Since 6 April 2026, contractors face severe penalties if they 'knew or should have known' about fraud in their supply chain. This learning path explains the rules under the Finance Act 2026, helps you assess your risk, and guides you through implementing due diligence to protect your business from 30% penalties and GPS cancellation.
Construction & PropertyRunning a BusinessUpdated 15 September 2026
references 2 guides
Phase 1: Understanding the April 2026 changes
The Finance Act 2026 (sections 220 to 222) gives HMRC strengthened powers to tackle CIS supply chain fraud, in force since 6 April 2026. These powers target organised criminal groups who use false supply chains to extract tax that is never paid to HMRC. The problem is that legitimate contractors can be caught up - and held liable - if they are part of a fraudulent chain without knowing it.
Allow 20 minutes to complete this learning path. By the end, you will understand the risks, know how to assess your exposure, and have a clear action plan for protecting your business.
What is CIS supply chain fraud?
Organised criminals create contrived supply chains with multiple layers of subcontractors. They issue false invoices, claim CIS deductions and VAT, then disappear before HMRC can collect. The tax "lost" in these schemes runs into hundreds of millions of pounds annually.
The fraud takes many forms:
Circular chains - Payments loop back to the original payer through intermediaries
Phoenix companies - Firms are dissolved with unpaid tax and replaced with identical new entities
Labour-only fronts - Companies invoice for labour that does not exist
Mini umbrella schemes - Workers split across many small companies to exploit Employment Allowance
Even legitimate contractors at the top of a chain can be held responsible for what happens further down.
The "knew or should have known" test
HMRC does not need to prove you were complicit in fraud. They only need to show that you knew or should have known about it. This is assessed by examining:
What due diligence checks did you carry out?
Were those checks appropriate for the level of risk?
Were warning signs present that should have prompted investigation?
What did you do when concerns arose?
Did you document your checks and decisions?
If you cannot demonstrate you took reasonable steps to verify your supply chain, HMRC may conclude you "should have known" - even with no actual knowledge of fraud.
Phase 2: Assess your risk exposure
Before implementing new processes, understand your current position. Some situations carry higher risk and require more thorough due diligence.
High-risk indicators
Your supply chain carries elevated risk if any of these apply:
Risk factor
Why it matters
Multiple layers of subcontracting
More opportunities for fraud entities to insert themselves
Labour-only arrangements
Commonly used in fraud schemes as there are no materials to verify
New subcontractor relationships
Less history to assess legitimacy
Unusually low prices
May indicate the subcontractor is not paying their taxes
Umbrella company structures
Complex employment arrangements can mask fraud
High subcontractor turnover
Different companies providing same workers is a red flag
Questions to ask about your current position
Review your existing subcontractor relationships:
Do you have a documented due diligence process for new subcontractors?
Do you keep records of verification checks and results?
Do you know your full supply chain beyond immediate subcontractors?
Have you verified all current subcontractors within the last 12 months?
Would you be able to show HMRC evidence of your checks if asked?
If you answered "no" to any of these, you have work to do now - the rules are already in force.
Phase 3: Implement due diligence processes
Due diligence must be proportionate to risk. Higher-risk situations require more thorough checking. The following guides provide detailed, step-by-step processes for implementation.
Comprehensive guide to implementing due diligence. Covers the step-by-step verification process, what documentation to keep, and how to build checks into your business operations. Essential reading - allows 15 minutes.
Recognising warning signs
Part of due diligence is knowing what to look for. If you identify red flags and investigate appropriately, you demonstrate you could not reasonably have known about fraud. If you ignore warning signs, HMRC may hold you responsible.
Detailed guide to identifying red flags including missing UTRs, unusual payment patterns, phoenix company indicators, and labour-only anomalies. Includes practical examples of what fraud looks like in real situations.
Phase 4: Ongoing monitoring requirements
Due diligence is not a one-time exercise. Your checks must continue throughout each subcontractor relationship.
What to do at each stage
Before engaging a new subcontractor:
Complete your due diligence checklist before any payment
Verify CIS status through HMRC and record the verification number
Check Companies House for company status and director history
Verify the payment account is the same as originally verified
Match invoiced labour to actual work you have seen done
Question any changes or anomalies before paying
Periodically (at least annually):
Re-verify CIS registration status
Check Companies House for any changes (directors, address, filing status)
Review your supply chain map for any structural changes
Update your risk assessment for each subcontractor
Record keeping requirements
Your records are evidence that you took reasonable steps. Retain due diligence records for at least 6 years from the date of the last payment to each subcontractor.
For each subcontractor, maintain a file containing:
Copies of documents provided (UTR, VAT certificate, insurance)
HMRC verification results with date and verification number