What verification is and why it sits at the heart of CIS
The Construction Industry Scheme requires contractors to deduct money from subcontractor payments and pass it to HMRC as an advance against the subcontractor's tax. The deduction rate is not a flat number. It depends entirely on the status of the individual subcontractor: 0% for a gross payment status (GPS) holder, 20% for a subcontractor registered under CIS, and 30% for anyone not on HMRC's register. A contractor cannot know which rate applies without checking. That check is verification.
Verification is a legal requirement, not a discretionary step. Before making the first payment to a subcontractor in a tax year, or the first payment to a subcontractor the contractor has not previously worked with, the contractor must contact HMRC to confirm the subcontractor's status. HMRC searches its records and returns a deduction rate and a verification number. The contractor applies the rate, records the number, and includes both in the monthly CIS300 return. The whole payment and deduction chain depends on this step being completed accurately.
Two things follow that are worth stating clearly. First, CIS deductions apply to the labour element of the payment only. The cost of materials the subcontractor buys for the job is excluded from the deduction base. So on a £2,000 invoice made up of £1,200 labour and £800 materials, the 20% (or 30%) rate applies to the £1,200, not the full £2,000. This is one of the most commonly misunderstood rules in CIS and getting it wrong creates real liability for contractors. Second, if a contractor cannot verify a subcontractor and applies a lower rate without HMRC's confirmation, the contractor is liable for the difference. The 30% rate is the default where verification has not been carried out.
From 6 April 2026, verification has taken on a second and more urgent function. Finance Act 2026 introduces a toughened GPS regime under which HMRC can revoke a contractor's gross payment status immediately, without advance notice, where the contractor "knew or should have known" about fraudulent connections in its supply chain. The "should have known" standard does not require intent: failing to carry out due diligence is sufficient. Re-verifying each subcontractor's CIS status before payment is one of the three core due-diligence steps that contractors must now document to protect themselves. This is covered in full in the section on April 2026 below.
How the verification process works in practice
Verification is done through HMRC's CIS online service, accessed via the Government Gateway, or by telephone on the CIS helpline. The contractor provides their own Unique Taxpayer Reference (UTR), the subcontractor's name, the subcontractor's UTR, and for limited companies the company registration number. HMRC cross-references its records and returns one of three results.
| HMRC result | What it means | Rate to apply |
|---|---|---|
| Gross payment status confirmed | The subcontractor holds GPS and is paid in full | 0% (no deduction) |
| Registered subcontractor | The subcontractor is on HMRC's CIS register but does not hold GPS | 20% on the labour element |
| Not found / unregistered | The subcontractor is not on HMRC's CIS register | 30% on the labour element |
Alongside the deduction rate, HMRC returns a verification number. This number is the evidence that verification took place. It must be recorded in the contractor's CIS records and included on the payment and deduction statement issued to the subcontractor after each payment. It is also required when filing the monthly CIS300 return for subcontractors being verified for the first time. Keeping accurate records of verification numbers is a basic compliance requirement and, from April 2026, part of the documentary trail that demonstrates due diligence has been carried out.
A 30% result does not necessarily mean fraud. It means HMRC cannot find the subcontractor on its register. The most common reasons are that the subcontractor has not registered for CIS, that the details provided do not match HMRC's records, or that registration is still being processed. The contractor must apply 30% until verification succeeds, regardless of what the subcontractor says about their own status. The contractor has no choice in this: applying a lower rate without HMRC confirmation creates a direct liability for the contractor.
Worked example: applying the deduction correctly
The labour-only deduction base matters a great deal in practice. Consider a plumber who submits the following invoice:
| Invoice line | Amount |
|---|---|
| Labour (2 days installation) | £900 |
| Materials (pipe, fittings, fixings supplied by subcontractor) | £600 |
| Invoice total (ex VAT) | £1,500 |
The contractor has verified the plumber and HMRC confirmed registered status (20%). The CIS deduction is calculated on the labour element only:
| Calculation | Amount |
|---|---|
| Labour element (deduction base) | £900 |
| CIS deduction at 20% | £180 |
| Materials (excluded, paid in full) | £600 |
| Net payment to subcontractor | £1,320 |
| Amount passed to HMRC | £180 |
A contractor who mistakenly applied the 20% rate to the full £1,500 would deduct £300 instead of £180, over-deducting by £120 on a single invoice. Across a year, with multiple subcontractors and multiple payments, the cumulative error becomes substantial. The correct rule is clear: materials are excluded, and the deduction base is the labour element as stated on the invoice. Where an invoice does not separate labour and materials, HMRC guidance requires the contractor to make a reasonable estimate and to document the basis for it.
Re-verification: when the original check is no longer enough
A single verification carried out at the start of an engagement does not serve indefinitely. HMRC's own guidance sets out the circumstances in which re-verification is required, and the April 2026 changes have broadened the practical expectation considerably.
Re-verification is required in the following situations. First, at the start of a new tax year for subcontractors who have not received any payments in the previous two months of the current year. If a subcontractor worked for the contractor in January 2026 but nothing has been paid since, the contractor must re-verify before the next payment. Second, whenever HMRC sends a notice that a subcontractor's status has changed. Third, where there is reason to believe the subcontractor's position has altered, for example if GPS is known to have been revoked or if the subcontractor's registration is disputed.
In practice, from April 2026, contractors with GPS should treat re-verification as a routine step before each payment rather than a periodic check. The section below explains why.
April 2026: verification becomes a fraud-risk control
Finance Act 2026, in force from 6 April 2026, introduces the most significant changes to the GPS framework since the scheme began. The changes apply to contractors who hold GPS, and they make verification a central pillar of a new due-diligence duty. This is settled, in-force law: Finance Act 2026 received Royal Assent on 18 March 2026 and the CIS provisions took effect on 6 April 2026 under SI 2026/289.
The core change is the "knew or should have known" standard for GPS revocation. Previously, HMRC revocation of GPS on fraud grounds required evidence that the contractor had actual knowledge of fraudulent connections in the supply chain. From 6 April 2026, HMRC can revoke GPS immediately, without advance notice, where the contractor either knew or should have known about those connections. The "should have known" limb is the critical one. It means that a failure to carry out due diligence is itself enough. HMRC does not need to prove the contractor was complicit. It needs to show only that a contractor taking reasonable steps would have detected the problem.
The consequences of revocation under this standard are severe:
| Consequence | Detail |
|---|---|
| Immediate revocation | GPS removed without advance notice from the date HMRC determines the standard is met |
| Five-year reapplication ban | Previously one year. A contractor losing GPS on fraud grounds cannot reapply for five years |
| Cash-flow cost | Roughly £100,000 per year in deductions at source for a contractor with £500,000 in annual turnover, because GPS (0%) is replaced by the 20% registered rate |
| Knowledge-based penalty (ss.62A/62B) | A 20% penalty on the payment, or the sums a return treats as paid, where the payer or return-maker knew a connected party deliberately failed to comply. It falls on the company; the officer-liability rules can then reach the responsible directors personally |
To meet the "should have known" standard and protect GPS, contractors are now expected to carry out three due-diligence steps before each payment. These are not optional extras. They represent the baseline that HMRC will look for when assessing whether a contractor took reasonable precautions:
- Re-verify the subcontractor's CIS status with HMRC before each payment and record the verification number.
- Check the subcontractor's Companies House record (for limited companies) to confirm the company is actively registered, matches the trading name, and has not been flagged for anomalies such as a very recent incorporation or an address shared with many other recently registered companies.
- Verify that the bank account name matches the subcontractor's registered or trading name before transferring funds. Bank account name verification (through Confirmation of Payee or an equivalent check) reduces the risk of payments being redirected through fraudulent accounts in the supply chain.
These three steps sit alongside each other. Carrying out CIS verification without the Companies House and bank-name checks, or completing the Companies House check without re-verifying status, does not constitute full due diligence under the standard HMRC expects. Contractors should document each step for every subcontractor, every payment, and retain that documentation in case HMRC opens an enquiry.
The GPS guide at CIS gross payment status: how to qualify, apply and keep it in 2026 covers the full April 2026 regime in detail, including the five-year ban, the 20% knowledge-based penalty under ss.62A/62B, and how the revocation and reapplication processes work. Contractors who hold GPS and have not yet reviewed their supply-chain due-diligence procedures should treat that guide as essential reading alongside this one.
Verification and the monthly CIS return
Verification feeds directly into the contractor's monthly CIS300 return. Every return must include, for each subcontractor paid in the tax month, the subcontractor's name and UTR, the gross amount paid, the amount of materials (excluded from deductions), the deduction made, and, for subcontractors verified for the first time in that return, the verification number HMRC issued. A return that omits verification numbers where they are required is incomplete and can trigger an HMRC compliance check.
The monthly return must be filed by the 19th of the following tax month. Tax months run to the 5th, so the return covering the month to 5 May is due by 19 May. Payment of the CIS deducted must reach HMRC by the 22nd electronically or the 19th if paying by cheque.
One change from April 2026 that is directly connected to the monthly return is the reinstatement of the nil return obligation. Where a contractor makes no payments to subcontractors in a tax month, a CIS300 nil return must still be filed by the 19th. This obligation was removed in 2015 and has been reinstated from 6 April 2026. Many contractors are already missing it. The full detail on nil returns, the penalty ladder and the pre-notification alternative is in our guide to CIS monthly returns: deadlines, nil returns and penalties.
Common verification errors and how to avoid them
Four mistakes come up repeatedly in contractor CIS compliance work. Each is avoidable with a clear process.
Applying the rate stated by the subcontractor rather than the HMRC-confirmed rate. A subcontractor who tells you they are registered and should have 20% deducted may be telling the truth, but the contractor cannot rely on that. The contractor's obligation is to verify with HMRC directly. Relying on the subcontractor's own assertion, however plausible, does not discharge the verification duty.
Failing to separate labour and materials on the invoice. If a subcontractor invoices a single lump sum without breaking out labour and materials, the contractor must obtain the breakdown before applying the deduction. Asking for an itemised invoice is not pedantic. It is a practical necessity. Where the breakdown cannot be established, HMRC expects a reasonable and documented estimate. Applying the deduction rate to the whole invoice, including materials, over-deducts and can create disputes about the payment and deduction statement.
Carrying the original verification result forward indefinitely. A verification from two years ago confirming GPS may no longer reflect current status. GPS can be revoked between verifications, and from April 2026 the consequences of paying at 0% to a subcontractor whose GPS has since been removed are serious. Re-verifying routinely, and keeping a record of each re-verification, is the only reliable way to protect the contractor's position.
Keeping inadequate records of verification numbers. A verification number is the audit trail that proves the contractor fulfilled the obligation. If HMRC opens a compliance check and the contractor cannot produce verification numbers for its subcontractors, the assumption is that verification did not happen. The number must be recorded at the time of verification and linked to the relevant payment in the contractor's CIS records.
What verification cannot tell you (and what else is now required)
CIS verification confirms a subcontractor's status with HMRC. It does not tell the contractor anything about the subcontractor's ownership, whether the company is recently incorporated to facilitate fraud, whether the bank account genuinely belongs to the business, or whether the supply chain above or below that subcontractor contains fraudulent parties. Before April 2026 these wider questions were largely outside the formal CIS compliance framework. From April 2026 they are not.
The "should have known" standard requires contractors to look beyond the HMRC confirmation. A company registered two weeks ago with no trading history, an address shared with fifty other construction companies and no visible presence is a warning sign that a CIS verification alone would not reveal. A bank account in a name that does not match the business invoicing for the work is another. The three-step due-diligence framework (CIS re-verification, Companies House check, bank-name verification) is designed to catch these risks. No single step is enough on its own.
This is particularly relevant for contractors who engage subcontractors through supply chains they do not directly control, for example where a main contractor engages a domestic sub that itself uses further labour-only sub-subcontractors. HMRC's focus in GPS fraud investigations has been on supply-chain structures where fraudulent labour providers insert themselves between the legitimate parts of the chain. Understanding who is actually doing the work and verifying the legitimacy of the immediate payee is a practical starting point.
Public sector payments: verification no longer applies
One carve-out from April 2026 is worth noting. Under new Regulation 24ZA, payments to local authorities and public sector bodies are fully exempt from CIS. This means contractors working on public sector contracts no longer need to apply CIS deductions to those payments, do not include them in the monthly CIS300 return, and do not need to carry out CIS verification for those payees. The exemption covers the payment side: a contractor who is themselves a subcontractor on a public sector contract is still subject to normal CIS rules on what they receive from the main contractor, depending on their own status.
Next steps for contractors
The verification duty is among the most operationally significant obligations a contractor carries under CIS. Getting it right means applying the correct deduction rate, protecting the business from HMRC liability, and from April 2026 building the documentary record that demonstrates the due-diligence duty has been met.
For contractors who hold GPS, the priority is to review existing verification processes and ensure that re-verification, Companies House checks and bank-name verification are built into the payment workflow before each payment, not as a one-off exercise at the start of an engagement. The GPS anti-fraud changes make this an ongoing obligation, not a box to tick at onboarding.
For subcontractors, the key protection is registration. An unregistered subcontractor suffers a 30% deduction on the labour element of every payment. A registered subcontractor suffers 20%. That 10-point gap on every invoice, before expenses and allowances are taken into account, is the practical argument for registering with HMRC before starting any CIS work. A specialist CIS accountant can handle the registration and set up the framework for reclaiming over-deductions through Self Assessment (sole traders) or in real time via the Employer Payment Summary (limited companies). If you would like support with your CIS position, you can find out more on our CIS refund service page or get in touch directly.
To see what each verification outcome means in cash terms, our CIS deduction calculator shows the difference between the 0%, 20% and 30% rates on a real invoice.
For a full introduction to how the scheme works, including the registration process and what contractors and subcontractors are each required to do, see What is the Construction Industry Scheme? A complete guide. For contractors managing the monthly return and nil-return obligations alongside verification, the CIS monthly return guide covers all the deadlines and penalty rules in one place.