CIS due diligence is now a central part of how HMRC assesses a business’s knowledge of fraud within a construction supply chain. Since 6 April 2026, where a business knew or should have known that a payment was connected with the fraudulent evasion of tax, HMRC has new powers it may use depending on the circumstances: cancelling gross payment status with immediate effect, making the business liable for an amount based on the payment, and charging a penalty of up to 30 per cent of that amount.
HMRC is also looking closely at the returns themselves. On 18 September 2026 it published a reporting route for contractors it has written to about applying an incorrect deduction rate between 6 April 2025 and 5 April 2026. Those letters concern deduction-rate errors, not findings of fraud. They nevertheless provide a separate reminder that CIS return accuracy remains an active compliance issue.
For contractors, end-hirers and the recruitment agencies that supply construction labour, an HMRC enquiry is unlikely to stop at whether checks were run. Its manual asks officers to document what those checks found, how regularly they were repeated and how the business responded.
What changed for CIS due diligence on 6 April 2026
Section 220 of Finance Act 2026 amended the Construction Industry Scheme in Part 3, Chapter 3 of Finance Act 2004. According to HMRC’s tax information and impact note, where a business knew or should have known that a payment was connected with fraudulent evasion of tax, HMRC can:
- Cancel gross payment status immediately. The bar on reapplying rises from one year to five.
- Make the business liable for the lost tax. HMRC’s manual at CISR85020 describes a liability of 20 per cent of the payment made.
- Charge a penalty of up to 30% of the amount determined under section 62A. Where the statutory conditions are met, HMRC may make an officer personally liable for some or all of the company’s penalty.
The same note says the measure should not affect compliant businesses that carry out the due diligence needed. HMRC projects, in figures certified by the Office for Budget Responsibility, that the measures will raise £205 million in 2026 to 2027.
The knowledge test is borrowed from VAT, where the Kittel principle has applied for years. What sharply comes into focus in CIS is the record. HMRC does not have to prove a contractor knew; it can argue the contractor should have known.
The questions HMRC tells officers to ask about CIS due diligence
HMRC’s Construction Industry Scheme Reform Manual at CISR85080 instructs officers to determine and document what checks were performed, when and how regularly, what the results indicated, what purpose the business believed they served, whether they were appropriate, adequate and timely, and whether the business acted on the results.
HMRC’s manual says due diligence should normally be carried out before a transaction, so dated records made at the time are the clearest evidence of what was checked and known. A verification response saved on the day a subcontractor started shows that a check took place; on its own, it says little about what followed.
The manual is candid on two further points. A lack of due diligence alone is unlikely to prove a business should have known, but checks that would have given cause for concern are highly relevant. Equally, pristine paperwork is not enough, because officers will look at whether the checks were genuine.
The question HMRC’s manual asks is not whether you verified a subcontractor. It is what you did with what you found.
Applying Check, Act and Review to the construction supply chain
The manual points businesses to HMRC’s GfC12 guidance on labour supply chain assurance. In OPRaaS’s view, the CIS questions map closely onto the Check, Act and Review principles that sit behind HMRC’s supply chain due diligence approach. That mapping is OPRaaS’s reading; HMRC has not published it.
Check
Check covers what was looked at, and how far down. At CISR85090, HMRC says checks limited to a business’s immediate subcontractors and customers are not necessarily sufficient to judge the integrity of the supply chain. Below tier one is where risk can be hardest to see.
Act
Act is where many files run out. At CISR85100, HMRC says making enquiries is not enough, and gives warning signs such as a short trading history, a large income in that short period, a poor credit rating and contact out of the blue. Contracting anyway, with no further enquiry, may suggest the checks were casually undertaken.
Review
Review answers the question of how regularly. Review frequency should reflect the supplier, transaction and risk profile. Dated periodic reviews, together with checks triggered by material changes or warning signs, can help demonstrate that decisions remained informed when payments were made.
Why CIS due diligence now reaches the boardroom and the payroll
Two features of the regime widen it beyond the accounts team. First, HMRC may make a director or other officer personally liable for some or all of the company’s penalty where the relevant company actions are attributable to them and they personally knew or should have known that the transactions were connected with deliberate non-compliance (CISR85150). Agreeing transactions or failing to intervene despite that knowledge may be relevant.
Second, the section 62A rules can also reach deliberate PAYE failures within a construction supply chain. They apply where a person makes a payment under a construction contract and, before payment, knew or should have known that a relevant party had deliberately failed, or would deliberately fail, to deduct or pay CIS or PAYE amounts. Agency and umbrella arrangements therefore need to be considered where they form part of the relevant construction supply chain.
That labour also sits under the new joint and several liability rules for umbrella arrangements, introduced by Finance Act 2026, which inserts Chapter 11 into Part 2 ITEPA 2003, with effect for payments made on or after 6 April 2026. They are distinct from older PAYE debt transfer powers. Two regimes started on the same day.
The legal tests are different. CIS fraud liability depends on the statutory payment and knowledge conditions. Umbrella joint and several liability depends on the qualifying arrangement and the identity of the relevant party. A shared evidence record may support both control frameworks, but due diligence should not be presented as a statutory defence to umbrella JSL.
Module 4 of the OPRaaS LSCA Self-Certification Course makes the point plainly in its Supplier Due Diligence, CAR Principles topic: third-party services may assist with due diligence, but the contracting organisation remains accountable for supplier choices and due diligence decisions.
How OPRaaS audits support CIS due diligence
For CIS due diligence, HMRC verification establishes the applicable deduction treatment. It does not, on its own, show that the supply chain behind a payment is sound. That evidence has to come from the suppliers.
The OPRaaS audit platform asks agencies and umbrella companies to answer structured questions on CIS, PAYE, employment status and fraud controls, and to upload the evidence behind each answer. The umbrella CIS audit, for example, asks whether the supplier retains proof of subcontractor verification. Red flags are highlighted, each audit is scored, and the client can download the audit report as part of its evidence file. Clients of the OPRaaS Virtual Compliance Director (OPRaaS VCD) service also receive an in-depth review report.
An audit shows what a supplier evidenced and where the concerns lie. Deciding what to do about a red flag, and recording that decision, remains with the contracting business. That is the part of the CIS due diligence record the CISR85080 points focus on, and no audit can supply it on the business’s behalf.
What contractors, agencies and boards should take from this
For businesses holding gross payment status, the fraud measures increase the importance of ongoing, evidenced supply-chain judgement. Initial verification is not a substitute for responding to later warning signs. For recruitment agencies and umbrella companies supplying construction sites, the PAYE limb means their payroll arrangements may fall within a contractor’s CIS due diligence where they form part of the relevant construction supply chain and the statutory conditions are met. For boards, the officer provisions make the record a matter of personal as well as corporate exposure.
HMRC’s manual also lists press and trade coverage of CIS and labour supply chain fraud among the signs of general awareness. Awareness is now on the record. The test is whether the checks, the follow-up and the decisions are on the record too.
Compliance is your asset. Evidenced daily.
Read next
“When HMRC questions gross payment status, what can a contractor show?“
This article draws on HMRC’s tax information and impact note on tackling CIS fraud, section 220 of Finance Act 2026, HMRC’s Construction Industry Scheme Reform Manual at CISR85020, CISR85070, CISR85080, CISR85090, CISR85100 and CISR85150, HMRC’s Employment Status Manual at ESM2420, HMRC’s guidance for contractors who have received a letter about monthly return errors, HMRC’s GfC12 and Module 4 of the OPRaaS LSCA Self-Certification Course.
Talk to OPRaaS about your labour supply chain.
Talk to OPRaaS about auditing the agencies and umbrella companies in your construction supply chain. Use the contact form alongside this article or email info@opraas.co.uk.
This article is editorial commentary by OPRaaS Limited (On-Pay-Roll-as-a-Service), drawing on published research, legislation and government guidance. It provides general information and does not constitute legal, tax, employment or compliance advice. Obligations vary according to organisation, contractual arrangements and individual engagements. Appropriate professional advice should be obtained before acting on a specific position.