Tax and SARS knowledge base
How do I enrol for SARS third-party data using Connect:Direct?
How do I enrol for SARS third-party-data submission using Connect:Direct?
Last reviewed:
Direct answer
SARS says Connect:Direct is a direct-data-flow channel for bulk third-party-data submissions. A taxpayer using it needs an eFiling profile, enrolment and activation for the channel, a SARS security certificate and, after a successful data submission, an authorised declaration that the submitted data is accurate.
Connect:Direct is a channel, not a substitute for data quality or governance. The team must still prepare the correct tax-type data, manage certificate security and complete SARS's declaration process.
What this means in practice
SARS lists eFiling, Connect:Direct and secure-web HTTPS as third-party-data channels. Its guide says eFiling has limited volume, while Connect:Direct enables bulk data, can reduce administrative burden and can shorten processing cycles. Choose it because the entity has an approved high-volume operating model, not because it appears simpler for a one-off upload.
The process consists of registration, activation, enrolment, submission and declaration. SARS says the first three are vital for use of eFiling and third-party-data submission, while submission and declaration are the recurring operational stages. The workflow has four distinct responsibilities: the Business Administrator enrols the legal entity and Technical Administrator, and activates the tax type; the Technical Administrator enrols Technical Users and requests the certificate; a Technical User, who must be different from the Technical Administrator, submits the data; and the business user authorises the final data declaration.
Step-by-step
- Confirm the entity, permitted third-party-data type, reporting calendar and authorised users. SARS lists types including IT3, INS, MED, TRN, Foreign Tax Information and CRS for Connect:Direct. Do not use a channel merely because another group entity uses it.
- Set up the correct eFiling profile and enable users. The Business Administrator enrols the legal entity and Technical Administrator, and activates the tax type. Keep individual credentials, roles and approvals in a current access register. Never share a login or personal authorisation code.
- Enrol the entity through the eFiling third-party-data process. The Technical Administrator enrols the Technical User and requests the SARS security certificate on behalf of the entity. The Technical User must be different from the Technical Administrator.
- Request a certificate from eFiling: Services, Enrol 3rd Party Data, Request Certificate. Accept the terms and conditions, record the interface name and follow the official email and retrieval process. Keep reference and authorisation codes confidential.
- Protect the certificate. SARS says certificates are valid for 12 months from issue and the renew option appears 30 days before expiry. Keep a monitored renewal date and restrict certificate export, storage and password access.
- Configure the approved connection and test it under the organisation's security controls. Use current SARS technical material and record the test result without treating it as a production declaration.
- The Technical User submits the prepared data file. The business user then completes the required accuracy declaration. SARS says taxpayers must authorise the data submission after successful submission. Save both the transfer response and declaration acknowledgement.
Documents and records to keep
- Entity authority, enrolment and user-rights register, identifying the Business Administrator, Technical Administrator, Technical User and business authoriser.
- Certificate request, issue status, expiry date and controlled custody record.
- Interface name, approved technical configuration and test record.
- File version, submission response and accuracy declaration acknowledgement.
- Incident and renewal log.
Important limits and exceptions
Certificate custody is security sensitive. Do not place certificate files, passwords, reference codes or authorisation codes in shared folders, tickets or ordinary email. SARS states that a revoked certificate requires contact with Third-Party Data Support through the guided process. Follow verified current SARS guidance if a credential is compromised.
A successful file transfer does not finish the compliance process. SARS expressly requires a declaration of accuracy after submission. Ensure the business approver understands what was submitted before authorising it.
When to get tailored advice
Get technical and compliance support where a certificate has expired, staff roles changed, a group uses multiple entities, a file contains sensitive AEOI data or the channel produces repeated errors. Escalate immediately if credentials may have been exposed or a filing deadline cannot be met.