Record Keeping and ATO Data Matching

What records Australian businesses must keep and for how long, the ATO's 20+ programs, small business benchmarks, lifestyle asset checks, TPAR reporting, the Sharing Economy Reporting Regime, and the consequences of poor records.

Australian businesses must keep records of all transactions relevant to their tax, super, and registration obligations for at least five years from lodgement, with depreciating asset records held for the life of the asset plus five years after disposal. The ATO operates more than 20 programs in 2025-26, cross-referencing returns against data from banks, property registries, share brokers, ride-sourcing platforms, online selling marketplaces, and the TPAR contractor-payment system. Discrepancies between third-party data and declared income are flagged automatically for review or audit.

Last reviewed: 28 May 2026

Guidance, not advice. We explain the rules, we don't assess your situation. Always seek financial or tax advice from your accountant, or contact ATO. Read our editorial scope →

What records you must keep

The ATO requires records of all transactions relevant to your tax, super, and registration obligations. The obligation extends beyond receipts to include financial statements, invoices issued, bank statements, logbooks, asset records, elections, choices, estimates, and the basis for any calculations (such as home-office methods or business-use percentages).

Income records

All documents relating to business income and sales: invoices issued, receipts from cash or card sales, bank statements showing deposits, and online payment records (including contractor platform payouts). Investment income statements covering interest, dividends, rental income, and managed fund distributions.

Expense records

Written evidence for deductions: receipts and tax invoices for all business expenses including supplies, tools, software, phone, internet, utilities, insurance, marketing, professional fees, and vehicle and travel costs. Where an expense is partly private, records must clearly show how you calculated the business portion.

Asset and depreciation records

For depreciating assets: records of purchase, improvements, and disposal including date, cost, and private-use apportionment. Kept for as long as you hold the asset and five years after disposal. For CGT assets (property, shares): acquisition records, cost-base elements, and disposal details for the period needed to calculate capital gains, plus five years after the CGT event.

GST and BAS records

If registered for GST: tax invoices and adjustment notes for both sales and purchases, plus working papers showing how BAS amounts were calculated (GST collected, GST paid, corrections, GST-free or input-taxed sales). Same five-year retention rule unless a longer period is required.

Retention periods

The standard period is five years from lodgement or completion of the transaction, but several categories require longer retention.

Digital records and the ATO myDeductions tool

Digital records are fully acceptable. The ATO app includes the myDeductions tool, which lets individuals and sole traders record income, expenses, work-related car trips, and working-from-home hours with attached photos of receipts and invoices. Records stored in myDeductions can be exported to your tax agent or uploaded to pre-fill your tax return.

ATO programs

The ATO runs formal programs obtaining bulk data from third-party sources and comparing it with taxpayers' returns. In 2025-26, more than 20 separate protocols operate simultaneously. Discrepancies between third-party data and declared amounts are flagged for review or audit.

Financial institutions and investments

Banks report interest and other income to the ATO for pre-fill and compliance. Share registries, brokers, and managed funds provide data on share trades, dividends, and fund distributions. This data is cross-checked against capital gains reporting and investment income declarations.

Property and rentals

State and territory land titles offices and property registries provide sale and purchase data, matched against CGT and income tax reporting. Property managers, rental bond authorities, and online accommodation platforms (Airbnb, Stayz) supply data to verify rental income and short-term accommodation revenue.

The ATO has run ride-sourcing with platforms such as Uber since before 2020. From 1 July 2023, the Sharing Economy Reporting Regime requires electronic distribution platforms for ride-sourcing and short-term accommodation to report identification and payment information to the ATO on an ongoing basis. From 1 July 2024, this extends to other sharing-economy transaction types.

Contractor payments (TPAR)

Businesses in building and construction, cleaning, couriers, IT, security, and other covered industries must lodge a Taxable Payments Annual Report listing payments to contractors. The ATO cross-matches these reports against contractor tax returns to detect undeclared income. TPAR is due by 28 August each year.

Cryptocurrency and digital assets

The ATO obtains cryptocurrency transaction data from designated service providers going back to 2014. This data identifies undeclared capital gains and income from digital assets. All crypto transactions must be documented with dates, amounts, and AUD values at the time of each event.

Small business benchmarks and risk profiling

The ATO publishes performance benchmarks for more than 100 industries, derived from real business data. Benchmarks cover cost-of-sales to turnover, total expenses to turnover, labour as a percentage of turnover, rent as a percentage of turnover, and profit margins. Businesses whose reported figures fall outside the middle 50% of their industry are more likely to be selected for review.

Lifestyle asset checks

The ATO uses data matching on high-value assets to detect mismatches between declared income and spending patterns. Current lifestyle-asset program thresholds include motor vehicles at $65,000 or more, marine vessels at $100,000 or more, plus caravans, motorhomes, horses, fine art, and aircraft. The stated aim is identifying omitted income, unreported capital gains, incorrect GST or FBT treatment, and SMSF breaches.

Pre-fill and automated checks

The ATO pre-fills individual returns with data from banks, employers, managed funds, share registries, government agencies, and private health insurers. Pre-fill allows automated detection of differences between third-party reports and what the taxpayer lodges. Mismatches trigger follow-up letters, adjustments, or audits.

Consequences of poor records and non-compliance

The ATO enforces record-keeping obligations through escalating consequences.

Disallowed deductions and default assessments

Without adequate substantiation, deductions can be denied and you may be required to repay tax plus interest. Where income is under-reported or records are unreliable, the ATO can issue default or amended assessments based on its own estimates of your income, using results and industry benchmarks.

Administrative penalties

Penalties of up to 20 penalty units (approximately $6,000 or more at current values) for failing to keep required records. Additional penalties for false or misleading statements. Late-lodgement penalties can scale rapidly as documents become more overdue.

Criminal offences

Failing to retain tax records for at least five years can constitute a criminal offence with statutory fines based on penalty units. Intentional destruction, falsification, or concealment of records can be prosecuted under taxation and criminal laws dealing with tax evasion and fraud, carrying consequences far more serious than administrative penalties.

Best practice for self-employed Australians

Seven practices that significantly reduce compliance risk and audit exposure.

Statute references

Taxation Administration Act 1953, Schedule 1 (record-keeping obligations, GIC, administrative penalties)
Income Tax Assessment Act 1997 Division 900 (substantiation rules)
Sharing Economy Reporting Regime (from 1 July 2023, platform reporting obligations)
ATO small business benchmarks (industry-specific performance ratios)
ATO program protocols (published protocol summaries)
TAA Sch 1 Division 382 (record-keeping obligations — generally 5 years from later of return lodgement or transaction)
Privacy Act 1988 (Cth) Australian Privacy Principles (APP 6) — limits ATO use of information
Privacy Act 1988 (Cth); OAIC Guidelines on Data Matching in Australian Government Administration (2014); ATO Data Matching Protocols (published per programme on the Federal Register of Legislation)
TAA Sch 1 s 353-10 (Commissioner's information-gathering power supporting exchanges)

Frequently asked questions

Can I keep only digital records and dispose of paper originals?+

Yes. The ATO accepts records in electronic form provided they are accurate, readable, and in English (or easily convertible to English). Photos or scans of receipts are acceptable written evidence if the images are clear and properly stored and backed up. Once you have good digital copies, you do not need to retain the original paper receipts. The ATO's myDeductions app is one endorsed tool for this purpose.

What are ATO small business benchmarks and should I worry about them?+

The ATO publishes performance benchmarks for more than 100 industries, covering ratios such as cost-of-sales to turnover, total expenses to turnover, labour as a percentage of turnover, and profit margins. These are derived from real business data. If your reported figures fall significantly outside the expected ranges for your industry, you are more likely to be selected for review. Proactively comparing your numbers against published benchmarks is one of the simplest ways to identify reporting errors before the ATO does.

What is a TPAR and who needs to lodge one?+

A Taxable Payments Annual Report (TPAR) is required from businesses in certain industries (building and construction, cleaning, couriers, IT, security, and others) that make payments to contractors. The report lists each contractor's name, ABN, gross payments, and GST component. It is lodged by 28 August each year and feeds directly into the ATO's programs. If you are a head contractor in a covered industry and you pay subcontractors, assume TPAR applies.

Does the ATO track cryptocurrency transactions?+

Yes. The ATO has been obtaining cryptocurrency transaction data from designated service providers going back to 2014. This data is matched against taxpayers' returns to identify undeclared capital gains and income from digital assets. If you hold or trade crypto assets, all transactions must be recorded with dates, amounts, and values in Australian dollars at the time of each transaction.