Giving staff eFiling access without sharing logins
How a South African tax practice can give staff eFiling access to client profiles through the practitioner's profile, without anyone sharing a login.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa
In many small practices, there is one eFiling login and everybody knows it. The partner set it up years ago, the password is on a sticky note or in a shared spreadsheet, and whoever is preparing a return logs in as the partner. It is quick, it works, and it breaks SARS's rules in a way that leaves the partner answerable for everything anyone did.
SARS's eFiling system is built for practices to work through their staff without sharing credentials. This article explains the roles involved, the rules that apply to every user, and how to line the practice's internal access up with them.
The practitioner and the power of attorney
SARS's guide to registering for eFiling describes a tax practitioner on eFiling as a person registered with SARS and with a Recognised Controlling Body who holds a signed power of attorney to act for the taxpayer.
Two things follow for the practice. Each client the practice files for should have a signed power of attorney on file, current and covering the work being done. And the practitioner's own registration is the foundation the staff access is built on; who must register as a tax practitioner covers that registration.
Staff users linked to the practitioner
The same guide says that a user who is not a confirmed tax practitioner, or not linked to one, can only save and not submit ITR12 returns on eFiling. It also says tax practitioners can delegate authority to staff users linked to their practitioner number.
That is the structure the practice should use. Each staff member has their own eFiling user, linked to the practitioner's number, with the authority the practitioner chooses to delegate. Work is done under the staff member's own credentials, and what they can do depends on what was delegated.
A simple way to set it up:
- List every person who works on eFiling, and what they need to do: prepare, submit, view statements, handle correspondence.
- Have each one register their own eFiling user.
- Link each user to the practitioner's number and delegate only the authority their work needs.
- Remove the link the day a person leaves.
Registered representatives for entity clients
For clients that are companies, trusts or other entities, there is a further step. SARS's guide says an appointed registered representative of an entity must activate that status on eFiling before transacting on the client's behalf.
Where the practice acts as or through a client's registered representative, check that the status is active before anyone tries to submit for that client. A return prepared against an entity profile where the representative status was never activated can hold up a submission at the last minute.
Rule 6: your own user ID and access code only
SARS's Electronic Communications Guide quotes rule 6 as requiring an eFiling user to access eFiling only with their own user ID and access code, and never to share the access code with anyone, including a SARS official.
The same guide says a registered eFiling user is liable for all activities and transactions performed using their user ID and access code.
Put those two statements side by side and the shared-login practice looks very different. Every return submitted under the partner's login is, in SARS's eyes, the partner's act. If a junior submits the wrong figure, or a departed employee logs in from home, the partner carries it. The rule also has no exception for convenience or for trusted staff.
Matching the practice's own controls
SARS's rules govern eFiling. The practice's own systems should reflect the same principles: each person signs in as themselves, has only the access their role needs, and leaves a record of what they did.
In Achekam, a firm can allow or deny what each role may do, check why a member may or may not act, and grant named permissions per role or per person. That lets the practice mirror its eFiling delegation: the people who submit on eFiling are the people whose Achekam role covers the related filing records.
Users can turn on two-factor sign-in with an authenticator app, a firm can require it for all members, and members can sign in with Google or Microsoft Entra ID once the firm sets up single sign-on. Requiring two-factor sign-in for everyone who handles tax work closes the same gap rule 6 is aimed at: a password alone, written down somewhere, should not be enough to act for a client.
Filing records that show who did what
Achekam does not file with SARS. For payroll, Achekam prepares the monthly EMP201 figures and PDF and the IRP5 and IT3(a) certificates from approved runs; a person files them on SARS eFiling and records the reference in Achekam.
That division works well with individual eFiling users. The person who submitted on eFiling, under their own credentials, records the reference against the client's filing in Achekam. When a question comes later, the practice can see who submitted, when and with what reference, without relying on a shared login that makes everyone indistinguishable. How tax work is tracked alongside eFiling is covered in exporting and tracking client tax work.
A checklist for the next staff meeting
- One eFiling user per person, no exceptions.
- Every staff user linked to the practitioner's number with only the authority needed.
- A signed power of attorney on file for each client.
- Registered representative status active for every entity client before submission.
- Two-factor sign-in required for the practice's own systems.
- Access removed on eFiling and in the practice's systems on a leaver's last day.
SARS's guide for the set-up
SARS's guide to registering for eFiling and managing your user profile explains how to register, manage a profile and handle its users. Work through it with the practitioner and each staff member in turn, and retire the shared login the same week.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
