Take note

These rules are in force

New HMRC powers came into force on 6 April 2026 under the Finance Act 2026. Contractors who make a payment or return when they knew or should have known that a connected party had deliberately failed, or would deliberately fail, to deduct or pay tax under CIS or PAYE face:

Penalty of up to 30% of the amount determined liable under section 62A or 62B; where the business is a company, HMRC can make an officer such as a director liable for a portion of the penalty by decision notice, which the officer can appeal within 30 days
Determined liability - 20% of a relevant payment under section 62A, or the sum falsely treated as deducted or paid under section 62B
Immediate GPS cancellation with a 5-year bar on reapplying

You do not need to be directly involved in fraud for HMRC to apply these provisions. If you "knew or should have known" about it, HMRC can determine liability under section 62A or 62B.

Phase 1: Understanding the April 2026 changes

The Finance Act 2026 (sections 220 to 222) gives HMRC strengthened powers to tackle CIS supply chain fraud, in force since 6 April 2026. These powers target organised criminal groups who use false supply chains to extract tax that is never paid to HMRC. The problem is that legitimate contractors can be caught up - and held liable - if they are part of a fraudulent chain without knowing it.

Allow 20 minutes to complete this learning path. By the end, you will understand the risks, know how to assess your exposure, and have a clear action plan for protecting your business.

What is CIS supply chain fraud?

Organised criminals create contrived supply chains with multiple layers of subcontractors. They issue false invoices, claim CIS deductions and VAT, then disappear before HMRC can collect.

The fraud takes many forms:

Circular chains - Payments loop back to the original payer through intermediaries
Phoenix companies - Firms are dissolved with unpaid tax and replaced with identical new entities
Labour-only fronts - Companies invoice for labour that does not exist
Mini umbrella schemes - Workers split across many small companies to exploit Employment Allowance

Even legitimate contractors at the top of a chain can be held responsible for what happens further down.

The penalties

The consequences of failing the 'knew or should have known' test are severe. These penalties have applied since 6 April 2026.

From 6 April 2026, HMRC can hold a business liable where it knew or should have known that a connected party had deliberately failed, or would deliberately fail, to comply with a Construction Industry Scheme (CIS) requirement. The powers were inserted into the Finance Act 2004 by section 220 of the Finance Act 2026.

When a contractor is liable

Section 62A applies to a contractor that has made a payment under a construction contract and, before paying, knew or should have known that a connected party had deliberately failed, or would deliberately fail, to deduct a sum under the CIS, pay it to HMRC, or deduct or pay an amount under PAYE regulations. A connected party is another party to that contract, or a party to another construction contract relating to the same construction operations. HMRC can determine that the contractor must pay 20% of the payment.

Section 62B applies to a person who makes a return treating a sum as deducted and paid, having known or should have known that the sum had not been deducted, or had deliberately not been (or would deliberately not be) paid. HMRC can determine that the person must pay the sum the return treats as paid.

Penalties

A person liable to pay an amount under section 62A or 62B can be charged a penalty of up to 30% of that amount. Where the liable business is a company or unincorporated association and its actions were attributable to an officer, such as a director, the officer can be made liable for a portion of the penalty (up to all of it) by decision notice, after HMRC has given them the chance to make representations. The officer can appeal within 30 days of the notice. HMRC cannot recover more than 100% of the penalty in total.

Gross Payment Status

Where section 62A or 62B applies to a business, HMRC may cancel its Gross Payment Status with immediate effect. It cannot apply for gross payment status again for 5 years from the day the cancellation takes effect.

Amount under section 62A: 20% of the payment made
Amount under section 62B: The sum the return treats as deducted and paid
Maximum penalty: 30% of the amount determined liable
Officers' liability: Portion of the company's penalty, up to 100%, by decision notice
GPS cancellation: Immediate, where section 62A or 62B applies
Bar on reapplying for GPS: 5 years
Effective from: 6 April 2026

The "knew or should have known" test

The legislation asks whether the person knew or should have known, before making the payment or return, of the deliberate failure. HMRC has said it will look at all the circumstances of the transaction, including the due diligence checks carried out and whether warning signs were present.

Tackling Construction Industry Scheme fraud (opens in a new tab)

The "knew or should have known" test

HMRC does not need to prove you were complicit in fraud. They only need to show that you knew or should have known about it. This is assessed by examining:

What due diligence checks did you carry out?
Were those checks appropriate for the level of risk?
Were warning signs present that should have prompted investigation?
What did you do when concerns arose?
Did you document your checks and decisions?

If you cannot demonstrate you took reasonable steps to verify your supply chain, HMRC may conclude you "should have known" - even with no actual knowledge of fraud.

Phase 2: Assess your risk exposure

Before implementing new processes, understand your position. Some situations carry higher risk and require more thorough due diligence.

High-risk indicators

Your supply chain carries elevated risk if any of these apply:

Risk factor	Why it matters
Multiple layers of subcontracting	More opportunities for fraud entities to insert themselves
Labour-only arrangements	Commonly used in fraud schemes as there are no materials to verify
New subcontractor relationships	Less history to assess legitimacy
Unusually low prices	May indicate the subcontractor is not paying their taxes
Umbrella company structures	Complex employment arrangements can mask fraud
High subcontractor turnover	Different companies providing same workers is a red flag

Questions to ask about your current position

Review your existing subcontractor relationships:

Do you have a documented due diligence process for new subcontractors?
Do you keep records of verification checks and results?
Do you know your full supply chain beyond immediate subcontractors?
Have you verified all your subcontractors with HMRC and re-checked them regularly?
Would you be able to show HMRC evidence of your checks if asked?

If you answered "no" to any of these, you have work to do - the rules are already in force.

Phase 3: Implement due diligence processes

Due diligence must be proportionate to risk. Higher-risk situations require more thorough checking. The following guides provide detailed, step-by-step processes for implementation.

Protecting your business from CIS supply chain fraud

Comprehensive guide to implementing due diligence. Covers the step-by-step verification process, what documentation to keep, and how to build checks into your business operations. Essential reading - allows 15 minutes.

Due diligence requirements

HMRC does not prescribe exactly what checks you must do, but your due diligence must address the risks in your supply chain. These are the baseline checks every contractor should perform.

The law does not set a list of checks. HMRC's guidance says you must decide which checks are relevant, reasonable and proportionate for your own business, when you carry them out and how often. It sets out supply chain due diligence principles of check, act and review. They are good practice examples, not a definitive checklist, and HMRC expects the checks to be more extensive in sectors with greater commercial risk. Keep a detailed record of all the checks you do.

Approach: Risk-based, relevant, reasonable, proportionate and ongoing
Principles: Check, act and review
Checklist: None set by HMRC; you decide which checks apply
Records: Keep a detailed record of all checks

Check

Know your own risks and those of your suppliers. HMRC suggests checking your suppliers' tax and legal compliance, such as whether they submit tax returns and make payments on time, and looking for indicators of modern slavery and exploitation.

Act

Carry out due diligence on your suppliers, and if you find risks, act to reduce or remove them rather than ignoring them. HMRC's examples include:

do not assume tax compliance, and watch for previous business failures
check the credibility of directors, and that the people signing contracts are accountable office holders
know who provides the workers, who they are, their employment status and who pays them and how much
know how long your supply chain is, because opportunities for fraud grow with every layer of subcontracting, and check that the supplier actually exists
verify a supplier's VAT registration with HMRC before you use them, and check regularly afterwards
check that any licences are held, such as a Gangmasters and Labour Abuse Authority or Security Industry Authority licence
ask labour suppliers to show evidence of the VAT and PAYE returns they have filed and payments made to HMRC
consider contract clauses that need your authorisation before further subcontracting and that stop the use of offshore intermediaries

Review

Due diligence needs continuous monitoring and review. Procedures should be risk-based, relevant, reasonable, proportionate and ongoing.

Supply chain due diligence principles (opens in a new tab)

Help with labour supply chain assurance (GfC12) (opens in a new tab)

Recognising warning signs

Part of due diligence is knowing what to look for. If you identify red flags and investigate appropriately, you demonstrate you could not reasonably have known about fraud. If you ignore warning signs, HMRC may hold you responsible.

Red flags to watch for

The presence of warning signs does not mean fraud is occurring, but it requires additional scrutiny and documentation of your investigation.

HMRC publishes signs of fraud in labour supply chains. Warning signs should not be taken in isolation, but ignoring them can count against you if HMRC asks whether you knew or should have known about the fraud.

Payroll savings: Labour or payroll cost savings that seem too good to be true
Payroll company: Asks an established business to transfer its staff, or has a name similar to the business
Payments: Unusual arrangements, such as payments to a third party
Kickbacks: Offers to refund administrative costs ('milestone kickbacks')
Presence: No physical presence at the registered office or no online presence
Mini umbrella companies: Several companies set up at the same time with similar or unusual names
Company activity: Business activities on Companies House that do not match the workers' services
Directors: Foreign national directors with no previous UK labour supply experience
Workers: Workers moved between companies, unsure who their employer is
Lifespan: Short-lived companies replaced by new ones

Outsourced labour payroll fraud

This is when a legitimate business transfers its workers and payroll to another business that does not declare or pay the correct tax to HMRC. HMRC lists these general signs for employers and agencies:

payroll companies asking an established business to transfer staff to them
savings on payroll and labour costs that seem too good to be true
a payroll company with a similar name to the business
unusual payment arrangements, such as payments to a third party
offers to refund administrative costs, also known as milestone kickbacks
no physical presence at the registered office address
no online presence or website

Mini umbrella company fraud

Organised crime groups break one umbrella company into many small limited companies, each employing few workers, so they can claim small business incentives such as the Employment Allowance or VAT Flat Rate Scheme, then build up tax debts and close. HMRC says the signs include:

multiple companies set up around the same time with similar or unusual names, and registered addresses that do not seem suitable for their business
business activities on Companies House that do not relate to the services the workers provide
foreign nationals with no previous UK labour supply experience listed as directors
employees regularly moved between companies and unsure who their employer is
short-lived companies, replaced in the supply chain by new ones

If you find warning signs

HMRC's guidance says to carry out checks on your supplier, make sure you know who pays your workers and how, question your supplier if you have concerns, and keep a detailed record of the checks. You can report concerns about a supplier or suspected tax evasion to HMRC.

Check for signs of payroll company fraud (opens in a new tab)

Mini umbrella company fraud (opens in a new tab)

Report tax fraud or avoidance to HMRC (opens in a new tab)

Phase 4: Ongoing monitoring requirements

Due diligence is not a one-time exercise. Your checks must continue throughout each subcontractor relationship.

What to do at each stage

Before engaging a new subcontractor:

Complete your due diligence checklist before any payment
Verify CIS status through HMRC and record the verification number
Check Companies House for company status and director history
Verify VAT registration if they charge VAT
Confirm bank account matches the business name

At every payment:

Review invoice for unusual patterns (round numbers, 100% labour, missing detail)
Verify the payment account is the same as originally verified
Match invoiced labour to actual work you have seen done
Question any changes or anomalies before paying

Regularly:

Re-verify CIS registration status
Check Companies House for any changes (directors, address, filing status)
Review your supply chain map for any structural changes
Update your risk assessment for each subcontractor

Record keeping requirements

Your records are evidence that you took reasonable steps. Keep them with your CIS records, which you must keep for at least 3 years after the end of the tax year they relate to.

For each subcontractor, maintain a file containing:

Copies of documents provided (UTR, VAT certificate, insurance)
HMRC verification results with date and verification number
Companies House search results
Bank account verification evidence
Physical verification notes (site visits, premises checks)
Any concerns identified and how they were resolved
Decision records explaining your assessment

Phase 5: Test your readiness

With the rules in force, verify your processes are working. Use this checklist to assess your preparedness.

Readiness checklist

1. Process documentation	Do you have a written due diligence procedure?
2. New subcontractor onboarding	Is due diligence required before any first payment?
3. Existing subcontractors	Have all your subcontractors been verified with HMRC and re-checked regularly?
4. Supply chain mapping	Do you know who your subcontractors use?
5. Record keeping	Can you produce due diligence evidence for any subcontractor?
6. Staff training	Do people who deal with subcontractors know the warning signs?
7. Escalation procedure	Is there a clear process for raising and investigating concerns?

What to do if you identify concerns

If you spot warning signs in your current supply chain:

Do not make or accept payment - Pause until you have investigated
Document what you found - Record the concern, date, and details
Ask direct questions - Request explanation and evidence
Seek professional advice - Consult your accountant or solicitor
Consider reporting - If you suspect fraud, report to HMRC
Terminate if unresolved - End the relationship if concerns remain

Proceeding despite unresolved concerns is dangerous. If fraud is later discovered, HMRC will ask why you continued to deal with that subcontractor.

Getting help

If you are unsure about your due diligence processes or have concerns about your supply chain:

Your accountant - Can review your processes and suggest improvements
A solicitor - For complex situations or if you suspect fraud
Trade associations - Many provide guidance and templates
HMRC CIS helpline - 0300 200 3210 (Monday to Friday, 8am to 6pm)

Key dates

Date	What happens
6 April 2026	Supply chain fraud powers came into force (Finance Act 2026). HMRC can penalise contractors who "knew or should have known" about fraud.
Before your next payment	Review your supply chain, implement due diligence processes, and verify existing subcontractors.
Ongoing	Maintain due diligence throughout all subcontractor relationships. Repeat your checks regularly.

Protect your business from CIS supply chain fraud

Phase 1: Understanding the April 2026 changes

What is CIS supply chain fraud?

The "knew or should have known" test

Phase 2: Assess your risk exposure

High-risk indicators

Questions to ask about your current position

Phase 3: Implement due diligence processes

Protecting your business from CIS supply chain fraud

Recognising warning signs

Phase 4: Ongoing monitoring requirements

What to do at each stage

Record keeping requirements

Phase 5: Test your readiness

Readiness checklist

What to do if you identify concerns

Getting help

Key dates

Official guidance

Protect your business from CIS supply chain fraud

Phase 1: Understanding the April 2026 changes

What is CIS supply chain fraud?

The "knew or should have known" test

Phase 2: Assess your risk exposure

High-risk indicators

Questions to ask about your current position

Phase 3: Implement due diligence processes

Protecting your business from CIS supply chain fraud

Recognising warning signs

Phase 4: Ongoing monitoring requirements

What to do at each stage

Record keeping requirements

Phase 5: Test your readiness

Readiness checklist

What to do if you identify concerns

Getting help

Key dates

Official guidance

Next steps

Growing your business

Start importing goods to the UK

Transfer ownership of your business

Related journeys

Starting a waste business

Gateway 2 preparation checklist

Contamination discovered on your site

New higher-risk building development compliance