TL;DR: Three legislative changes hit CIS on 6 April 2026. HMRC can now cancel Gross Payment Status instantly where a business ‘knew or should have known’ a transaction was fraud-connected. Reapplication takes five years, not one. Directors face personal liability. And nil return filing is back. This guide covers the new due diligence standard, the documented trail you need, and how outsourced CIS compliance protects your contractor clients.
April 2026 Is Not a Soft Deadline
The Construction Industry Scheme is changing in ways that most practices have not yet fully absorbed, and the window for preparation is closing. From 6 April 2026, a package of measures announced in the Autumn Budget 2025 comes into force that fundamentally shifts how HMRC can respond to fraud-connected CIS transactions, how gross payment status can be cancelled and when nil returns must be filed. These are not incremental adjustments to an existing framework. They represent a material increase in both financial risk and compliance obligation for every contractor client on your books.
The firms that will be best placed in April are those that have already reviewed their subcontractor due diligence processes, updated their engagement letter terms, and built the monitoring workflows that the new “knew or should have known” standard will demand. That preparation is achievable between now and 6 April, but it requires deliberate action rather than a wait-and-see approach. The purpose of this article is to set out precisely what is changing, what those changes mean in practice, and how to build compliance processes that will hold up to HMRC scrutiny when they are tested.
What Is Actually Changing Under CIS from 6 April 2026
There are three distinct legislative changes taking effect from 6 April 2026, each introduced through Finance Bill 2025-26. They were announced at Autumn Budget 2025 and confirmed by HMRC in published legislation. Understanding each one separately is important, because they operate independently and each creates its own compliance obligations.
Change 1: Immediate GPS cancellation for fraud-connected transactions
HMRC gains the power to immediately cancel a contractor’s or subcontractor’s gross payment status where it can be demonstrated that the business knew or should have known that a transaction was connected to the fraudulent evasion of tax. This mirrors the existing VAT countermeasure framework, where the same standard has been applied to supply chain fraud since 2021. The published legislation amends Section 66(3) of the Finance Act 2004 to create this new ground for immediate removal.
The word “immediately” in this context is significant. Under the previous regime, GPS cancellation followed a review process with notice periods and appeal windows before the cancellation took effect. From April 2026, where the fraud connection is established, HMRC can act without that process. For a subcontractor business whose cash flow depends on receiving payments gross rather than net of 20% or 30% deductions, immediate cancellation is an operational emergency.
Change 2: The five-year reapplication bar
Where GPS is cancelled on fraud grounds under the new power, the reapplication period increases from one year to five years. This is documented in the amendment to Section 66(7) of the Finance Act 2004. A business that loses GPS under the new rules cannot reapply until five years have elapsed from the date of cancellation. For a subcontractor operating in the construction sector, losing GPS for five years is not a temporary inconvenience. It is a business-model threat. The cash flow impact of having 20% or 30% withheld from every payment for five years, across a full roster of contracts, will be existential for many businesses.
Change 3: Reinstatement of nil CIS returns
The requirement to file nil CIS returns, which was removed in 2015, is being reinstated from 6 April 2026. Under the consultation published by HMRC, contractors who have not paid any subcontractors in a given month must file a nil return for that month unless they have notified HMRC in advance that they will not be making subcontractor payments. Where neither action has been taken, a penalty will be charged. The ICAEW confirmed this change in its January 2026 tax briefing, noting that the consultation closed on 3 February 2026 and that the final regulations will take effect from 6 April 2026.
Change 4: Liability for lost tax and director-level penalties
In addition to GPS cancellation, a business that knew or should have known it was party to a fraud-connected transaction becomes directly liable for the tax lost in that transaction. On top of that liability, HMRC can impose a penalty of up to 30% of the lost tax, chargeable not only against the business but also against its directors and other persons connected to the business. This personal liability dimension changes the risk profile considerably for directors of construction businesses and for their advisers. Penalty exposure is no longer limited to the corporate entity.
The HMRC policy document estimates the Exchequer impact of these measures at £205 million in 2026-27 alone, rising from £25 million in 2025-26 as the measures begin to take effect. That figure reflects the scale of fraud HMRC believes is currently operating within CIS supply chains and the volume of enforcement action it anticipates.
The "Knew or Should Have Known" Standard and What It Demands in Practice
The “knew or should have known” test is the central compliance challenge created by the April 2026 changes. It is also the one that is most widely misunderstood. The standard does not require HMRC to prove that a contractor deliberately engaged with a fraudulent subcontractor. It requires only that HMRC can show that a reasonable business in the same position, with the same information available, should have identified that the transaction was connected to fraud. Ignorance is not a defence if the warning signs were present and the business failed to investigate them.
This mirrors the way the same test operates in VAT supply chain fraud cases, where the First-tier Tribunal and Upper Tribunal have developed a substantial body of case law on what constitutes adequate due diligence. The key principle consistently applied in those cases is that a business cannot deliberately avoid knowledge of fraud by refusing to ask questions or conduct checks that a reasonable business would conduct. HMRC will apply the same logic to CIS from April 2026.
What the standard demands from contractors
In operational terms, the “knew or should have known” standard requires that every contractor can demonstrate it took active steps to verify that each subcontractor in its supply chain was legitimate, was registered for CIS where required, and did not display characteristics associated with fraudulent operators. The GOV.UK guidance on subcontractor verification sets out the baseline verification requirement. But from April 2026, that baseline is the starting point for due diligence, not the finishing point.
A contractor that verified a subcontractor at the start of an engagement and took no further steps to monitor that subcontractor across the life of the contract will not be able to rely on that initial verification as a complete defence. The “should have known” limb of the test means that if warning signs emerged after verification, including changes in payment details, inconsistencies in invoicing, or indicators of a missing trader structure, the contractor should have identified and responded to those signs.
What records must contractors keep
To satisfy the standard under HMRC scrutiny, contractors should maintain and be able to produce:
- The date and outcome of every subcontractor verification, including the status returned by HMRC
- Evidence of the due diligence conducted before each subcontractor was onboarded, including Companies House checks, VAT registration confirmation where applicable, and review of director history
- Records of any changes to subcontractor payment details and the steps taken to verify the legitimacy of those changes
- Any communications that raised concerns about a subcontractor and the steps taken in response
- Confirmation that each subcontractor’s CIS registration status was re-checked at intervals throughout the engagement rather than only at the point of onboarding
The CIS 340 guide for contractors and subcontractors sets out HMRC’s existing record-keeping expectations. From April 2026 those expectations should be treated as a minimum, not a comprehensive compliance standard.
Red flags that will support a “should have known” finding
The following indicators, drawn from the VAT fraud case law that the new CIS standard is modelled on, represent the types of factors HMRC will look for when assessing whether a contractor should have identified a fraudulent connection:
- Subcontractor invoice values that appear inconsistent with the scale or nature of the work performed
- Frequent changes to bank account details or requests to pay through third-party accounts
- Subcontractors with no registered business address or a registered address that does not match operational reality
- Director records that show a pattern of dissolved companies, county court judgements, or disqualification history
- Payment terms that differ significantly from normal commercial practice without clear explanation
- Subcontractors who are not VAT registered where the scale of their operations would normally require registration
None of these indicators individually constitutes proof of fraud. Collectively, or in combination with others, they represent the kind of pattern that a reasonable business is expected to investigate rather than ignore.
Gross Payment Status: Why a Five-Year Loss Changes Everything
Gross payment status is the operational foundation on which most registered CIS subcontractor businesses are built. Without it, 20% is withheld from every payment where the subcontractor is registered for CIS, or 30% where the subcontractor is unregistered. For a subcontractor turning over £500,000 per year in contract payments, a 20% deduction means £100,000 per year held by contractors and paid to HMRC as a deduction on account. That money is recoverable through the self-assessment or corporation tax process, but only after the end of the tax year, and subject to the subcontractor being in a refund position overall.
The five-year reapplication bar introduced from April 2026 means that a GPS cancellation on fraud grounds is not a temporary setback that can be resolved through an appeal and a fresh application twelve months later. It is a five-year operational constraint. The GOV.UK guidance on gross payment status sets out the conditions for GPS, and the new legislation adds fraud-connection as a ground for immediate removal with the extended reapplication period.
Can HMRC withdraw GPS without warning?
From 6 April 2026, yes. The new power under Section 66(3) of the Finance Act 2004 as amended enables immediate cancellation where the fraud connection is established. There is no requirement for a warning notice, a review period, or a pre-cancellation hearing before the cancellation takes effect. The right to appeal will exist, but the cancellation will be operative from the moment HMRC acts. This is a significant departure from the previous process and one that advisers need to communicate clearly to their construction clients.
GPS compliance checks that need to happen before April
For clients who currently hold GPS, the period before April 2026 is the time to confirm that their GPS qualification is soundly based and that their supply chain does not contain any relationships that could, under scrutiny, give rise to a “knew or should have known” finding. That means:
- Reviewing the current subcontractor roster and confirming CIS registration status for each one
- Checking that the payment and deduction records for the last two to three years are complete and accurate
- Identifying any subcontractors in the supply chain whose profile raises any of the red flag indicators listed above
- Documenting the due diligence steps taken at onboarding for each active subcontractor and updating any gaps
Practices managing GPS clients should consider scheduling a formal pre-April review for each one. The Saffery analysis of the April 2026 changes describes a three-phase process covering review, vendor risk profiling, and process improvement that provides a useful structural framework for that work.
Nil Returns Are Back: What Contractors Must Do Now
The reinstatement of the nil return obligation is the change that will create the most immediate operational disruption for practices managing CIS returns for construction clients. The nil return requirement was removed in 2015, which means that any contractor who began operating after 2015 has never encountered it and may be entirely unaware of it.
From 6 April 2026, a contractor who makes no subcontractor payments in a given month must do one of two things:
- File a nil return for that month through their HMRC online CIS account, or
- Notify HMRC in advance that they will not be making subcontractor payments that month, using the established notification process.
If neither action is taken, a penalty will be charged for the missed filing. The HMRC consultation document explains the background to this change, noting that the removal of the nil filing obligation in 2015 did not reduce administrative burdens in practice and resulted in erroneous late filing penalties where contractors assumed no filing was required. The reinstatement is intended to eliminate that confusion by creating a clear binary obligation: file or notify.
Why this matters more than it appears
The nil return obligation will create compliance failures in the first few months after April for any practice that has not actively communicated the change to its contractor clients. Seasonal construction businesses, contractors who are between projects for one or more months, and businesses that have temporarily paused subcontractor engagement are all at risk of missing the obligation simply because they do not know it exists. A single missed nil return generates a penalty. Multiple missed nil returns compound into a penalty debt that is disproportionate to the underlying issue.
For practices managing CIS compliance outsourcing on behalf of contractor clients, the nil return obligation needs to be built into the monthly workflow from April 2026. The process should include a monthly check on whether a return is required, a nil return filing if no payments have been made, and a client-facing confirmation that either action has been completed. Leaving this to client-initiated instructions will result in gaps.
Communicating the nil return change to clients
This change warrants a direct client communication before April, not an annual letter that mentions it alongside several other updates. Construction contractor clients need to understand specifically that from April 2026 they must either confirm monthly subcontractor payments, file a nil return in months where no payments are made, or notify HMRC in advance of inactive months. Practices that have already issued this communication will find client compliance significantly easier to manage from April onwards.
The Most Common CIS Compliance Failures That Will Trigger Penalties
The April 2026 changes increase the consequences of compliance failures that were already present in the CIS framework. Understanding which failures are most common, and most likely to come to HMRC’s attention under the enhanced enforcement environment, is the starting point for any pre-April review with construction clients.
Failure to verify subcontractors before payment
The most fundamental and frequently occurring CIS failure is making a payment to a subcontractor without completing the verification process first. The GOV.UK verification guidance requires contractors to verify every new subcontractor with HMRC before making the first payment. The verification process confirms whether the subcontractor is registered for CIS and at what deduction rate. A contractor who pays a subcontractor without completing this step has not only applied the wrong deduction rate in many cases but has also failed a basic due diligence requirement that will undermine any defence against a “knew or should have known” finding.
Applying the wrong deduction rate
Deduction rate errors are among the most common CIS mistakes and they come in both directions. Applying 20% to a subcontractor who holds GPS results in an unauthorised deduction and a liability to the subcontractor. Applying 20% to an unregistered subcontractor who should be deducted at 30% results in an underpayment to HMRC. The consequences of underpayment are more serious under the post-April framework because they sit within the compliance record that HMRC will examine when assessing whether the business exercised appropriate care. A pattern of rate errors, even where they are innocent mistakes rather than deliberate evasion, will not support a credible “did not know” defence.
Late or missed monthly returns
Monthly CIS returns must be filed by the 19th of the month following the month in which payments were made. Late filing generates automatic penalties starting at £100 for the first month, rising to £200, £300, and then £3,000 for sustained failure. Practices managing CIS returns for multiple construction clients know that this deadline creates recurring pressure, particularly when clients are slow to provide payment information. From April 2026, the nil return obligation adds a layer to this requirement: a month with no payments still requires a filing action.
Failing to deduct on materials versus labour
CIS deductions apply to the labour element of a payment, not to the cost of materials that are directly incurred by the subcontractor. Contractors who apply deductions to the full invoice amount including materials are over-deducting. Contractors who accept inflated materials allocations from subcontractors to reduce the deductible amount without adequate verification are exposed to a challenge from HMRC on the accuracy of those allocations. The CIS 340 guide sets out how to calculate the deductible element, including the evidence required to support materials cost claims.
Inadequate records for payments and deductions
Contractors must be able to produce a complete record of every payment made to a CIS subcontractor, the deduction applied, and the monthly return it was reported on. Practices managing these records for construction clients frequently encounter gaps, particularly where the contractor uses a combination of payroll software, accounting software, and manual records that are not properly reconciled. From April 2026, the records dimension of CIS compliance carries more weight because they are the primary evidence available if HMRC investigates a supply chain connection.
Not re-verifying subcontractors after a break in engagement
A verification that was completed two years ago on a subcontractor who then had a gap in engagement before returning to the supply chain is not a current verification. CIS registration status can change. A subcontractor can move from registered to unregistered, or from net rate to gross rate, and the only way a contractor knows which deduction rate applies at any given moment is to verify at the time of payment or within the current tax year. The HMRC guidance on verification allows contractors to use a verification from the current or previous tax year, but relies on the contractor having actually obtained and recorded that verification.
Building a Subcontractor Due Diligence Process That Holds Up to HMRC Scrutiny
A subcontractor due diligence process that will satisfy the “knew or should have known” standard is not complicated in principle. It is a structured set of checks, documented at each stage, applied consistently across every new and continuing subcontractor relationship, and maintained as a live record rather than a one-time exercise. The difficulty for most practices and their construction clients is not understanding what is required but building the workflow discipline to execute it reliably across a potentially large and changing subcontractor roster.
The onboarding checklist
Before making a first payment to any subcontractor, contractors should complete and document the following steps:
- CIS verification with HMRC, recording the reference number, the status returned, and the applicable deduction rate
- Companies House check confirming the entity’s incorporation date, registered address, director names, and current filing status
- VAT registration check where the subcontractor’s turnover level suggests they should be registered
- Confirmation of bank account details matched to the entity name on the company register, not just to the trading name on the invoice
- Director search for any history of dissolved companies, county court judgements, or disqualification orders
- Review of the subcontractor’s insurance certificates appropriate to the work being performed
The subcontractor risk register
A subcontractor risk register is a live document that tracks each active subcontractor’s compliance profile and flags the indicators that warrant closer scrutiny. The register should include, at minimum:
- The date of most recent CIS verification and the status returned
- The date of most recent Companies House review
- Any changes to bank account details and the date and outcome of the verification conducted
- A risk rating based on the presence or absence of the red flag indicators described in Section 2
- The date of the next scheduled re-verification
- Notes of any concerns raised and the action taken
A risk register does not need to be a sophisticated technology solution. A well-maintained spreadsheet with clear column definitions is adequate for most practices. What matters is that it is updated whenever a relevant change occurs, reviewed at the start of each month alongside the CIS return preparation, and accessible for inspection if HMRC requests evidence of the due diligence process. For practices managing outsourced accounting services for construction clients, a standardised risk register template applied consistently across all clients is considerably more efficient than building a custom process for each engagement.
Continuous monitoring, not point-in-time verification
The “knew or should have known” standard, as applied in VAT supply chain fraud cases, consistently places weight on whether a business had a process for ongoing monitoring rather than just an onboarding check. A contractor that onboards a subcontractor carefully but then has no process for monitoring that subcontractor’s profile across the life of the engagement is exposed to a finding that it should have identified warning signs that emerged after the initial due diligence.
Continuous monitoring does not mean weekly checks on every subcontractor. It means a defined schedule, applied consistently, for re-verification with HMRC, for reviewing Companies House filings, and for flagging any changes in invoicing, payment instructions, or commercial behaviour that are inconsistent with the established pattern of the relationship. A quarterly review cycle for active subcontractors, with immediate action triggered by any of the red flag indicators, is a reasonable and defensible standard.
Practical actions before April 2026
For practices advising construction clients, the recommended pre-April actions are:
- Issue a client communication explaining the new “knew or should have known” standard and what it requires of them
- Request an updated subcontractor list from each contractor client and cross-reference it against HMRC verification records
- Identify any subcontractors in the roster who have not been verified in the current or previous tax year and initiate re-verification
- Build or update a risk register for each client, documenting the due diligence position for each active subcontractor
- Review engagement letter terms to confirm that CIS compliance obligations, including the risk of penalty under the new rules, are clearly allocated between the practice and the client
- Confirm whether each contractor client is aware of the nil return obligation and the process for complying with it from April
How Outsourcing CIS Compliance Reduces Penalty Exposure
The volume and precision of the compliance work that the April 2026 changes require is significant. For a practice managing CIS returns for fifteen or twenty construction clients, each with active subcontractor rosters that require monthly verification checks, nil return decisions, deduction calculations, and payment statement production, the workload will increase materially from April onwards. For many practices, the capacity to manage that increase from internal resources alone is constrained.
The accountancy talent pressures that UK practices are facing are well-documented, and CIS compliance is exactly the type of structured, process-driven, deadline-sensitive work that is well-suited to an offshore delivery model. An offshore and onshore delivery structure allows the high-volume monthly processing, verification checks, and nil return filings to be managed by an offshore team working to defined workflows, with the onshore practice team retaining responsibility for client-facing review, sign-off, and the judgement calls that require direct client knowledge.
The risk reduction from this model is structural rather than incidental. Defined workflows with documented outputs at each stage, applied consistently across every client engagement, produce the kind of record trail that satisfies the “knew or should have known” standard under scrutiny. A compliance process that varies by the experience level of the staff member who happened to execute it this month is inherently less defensible than one that follows a fixed checklist producing consistent documented outputs every time.
The same discipline that applies to VAT compliance outsourcing applies here: monthly deadlines, structured verification workflows, and complete documentation are the operational foundations of a CIS compliance service that reduces penalty exposure for contractor clients rather than simply filing returns on their behalf.
For practices considering how to build this capacity ahead of April, Acenteus CCA provides structured offshore delivery models specifically designed for UK accounting practices managing compliance-intensive client portfolios.
It is also worth noting that the GDPR and data security considerations involved in outsourcing CIS work, which includes sharing client subcontractor records, payment data, and verification outputs with a delivery partner, need to be addressed in the engagement terms and data processing agreements before work begins. This is not a reason to avoid outsourcing CIS compliance. It is a reason to set it up correctly at the outset.
The Compliance Window Is Closing
6 April 2026 is a fixed point and the preparation required to reach it in good shape is substantial. The “knew or should have known” standard will be tested in enforcement actions that HMRC has already signalled it will pursue actively. The five-year GPS reapplication bar will make fraud-connected GPS cancellations into business-threatening events for the subcontractors affected. The nil return obligation will generate automatic penalties for every contractor client who does not understand the new requirement before the first filing month arrives.
The good news is that none of this is unmanageable with the right preparation. Practices that have structured subcontractor due diligence processes, updated their engagement letter terms, communicated the changes clearly to their contractor clients, and built the monitoring workflows that continuous compliance requires will be well-positioned from April. Those that are still working through that preparation have time to complete it if they act now.
The practices best placed for April are those that have already begun treating CIS compliance as a year-round structured process rather than a monthly return exercise. The year-end compliance pressures that construction-heavy practices face every April sit alongside these new obligations, which makes the case for building efficient, well-documented compliance workflows even stronger. April 2026 is not the end of HMRC’s attention on CIS supply chain fraud. It is the beginning of a more assertive enforcement era. Starting it with strong processes and documented due diligence is the most practical way to protect your clients and your practice.
Frequently Asked Questions (FAQ)
Three changes come into force: immediate GPS cancellation for fraud-connected transactions, a five-year reapplication bar where GPS is removed on fraud grounds, and the reinstatement of the nil CIS return obligation for months where no subcontractor payments are made. All are confirmed in HMRC's published legislation.
Yes. From 6 April 2026 HMRC can cancel GPS immediately where a business knew or should have known that a transaction was connected to the fraudulent evasion of tax. No advance notice period is required before the cancellation takes effect.
It means a contractor cannot rely on ignorance as a defence if warning signs of fraud were present and a reasonable business would have identified them. Active subcontractor due diligence and documented monitoring are the practical requirements.
Five years from the date of cancellation, increased from the previous one-year period. This applies specifically where GPS is cancelled under the new fraud-connection ground introduced from 6 April 2026.
Up to 30% of the lost tax, chargeable to the business and to its directors and other connected persons individually. The business also becomes directly liable for the full amount of the tax lost in the fraud-connected transaction.
Yes, from 6 April 2026. Contractors must either file a nil return or notify HMRC in advance that no subcontractor payments will be made that month. Failure to do either will result in an automatic late filing penalty. The HMRC consultation document confirms the requirement.
The higher rate of 30% applies to unregistered subcontractors. Contractors who apply the standard 20% rate to an unregistered subcontractor will have underpaid HMRC and face a shortfall liability. Verifying registration status before payment is essential.
Contractors must retain records of all subcontractor verifications, monthly return submissions, payment and deduction statements, and materials cost evidence for at least three years. The CIS 340 guide sets out the full record-keeping requirements.
A verification is valid for the current and previous tax year. Any subcontractor not verified within that window should be re-verified before the next payment is made. For actively engaged subcontractors, a quarterly review cycle is a sound minimum standard.
Structured offshore delivery ensures that monthly returns, nil filings, verification checks, and subcontractor risk register updates are completed to a consistent documented standard, reducing the variability that creates compliance gaps and penalty exposure under the new enforcement framework.
