DGFiP tightens professional-space security and SEPA mandate steps

The Direction Générale des Finances Publiques (DGFiP) has updated its two guides for creating an espace professionnel on impots.gouv.frImpots, the mode expert guide and the mode simplifié guide, both stamped with a last update of 11 September 2026Impots.

Both guides now state that the connection password must contain at least twenty charactersImpots, with a complexity gauge shown at entry. The guides point to the password-generation tool offered by the Commission Nationale de l'Informatique et des Libertés (CNIL) at cnil.fr/fr/generer-un-mot-de-passe-solide, and give a sentence-based memorisation technique, with the example phrase « mon espace professionnel est davantage sécurisé si je choisis un mot de passe personnalisé de plus de 20 caractères ! » producing mepedssjcumdppdpd20c!. The recommendations are to use a different password per site, never send it by email or write it down, renew it regularly, and set the browser not to remember entered passwords.

For EDI payment users, the expert guide now says that, under the SEPA rules, the bank payment accounts used in EDI must be present and valid B2B in the company's espace professionnelImpots, and that the B2B mandate mentioning the Référence Unique de Mandat (RUM) must be recorded by the account-holding establishment before any first paymentImpots. Such users must, if not already done, create an espace professionnel and join at least one « Payer » service.

In the simplified mode, declaring a bank account distinguishes two cases. Where the bank is eligible only for the SEPA CORE direct-debit standard, the holder information is entered and the conditions accepted before validating. Where the bank is eligible for SEPA B2B, the electronic-signature box is also ticked. The guide then shows the SEPA mandate screen: the mandate must be sent to the account-holding establishment before any use for a paymentImpots, and the inter-entreprise mandate is edited through the « Editer le mandat interentreprises » link, which displays the mandate in French and in English. The user must send it to the bank directly and without delay, complete and sign it, and make sure the bank has recorded the RUM shown on it before any first payment of self-assessed taxes (TVA, PAS, IS, TS, CVAE and others) using that accountImpots. For security reasons only part of the bank references is pre-filled on the edited mandate.

The guides restate the procedural frame. In expert mode a gestion cabinet acting for several companies creates only one space, from which it can manage up to 100 companies, and a single space is generally capped at 100 files or SIREN, beyond which slowdowns or blockages can occur at peak times. The expert-mode activation code is sent by email and the space must be activated within 48 hours; past that point the code is inoperative and the whole procedure must be restarted. In simplified mode the company's email address is verified through a link usable for 72 hours at most, then the space is activated with a single-use code sent by post, valid 60 days at most; failing either step, a new request must be made. The guides distinguish the company's address, chosen by the legal representative for DGFiP correspondence, from the personal connection address of the space owner; one address serves only one space. Territorial collectivities and other administrations must use expert mode, and the trust-question answer used on a forgotten password must reproduce exactly the capitals, accents and spaces entered.

Legal basis: Regulation (EU) No 260/2012 on SEPA credit transfers and direct debits, which defines the mandate and requires mandate-related information with each direct debit; the operative account, mandate and deadline rules are those stated in the two DGFiP FOCUS guides.