The Construction Industry Scheme has always required contractors to verify subcontractors, apply the correct deductions and submit accurate returns. Since 6 April 2026, however, the risk has moved further up the chain.
Under HMRC’s new CIS fraud regime, a principal contractor can be pursued where it knew or should have known that payments or CIS credits were connected to deliberate non-compliance elsewhere in the supply chain. That means a business may face consequences even when it was not the direct party withholding tax, operating a fraudulent payroll arrangement or claiming a false CIS credit.
The immediate exposure can include a determination of up to 20% of the relevant payment, a penalty of 30% of that determination, and the cancellation of Gross Payment Status. In serious cases, the business may be prevented from reapplying for Gross Payment Status for five years, while penalties may also be transferred to individual company officers.
This is not simply another filing rule. It is a supply-chain responsibility test.
The HMRC CIS fraud guidance confirms that the new powers apply to payments for construction operations and CIS credits claimed on or after 6 April 2026. Construction News has now reported that HMRC is actively targeting payroll fraud involving criminal umbrella companies, while Construction Management has warned that the absence of public cases does not mean contractors are safe.
For contractors in Essex, Kent, London and throughout the UK, these are the five checks that should be completed before the next CIS review or HMRC enquiry.
1. Document your supply-chain due diligence
The first question is not whether you have checked a subcontractor once. It is whether you can show what you checked, when you checked it, what you found and what you did with the information.
A basic verification of a subcontractor’s UTR and CIS status is still important, but it may not be enough where the wider arrangement raises concerns. HMRC is looking at the reality of the labour supply chain, including agencies, payroll companies, umbrella providers and any onward subcontracting.
Your due-diligence file should normally consider:
- Company registration and trading history
- VAT registration where relevant
- Directors, owners and connected businesses
- CIS registration and payment status
- PAYE arrangements for labour supplied through an agency or umbrella
- Evidence that workers receive proper payslips and deduction statements
- References and previous project history
- The identity of the party actually paying the workers
- Any onward subcontracting or changes in the payment route
It is also important to repeat checks periodically. Continuous due diligence is more credible than an onboarding form completed several years ago and never reviewed again.
Construction News reported on 15 September that HMRC’s current campaign is focused on payroll fraud where income tax, National Insurance and CIS deductions are taken from workers but not passed to HMRC. The article’s practical message is clear: contractors should know who their suppliers are, who pays the workers and whether the deductions shown on payslips are being accounted for.
A concern is not automatically a breach. But an unexplained concern that is ignored is much harder to defend.
2. Benchmark labour rates against market norms
Unusually low pricing is one of the clearest warning signs in a supply chain. It does not prove fraud, but it should prompt questions.
A labour provider offering rates materially below the market may be benefiting from genuine efficiencies. Equally, the price may only be possible because PAYE, National Insurance, CIS deductions, VAT or minimum wage obligations are not being dealt with properly.
Contractors should therefore retain evidence of how rates were assessed. This might include:
- Comparable quotes from other labour providers
- Published wage or industry data
- Project cost plans
- Records of conversations with the supplier
- Explanations for significant differences in price
- Confirmation of what the rate includes, such as holiday pay, employer costs and payroll administration
A low quote becomes more concerning when combined with other issues, such as an unclear contract, multiple layers of intermediaries or a supplier with very little relevant trading history.
This is where the “should have known” test becomes uncomfortable. HMRC does not necessarily need to show that the contractor understood the fraud. It may ask whether a reasonable contractor would have challenged the commercial arrangement before making payments.
The answer should not be based on hindsight. A properly documented pricing review gives you evidence of what was known and considered at the time.
3. Investigate red flags rather than simply recording them
Many businesses have policies that list risk indicators, but the real test is what happens after a red flag appears.
Possible warning signs include:
- A labour rate that is too low to appear commercially realistic
- Frequent changes in the contracting entity or bank account
- A supplier that refuses to explain its ownership or payment process
- Workers receiving unclear, inconsistent or missing payslips
- A company with no obvious construction experience supplying a large workforce
- Several layers of agencies or subcontractors with no clear commercial purpose
- Pressure to make payments to a different entity
- Invoices that do not match the work completed
- A supplier unwilling to provide evidence of PAYE, VAT or CIS compliance
- Significant labour costs being paid without a formal written agreement
A red flag should lead to a proportionate response. That might involve asking for further documents, pausing a payment, obtaining independent tax advice, reducing the number of intermediaries or ending the relationship.
The important point is to record the decision and the reason for it. “We have always used them” is not a control. Neither is “the price was attractive”.
The HMRC penalty factsheet explains that penalties can apply where a business knew or should have known that a payment or CIS credit was linked to deliberate non-compliance by a connected party.
4. Obtain written assurance and keep a proper audit trail
A supplier’s verbal assurance is useful, but it is not a complete compliance process. Contractors should use written agreements that clearly explain who is responsible for payroll, PAYE, National Insurance, CIS deductions, VAT and worker documentation.
Depending on the arrangement, you may also want to request:
- Written confirmation of the supplier’s payroll model
- Evidence of relevant registrations
- Sample payslips with personal information removed
- Confirmation of how deductions are calculated and paid
- Contractual rights to audit or request supporting records
- Notification requirements for changes in ownership, bank details or onward subcontracting
- Warranties concerning compliance with tax and employment obligations
The audit trail should connect the evidence to the decision. It should show who approved the supplier, who reviewed any warning signs and what follow-up took place.
Construction Management’s September analysis makes an important point: HMRC enquiries may take time and may not become public until a dispute reaches a tribunal. Silence therefore does not mean that the regime is inactive. It gives contractors an opportunity to improve their records before an enquiry letter arrives.
It is worth training commercial managers, project managers, procurement teams and finance staff so that concerns do not remain isolated in one department. A project manager may notice a change in labour behaviour before the finance team sees an unusual payment pattern.
5. Make sure your insurance declarations match reality
Insurance will not pay an HMRC tax determination or a CIS penalty. These are financial liabilities arising from tax and regulatory non-compliance, not accidental third-party losses. A policy also cannot restore Gross Payment Status after it has been cancelled.
That does not mean insurance is irrelevant.
The due-diligence failure that contributes to an HMRC problem may also indicate a wider risk-management weakness. Insurers and surety providers are increasingly interested in how contractors use labour-only subcontractors, agencies and other supply-chain partners. Your answers can affect underwriting, policy terms, premiums and bond capacity.
When reviewing your Construction Contractor Insurance or General Contractor Liability Insurance, check that your declarations accurately describe:
- The proportion of work completed by subcontractors
- Whether subcontractors are labour-only or bona fide
- The trades and activities being undertaken
- The size and value of projects
- The use of temporary labour, agencies or umbrella companies
- Who supervises subcontracted workers
- Whether subcontractors carry their own liability insurance
- Whether your policy requires evidence of that insurance
A standard public liability policy is not a substitute for tax compliance, but it remains important protection against injury, property damage and other insured claims arising from construction work. Moyak’s commercial combined insurance can include public liability, employers’ liability, business interruption and legal expenses, depending on the policy selected.
Legal expenses or tax protection sections may assist with certain professional costs connected to an investigation, subject to the wording, limits and exclusions. They should not be confused with cover for the underlying tax, determination or penalty.
The wider risk picture for contractors
The timing matters. The Building Safety Levy is due to take effect on 1 October 2026, while Ardmore’s Building Liability Order appeal is listed for 15 December. Recent TCC decisions also continue to test how liability may reach connected companies and wider project participants.
These issues are different from CIS fraud, but they point in the same direction: construction businesses are being expected to understand more than their immediate contract. Group structures, labour arrangements, payment flows and governance all matter.
That is why insurance reviews should be practical rather than purely administrative. At Moyak Insurance Services, our individual approach means we ask how your business actually operates, not just which box appears easiest to tick. We work with businesses across Essex, Kent and London and can help assess whether the insurance information provided to insurers reflects your current work.
If you are looking for Business Insurance Essex or Business Insurance London, the starting point should be an honest review of the risk, including your subcontracting model and supply-chain controls.
What to do this week
Before your next CIS audit or HMRC enquiry:
- Map every active subcontractor, agency and labour provider.
- Check who actually pays the workers.
- Review labour rates that appear unusually low.
- Investigate and document every material red flag.
- Refresh contracts and written compliance assurances.
- Check that your CIS returns and records are complete.
- Review your insurance proposal forms and policy schedule.
- Speak to your accountant or tax adviser about the new rules.
The new regime does not require contractors to guarantee that nobody in their supply chain will ever breach a tax obligation. It does require them to act reasonably, investigate concerns and retain evidence of those decisions.
That is the practical standard now. Strong due diligence will not make every construction risk disappear, but it can help demonstrate that your business did not ignore the warning signs. And it may protect more than your CIS position: it can also support better insurance terms, stronger insurer confidence and more sustainable bond capacity.
This article is for general information and is not tax or legal advice. Contractors should obtain advice on their own CIS arrangements and review their insurance policy wording with a qualified broker.