CIS supply chain due diligence: what HMRC expects

The test

Since 6 April 2026 HMRC can act where a business knew or should have known that payments it made or received were connected with fraudulent evasion of tax. It can cancel gross payment status at once, make the business liable for the lost tax and charge a penalty of 30% of it. Source: Tackling Construction Industry Scheme fraud (policy paper, 26 November 2025).

HMRC's manual says "knew or should have known" is not defined and is an objective test. A business should have known if the only reasonable explanation for a transaction was that it was connected to the fraud. "The only reasonable explanation" does not mean there is no other explanation, only that it is the only reasonable one. Source: HMRC manual CISR85060: 'knew or should have known' principles.

Signs HMRC names

Too good to be true. A business should judge from its risk assessment that a deal which looks too good to be true probably is, and either not go ahead or look at it much harder. Source: HMRC manual CISR85060: 'knew or should have known' principles.
Contrived transactions. The manual says it is common for supply chain fraud to involve one or more contrived transactions. Source: HMRC manual CISR85060: 'knew or should have known' principles.
Firms that go missing. The policy paper says businesses in fraudulent supply chains often deal again and again with businesses that go missing or default on payments. Source: Tackling Construction Industry Scheme fraud (policy paper, 26 November 2025).

Whose knowledge counts

For a company, HMRC looks at what its directors and company secretaries knew, and also its employees and third parties such as agents and advisers who helped with the transactions. Source: HMRC manual CISR85060: 'knew or should have known' principles. So what your office staff knew can count, not only what the directors knew.

What HMRC says about compliant businesses

The policy paper says the measures should not affect compliant businesses in construction that do the due diligence needed to make sure those they contract with in the supply chain are not engaged in supply chain fraud. Source: Tackling Construction Industry Scheme fraud (policy paper, 26 November 2025). Checks you have written down, with the date and what you were told, are how you show it.

What we suggest you record

These are our suggestions, not an HMRC list:

the date you verified each subcontractor with HMRC, the verification reference and the rate (how to verify)
a check of each limited company on the Companies House register, with the date (how to check a company)
whether they pass the work on, and to whom
why you chose them, and how their quote compares with the others you were given
any change of bank details, and how you confirmed it

Supply labour, or pay firms that do? Read CIS checks for labour providers.

Questions people ask

What checks does HMRC expect?

HMRC's manual says a business should make a judgement based on its risk assessment, and either not go ahead with a deal that looks too good to be true or look at it much harder. The policy paper says compliant businesses that do the due diligence needed should not be affected.

Whose knowledge counts in a company?

HMRC's manual says the knowledge of the directors and company secretaries counts, and so does that of employees and of third parties such as agents and advisers who helped with the transactions.

Does due diligence matter if I only pay labour providers?

Yes. The rules reach payments made or received, so the firms you pay and the firms that pay you both sit in the chain.

Read on GOV.UK on 26 October 2026. If GOV.UK changes, we change this page.

Run the free checks. The company check reads the Companies House register for one company, and the self-check asks 15 quick questions about who you pay and how you check them. No signup.

More guides

Wherever you build: CIS checks across the UK.