We are pleased to confirm the upcoming release of InPay V9.0. This will be available to you on 10 april 2023.
Listening to our users is important to us, and therefore we hope that you find these changes useful, and they help in streamlining your business processes. We always value feedback, so please contact account management if you wish to discuss anything further.
All previous release notes can be found here: InPay release notes.
Key highlights
Nest API connection. We are pleased to announce you can now connect via Nest API. You will be able to retrieve opt out information and send over contribution submissions without downloading or uploading data. This will be controlled within InPay with a direct connection to your account with Nest.
Multi-factor authentication. We have introduced multi-factor authentication for InPay and our payslip portal and is available for all users. If you are an InPay admin user, you will have the ability to add this to each individual user's account for InPay, and switch on the ability for all employees to use MFA for the payslip portal.
New features:
Multi-factor authentication and administration: what is MFA?,
InPay authentication: how is it set up?, how do users login for the first time?, what happens if I have changed/lost my device?
Payslip portal authentication: how is it set up?, how do users login for the first time?, what happens if I have changed/lost my device?
Improvements:
Importing: validation for relevant fields and special characters, custom import for P45 previous tax basis, worker pay type added to custom importer, custom importing P45 student loan details, additional validation for holiday history override import
Exporting: external exports for report groups
Reporting: reporting on pay holiday immediately schemes, email payslip report performance improvements, P45 pre-printed not working with 1 or 0 in pay period parameter, HMRC RTI download report
Pension reports: pension scheme end date added to basic pension report, standard life contribution (NEW) report to include pension refunds, royal london pension report consolidation,
NI values where there are multiple FPSs in a period
New features details
Nest API connection
Following on from our People's Pension API connection, you can now connect to NEST. This can be set up immediately, with no requirement for switch on from support. Go to, company - pension schemes and enter your pension provider details. Then within processing - pension process you can enter the login details for NEST. Once connected your opt out information will be available for you to review and upload. You can also send a contribution file to NEST, this will automatically include a joiner's file. We have provided a reporting button, allowing you to download a copy of the data that is being uploaded. For full details on how to set up and use this functionality go to pension process.
Multi-factor authentication and administration
What is MFA?
MFA is a two step process. You will log in to InPay o payslip portal as normal, and then be required to enter a one-time password. This password is generated by a mobile application authenticator. These can be downloaded via app stores, the most common ones are google authenticator and microsoft authenticator. When you go into your app, you will be given a one-time password (which is time sensitive) to enter into the your login screen. This adds an additional layer of security to your data and login details, based on a password that only you know, and a one-time password on a device that only you have.
InPay authentication:
How is it set up?
To be able to activate this for users, you will need to be an InPay admin user. If you have the security setting in your top menu bar, go to manage users. Search for the user and click edit, or click new if you are setting up the user for the first time. Within details you will see a dropdown field authentication type. Select time-based one-time password. Click save. Once this has been saved, users will be required to log in via MFA.
How do users login for the first time?
Firstly, make sure you have an authenticator app already downloaded on to your mobile device. Each individual user will need to have this on their own device.
When you log in for the first time, after providing the username and password. You will then be presented with a QR code, and a verification code box. Scan the QR code using the authenticator app you have downloaded. The app will then provide you with a one-time 6 digit verification code, (this is time sensitive) enter the code in the box provided and click next, you will be successfully logged in.
After the initial login, you will no longer see the QR code. Simply enter your username and password you will then be prompted to enter your 6 digit verification code from your authenticator app, click next and you will be logged into InPay.
What happens if I have changed/lost my device?
If you lose or change your mobile device, or have had to reinstall the authenticator application, you may need to have your MFA reset. Within the user details you will have a reset totp authentication button, click this to reset. Once reset, you will follow the steps as above as a first time user. For Saas what will they do?
The MFA is applicable for both SSO and non SSO user.
| Login Type | Require MFA (if specified against user)? |
| Standard Pay Manager login (logging in with a username and password) | Y |
| Pay Manager login with SSO. Internal only | Y |
| Logging into Pay Manager via SSO from Intime | N |
| Logging into Pay Manager via Client Portal Reports Menu Option | N |
Payslip portal authentication
How is it set up?
Within the company - general screen, we have removed in the payslip portal section, the previous tick box for require two factor email has been removed. You will now see a authentication type dropdown. The options include password only, two factor-email, time-based one-time password.
when the company is configured with "Password Only" authentication type, Payslip Portal Users need to provide Username and Password for Non-SSO and Username alone for SSO Users - This is the same process as the previous "Require Two Factor Email" checkbox un-ticked. DO I NEED THIS? Shall I add it to MFA details?
when the company is configured with "Two Factor - Email" authentication type, Login of Payslip Portal Users goes through 2 step authentication process via Email - This is the same process as the previous "Require Two Factor Email" checkbox is ticked.
New authentication type "Time Based One-Time Password" is introduced.
How do users login for the first time?
Log into the payslip portal with your username and password as normal. You will then be presented with a QR code, and a verification code box. Scan the QR code using the authenticator app you have downloaded. The app will then provide you with a one-time 6 digit verification code, enter the code in the box provided and click next. You will then be logged into the payslip portal.
After the initial login, you will no longer see the QR code. Simply enter your username and password you will then be prompted to enter your 6 digit verification code from your authenticator app, click next and you will be logged into the payslip portal. 
What happens if I have changed/lost my device?
If the payslip portal user has lost the mobile phone or the authenticator app, then the RSM admin users can reset the MFA key via Security→ Payslip Portal Admin.
"Payslip Portal Admin" is a new page introduced specifically to display the payslip portal users details and reset the TOTP Authentication.
Admins can reset the Time Based One Time Password by clicking on "Reset TOTP Authentication" button.
Standard Companies:
Payslip Portal Admin page displays the details of payslip portal users and Authentication Type for a user is derived as follows:
- Non-linked Users: Authentication Type is same as that of "Authentication Type" drop-down value in Company > General page.
- Linked Users: If for one then will be for all.
1. If a user is linked to multiple companies, Two Factor Authentication will be required if at least one company has it enabled.
2. Time-Based One-Time Password takes precedence over Two Factor email. When a user is linked to multiple companies, one with Two Factor Email enabled and one with Time-Based One-Time Password enabled. Time-Based One-Time Password will be required on login in this case.
The MFA is applicable for both SSO and non SSO user and follows the below grid:
If a company has Time-Based One-Time Password enabled, and then this is changed back to "Password Only" or "Two Factor Email" then in the future this is changed back to Time-Based One-Time Password, the users who had previously registered with TOTP will be required to register again. The exception to this is if the user is linked to at least one other company with TOTP enabled at the time Time-Based One-Time Password is disabled.
Improvement details
Importing
We have made further enhancements to our imports, and custom imports within this release. We have improved the error messages and added additional validation checks for importing information.
Validation for relevant fields and special characters
We have added validation for the following characters: @, +, -, =. This validation will apply to employee related fields whether it is via manual input, standard importers or custom importers. The validation will stop these characters from being inputted, for example: @forename or =surname will be highlighted as a validation error. However a hyphenated double-barrelled surname or a telephone number starting with +000 will be accepted. When using manual entry you will see red message at the top of the screen.
If using the importers, you will get errors messages as below.
Custom Import for P45 Previous Tax Basis
We have made a change to our custom importer when updating P45 previous w1/m1 tax basis field. Previously this required a Y or N, but would fail on update. Now you will use 0 to not tick the box and 1 for the tick box to be populated. This updates the section tax details, within employee - previous employment P45.
Worker pay type added to custom importer
You can now use the field worker pay type within employee page in the custom importer. It will allow the following names or value: 'not selected' or 0, 'salaried' or 1, "grade" or 2, "hourly" or 3, "timesheet" or 4. If the field is left empty for a new starter, it will set the worker to 'not selected'. When updating a current employee and column is left empty, it will leave the field unchanged.
Custom importing P45 student loan details
Previously when using the custom importer for P45 details and marking the student loan indicator as Y, the plan type field was remaining blank in the statutory loans screen. The plan type will now populate as expected. Also when adding previous employment P45 details, a student loan with type 'plan 1' will not be created when an employee already has a student loan set up on pay -student loans screen.
Additional validation for holiday history override import
We have improved the error messages within the messages section if the below errors occur, allowing you to make the appropriate changes to the import file. Previously this would display as object reference, instead of the error.
The employee does not exist in the system
Any pay or unit overrides supplied are not numerical
The pay periods in the file do not exist in the system
Message gets highlighted as cannot delete. pay period in use if deleting periods when there are employee holiday calculation rows for that period on payroll - pay periods screen
Exporting
NP – 2227 External exports for report groups - Internal/External
We have developed a new option to export P60, P45 and payslips based on report groups. This has been option has been added to processing - external export screen. When you select your export type and export level, click export. You will now see a new dropdown field called group filter. Any report groups you have set up will be available within this dropdown. Our external export screen allows for the generation and delivery of Payslips, P60s, and P45 to a specified SFTP location.
Reporting
To help provide further data we have made changes and improvements to a variety of our reports within standard reports. We have also developed new consolidation for the royal london pension report, as well as a new report for HMRC RTI downloads.
Reporting on pay holiday immediately schemes
Within reporting under the employee category the holiday report will now reflect pay holiday immediately schemes. The taken hours value will show the same as accrued hours, as each pay period the accrued hours will be allocated for payment. Also columns due hours, gross booked and gross due will be '0' as no holidays can be booked by employee within the scheme.
Email payslip report performance improvements
We have enhanced the performance of our email payslip report in the payslips category within reporting. Previously you may have experienced delays when reporting on large volumes.
P45 pre-printed not working with 1 or 0 in pay period parameter
Previously you may have noticed that your P45 pre printed report within the statutory category was not running if the pay period was set as '0' for current period and '1' for previous period. This will now work as expected.
HMRC RTI download report
There is a new report called HMRC RTI download report within the employee category in standard reports. This report will capture details of any employees updated with P6s, P9s, SL1s, SL2s, PGL1s, PGL2s, and NINO updates from the processing - HMRC data retrieve screen.
Pension reports
Pension scheme end date added to basic pension report
The basic pension and basic pension by date range reports will now include a pension scheme end date of an employee. The end date is held against an employee's pension scheme on with the pay - pensions screen, within the leaving date field. Please note: this will only show within the report when there is no current pension record.
Standard life contribution (NEW) report to include pension refunds
We have added the additional information of employees with pension refunds within the above report. This can be found within reports and category pension exports.
Royal london pension report consolidation
We have provided a tick box option to consolidate all payrolls within the pension exports - royal london pension contribution report. This will allow you to have 1 report with all payroll frequencies reported, and stops the requirement to combine multiple reports outside of InPay.
NI values where there are multiple FPSs in a period
Previously gross earnings for NICs in period, total employer NICs in period and employee contributions in period were displaying incorrect values. This would only happen when there was a change to the NI letter or there had been NI movements in the pay period after the first FPS submission. This will now display expected values under each table letter. Please note: This has had no impact on monies owed to the HMRC or the Employee's NI record with the HMRC, as YTD figures are used in both cases.