A COP9 letter is the most serious civil communication HMRC sends: it means the Fraud Investigation Service suspects you of tax fraud, and it offers you a one-time deal — the Contractual Disclosure Facility. Admit the deliberate conduct, disclose everything within 60 days, cooperate fully, and HMRC contracts not to prosecute the fraud you disclose. Handle it badly — deny, delay, or disclose partially — and the criminal option comes back onto the table. Around 300 of these letters go out each year, and what the recipient does in the first two months shapes everything after.
Here is how COP9 actually works under the current (2023) code, and the decisions that matter.
What receiving COP9 means
COP9 is not a routine enquiry escalated. It is issued only where HMRC's Fraud Investigation Service suspects deliberate conduct — concealed income, false invoices, offshore structures used to hide money, suppressed takings — and it arrives with HMRC already holding information: bank data, land registry records, overseas exchange-of-information material, sometimes an informant. The letter deliberately does not say what HMRC knows. That asymmetry is the point, and it is why guessing what to disclose based on what you think they have found is the classic, catastrophic mistake.
Alongside COP9 sits its quieter sibling, COP8 — used for large or complex tax loss without suspected fraud, typically avoidance schemes. COP8 carries no immunity offer and no admission requirement, but it can convert to COP9 or criminal investigation if fraud emerges, so it deserves the same seriousness.
The 60-day decision
From receipt of the offer you have 60 days to respond, and three roads:
- Accept the CDF. This requires admitting that deliberate conduct brought about a tax loss, and submitting an Outline Disclosure within the same 60 days: what you did, how, which taxes, roughly how much. In exchange, HMRC commits not to open a criminal investigation into the fraud you disclose. The protection covers what is in the outline — material omissions forfeit it, which is why the outline is drafted with more care than any other document in the process;
- Reject it, or deny fraud. HMRC investigates on its own terms, civil or criminal, with none of the CDF's protections and your denial on file;
- Ignore it. Treated as rejection, with the same consequences plus the inference silence invites.
For anyone who has in fact done what HMRC suspects, acceptance is almost always right: prosecution risk exchanged for money. The genuinely difficult cases are the ones where conduct was careless rather than deliberate, or the recipient truly has nothing to disclose — because accepting the CDF means admitting deliberate conduct, and doing that untruthfully to buy peace creates its own problems. Those cases need specialist judgement in week one, not week seven.
After acceptance: the disclosure report and the bill
The outline is followed by a full Disclosure Report — typically prepared by specialist advisers over months: a forensic reconstruction of the irregularities, year by year, tax by tax, with certified statements of assets and full cooperation along the way. HMRC tests it against what it holds; a report that survives that testing becomes the basis of a civil settlement contract.
The money has three parts. The tax itself, with HMRC able to assess up to 20 years back for deliberate conduct. Interest for the whole period. And penalties scaled to behaviour: deliberate inaccuracies run 20–70% of the tax, deliberate and concealed 30–100%, and offshore matters up to 200% — with the actual percentage inside those ranges driven overwhelmingly by the quality of disclosure and cooperation. The difference between a grudging process and an exemplary one is routinely worth tens of percentage points, which on a 20-year liability is real money. Payment plans are negotiable; certified statements that later prove false are not survivable.
The numbers behind the process are worth knowing (all from HMRC's Fraud Investigation Service technical note to its 2025/26 annual report): 296 COP9 investigations opened in 2025/26 with in-year yield of £67 million from COP9 work specifically, while FIS as a whole ran 300 prosecutions with an 87% conviction rate. The criminal route is not theoretical; the CDF is valuable precisely because it is.
If the letter has not arrived — but could
Anyone sitting on undisclosed deliberate irregularities has a better option than waiting: a voluntary approach to HMRC, including requesting the CDF before being offered it. Voluntary disclosure buys materially lower penalties and a stronger negotiating position — and, once HMRC offers and you accept the CDF contract, the same protection from prosecution (the request alone confers nothing; the accepted contract does) — and with HMRC's data feeds (banks, platforms, overseas authorities, and from 2026 crypto exchanges) expanding yearly, "they'll never find it" is a strategy with a shortening half-life. The worst possible sequence is HMRC writing first.
Getting the handling right
COP9 is a specialist field with unforgiving mechanics: the 60-day clock, the completeness rule on the outline, the certified statements. The practical rules for a recipient are short — tell no one who does not need to know, destroy nothing, respond to nothing without advice, and appoint advisers who handle COP9 regularly rather than occasionally. Acumon's HMRC tax investigation team manages COP9 and COP8 cases end to end — the acceptance decision, outline drafting, the disclosure report and settlement negotiation — alongside tax dispute resolution for the contested cases. If the letter is on your desk, the 60 days have already started; call before you answer it.