file is sent.
UK GDPR: roles, contracts, and the transfer
Roles. When an accountant acts for a client, the ICO’s guidance treats the accountant as a controller of the client’s personal data. An offshore provider that works only on the firm’s documented instructions is likely to be a processor. The labels depend on the facts, so the arrangement should be checked, not assumed.
The processor contract. Article 28(3) of UK GDPR sets out what the contract between a controller and a processor must contain: processing only on documented instructions, including instructions about international transfers; confidentiality commitments from the provider’s staff; appropriate security; conditions for using sub-processors; assistance with data subject rights and breaches; deletion or return of data at the end; and access for audits and inspections. A provider that cannot sign up to these terms is not ready to work for a UK firm.
The international transfer. Sending personal data to a provider outside the UK is a restricted transfer. The ICO’s guidance sets out the sequence: rely on UK adequacy if the destination has it; if not, put appropriate safeguards in place, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses, supported by an assessment; and only then consider the limited exceptions.
Adequacy. The UK’s adequacy list covers the EEA and a defined set of other jurisdictions, including Switzerland, New Zealand, Israel, and the Republic of Korea, with partial coverage for Canada, Japan, and the US data bridge. Bahrain and Pakistan are not on it. A transfer to a provider in either country therefore needs an IDTA or the UK Addendum.
The new test. The international transfer reforms in the Data (Use and Access) Act 2025 came into force on 5 February 2026. The standard for safeguards is now whether the protection in the destination is not materially lower than in the UK, and what was previously called a transfer risk assessment is now referred to in the legislation as the data protection test. A firm transferring data to an offshore provider should have that test documented, alongside the contract.
Anti-money laundering stays with the firm
Outsourcing is not the same as reliance under the Money Laundering Regulations 2017. Regulation 39 allows a firm to rely on another regulated person for customer due diligence in defined circumstances, and even then the firm remains liable for any failure. Where a firm uses an agent or outsourcing provider, Regulation 39(7) requires the arrangements to keep the firm itself liable. The ICAEW’s subcontractor guidance adds that AML responsibilities remain with the firm, and that subcontractors should be brought within the firm’s screening and AML training.
The practical consequence is that an offshore team can prepare the work, but the firm’s money laundering compliance principal and its own CDD processes stay in charge.
HMRC access and the Agent Services Account
HMRC’s guidance on the Agent Services Account covers giving access to the firm’s own staff. We have found no HMRC guidance that contemplates an offshore third party using the firm’s agent credentials, and HMRC’s Standard for agents, updated in February 2026, expects agents to keep online access and account credentials safe from unauthorised use. The safe model is for the offshore provider to prepare returns and working papers, with submission and any contact with HMRC handled by the firm.
The same model keeps the arrangement clear of the mandatory registration for tax advisers introduced by the Finance Act 2026, which began on 18 May 2026 and turns on whether a person interacts with HMRC on a client’s behalf. A provider that never deals with HMRC directly appears to fall outside it, though a firm should confirm the position for its own arrangement.
Professional indemnity insurance
No ICAEW or ACCA PII regulation was found that expressly requires a firm to disclose outsourcing to its insurer. The guidance points the same way regardless: the ICAEW’s subcontractor helpsheet notes that a subcontractor’s name and status need to be advised to insurers for the policy’s protections to extend to them, and ACCA notes that insurers may attach conditions, exclusions, or higher premiums to offshore work, while the firm remains liable to its clients. Telling the insurer before the arrangement starts is the prudent course.
A checklist before the first file is sent
- Engagement letters and privacy notice updated to say that work may be subcontracted, including outside the UK.
- Due diligence on the provider: qualifications, professional standards, security, and references.
- An Article 28 processor agreement with the provider, covering instructions, confidentiality, security, sub-processors, and deletion.
- A transfer mechanism: the IDTA or the UK Addendum, with a documented data protection test for the destination country.
- AML: the firm’s own CDD retained, and the provider’s staff within the firm’s screening and training.
- HMRC: submissions and HMRC contact kept with the firm, and agent credentials never shared.
- The insurer told about the arrangement in advance.
- Supervision and review: a documented review of the provider’s work, so the firm can show it supervised what it signed.
A note on scope and sources
The position above reflects the ICAEW Code of Ethics 2026, the ACCA Code of Ethics and Conduct and its supplementary requirements, the joint engagement letter guidance for tax practitioners updated in March 2026, UK GDPR and the ICO’s guidance on controllers, processors, and international transfers, the Data (Use and Access) Act 2025, the Money Laundering Regulations 2017, and HMRC’s published agent guidance, as they currently stand. It is a general guide, not legal advice, and a firm’s own arrangement should be checked against its professional body’s current guidance and, where needed, with its data protection adviser.
SRR Consultants provides white-label support to UK accounting firms from Bahrain, covering bookkeeping, tax and VAT return preparation, year-end accounts, and workpaper preparation on a white-label basis, so client contact and submissions stay with the firm. Processor and transfer terms can be discussed as part of a firm’s due diligence before any work begins. For how an engagement runs, see how we work.