Tax and SARS knowledge base
Why do I need a SARS certificate for third-party-data submissions?
Why do I need a SARS certificate for third-party-data submissions?
Last reviewed:
Direct answer
You need a SARS security certificate when your organisation submits third-party data through the SARS direct-data-flow process, including Connect:Direct. SARS says the certificate is required for data submission through that channel. It is requested in eFiling by the enrolled Technical Administrator on behalf of the entity, and SARS says it is valid for 12 months from the date it is issued.
The certificate is a security control, not a general tax clearance, a filing confirmation or permission to submit any file without further checks. The organisation must still complete the relevant eFiling enrolment and role setup, prepare data to the applicable SARS specification, submit through the approved channel and complete the required declaration after submission.
What this means in practice
Treat the certificate as a controlled organisation credential. It belongs to the submitting entity and should be requested only through the right organisation profile and approved Technical Administrator. A payroll bureau, financial institution or other third-party-data provider should know which entity the certificate belongs to, which interface it supports, who holds it, where it is stored and when it will expire.
SARS describes a sequence of enabling eFiling users for third-party data: register for eFiling, activate the registered representative and relevant tax types, enrol the organisation, enrol the Technical Administrator, request the SARS certificate and enrol the Technical User. Skipping the role or enrolment steps can produce an access problem that the certificate itself cannot solve.
The certificate should also be separated from ordinary working papers. Do not attach it to an email thread, store it in an open shared folder or let an external service provider retain it without a documented authority and access arrangement. The file may be technical, but its control matters because it supports a channel that sends data to SARS.
Step-by-step
- Confirm the data owner and channel. Identify the legal entity making the submission, the specific third-party-data service and whether the proposed channel is Connect:Direct or another SARS direct-data-flow channel. Check that the work is being performed in that entity's eFiling profile.
- Confirm roles before requesting anything. SARS says the Technical Administrator requests the certificate and must first have been successfully enrolled. Verify that the registered representative, Technical Administrator and Technical User arrangements are current, documented and appropriate for the organisation.
- Open the correct eFiling service. SARS's current Connect:Direct guide directs the Technical Administrator to eFiling, then Services, then Enrol 3rd Party Data, followed by Request Certificate. The certificate list initially may be empty for a taxpayer. Do not create a request in a similarly named but unrelated taxpayer profile.
- Record the interface details. SARS asks the requester to capture the Interface Name and notes that it should be retained for future reference. Preserve the interface name, organisation, requester, date and service desk reference, if any, in a certificate register.
- Read and accept terms only under approved authority. SARS's guide says the requester must accept the applicable terms and conditions before continuing with the request. Ensure the person doing so has authority under the organisation's internal policy and that a copy of the terms or acceptance record is retained where required.
- Follow the communication trail securely. SARS says the process generates two emails containing a reference code and an authorisation code with a registration link. Treat those communications as sensitive. Check that they were received through authorised addresses, record the request reference and investigate unexpected messages through verified SARS support channels.
- Store and monitor the issued certificate. SARS says the certificate is valid for 12 months from issue. Keep a restricted-access record of its issue date, expiry date, custodian and renewal owner. Set a reminder early enough to prevent a submission cycle from being delayed by expiry.
- Test the operational path without treating a test as a live filing. Coordinate with the technical team to confirm that the certificate, interface and user roles work in the approved environment. The tax or compliance owner should still review the file content and approve the final declaration process.
Documents and records to keep
- The organisation's relevant tax reference, eFiling profile confirmation and authorised user list.
- The Technical Administrator's enrolment and authority record.
- The certificate request reference, interface name and SARS communications.
- A restricted certificate inventory showing issue date, expiry date, custodian and renewal action.
- Internal approvals, test results and incident records where access or certificate problems occurred.
Do not keep access codes, certificate passwords or other credentials in the same uncontrolled register that is circulated to operational staff. The register should prove governance without creating a second security exposure.
Important limits and exceptions
The certificate does not replace the data rules. SARS still requires the organisation to prepare and submit data through the appropriate channel and to declare the accuracy of submitted data through eFiling. A technically successful connection does not prove that the data is complete, accurate or submitted by the deadline.
SARS distinguishes roles in the third-party-data process. A Technical Administrator has a defined enrolment and certificate-request role, while a Technical User is involved in the submission process. Do not simply share a single eFiling login to work around an access problem. Correct the approved user setup instead.
SARS publishes channel-specific guides and can update operational requirements. The 12-month validity stated in its Connect:Direct guide is a useful control point, but the organisation should confirm the actual certificate status before every important filing period.
When to get tailored advice
Get technical and compliance help if the organisation cannot see the certificate service, an email code or registration link is unexpected, the certificate appears expired, an outsourced provider needs access, or a submission failure may affect a statutory reporting deadline. Escalate immediately where a certificate or code may have been disclosed, lost or used from an unauthorised environment.