Warning signs of CIS fraud in your supply chain

HMRC can hold you liable for fraud in your supply chain if you knew or should have known about it. Under section 62A, HMRC can determine liability equal to 20% of a relevant payment; under section 62B, it can determine liability for the sum falsely treated as deducted or paid. You could face that liability even if you were not directly involved in the fraud.

Recognising warning signs is your first line of defence. If you identify red flags and investigate appropriately, you demonstrate that you could not reasonably have known about any fraud. If you ignore warning signs, HMRC may determine you "should have known" and hold you responsible.

This guide explains what to look for and what to do when you spot potential problems.

Why this matters

Since 6 April 2026, under the Finance Act 2026 (section 220, amending the Finance Act 2004), the consequences of failing to spot fraud in your supply chain are severe:

• Penalty of up to 30% of the amount determined liable under section 62A or 62B; where section 72B applies, HMRC can recover a specified portion from an officer such as a director
• Determined liability - 20% of a relevant payment under section 62A, or the sum falsely treated as deducted or paid under section 62B
• Immediate GPS cancellation with a 5-year bar on reapplying
• Reputational damage affecting relationships with other contractors and clients

Organised criminal groups use construction supply chains to extract tax that is never paid to HMRC. Even legitimate contractors at the top of a chain can be held responsible for what happens further down.

Red flags at a glance

The following snippet summarises the key warning signs HMRC has identified. Each of these should prompt further investigation before you make or receive payments.

Practical examples: what fraud looks like in practice

Understanding how these red flags appear in real situations helps you spot them in your own supply chain.

Example 1: The disappearing subcontractor

Scenario: A new labour-only subcontractor offers competitive rates for groundwork on your housing development. They provide a UTR that verifies successfully, but when you search Companies House, the company was only formed 3 months ago. The registered address is a residential property. After 6 months of work, the company stops responding and you discover they have been dissolved with unpaid tax.

Warning signs you should have spotted:

• Newly incorporated company with no trading history claiming significant turnover
• Registered address is a residential property, not business premises
• Labour-only invoices with no evidence of actual workforce on your site
• Prices below market rate (the subcontractor was not paying their taxes)

What you should have done: Visited the business premises, verified the workforce existed, checked director history for previous dissolved companies, and questioned the below-market pricing.

Example 2: The circular payment chain

Scenario: You pay a tier-1 subcontractor who subcontracts to a tier-2, who subcontracts to a tier-3. Each company is registered for CIS and verifies correctly. However, the tier-3 company never pays the CIS deductions to HMRC. HMRC investigates and finds the three companies share directors or connected persons, and money flowed back to the original payer.

Warning signs you should have spotted:

• Multiple layers of subcontracting for relatively simple work
• The same workforce appearing across different company names
• Rapid changes in which company invoices you for the same labour
• Shared addresses or directors across companies in the chain

What you should have done: Mapped your complete supply chain, asked direct questions about who employs the workers, and investigated when company names changed.

Example 3: The phoenix company

Scenario: A bricklaying subcontractor you have used for years suddenly changes company name. The directors are the same, the workers are the same, but invoices now come from "ABC Brickwork Ltd" instead of "XYZ Brickwork Ltd". When you check Companies House, XYZ Brickwork Ltd was dissolved with outstanding tax liabilities.

Warning signs you should have spotted:

• Directors have previously been involved with dissolved companies
• Pattern of companies lasting 12-18 months then disappearing
• History of Companies House late filing or strike-off notices
• Same people, same workforce, different company name

What you should have done: Checked director history before continuing the relationship, asked why the company changed, and verified the new company's compliance status.

How to investigate warning signs

When you spot a red flag, you must investigate before making payment. Simply noting the concern is not enough - you need to take action and document what you did.

Step 1: Pause the payment

Do not pay until your concerns are resolved. Once money leaves your account, recovering it from a fraudulent supplier is extremely difficult. Genuine subcontractors will understand reasonable payment delays for verification.

Step 2: Ask direct questions

Contact the subcontractor and ask specific questions about the concern:

• "Why has your company name changed from the one I originally contracted with?"
• "Can you explain why your registered address is a residential property?"
• "Your price is significantly below what other subcontractors quoted - can you explain how you achieve this?"
• "Can you provide references from other contractors you work with?"

Evasive or inconsistent answers are themselves a warning sign.

Step 3: Verify independently

Do not rely solely on information the subcontractor provides:

• Visit the business premises - Does it look like a functioning business?
• Search Companies House - Check filing history, director history, and accounts
• Check for director connections - Are the same people behind multiple companies?
• Verify insurance independently - Call the insurer directly to confirm the policy
• Contact references - Speak to other contractors who have used them

Step 4: Document everything

Keep a written record of:

• What warning sign you identified and when
• What questions you asked and the responses received
• What verification steps you took
• What decision you made and why

If HMRC later investigates, this documentation demonstrates you took the "knew or should have known" test seriously.

Step 5: Make a decision

Based on your investigation, decide whether to:

• Proceed with payment - If your concerns are fully resolved with evidence
• Proceed with enhanced monitoring - If partially resolved but you will watch for further issues
• Terminate the relationship - If concerns cannot be adequately explained
• Report to HMRC - If you believe fraud is occurring

When to report suspected fraud

You can report suspected CIS fraud to HMRC anonymously. Reporting protects you by demonstrating you took action when you identified concerns.

Consider reporting if:

• You have strong evidence of fraudulent activity, not just suspicion
• A subcontractor has disappeared owing you money or CIS deductions
• You discover a company in your supply chain has been dissolved with unpaid tax
• You identify circular payment patterns or phoenix company activity

HMRC will not tell you the outcome of any investigation, but reporting demonstrates you acted responsibly.

Building warning sign detection into your processes

Rather than treating fraud detection as a one-off exercise, build it into your standard onboarding and payment processes:

At onboarding

• Use a standard checklist covering all verification steps
• Flag any warning signs identified and document your investigation
• Require sign-off before adding new subcontractors to your approved list
• Set a review date to re-verify (at least annually)

At every payment

• Check invoices for round numbers, labour-only patterns, or missing detail
• Verify the payment account matches the registered business
• Question any request to pay a different entity or bank account
• Match invoiced labour to actual workers you have seen on site

Periodically

• Re-verify CIS status at least annually
• Check Companies House for any changes (new directors, address changes, filing delays)
• Review your full supply chain map and question any changes
• Share intelligence with other contractors about problematic suppliers

What happens if you ignore warning signs

If HMRC determines you "should have known" about fraud in your supply chain, the consequences are severe:

Ignorance is not a defence. If warning signs were present and you did not investigate, HMRC will argue you should have known.

Next steps

To protect your business from supply chain fraud liability:

1. Review your current subcontractors - Check each one against the warning signs in this guide
2. Implement due diligence processes - See our guide on protecting your business from CIS supply chain fraud
3. Train your team - Ensure everyone involved in subcontractor management knows what to look for
4. Document your processes - Create an audit trail showing you take fraud prevention seriously
5. Seek professional advice - If you have concerns about existing subcontractor relationships