SARS modernisation will make section 180 personal liability easier to prove, so its safeguards must keep pace

Introduction

Tax debt owed to SARS stood at R646 billion on 31 January 2026, and R518.2 billion of it was undisputed (National Treasury, 2026). SARS had collected R79.4 billion of that debt by then and was R15 billion short of its target, which Treasury put down partly to late hiring of collection staff, more disputed debts and more deferred payment arrangements (National Treasury, 2026). When a company cannot pay and the money has gone somewhere, the Tax Administration Act 28 of 2011 gives SARS a route to the people behind it. Section 180 makes a person personally liable for a taxpayer’s tax debt to the extent that the person’s negligence or fraud caused the failure to pay (Republic of South Africa, 2011).

This paper argues that section 180 is constitutionally safe after Greyvensteyn, but that it is about to be used in a different information environment and that the safeguards around it were built for the old one. SARS says it wants a system in which tax ‘just happens’ for most taxpayers, using third-party data and, in time, e-invoicing (South African Revenue Service, 2026a). Better data should make SARS faster at spotting a company that collects VAT and does not pay it over. It should also make negligence easier to allege. The sections below set out what section 180 requires and what the court decided, describe how far the digital programme has actually got, explain why data changes the negligence question, and then propose safeguards that could be added before the data arrives (Van Huyssteen and Nel, 2025; Mpofu, 2024).

What section 180 asks and what the Greyvensteyn case settled

Four things have to be true before section 180 bites. The taxpayer has an unpaid tax debt. The person controls, or is regularly involved in managing, the taxpayer’s overall financial affairs. That person’s negligence or fraud resulted in the failure to pay. And a senior SARS official is satisfied that the person was negligent or fraudulent in respect of paying the debt (Greyvensteyn v Commissioner for the South African Revenue Service, 2025). Nothing in this limits the provision to company directors. It reaches anyone who runs the money, which could include a financial manager who sits nowhere on the board (Republic of South Africa, 2011). The word ‘regularly’ is doing a lot of work here, and the Act does not say how often regular is.

The applicant in Greyvensteyn challenged sections 180, 184(2) and 186(3) of the Act. The Gauteng Division in Pretoria, through Amien AJ, handed down its decision on 12 February 2025 and upheld all three (Greyvensteyn v CSARS, 2025). The background was a gold refinery, The Gold Kid, which SARS alleges claimed VAT refunds on gold that it did not buy from registered vendors, and SARS held the applicant liable for its debts on several grounds including section 180, while the applicant disputes SARS’s claims (Greyvensteyn v CSARS, 2025). SARS’s own summary says the court treated its decisions under sections 180 and 184(2) as administrative action that can be reviewed under the Promotion of Administrative Justice Act, and found the limits that section 186(3) places on movement and trade reasonable and justifiable (South African Revenue Service, 2025).

What matters about the decision is mostly what it leaves in place. The statutory test asks for a senior SARS official to be satisfied, which is a lower bar than a court finding, and the court’s answer to the access-to-court complaint was that the official’s determination is reviewable and does not push out judicial oversight (Greyvensteyn v CSARS, 2025). Keulder (2025) makes a related point from the rule-of-law side. SARS’s role in giving taxpayers access to justice depends on observing the framework, and her survey of case law suggests SARS must see that the purpose of peremptory provisions is achieved, avoid retroactive compliance and exercise its discretion with due consideration. Review is the remedy, in other words, and review comes after the notice has been issued.

The academic literature is less relaxed about third-party liability generally. Baker, Pistone and Perrou (2023) look at such liability from a human rights angle, including the joint and several liability of a company director for another person’s tax, and they doubt that securing collection is enough to justify exposing third parties to obligations where no specific involvement in avoidance or evasion has been shown. Van Huyssteen and Nel (2025) study the sister provisions in sections 183 and 184 and find uncertainty about what a tax debt is and when it arises, what dissipation of assets means, what ‘knowingly’ requires and what the same rights against recovery amount to. They suggest guidance on whether an assessment is necessary and clearer procedural steps. Neither article is about section 180, and the text of section 180 as the court set it out does not mention an assessment, so the same question seems to arise there too.

How far the digital programme has actually got

A good deal of the modernisation is already running in the form of third-party data. Under section 26 of the Act and SARS notices, banks, medical schemes, insurers, estate agents, JSE-listed companies and many others must send SARS data, with annual submissions due between 1 April and 31 May and bi-annual submissions between 1 September and 31 October, and SARS says the purpose includes pre-populating and automatically assessing returns (South African Revenue Service, 2026b). Treasury reports that new technology helped SARS register 1.3 million new taxpayers, who contributed R4.9 billion in net revenue, and that overdue scheduled payments fell from R14.6 billion to R6.8 billion in the first three quarters of 2025/26 (National Treasury, 2026). Mpofu (2024) reviewed the literature on digital transformation by tax authorities in developing countries and concluded that it can cut administrative and compliance costs, help with risk identification and reduce corruption, although complexity, poor infrastructure, the digital divide and system failures stand in the way.

E-invoicing is the next layer, and for now it is still on paper. SARS released its VAT Modernisation Consultation Paper on 17 August 2026, with comments due by 16 October 2026 (South African Revenue Service, 2026a). The model combines structured e-invoices, an interoperability framework run through accredited access points, and e-reporting to SARS in near real time. SARS would receive the data at its own access point for risk management and pre-filled returns, although taxpayers would still confirm or edit their returns. The timetable is long. Preparation and draft regulations run from 2026/27, regulations are promulgated in 2027/28, a pilot follows in 2029/30, and phased implementation starts in 2030, with large businesses first and small and micro enterprises later (South African Revenue Service, 2026a). The paper needs new VAT legislation and gives no cost figures, and it says MSMEs may find the shift hardest.

The international evidence suggests the benefits are real but uneven. The OECD (2025) inventory covers 54 tax administrations and reports that close to 40 per cent can prefill VAT returns thanks to technologies such as electronic invoicing, and that more than 70 per cent use artificial intelligence, most often to detect evasion and fraud. In Peru, Bellon et al. (2022) found that voluntary adoption of e-invoicing was higher among firms whose partners had been mandated to adopt it, and that smaller firms trading with a mandated partner reported about 11 per cent more sales and paid more VAT in the year the partner was mandated. They also found that firms became less likely to keep trading with a mandated partner, which they read as a sign that networks may segment. The OECD (2022) survey, prepared by officials from Canada, Chile, China, Hungary and Spain, adds case studies and design considerations for administrations still deciding what to build.

Why better data changes the negligence question

Section 180 turns on negligence, and negligence is a question about what a reasonable person in that position would have known and done. At the moment SARS often has to piece together what a financial controller knew from returns filed after the event. With near real-time VAT data, an unpaid output tax would show up within weeks and not at the next return (South African Revenue Service, 2026a). That helps SARS, and it may help directors too, since early contact leaves less room for debt to grow. It also lowers the cost of arguing that the person in control must have known. The consultation paper itself says nothing about tax debt or recovery (South African Revenue Service, 2026a), so this is an inference from how the data would work, although it fits the OECD (2025) picture of administrations using richer data for prefilled returns and fraud detection. The wording of the section stays the same while the practical standard drifts upward with the information available.

Data also tells SARS about companies and not about people. An e-invoice carries the supplier’s and buyer’s VAT details, but section 180 needs a finding about an individual who controls or regularly manages the financial affairs. That link still depends on records outside the invoice stream, such as company registers, bank signatories and payroll, and a wrong link could land on a junior bookkeeper or on a director who left months earlier. Shandu and Maluleke (2023) interviewed thirteen participants in KwaZulu-Natal and found that syndicates defrauding SARS often use e-filing fraud, with suspected collusion involving tax consultants and SARS personnel, and with cooperation between the police, the prosecuting authority and SARS in the province in disarray. A system that can be gamed that way can also produce false trails. A false trail pointing at a named person is exactly what a ‘satisfaction’ threshold might let through (Greyvensteyn v CSARS, 2025).

There is a privacy side as well. Moosa (2021) argues that warrantless inspections under section 45 limit taxpayers’ privacy in a way that may not pass the limitations clause of the Constitution, and that the section should be amended. His point reaches further than section 45. The more SARS knows without asking, the more the question shifts from what it may inspect to what it may infer, and the Act has few brakes on inference. The consultation paper speaks of data protection, secrecy provisions and strong data-security controls, and does not mention the Protection of Personal Information Act by name (South African Revenue Service, 2026a). The legislation it promises is the obvious place to fix that, and Mpofu (2024) lists the digital divide and system failures among the barriers any such programme faces.

Data could also work for the person on the receiving end, and this part gets less attention. Section 180 makes a person liable to the extent that the person’s negligence or fraud resulted in the failure to pay, and ‘to the extent’ suggests that liability is meant to be proportionate and not automatic (Republic of South Africa, 2011). Apportioning it needs a timeline, namely when the debt arose, when the person took over the finances and when the money left. Van Huyssteen and Nel (2025) flag the question of when a tax debt arises as one of the unsettled points in the neighbouring provisions. Time-stamped transaction data would settle some of that, because it would show that a debt was already there before a new financial manager arrived, or that a director raised the alarm. SARS has its own interest in giving the person the data and not only using it against them (Greyvensteyn v CSARS, 2025).

The people most exposed are probably owner-managers of small companies, who tend to be the same people who do the books, sign the cheques and talk to the bank. They are also the group the consultation paper expects to have the most difficulty with e-invoicing, since it says MSMEs may struggle most and proposes onboarding support and simplified digital tools (South African Revenue Service, 2026a). The Peruvian study points the same way, in that the gains it found were among smaller firms that were drawn in by larger partners and not forced in directly (Bellon et al., 2022). A small company that is brought into the system later and with less help is the one most likely to fall behind on VAT, and its controller is the person section 180 would then reach.

Safeguards that should arrive before the data does

The representations rule is where the pressure will fall first. Section 184(2) gives the person a chance to make representations before being held liable, but only if this will not place the collection of tax in jeopardy (Greyvensteyn v CSARS, 2025). Jeopardy is a judgement, and SARS will have more occasions to make that judgement when it can see arrears building in near real time. The representations may then follow the decision and not precede it. Maleka (2023) asks whether taxpayers must still pay when SARS has not complied with sections 92, 95 and 96 of the Act, using Nondabula, and the existence of that dispute shows that procedural slippage by SARS already reaches the courts. Keulder (2025) adds that the discretion has to be exercised with due consideration.

Three modest additions would help, and none of them needs the Act to be rewritten at once. SARS could publish a practice note setting out what it treats as indicators of negligence under section 180 and what kinds of data it relies on, so that the standard is visible before the first notice and not discovered in court. It could also commit to disclosing the data it relied on when it gives notice of intended liability, and to hearing representations first unless it records a specific jeopardy finding that a court can examine. And the VAT legislation promised in the consultation paper could say that e-invoice data alone is not enough to attribute liability to an individual without corroboration of who controlled the finances (South African Revenue Service, 2026a). The call by Van Huyssteen and Nel (2025) for guidance on assessments and clearer procedure points the same way.

An obvious objection is that process slows recovery when R518.2 billion of the debt is undisputed (National Treasury, 2026). The objection has some force, but most of that money is owed by the taxpayers themselves, and nothing in the Budget Review says how much is chased through section 180. Without that figure the case for speed over process is a guess. Baker, Pistone and Perrou (2023) also note that compulsory involvement of third parties is imposed without remuneration and without much thought for the burden it creates, a point that sits uneasily with the position of a part-time financial manager in a failing small company. The pressure to collect is real, and so is the risk of landing the debt on the wrong person.

Conclusion

Section 180 survived its first constitutional test, and the reasoning of the High Court suggests the provision will be treated as an ordinary administrative power, reviewable after the event (Greyvensteyn v CSARS, 2025; South African Revenue Service, 2025). That is a reasonable result for a power exercised against people who allegedly ran a company badly or with fraud. The difficulty is the information that will sit behind the next decade of notices. Third-party data is already feeding SARS, and e-invoicing is planned for 2030 onwards (South African Revenue Service, 2026a; South African Revenue Service, 2026b).

My view is that the data should be used first to warn and only later to charge. Early contact with a company whose VAT is going unpaid costs SARS little, and the Peruvian evidence suggests firms respond to what their business partners are doing (Bellon et al., 2022). If SARS wants public support for a digital system that sees almost every invoice, it should show that the same visibility is matched by clear standards for who gets blamed when the money runs out (Keulder, 2025; Moosa, 2021). The legislation and regulations due in 2027/28 are the natural place to write that down.

Reference list

Baker, P., Pistone, P. and Perrou, K. (2023) Third-party liability for the payment of taxes and their fundamental rights. World Tax Journal, 15(1). doi:https://doi.org/10.59403/1h2sm78

Bellon, M., Dabla-Norris, E., Khalid, S., Paliza, J.C., Chang, J. and Villena, P. (2022) Digitalization and tax compliance spillovers: evidence from a VAT e-invoicing reform in Peru. IMF Working Paper 2022/057. Washington, DC: International Monetary Fund. doi:https://doi.org/10.5089/9798400204876.001

Keulder, C. (2025) ‘The South African Revenue Service’s role in providing access to justice to taxpayers’, in Taxation, human rights, and sustainable development. Abingdon: Routledge, pp. 139-155. doi:https://doi.org/10.4324/9781003432890-9

Maleka, M. (2023) Do taxpayers have to pay tax when SARS has not complied with sections 92, 95 and 96 of the Tax Administration Act? Nondabula v Commissioner: SARS & another explained. South African Mercantile Law Journal, 35(1), pp. 94-109. doi:https://doi.org/10.47348/samlj/v35/i1a5

Moosa, F. (2021) Section 45 of the Tax Administration Act: an unconstitutional limitation on taxpayer privacy? South African Law Journal, 138(1), pp. 171-196. doi:https://doi.org/10.47348/salj/v138/i1a8

Mpofu, F.Y. (2024) ‘Digital transformation by tax authorities’, in Moloi, T. (ed.) Digital transformation in South Africa. Cham: Springer, pp. 151-170. doi:https://doi.org/10.1007/978-3-031-52403-5_11

OECD (2022) Tax administration 3.0 and electronic invoicing: initial findings. Paris: OECD Publishing. doi:https://doi.org/10.1787/2ffc88ed-en

OECD (2025) Tax administration digitalisation and digital transformation initiatives. Paris: OECD Publishing. doi:https://doi.org/10.1787/c076d776-en

Shandu, S.N. and Maluleke, W. (2023) ‘Electronic-filing [tax] fraud in South Africa: perceptive and trends’, in Ehiane, S.O., Olofinbiyi, S.A. and Mkhize, S.M. (eds) Cybercrime and challenges in South Africa. Singapore: Palgrave Macmillan, pp. 211-235. doi:https://doi.org/10.1007/978-981-99-3057-9_10

Van Huyssteen, J.-R. and Nel, R. (2025) A critical analysis of third-party personal liability for tax debts in ss 183 and 184 of the Tax Administration Act 28 of 2011. South African Mercantile Law Journal, 37(1), pp. 1-20. doi:https://doi.org/10.47348/samlj/v37/i1a1

Legislation and case law

Greyvensteyn v Commissioner for the South African Revenue Service and Others (B2495/2023) [2025] ZAGPPHC 1452 (12 February 2025). Available at: https://lawlibrary.org.za/akn/za-gp/judgment/zagpphc/2025/1452/eng@2025-02-12 (Accessed: 18 October 2026).

National Treasury (2026) 2026 Budget Review, Chapter 4: Revenue trends and tax proposals. Pretoria: National Treasury. Available at: https://www.treasury.gov.za/documents/national%20budget/2026/review/Chapter%204.pdf (Accessed: 18 October 2026).

Republic of South Africa (2011) Tax Administration Act 28 of 2011. Available at: https://www.sars.gov.za/legal-counsel/primary-legislation/ (Accessed: 18 October 2026).

South African Revenue Service (SARS) (2025) The judgement reaffirms the constitutionality of the Tax Administration Act. Media release, 14 February 2025. Available at: https://www.sars.gov.za/media-release/the-judgement-reaffirms-the-constitutionality-of-the-tax-administration-act/ (Accessed: 18 October 2026).

South African Revenue Service (SARS) (2026a) VAT Modernisation Consultation Paper (August 2026). Available at: https://www.sars.gov.za/vat-modernisation-consultation-paper-august-2026/ (Accessed: 18 October 2026).

South African Revenue Service (SARS) (2026b) Third-party data. Available at: https://www.sars.gov.za/businesses-and-employers/third-party-data/ (Accessed: 18 October 2026).