Protecting your business from CIS supply chain fraud

The "knew or should have known" test

HMRC will assess whether you knew or should have known about fraud by examining your due diligence processes. They will consider:

• What checks did you carry out before engaging each subcontractor?
• Were those checks appropriate for the level of risk?
• Were warning signs present that should have prompted further investigation?
• What did you do when concerns arose?
• Did you document your checks and decisions?

Due diligence is not optional. If you cannot show you took reasonable steps to check your supply chain, HMRC may conclude you "should have known" about fraud, even if you had no actual knowledge.

Who is most at risk

While all CIS contractors should implement due diligence, some situations carry higher risk:

• Long supply chains - Multiple layers of subcontracting create more opportunities for fraud
• Labour-only arrangements - Contracts with no materials element are commonly used in fraud schemes
• New subcontractor relationships - You have less history to assess legitimacy
• Unusually low prices - If rates are significantly below market, question how the subcontractor can afford it
• Umbrella company structures - Complex employment structures can mask fraud
• High-turnover subcontractors - Different companies providing the same workers week after week

Due diligence requirements

HMRC does not prescribe exactly what checks you must carry out. Instead, your due diligence must be proportionate to the risk. Higher-risk situations require more thorough checking.

The following checks form the foundation of a robust due diligence process:

Step-by-step due diligence process

Follow this process for every new subcontractor, and repeat key checks periodically for existing relationships.

Step 1: Verify identity and registration

Before making any payment, confirm the subcontractor exists and is properly registered:

1. Request documentation - Ask for the subcontractor's UTR, National Insurance number (sole traders) or Company Registration Number (companies), and VAT registration number if applicable
2. Verify CIS registration - Use the CIS online service to verify the subcontractor with HMRC. Record the verification number and deduction rate
3. Check VAT registration - If the subcontractor charges VAT, verify their VAT number using HMRC's online VAT checker
4. Search Companies House - For limited companies, check: company is active, directors match people you are dealing with, registered address is genuine, filing history is up to date

Step 2: Verify physical presence

Fraud schemes often use "shell" companies with no real business operations:

1. Visit the business premises - Is there a genuine office or yard? Are workers present?
2. Check the registered address - Virtual offices or mail forwarding addresses are a warning sign
3. Verify the workforce exists - If they are providing labour, where do the workers come from?
4. Request references - Ask for contact details of other contractors they have worked for

Step 3: Understand the supply chain

Know who you are really dealing with:

1. Map your supply chain - Who does your subcontractor use? Are there further layers of subcontracting?
2. Ask direct questions - How do they source and pay their labour? Are workers employed directly or through intermediaries?
3. Request Key Information Documents - If using labour providers, ask for KIDs showing worker terms
4. Consider GLAA licensing - For gangmaster-regulated sectors, verify GLAA licence status

Step 4: Ongoing monitoring

Due diligence is not a one-time exercise. Monitor throughout the relationship:

1. Review every invoice - Does the work described match what was done? Are amounts reasonable?
2. Question unusual patterns - Sudden changes in pricing, payment requests to different accounts, or round-number invoices
3. Re-verify periodically - At least annually, re-run CIS verification and Companies House checks
4. Investigate concerns immediately - If something seems wrong, pause payments until resolved

Warning signs of fraud

HMRC has identified common patterns in CIS supply chain fraud. If you encounter these warning signs, investigate further before making or accepting payments.

Documenting your due diligence

Your records are evidence that you took reasonable steps to check your supply chain. If HMRC investigates, documented due diligence can demonstrate you did not "know or should have known" about fraud.

What to record

For each subcontractor, maintain a due diligence file containing:

• Identity verification - Copies of documents provided (UTR, VAT certificate, insurance certificates)
• HMRC verification results - Verification number, date, and deduction rate confirmed
• Companies House search - Screenshot or printout showing company status and directors
• VAT verification - Result from HMRC VAT checker
• Bank account details - Confirmation that account matches business name
• Physical verification notes - Record of any site visits or premises checks
• References - Contact details of referees and notes from conversations
• Ongoing monitoring notes - Record of any concerns and how they were resolved
• Decision records - If you identified a warning sign, record what you investigated and why you proceeded (or did not proceed)

How long to keep records

Retain due diligence records for at least 6 years from the date of the last payment to that subcontractor. HMRC can investigate historical payments, so having records protects you even after the relationship ends.

Format of records

Records can be paper or electronic. If electronic, ensure they are backed up and you can produce them if requested. Consider using a consistent folder structure and checklist template for each subcontractor.

What to do if you identify concerns

1. Do not make or accept the payment - Pause until you have investigated
2. Document what you found - Record the concern, when you identified it, and what it relates to
3. Ask questions - Request explanation and additional evidence from the subcontractor
4. Seek professional advice - Consult your accountant or solicitor before proceeding
5. Consider reporting - If you suspect fraud, report to HMRC through their fraud hotline
6. Terminate if concerns remain - If you cannot satisfy yourself that the arrangement is legitimate, end the relationship

Proceeding despite unresolved concerns is dangerous. If fraud is later discovered, HMRC will question why you continued to deal with the subcontractor despite warning signs.

Building due diligence into your processes

Before engaging any new subcontractor

Make due diligence part of your standard onboarding process:

• Create a checklist of required checks and documents
• Assign responsibility for completing checks before first payment
• Use a standard subcontractor application form requesting all necessary information
• Do not add subcontractors to your payment system until checks are complete

For existing subcontractors

Review your current supply chain against the due diligence requirements:

• Identify subcontractors you have not fully checked
• Prioritise higher-risk relationships (long chains, labour-only, new)
• Complete retrospective checks as soon as possible
• Set calendar reminders for annual re-verification

Training your team

If multiple people in your business deal with subcontractors:

• Ensure everyone understands the warning signs of fraud
• Create clear escalation procedures for concerns
• Make it clear that reporting concerns is expected and protected
• Review due diligence practices regularly

Summary: Your due diligence checklist

Use this checklist for every new subcontractor and review periodically for existing relationships:

What happens if you are investigated

If HMRC suspects you were involved in a fraudulent supply chain, they will examine your due diligence processes. Having documented evidence of thorough checks is your best defence.

HMRC will consider:

• What checks did you actually carry out? (They will want evidence)
• Were the checks proportionate to the risk?
• Did you identify any warning signs?
• If you identified concerns, what did you do about them?
• Is there evidence you deliberately ignored red flags?

If HMRC concludes you "knew or should have known" about fraud, the consequences are severe: a penalty of 30% of the lost tax, liability for the lost tax itself, and immediate GPS cancellation with a 5-year bar on reapplying.

Getting help

If you are unsure whether your due diligence processes are adequate, or if you have concerns about your current supply chain:

• Talk to your accountant - They can review your processes and suggest improvements
• Consult a solicitor - For complex situations or if you suspect fraud in your supply chain
• Contact your trade association - Many provide guidance and templates for supply chain due diligence
• Report suspected fraud to HMRC - Reporting known fraud protects you and the industry

Related guides

• Register as a CIS contractor - Setting up as a contractor and understanding your obligations
• Verify a subcontractor's CIS status - How to verify subcontractors with HMRC
• Submit your CIS monthly return - Filing requirements and deadlines
• Apply for Gross Payment Status - How to get GPS and the compliance tests you must pass
• Warning signs of CIS fraud in your supply chain - Detailed guide to red flags