What to write down today
If you are the only person who can get into the business's email, domain, bank and password manager, write down today what someone else would need to keep it running. This card is the short list. It records where things are and who can reach them.
A two-page A4 PDF to print and keep, free, with no email asked for. Edition 1, November 2026, reviewed every 12 months.
Who the card is for
For the owner of a small business, or a sole trader, who is the only person able to get into the email, the domain, the bank and the password manager. If you were locked out, ill or away tomorrow, this is what someone else would need to find. It records where things are and who can reach them, never a password.
5 parts, on two pages
- 01The accounts the business runs on
- 02Five facts for each account
- 03The people
- 04Keep it safe and current
- 05The next step
Read it here
The same words as the PDF, with its sources at the end.
Never write a password, a recovery code or a backup code on this card. Write where each one is kept and who can reach it. The secrets belong in a password manager.
The accounts the business runs on
Tick each one when it is written down, with the five facts below.
- Email: the provider, the address you log in with, and every other administrator.
- Domain: where it is registered, whose name it is in, and when it renews.
- DNS and website: where the records are managed, the host, and any developer’s access.
- Password manager: which one, and whether anyone has emergency access to it.
- Your mobile number: if login codes arrive by text, the number is a key. Note the network and the contract.
- Banking and payments: each account, card machine and payment service, and who else is authorised.
- Accounting, payroll and HMRC: the software, and whether your accountant is authorised as your agent. You must not share your HMRC sign in details with anyone, including your tax agent [1, 2].
- Companies House, for a company: where the company authentication code is kept. It is the equivalent of a company officer’s signature for online filing, so treat it like a bank card PIN [3].
- Files and backups: where the documents live, and where the backups are kept.
- Everything that renews: subscriptions and hosting, and the card each one is paid with.
Five facts for each account
- The login: the provider and the address you sign in with. It is often an old or a personal address.
- Whose name it is in: the business’s, or yours personally.
- Who else can get in today, and with what role.
- How it is recovered: the recovery email and phone number, and where any backup codes are kept. Check that the recovery email is not the mailbox you are trying to recover.
- What breaks first if it lapses, in one line, so whoever reads this knows what matters most.
The people
- Who to tell first, and how to reach them.
- Who can get in, and who may act. Access is not authority: someone who can log in may still have no right to act for you. In England and Wales, a lasting power of attorney gives that authority while you are alive, and it must be registered before your attorney can make decisions for you [4].
- Your accountant, your solicitor and your IT support, with how to reach each one.
| Who | Name and how to reach them |
|---|---|
| Told first | |
| Can get in | |
| May act for me | |
| Accountant | |
| Solicitor | |
| IT support |
Keep it safe and current
- Keep it where the person who needs it can find it and nobody else can, and tell them where it is.
- Try one recovery yourself, on an account that matters, so you know the route works.
- Check it every six months, and whenever you change your phone, a bank card, a provider or the person you have named.
Last checked on: ______________________
The next step
This card is the short version of our paid handbook, If I could not log in tomorrow: sixteen chapters and seven worksheets, from recovery chains and two-step login to the legal side in England and Wales. dacros.com/resources/owner-continuity-guide
Sources
- [1] GOV.UK, Keeping your HMRC login details safe, updated 15 December 2025, checked 10 November 2026 · gov.uk/guidance/keeping-your-hmrc-login-details-safe
- [2] GOV.UK, Appoint someone to deal with HMRC on your behalf, checked 10 November 2026 · gov.uk/appoint-tax-agent
- [3] GOV.UK, Company authentication codes for online filing, updated 25 September 2026, checked 10 November 2026 · gov.uk/guidance/company-authentication-codes-for-online-filing
- [4] GOV.UK, Make a lasting power of attorney, checked 10 November 2026 · gov.uk/power-of-attorney/make-lasting-power
The things people ask
Should I write my passwords on the card?
No. The card records where each password, recovery code and backup code is kept and who can reach it, never the secret itself. Keep the secrets in a password manager, and keep the card where the person who needs it can find it.
Is a list of my accounts enough for someone to take over?
No. A list helps someone find things, and access lets them in, but neither gives them the right to act for you. In England and Wales, a lasting power of attorney gives that authority while you are alive, and GOV.UK says it must be registered before your attorney can make decisions for you. Our paid handbook, If I could not log in tomorrow, covers the safe ways in and the legal side.
How often should I update it?
Every six months, and whenever you change your phone, a bank card, a provider or the person you have named. The card has a line for the date you last checked it.
Where to go next
The card is the short version of our paid handbook, If I could not log in tomorrow: sixteen chapters and seven worksheets, from recovery chains and two-step login to the legal side in England and Wales. See what the handbook covers.
Would you rather have it done for you? The free review, done remotely: what you run, what is exposed, and where the risk actually sits, written down. The document is yours regardless of what happens next. Book the free review.