Due diligence
CIS Verification, the First Piece of the Puzzle
What a clean CIS check tells you, what it doesn’t, and why the checks need to keep running.
What a clean CIS check tells you, what it doesn’t, and why the checks need to keep running.
Our CIS Defence platform has been live since the new CIS rules came into force on 6 April 2026, and we’ve seen it help contractors in some weird and wonderful ways. Stories stick better than legislation, so let me tell you one about CIS verification.
Claire is finance director at a mid-sized contractor. A labour provider comes recommended by one of her site managers. It can start on Monday and it is cheaper than the usual firms. Her team verifies it with HMRC and it comes back registered for CIS, so it is paid with 20% deducted. Job done, or so it seems.
That check did exactly what it is meant to do. HMRC confirmed the business was registered and told Claire’s team how much tax to take off. What it did not tell them is whether the business is genuine, whether its VAT is right, or whether anything changes after that first day. And HMRC won’t make you check again. As long as a subcontractor has been on one of your CIS returns in the current or last two tax years, that first verification still counts, however long ago it was. We cover what CIS verification does and does not confirm in a separate guide.
The provider now has 30 operatives across three of Claire’s sites. Every invoice carries VAT at 20%, which her team reclaims each quarter.
I’m not a technical VAT expert, so here’s the short version. On most construction work, the domestic reverse charge means the subcontractor doesn’t charge you VAT at all and you account for it yourself. It doesn’t cover everything, though. New homes and work where you’re the end customer are outside it, and so are labour agencies supplying workers, which is what Claire is buying. So her provider charges VAT, and the number on the invoice matters. If the business isn’t registered, that VAT normally can’t be reclaimed. If HMRC decides you knew or should have known the purchase was connected to fraud, it can refuse the reclaim anyway.
If your eyes glazed over somewhere around ‘reverse charge’, you’re not alone. Back to Claire.
One Friday afternoon, killing time before the weekend, Claire is scrolling through her phone when she notices the provider has gone into liquidation. The paperwork filed at Companies House shows HMRC as its biggest creditor. By the following week a new company has been incorporated, and the same people are in touch asking to pick up where they left off. The new company verifies with HMRC without a problem.
Claire’s team goes back through the file. They know these people. The site manager vouches for them, the work has been good, and the insurance certificates and usual paperwork are all there. But the provider’s VAT registration was cancelled months ago, its invoices kept charging VAT, and nobody had picked it up. Beyond the onboarding paperwork and a CIS verification from the first week, very little of what the team knew or checked along the way was ever written down.
If that unpaid tax includes CIS or PAYE, it matters far more since 6 April 2026. Under section 62A of the Finance Act 2004, inserted by the Finance Act 2026, HMRC can make a contractor pay 20% of every payment caught, where the contractor knew or should have known that CIS or PAYE was deliberately not being deducted or paid further down the chain. Penalties of up to 30% of that amount can follow, and HMRC can pass some or all of a penalty to directors personally. The contractor’s own Gross Payment Status, if it holds it, can be cancelled straight away, with a five-year wait before it can apply again.
HMRC has to show the contractor knew or should have known. Its guidance says it will look at what the business knew about the risks generally, anything about the payments that should have raised questions, and the checks it carried out. We explain how the test works and who can be held liable elsewhere.
Having sat on the other side of the table at HMRC, I can tell you the first questions are rarely complicated. What did you check, when did you check it, and what did you do about what you found? A good working relationship is real, but it is not a record, and “we’ve always trusted them” is not something you can show anyone.
Same provider, same Monday start. This time Claire’s team adds the provider to CIS Defence before the first payment. CIS is checked with HMRC through Claire’s own Government Gateway connection and comes back registered, exactly as before. The VAT number is checked with HMRC and the name matches the company at Companies House. The day rate is on the keen side, but within the normal range for the trade, and nothing looks out of place in the directors’ history. On day one there is nothing to find.
That is the point. The checks keep running.
Every 30 days they run again on their own. In month three, the site manager is sent a short site check by email, and the headcount he records is lower than the invoices show. In month five, the regular re-check picks up that two other companies run by one of the directors have been dissolved within weeks of each other. In month six, the VAT number comes back cancelled, while the invoices are still charging VAT.
None of those on its own proves anything. Together they build a picture, and Claire’s team sees it forming months before that Friday afternoon. They ask questions, make a decision and record why, along with who made it. If any check had failed to run, it would have said so rather than showing clean.
When Claire generates the HMRC Passport for the provider on that project, it is all there. It shows what was checked, when, what came back and what the team did about it. CIS Defence never told them who to work with. It just meant that if anyone ever asks, there is an answer they can show.
Both versions of Claire’s story had the same provider, the same people and the same Friday afternoon. The only difference was what her team could see, and when.
CIS verification is where every good check starts. It’s the first piece of the puzzle. The rest is the right checks, run often enough, with a record you can show.
The warning signs in Claire’s story are ones we see again and again. Stories like hers make for great reading. You just don’t want to be the protagonist.
Want a clear view of your own supply chain?