Why April 2026 matters more than most CIS updates
Most changes to the Construction Industry Scheme are incremental. A threshold moves, a deadline is clarified, a form is redesigned. The April 2026 package is different in kind. Finance Act 2026 did not simply adjust the dials of CIS, it changed who is exposed, how fast a sanction can land, and how far the consequences reach. A new 20% knowledge-based penalty now falls on anyone who pays, or makes a return, knowing a connected party deliberately failed to comply, gross payment status can be stripped away with no advance notice, and the absence of routine checks is itself treated as culpable.
That is why this update deserves more attention than the usual annual housekeeping. The CIS deduction rates themselves are unchanged for 2026/27: 0% for a subcontractor with gross payment status (GPS), 20% for a registered subcontractor and 30% for an unregistered one, all applied to the labour element of a payment only. What changed is the compliance environment around those rates, and in particular around the most valuable position in the scheme, GPS, which lets a subcontractor be paid in full with nothing deducted at source.
This guide walks through the four changes that matter most, in force from 6 April 2026 under Finance Act 2026: immediate GPS revocation on the knew-or-should-have-known standard, the jump in the reapplication ban from 1 year to 5 years, the new 20% knowledge-based penalty under new sections 62A and 62B, and the reinstated mandatory nil return. It works the numbers in real pounds, sets out the due-diligence checklist that protects you, and ends with what contractors and subcontractors should do now. If you want the deeper background on the status itself, our full guide to CIS gross payment status covers how to qualify, apply and keep it.
Change 1: Immediate GPS revocation on the knew or should have known standard
The first and most consequential change is that HMRC can now remove gross payment status immediately, with no advance notice, where a contractor knew or should have known about fraudulent connections in the supply chain. Previously, revocation generally followed a clear compliance failure, late returns, overdue tax, a PAYE default, and came with process. The new power is faster and broader.
What the standard means in practice
The phrase to focus on is "should have known". Knowing is the easy half: actual knowledge of fraud is plainly caught. The hard half is constructive knowledge. The standard means that a failure to carry out due diligence is itself sufficient for revocation. HMRC does not have to prove you intended to be involved in fraud, or even that you actually knew about it. If you paid a subcontractor you could and should have checked, and you did not check, you can fall foul of the test on that omission alone.
This is a meaningful shift in where the burden sits. Under the old regime, a contractor with a clean filing record was largely safe. Under the new one, a clean filing record is necessary but no longer sufficient. You also have to be able to demonstrate that you took reasonable steps to satisfy yourself that the businesses you paid were genuine. The absence of those steps is the gap the rule targets, because doing nothing is exactly what "should have known" is designed to catch.
Sections 62A and 62B and the documented trail
The provisions are enacted by Finance Act 2026, with the new knowledge-based penalty in FA 2004 sections 62A and 62B (covered in detail under Change 3 below). The practical upshot of the revocation power is that verification is no longer just the step that sets the deduction rate. From 6 April 2026 it doubles as a fraud-risk control, and a documented verification trail becomes your evidence that you did not have reason to know about a problem. We cover the mechanics of that first step in our guide to verifying subcontractors under CIS, which now feeds directly into the due-diligence duty.
The point is that this standard rewards process and punishes its absence. A contractor who runs and records the same three checks on every subcontractor before payment has a defensible position. A contractor who pays first and asks questions later does not. The rest of this guide is, in effect, about closing that gap.
Change 2: The reapplication ban rises from 1 year to 5 years
The second change sharpens the consequence of losing GPS on fraud grounds. Previously, a business whose GPS was removed could reapply after 1 year. From 6 April 2026 that wait rises to 5 years. While the ban runs, the business is back on the 20% deduction at source on every payment instead of 0%, so the cash-flow penalty does not just bite once, it compounds year after year for half a decade.
Worked example: a £500,000 turnover business loses GPS
Take a subcontractor turning over £500,000 a year on its labour element. With GPS, nothing is deducted at source and the full turnover stays in the business as working capital. Lose GPS and 20% is withheld on every payment. That is roughly £100,000 a year taken at source and held by HMRC until it is reclaimed after the year end.
Under the old 1-year ban, the exposure was a single bad year: around £100,000 of cash tied up before the business could reapply and return to 0%. Under the new 5-year ban, that £100,000 a year recurs across the whole ban period. Multiplied out, the working-capital hit is in the region of £500,000 of cash held back over five years.
| Reapplication ban | Cash withheld per year (20% on £500k) | Total cash withheld over the ban |
|---|---|---|
| Old regime: 1 year | ~£100,000 | ~£100,000 |
| From 6 April 2026: 5 years | ~£100,000 | ~£500,000 |
The deductions are an advance against tax, not an extra tax, so the business eventually reclaims any overpayment. But the timing is the point. For a trade that runs on thin margins and a long cash cycle, losing the use of £100,000 a year for five years is not an inconvenience, it is a threat to survival. The five-year ban turns a recoverable cash-flow problem into a structural one.
Change 3: New knowledge-based penalties under sections 62A and 62B
The third change is the one with the longest reach, because it puts a direct penalty on the act of paying or reporting while turning a blind eye. New FA 2004 sections 62A and 62B, inserted by Finance Act 2026, create a penalty for knowledge-based involvement in deliberate non-compliance. Under section 62A, a person who makes a payment under a construction contract knowing, or having reason to know, that a connected party deliberately failed to comply with its CIS obligations is liable to a penalty of 20% of the payment. Under section 62B, a person who makes a return knowing it is wrong because a connected party deliberately failed to comply is liable to an amount equal to the sum the return treats as deducted and paid, that is 100% of the sum falsely returned, with no percentage reduction. The two quanta are different: section 62A takes a fifth of the payment, section 62B claws back the whole of the sum a false return pretends was accounted for.
Who the penalty falls on, and how it reaches the individual
The penalty attaches to the payer or the return-maker, which may be a company or an individual. There is no special director rate and no 30% figure in either section. What stops the corporate structure being a firewall is the separate, long-standing officer-liability rules: where a company's deliberate behaviour produces a penalty, HMRC can transfer part or all of that penalty to the officers personally responsible for the behaviour. There is no fixed percentage on that transfer, it turns on the facts, but the practical effect is real. A director who let the due diligence slip, or who knew about a problem and paid anyway, can be pursued personally for the company's penalty. For limited-company subcontractors and contractors, that converts supply-chain hygiene from a company-level compliance matter into a personal financial risk.
Worked example: £200,000 of relevant payments
Suppose a company makes £200,000 of payments under construction contracts knowing that a connected party deliberately failed to comply with its CIS obligations. Under section 62A the penalty is 20% of those payments, charged on the company as the payer.
| Relevant payments made with knowledge | Penalty rate (s.62A) | Penalty on the payer |
|---|---|---|
| £200,000 | 20% | £40,000 |
| £100,000 | 20% | £20,000 |
| £500,000 | 20% | £100,000 |
On the headline £200,000 figure, the section 62A penalty is £40,000, charged on the payer. Where the payer is a company and the failure was deliberate, HMRC can then look to recover part or all of that penalty from the responsible officers under the officer-liability rules, so a director can end up personally on the hook even though the 20% itself is a company-level charge. The change in principle is what matters: the downside of paying without checking a supply chain is now a direct 20% penalty on the payments involved, and the individuals behind the company are no longer insulated from it. That is the strongest argument for treating the due-diligence checklist below as non-negotiable.
Section 62B works differently and bites harder per pound. It targets the return-maker rather than the payer, and the amount is not a percentage of payments but the whole sum the return falsely treats as deducted and paid over. If a return is made, in the knowledge of a connected party's deliberate failure, that pretends £200,000 was accounted for to HMRC when it was not, the section 62B liability is the full £200,000, not a fifth of it. So where section 62A is a 20% charge on the payer, section 62B recovers 100% of the sum a false return claims to have paid from whoever made the return.
Change 4: The mandatory nil return is back
The fourth change is quieter but catches a lot of contractors off guard. The CIS300 nil return is mandatory again from 6 April 2026. The obligation existed historically, was removed in 2015, and has now been reinstated.
What a nil return is and when it must be filed
A contractor must report payments to subcontractors to HMRC on a monthly CIS300 return, due by the 19th of the following tax month (tax months run to the 5th). A nil return is simply a CIS300 filed for a tax month in which the contractor made no payments to any subcontractor. Between 2015 and April 2026 you could just stay silent in a quiet month. From 6 April 2026 you cannot: where you pay no subcontractors in a tax month, you must still file a nil CIS300, or pre-notify HMRC that you are inactive for that period so it does not expect a return.
This trips up contractors who work in bursts, take seasonal breaks, or have a single large subcontractor relationship that pauses. A month with no subcontractor payments now carries a positive filing duty rather than a quiet gap. If you have an inactive spell coming, the cleaner route is usually to pre-notify HMRC of the inactivity rather than file a string of separate nil returns.
Penalties for failure
A late or missed nil return is treated like any other late CIS300, and the penalty ladder is unforgiving for what feels like a paperwork formality:
| Lateness | Penalty |
|---|---|
| 1 day late | £100 |
| 2 months late | £200 |
| 6 months late | £300 or 5% of the CIS liability, whichever is higher |
| 12 months late | £300 or 5% of the CIS liability, whichever is higher; up to £3,000 or 100% where information is withheld deliberately |
For a genuine nil month the liability is zero, so the higher-of figures at six and twelve months default to the fixed £300, but the early penalties still apply: £100 the day after the deadline and £200 at two months. Miss several quiet months and the £100s stack up quickly. The fix is mechanical: a recurring monthly check, file the CIS300 even when it is nil, or pre-notify inactivity in advance. For a fuller treatment of the monthly cycle, see our CIS gross payment status guide and the related verification material, both of which sit alongside the contractor return obligations.
The due-diligence checklist that meets the new standard
Because the should-have-known standard is satisfied by the simple absence of reasonable checks, the defence is to carry out, and be able to evidence, due diligence before paying any subcontractor. Three steps are central, and the discipline is to do all three, every time, and keep the record.
- Re-verify the subcontractor's CIS status with HMRC. Verification tells you whether to deduct at 0% (GPS), 20% (registered) or 30% (unregistered), so it sets the correct rate. From 6 April 2026 it also confirms the subcontractor is genuine and on HMRC's records, which is the first plank of your should-have-known defence. Re-verify rather than relying on a stale check from months ago.
- Run a Companies House legitimacy check. Confirm the business you are paying actually exists, is active, and matches who you contracted with. A dormant, recently dissolved, or freshly incorporated shell that does not line up with the trading relationship is exactly the kind of red flag the rule expects you to spot.
- Carry out bank account name verification. Check that the payee account belongs to the entity you contracted with, not a redirected or substituted third party. Mismatched payee names are a classic fraud signal, and verifying them is a low-effort, high-value control.
None of these is onerous on its own. The change is that they are no longer optional good practice, they are the evidence that protects your GPS and shields your directors. Build them into the payment process as a gate that a subcontractor invoice cannot pass until all three are recorded, and the should-have-known risk falls away.
Before and after: the April 2026 CIS regime at a glance
The table below summarises how the four headline changes shift the position. The deduction rates themselves (0% / 20% / 30% on labour) are unchanged, so the movement is entirely in the compliance regime around them.
| Aspect | Before 6 April 2026 | From 6 April 2026 (Finance Act 2026) |
|---|---|---|
| GPS revocation trigger | Generally followed a clear compliance failure, with notice | Immediate, no advance notice, on knew or should have known about supply-chain fraud |
| Reapplication ban after fraud-grounds removal | 1 year | 5 years |
| Knowledge-based penalty | No standalone CIS penalty for paying or reporting with knowledge of deliberate failure | s.62A: 20% of the payment, on the payer. s.62B: 100% of the sum a false return treats as paid, on the return-maker. Officer-liability rules can reach directors personally |
| Nil return obligation | Not required (removed in 2015) | Mandatory again, or pre-notify inactivity |
| Role of due diligence | Good practice | Effectively required: its absence meets should have known |
The cash-flow impact of losing GPS at different turnover levels
The single most important number in all of this is the cash withheld when GPS goes. Because the 20% applies to the labour element of every payment, the annual cash held back scales directly with turnover. The table below shows the rough in-year cash impact at three turnover levels, and then the exposure across the new five-year ban.
| Annual labour turnover | Cash withheld per year at 20% (vs 0% with GPS) | Exposure across a full 5-year ban |
|---|---|---|
| £200,000 | ~£40,000 | ~£200,000 |
| £500,000 | ~£100,000 | ~£500,000 |
| £1,000,000 | ~£200,000 | ~£1,000,000 |
These figures assume the bulk of turnover is labour, which is where the deduction bites; a business with heavy materials spend would see a smaller deduction, because materials are excluded from the CIS base. Even so, the direction is unmistakable. The higher your turnover, the more GPS is worth, and the more catastrophic losing it for five years becomes. A £1 million subcontractor losing GPS for the full ban period is looking at roughly £1 million of cash cycling through HMRC and back rather than staying in the business. You can model your own position with our CIS gross payment status eligibility checker.
What contractors and subcontractors should do now
The changes are live from 6 April 2026, so the work is not to wait and see but to adjust process now. The priorities differ slightly by role, but they overlap.
If you hold gross payment status, your two jobs run side by side. Stay current on your own filing and payments so you pass the routine annual compliance review, and run consistent, documented due diligence on every subcontractor you pay so you stay clear of the immediate-revocation power. Neither alone is enough now. A perfect filing record no longer protects you if you cannot show you checked your supply chain, and the best checks in the world do not help if you fall behind on your own returns.
If you are a contractor who files CIS300 returns, add a standing monthly step to file the return even when it is nil, or pre-notify HMRC of any inactive period in advance, so the reinstated nil-return obligation does not quietly accrue £100 and £200 penalties in your quiet months. Treat the three due-diligence checks as a gate that every subcontractor payment must pass before the money goes out.
If you are a limited-company director, understand that sections 62A and 62B make supply-chain fraud a personal financial risk, not just a company one. The section 62A penalty is a 20% charge on the company as payer (and section 62B can recover 100% of any sum a false return claims to have paid from the return-maker), but where the failure is deliberate HMRC can recover the penalty from the responsible officers under the officer-liability rules, so the £40,000 company penalty in the worked example above can follow you personally. That is the reason to insist the due-diligence routine is actually followed and recorded, not delegated and forgotten. Whether those checks happen is now tied directly to your own exposure.
If you are a subcontractor weighing GPS, the status is still the most valuable position in CIS because of the cash-flow benefit, and the new rules do not change that. They change what it takes to keep it safely. If your business can clear the turnover threshold (£30,000 net for a sole trader, £30,000 per partner or director or £100,000 total for a partnership or company), keep a clean compliance record, and sustain the due-diligence discipline, GPS remains well worth holding. If you cannot yet commit to that discipline, the refund route on the 20% rate may be the better interim position. Our gross payment status application and maintenance service is built around exactly this balance: securing the status and then keeping it safe under the new regime.
The bottom line
April 2026 is not a routine CIS update. Finance Act 2026 made gross payment status revocable immediately on a should-have-known standard, lengthened the reapplication ban from 1 year to 5, reinstated the mandatory nil return, and, most strikingly, created knowledge-based penalties on anyone who pays or reports under CIS knowing a connected party deliberately failed to comply (20% of the payment under section 62A, 100% of the sum a false return treats as paid under section 62B), reaching the responsible officers personally through the officer-liability rules. The rates are unchanged at 0% / 20% / 30% on labour, but the compliance environment around them is materially tougher, and the consequences now reach the individual.
The defence is process. A documented three-step check on every subcontractor before payment, a clean filing and payment record, and a monthly nil-return discipline together meet the new standard and protect both the company's GPS and its directors. If you want help building that routine, working out whether you qualify for or should keep GPS, or modelling the cash-flow cost of losing it, our team handles GPS applications, maintenance and CIS compliance every week. Start with our CIS gross payment status eligibility checker or read more on our gross payment status service page.