For a business that has accumulated years of unpaid tax, the size of the problem is not always the tax itself.Penalties and interest can turn an old tax liability into a much larger bill, making it increasingly difficult for a business to bring its tax affairs back into order.The Zambia Revenue Authority (ZRA) has now opened a temporary window for taxpayers facing such liabilities to do exactly that.The Extended Voluntary Disclosure Scheme (EVDS), which began on 17 September 2026 and runs until 31 December 2026, offers eligible taxpayers a 100 percent waiver of accrued penalties and interest when the underlying principal tax due is settled.That distinction matters.The scheme does not erase the principal tax obligation. Instead, it removes the accumulated penalties and interest attached to it, potentially reducing the cost of bringing an outstanding tax account into compliance. <h2>A second chance, but not a tax holiday</h2>The government has been careful to describe the initiative as a compliance intervention rather than a reward for failing to pay taxes.At the launch in Lusaka, Finance and National Planning Minister Situmbeko Musokotwane said the scheme is intended to give eligible taxpayers a structured opportunity to correct past omissions and return to consistent compliance.That makes the EVDS different in emphasis from simply declaring another tax amnesty.The objective is not only to collect old liabilities. It is also to bring taxpayers who have fallen behind back into the regular tax system.For ZRA, this is part of the wider challenge of improving voluntary compliance and domestic resource mobilisation. Commissioner General Dingani Banda said non-compliance remains a challenge in tax administration. <h2>The opportunity is particularly relevant to small businesses</h2>For a small company, an old tax problem can easily become an administrative problem before it becomes a financial one.A business may have changed accountants, lost records, failed to file certain returns, misunderstood an obligation or simply accumulated arrears during a difficult period.Years later, the business may discover that what started as a relatively manageable tax obligation has grown because of penalties and interest.The EVDS creates a defined period in which eligible taxpayers can examine those liabilities and determine what it would take to settle the principal.That makes the first step less about finding money and more about finding out what the business actually owes. <h2>The deadline changes the calculation</h2>The scheme runs for just over three months.That means businesses with outstanding tax issues should not treat December as the starting point for investigation.They need time to reconcile their records, establish the principal liability, verify their position with ZRA and, where necessary, obtain professional tax advice.This is particularly important for businesses whose records stretch across several tax years.Waiting until the final weeks could turn what should be a compliance exercise into another administrative scramble. <h2>Why this matters beyond individual taxpayers</h2>Tax compliance is ultimately connected to the government's ability to finance public expenditure.ZRA's 2025 annual report recorded gross revenue collections of K185.6 billion, with net collections of K160.7 billion after refunds.That puts the EVDS into a broader fiscal context.Government needs revenue, while businesses need a tax system in which outstanding obligations can be identified and resolved without old penalties making compliance progressively harder.There is therefore a mutual interest in bringing dormant or irregular tax accounts back into the formal system.But the longer-term test will be what happens after the waiver expires. <h2>The real test begins in January</h2>A successful voluntary disclosure programme should not simply produce a short-term increase in tax payments.It should leave more taxpayers with accurate records, up-to-date filings and a clearer understanding of their obligations.That is why the period after 31 December 2026 may ultimately be more important than the waiver itself.If businesses use the window to settle principal liabilities and then remain compliant, the scheme becomes part of a broader shift towards regular tax administration.If taxpayers simply wait for another waiver, the underlying compliance problem remains.For businesses with outstanding liabilities, however, the immediate issue is simpler.There is now a defined window to review the books, establish what is owed and determine whether the EVDS can help remove the penalties and interest that have accumulated around the principal tax.The opportunity has a deadline.31 December 2026.

ZRA Opens a Window for Taxpayers to Clean Up Outstanding Liabilities

A small business owner receives a WhatsApp message from what appears to be a regular supplier. The supplier's number looks familiar. The message asks for a payment to a new bank account.The owner pays.Only later does someone call the supplier and discover that their WhatsApp account had been compromised.There was no sophisticated cyberattack. No server was breached. No specialist hacker had to break through layers of corporate security.Someone simply gained control of an account.For Zambia's small businesses, this is an important distinction. Cybersecurity is often discussed as if it belongs to banks, telecommunications companies and large corporations. But as businesses move their banking, accounting, sales and customer communication onto phones and cloud services, the risks increasingly sit inside ordinary business operations. <h2>Your WhatsApp account is part of the business</h2>For many Zambian businesses, WhatsApp is not just a messaging application.It is a sales channel, customer-service desk, order book and sometimes an informal record of transactions.That makes a compromised WhatsApp account commercially valuable.Businesses should enable two-step verification, protect the email account associated with recovery and avoid sharing verification codes. Staff should also be cautious when someone suddenly asks for money, confidential information or a change in payment details.Most importantly, unusual requests should be verified through a second channel.A phone call can sometimes prevent a very expensive WhatsApp conversation. <h2>Protect the money first</h2>A business may have only a few digital systems, but those systems can connect directly to money.Banking platforms, mobile-money accounts, payment gateways and email accounts that receive financial notifications should receive stronger protection than an ordinary social-media account.Multi-factor authentication should be enabled wherever available. Banking credentials should never be shared between employees, and businesses should establish clear approval procedures for significant payments.A request to change a supplier's bank details should not be treated as routine administration.It should trigger verification. <h2>ZRA documents are business data too</h2>Small businesses routinely exchange sensitive documents containing TPINs, tax information, identification details, invoices, payroll records and financial statements.These documents can end up scattered across WhatsApp chats, personal email accounts, USB drives and office computers.That creates a different kind of cybersecurity problem: the business may not know where its own sensitive information is.Companies should maintain a basic record of where important financial and tax documents are stored, who can access them and how they are backed up.Not every employee needs access to everything. <h2>Backups matter when the laptop fails</h2>Cybersecurity is not only about stopping criminals.A laptop can be stolen. A hard drive can fail. A phone can be lost. A ransomware infection can make files inaccessible.For a small business, losing customer records, accounting files or years of documents can be more damaging than losing the hardware itself.Important files should therefore be backed up regularly, with at least one backup kept separately from the main device.A simple test is useful:If the office laptop disappeared tonight, could the business continue tomorrow?If the answer is no, the problem is bigger than cybersecurity. It is business continuity. <h2>The employee is part of the security system</h2>Many attacks begin with an ordinary message.A fake invoice. A suspicious link. A request to reset a password. A message supposedly from the boss asking an employee to make an urgent payment.Technology can identify some of these threats, but employees still make many of the final decisions.Small businesses should establish simple rules: <ul><li>Never share passwords or verification codes.</li><li>Verify unexpected payment requests by phone.</li><li>Do not open suspicious attachments.</li><li>Be cautious about links asking you to log into an account.</li><li>Report suspicious messages rather than hiding mistakes.</li><li>Remove access when an employee leaves the business.</li></ul>The objective should not be to frighten employees into avoiding technology. It should be to make good security behaviour part of normal business practice. <h2>Do not overlook the office computer</h2>Many small businesses still depend heavily on one or two computers.Those machines should have automatic updates enabled, screen locks, reputable security software and separate user accounts where appropriate.Old computers and phones should also be securely wiped before being sold, discarded or given to someone else.A device does not stop containing business information simply because the business has stopped using it. <h2>Cybersecurity does not have to start with expensive software</h2>For a small Zambian business operating on a limited budget, cybersecurity can appear expensive.The first investments, however, do not necessarily require a large IT contract.Start with the basics:Strong passwords. Multi-factor authentication. Regular backups. Software updates. Limited access. Employee awareness. Payment verification.Then build from there.As the business grows, it can introduce stronger controls, professional security assessments, device management, encryption and formal incident-response procedures.The important thing is to start before the first serious incident. <h2>The bigger issue is trust</h2>A cybersecurity incident does more than disrupt a computer.It can delay salaries, expose customer information, interrupt sales and damage relationships with suppliers. For a small company that depends heavily on reputation, the financial consequences can extend well beyond the original loss.Zambia's digital economy will continue to expand. More businesses will use online banking, mobile payments, cloud software, digital tax systems, social commerce and remote services.That creates opportunities for smaller companies to operate more efficiently.But digitalisation also changes what it means to protect a business.Cybersecurity is no longer simply an IT department's responsibility.For a small business, it is part of protecting the money, records, customers and reputation that keep the business alive.

Cybersecurity for Small Businesses: The Risks Are Closer Than You Think

Search results for "ZRA"

ZRA Opens a Window for Taxpayers to Clean Up Outstanding Liabilities

Cybersecurity for Small Businesses: The Risks Are Closer Than You Think