Aqsa Khan v HMRC [2026] UKFTT 1205 (TC), released 18 August 2026, is not a technical VAT point for the tax team to file and forget. It is a board-level personal-liability case. The First-tier Tribunal dismissed the sole director’s appeal against a Personal Liability Notice (PLN) for £1,492,869 — 70% of the VAT HMRC said Best Buy Scot Limited failed to declare on its final three returns (periods 11/20, 02/21 and the final period to 27 April 2021).
The company penalty sat under Schedule 24 to the Finance Act 2007. The PLN put 100% of that deliberate-inaccuracy penalty on the director personally. Her defence was company hijacking: identity stolen, metal trading done in the company’s name without her knowledge. The Tribunal rejected that case on the balance of probabilities. HMRC kept the PLN.
Primary sources: the full judgment on Find Case Law, Claritax’s note on Khan and missing-trader PLNs, HMRC’s CH81150 (deliberate but not concealed), officers’ liability in Sch 24 para 19, culpability in Sch 24 para 3, practitioner guidance on PLNs, and HMRC’s CC/FS7a factsheet.
What a Schedule 24 PLN actually does
Schedule 24 FA 2007 charges a penalty where a person gives HMRC a document containing an inaccuracy that understates tax, inflates a loss or inflates a claim, and the behaviour is careless or deliberate. For companies, paragraph 19 is the knife edge: if the company penalty is for a deliberate inaccuracy attributable to an officer, HMRC may issue a written notice making that officer personally liable for all or part of the company penalty. “Officer” includes a director, shadow director, manager or secretary. No criminal conviction is required. The civil bill often lands after the company is insolvent.
Penalty scale before disclosure reductions is brutal:
- Deliberate but not concealed — typically up to 70% of potential lost revenue (the Khan quantum).
- Deliberate and concealed — up to 100%.
HMRC’s CH81150 line is practical: a deliberate inaccuracy exists where the person gives a document they know contains an inaccuracy. HMRC need not prove they knew the correct figure — only that they knew the figure they put in was wrong, or deliberately failed to take the steps needed to make it right. Large, patterned omissions of sales are classic deliberate territory.
What the Tribunal actually found in Khan
Best Buy Scot Limited was incorporated in February 2018 with Ms Khan as sole director and shareholder. The stated story was clothing retail from Market Village in Glasgow’s Forge shopping centre, run day-to-day by her husband while she had other employment. The company registered for VAT. The disputed returns omitted substantial metal-trading outputs. HMRC treated the under-declarations as deliberate and attributable to her as sole director.
Her case was hijacking: she said she never traded metals and someone else used Best Buy’s identity. The Tribunal preferred contemporaneous documents — rental invoices, wholesaler receipts, Companies House filings, VAT history, CJRS claims — over late oral reconstruction. Key findings included:
- No credible commercial reason for incorporating Best Buy when the family clothing trade had long run without a company, and the husband continued as a sole trader on the Market Village invoices.
- No credible basis for compulsory VAT registration at the claimed threshold, and no good reason for remaining VAT-registered while filing nil returns.
- Financial statements for the early periods were not credible; the director could not explain them.
- The Market Village rental trail did not evidence Best Buy as the clothing retailer at the claimed unit.
- There was no reliable retail sales documentation. Record-keeping was accepted, with hindsight, as inadequate.
- The hijacking chain required a long sequence of assumptions. Possibility was not enough. On the balance of probabilities, hijacking was not proved.
- She had also demonstrated capacity for dishonest behaviour on other points, including CJRS claims after the date she said trading had ceased.
Outcome: inaccuracy yes; deliberate yes; attributable to the director yes; hijacking no. Appeal dismissed. PLN confirmed. Separately, the Insolvency Service had banned her from acting as a director for seven years from 28 November 2025 for failure to maintain adequate accounting records — a governance red flag admitted into evidence.
Why CFOs should care even if they are not sole traders in metals
PLNs are not confined to small retail shells. Groups with dormant subsidiaries, nominee directors, thin PE holdco boards, franchise SPVs or paper directors who rubber-stamp returns sit in the same risk family. The test is attribution of a deliberate company inaccuracy to an officer. Sleeping directors are not a safe harbour. “My accountant filed it” fails if the officer knew the volumes or deliberately failed to supervise.
Three board-level lessons from Khan:
- Identity and VAT registration are assets with residual risk. A live VAT number plus a passive director is a product for fraudsters — and if the tribunal does not accept hijacking, the residual risk sits with the named officer. Protect Companies House filings, bank mandates, Government Gateway / Agent Services access, and VAT Online credentials with the same seriousness as treasury payment rails.
- Nil returns are not free. A pattern of nils while a registration stays live, or while other state support (CJRS, BBLs) is claimed, creates a documentary narrative HMRC and tribunals will read against you. If the company is not trading, de-register and close cleanly. If it is trading, the books must show it.
- Contemporaneous evidence beats recollection. Khan is another Gestmin-style case: years later, memory is rebuilt around the desired story. Rent invoices, bank statements, timesheets, invoice sequences and VAT control accounts decide attribution. If your ERP cannot produce a clean audit trail from sale to return box, you are litigating on hope.
The control stack every finance leader should lock this quarter
Run this checklist across every UK company where a human officer could attract a PLN:
- Officer map — list every director, shadow director and “manager” who can cause a return to be given. Confirm who actually reviews VAT, CT, PAYE and CIS returns before submission. Document that review.
- Dormant / low-activity entities — either genuine trade with real books, or voluntary VAT de-registration and orderly strike-off. Do not leave empty VAT registrations “just in case”.
- Access control — dual control on VAT Online, Agent Services Account, Companies House authentication codes, and bank account opening. Log third-party agent changes. Treat lost ID / driving-licence incidents as security events, not admin noise.
- Output completeness controls — bank-to-sales reconciliations, unusual commodity or customer spikes, new supplier/customer onboarding with beneficial-ownership checks, and exception reports for high-value B2B trades outside core products (metals, electronics, labour supply, carbon, alcohol).
- Record retention — statutory VAT records, working papers behind every return box, and evidence of director challenge. The Insolvency Service ban in Khan sat on records failure; that evidence did not help the tax appeal either.
- Disclosure posture — if an inaccuracy is found, quality of disclosure still drives penalty reduction. Unprompted, full, and documented is cheaper than tribunal theatre. See HMRC’s inaccuracy penalty framework in CC/FS7a and the Compliance Handbook starting at CH81000.
- Insurance and indemnities — check D&O wording for civil tax penalties and deliberate-act exclusions. PLNs are often uninsured after insolvency.
Related PLN and VAT fraud architecture still in force
Khan sits alongside the wider UK VAT fraud toolkit. Input tax denial under the Kittel principle attacks the company where it knew or should have known of a connection to fraudulent evasion — see HMRC’s VATF52100 and VAT Notice 726. Schedule 24 penalties and PLNs attack the document and the officer. Joint and several liability notices under Finance Act 2020 can still reach directors in repeated insolvency settings. None of these regimes require a criminal MTIC prosecution first. For PE and group CFOs: diligence should include officer PLN history, open deliberate-behaviour enquiries, VAT registration hygiene, and shadow-director risk under paragraph 19 where consultants effectively run the tax function.
What to do this week
If you only do four things after reading Khan:
- Pull every UK entity’s last eight VAT returns and ask who signed off the numbers and how bank receipts reconcile to Box 6.
- Identify any company with a live VAT number and no real trade — fix registration status or restart proper books immediately.
- Confirm backup officers and dual control on digital tax credentials; rotate anything shared with departed agents.
- Brief the board audit committee that deliberate company VAT inaccuracies can become personal director debt at 70–100% of potential lost revenue, company insolvency notwithstanding.
The Tribunal was careful about the human consequences and still upheld the PLN. Limited liability protects share capital. It does not automatically protect a director from Schedule 24 personal liability when HMRC proves a deliberate company inaccuracy attributable to that officer. Build the controls before the notice arrives.
This article is general information for finance leaders, not advice on any person’s tax affairs. Always take advice on specific facts. Primary judgment: Khan v HMRC [2026] UKFTT 1205 (TC).