By Michael Court, Tax Consultant, McEwan Wallace
If you run a construction business, CIS is probably already part of day-to-day life: checking subcontractors, making deductions, filing returns and keeping payments moving.
But HMRC's latest powers mean CIS compliance is no longer just about getting the deductions right.
It is also about being able to show that you know who you are dealing with, and that you have taken reasonable steps to check the businesses and individuals in your supply chain. This includes looking out for risks connected to both CIS and PAYE compliance.
For owner-managed businesses, this matters because the consequences can affect cash flow, contract opportunities and, in some cases, directors personally.
What has changed?
HMRC now has stronger powers to tackle CIS and PAYE fraud within construction supply chains.
The rules are aimed at deliberate abuse, but they also create a practical risk for genuine businesses that cannot show they took appropriate steps to check who they were working with.
The key question HMRC can now ask is:
Did the business know, or should it have known, that payments in the supply chain were connected to fraud?
That is a significant shift for owner-managed businesses.
It means HMRC may look not only at your own CIS compliance, but also at whether there were warning signs elsewhere in the supply chain that should have been spotted and acted upon. This could include concerns around CIS deductions, PAYE obligations or wider payroll arrangements.
Where HMRC can establish this, the consequences can be serious. HMRC may be able to:
- Remove gross payment status immediately
- Assess the business for the related tax loss
- Charge a penalty of up to 30%
- Transfer penalties to company officers in some circumstances
- Prevent a business from reapplying for gross payment status for five years
For an owner-managed construction business, this could create immediate pressure. A loss of gross payment status may affect cash flow, make tendering more difficult and create concern for main contractors or customers who expect strong compliance procedures.
For some businesses, this could mean suffering CIS deductions on future payments, creating pressure on cash flow at exactly the wrong time.
Why this matters for owner-managed businesses
Many owner-managed construction businesses rely on trusted relationships. You may have worked with the same subcontractors for years, or you may take recommendations from people you know in the trade.
That is not necessarily a problem. But under the new rules, informal arrangements and verbal assurances may not be enough.
HMRC will expect businesses to have clear, documented checks in place. This does not mean you need a large compliance department. It does mean you should have a sensible process that can be followed consistently and evidenced later.
The risk is that a business could be drawn into an HMRC challenge even if it has not directly benefited from fraud. If HMRC believes there were warning signs and the business ignored them, the business may be exposed.
For directors and owner-managers, the message is simple: CIS due diligence needs to be part of how the business is run, not just an admin task completed after the event.
What does “knew or should have known” mean?
The phrase “knew or should have known” is central to the new rules.
“Knew” means actual knowledge. In other words, the business was aware that the transaction was connected to deliberate non-compliance.
“Should have known” is wider. It looks at whether, based on the circumstances, a reasonable business in the same position should have recognised that something was wrong.
HMRC may look at things such as:
- How experienced the business is in the construction sector
- Whether the price or commercial terms looked unusual
- Whether the subcontractor had a credible trading history
- Whether CIS status was checked before payment
- Whether those checks were repeated for ongoing relationships
- Whether there were proper contracts, invoices and insurance documents
- Whether payments were made to the correct business bank account
- Whether there were unnecessary layers of subcontracting
- Whether concerns were investigated and recorded
One issue on its own may not prove there is a problem. But several warning signs together could suggest the arrangement was not commercially realistic or needed further investigation.
Practical examples of red flags
Owner-managed businesses are often close to the detail of a job, which can be a strength. It means you may be well placed to spot when something does not look right.
Examples of red flags include:
- A subcontractor offering labour at a rate that appears unusually low
- A newly formed company taking on substantial work with little trading history
- A business with no clear premises, website or online presence
- Requests to pay a different company or third-party bank account
- Vague contracts or missing paperwork
- Repeated changes of subcontractor, but the same workers turning up on site
- Invoice details that do not match the business you thought you were dealing with
- Reluctance to provide basic compliance information
- Pressure to make payments quickly before checks are complete
These issues do not automatically mean fraud is taking place. But they should prompt further questions.
If the explanation is reasonable, record it. If it is not, think carefully before continuing with the arrangement.
Due diligence does not need to be complicated
For many owner-managed businesses, the right approach is not a long, complex policy that no one uses. It is a practical process that fits the way the business works.
At a minimum, businesses should consider:
- Verifying CIS registration and gross payment status before making payments
- Checking Companies House records where the subcontractor is a company
- Confirming VAT details where relevant
- Keeping copies of insurance documents
- Using written contracts or engagement terms
- Checking that invoice and bank details match the subcontractor
- Reviewing whether the pricing makes commercial sense
- Considering whether payroll or PAYE arrangements raise any concerns
- Keeping a record of the checks carried out
- Repeating checks periodically for ongoing subcontractors
- Recording any concerns and the decision made
The record-keeping point is important. If HMRC asks questions later, it may not be enough to say that checks were done. The business needs to be able to show what was checked, when it was checked, what the result was and why it was comfortable proceeding.
What should you do now?
The best time to review your CIS processes is before HMRC asks questions.
A practical review should cover:
- How subcontractors are taken on
Is there a standard onboarding process before work starts?
- Who is responsible for checks
Is it clear who verifies CIS status, reviews paperwork and approves new subcontractors?
- How often checks are repeated
Are checks only done once, or are they refreshed for ongoing relationships?
- What happens when something looks unusual
Do staff know what to do if pricing, paperwork, payroll arrangements or payment details do not look right?
- Whether records are kept properly
Could you evidence your checks months or years later?
- Whether directors have oversight
Are the business owners comfortable that the process is being followed in practice?
For owner-managed businesses, this does not need to become a burden. A checklist, clear responsibility and good filing can go a long way.
How our specialist team can help
The new rules are a reminder that CIS compliance is not just a tax return issue. It is a wider business risk involving cash flow, contracts, subcontractor relationships, PAYE risk and director responsibility.
Our specialist team works alongside owner-managed businesses to make tax and compliance practical. We can help you review your CIS processes, identify gaps in your subcontractor checks and put proportionate procedures in place.
If your business operates in the construction sector, now is the time to review your supply chain due diligence. A little work now could help protect your gross payment status, reduce your exposure to penalties and put you in a stronger position if HMRC ever asks questions.
Please speak to our team if you would like to review your CIS procedures or discuss how the new rules may affect your business.