HMRC CIS Subcontractor Verification: What UK Contractors Must Do Before They Pay

What is the Construction Industry Scheme (CIS)?

CIS is HMRC's mechanism for managing tax on payments made by contractors to subcontractors in the construction industry. If you pay subcontractors for construction work — whether they're sole traders, partnerships, or limited companies — you are a contractor under the scheme and the rules apply to you.

The scheme doesn't determine whether your subcontractor is employed or self-employed. It determines how tax is handled on the payments you make to them. Under CIS, you must apply the correct deduction rate to each payment and pay that deduction to HMRC on the subcontractor's behalf.

Three deduction rates apply:

Status	Rate	What it means
Gross	0%	Registered and meets HMRC's criteria. No deduction — the subcontractor pays their own tax.
Standard	20%	Registered but not at Gross status. You deduct 20% from their labour costs and pay it to HMRC.
Higher	30%	Subcontractor cannot be matched against HMRC records. Applied when you have not verified — this is the default risk rate.

The rate you apply must be the rate HMRC confirms, not the rate your subcontractor tells you. That confirmation is a CIS verification number.

What is a CIS verification number?

A CIS verification number is HMRC's written confirmation that a subcontractor's registration has been checked and a deduction rate assigned. It is your evidence that you applied the correct rate, and keeping that evidence on file is one of the clearest ways to show HMRC you took reasonable care if your CIS compliance is ever reviewed.

You obtain a verification number by querying HMRC's system before making the first payment to a subcontractor you haven't previously verified. Per HMRC's CIS guidance, you generally don't need to re-verify a subcontractor who was included on a CIS return you submitted in the current tax year or in either of the previous two tax years. Outside that window, or if you're unsure of a subcontractor's status, re-verify before paying them, since CIS status can change and HMRC's rules on this are detailed and situation-specific.

There are three ways to obtain a verification number:

• Government Gateway online service — The most common route for smaller contractors. Log in to HMRC's contractor portal and run the verification directly. Instant result in most cases.
• HMRC's CIS helpline — Phone-based verification. Takes longer and requires you to have the subcontractor's UTR (Unique Taxpayer Reference) and National Insurance number ready.
• API integration — For accounting software that connects directly to HMRC. The software runs the verification automatically when a new subcontractor is added.

The verification number itself looks like a reference code (for example: V1234567890X). Record it, along with the date of verification and the rate confirmed, and retain it for a minimum of three years.

The April 2026 "Knew or Should Have Known" rule

Before April 2026, HMRC had a high bar to hold contractors liable for tax arising from subcontractor fraud. HMRC needed to demonstrate that the contractor knew a subcontractor's gross status claim, connected to that fraud, was false.

From April 2026, the "Knew or Should Have Known" standard extends that liability. Where a payment is connected to fraud, HMRC can hold a contractor liable if it concludes the contractor should have known about it, even without direct proof the contractor knew. The rule is targeted at payments connected to fraud specifically; it is not a general rule that failing to verify a subcontractor automatically makes a contractor liable in every case.

What this means in practice:

• Verifying every subcontractor and keeping the evidence remains the clearest way to show HMRC you took reasonable care, and it puts you in a far stronger position if HMRC ever investigates a payment connected to fraud.
• Taking a subcontractor's word for their Gross status, without HMRC's confirmation, leaves you with much less evidence to fall back on if that status later turns out to be false. HMRC's verification confirms the rate; a subcontractor's assurance on its own does not.
• If you pay a subcontractor at Gross rate without verifying and they turn out not to have been entitled to that status, you risk being pursued for the shortfall, and not having a verification record makes that risk considerably harder to defend against.

This is a general summary of a detailed and evolving area of tax law. Whether the "Knew or Should Have Known" standard applies to a particular payment depends on the specific facts involved, so treat this section as background rather than a determination of your position, and confirm anything specific with HMRC or a qualified adviser.

What records does HMRC require you to keep?

Verification is only half the obligation. You must also retain the evidence that you verified, at what rate, and when. HMRC requires CIS records to be kept for a minimum of three years from the end of the tax year in which the work was carried out.

What you must keep:

• The CIS verification number for each subcontractor
• The date verification was carried out
• The deduction status confirmed by HMRC (Gross, Standard, or Higher)
• Gross payment amounts per subcontractor, per month
• Tax deducted per payment and the total paid to HMRC
• Each monthly CIS return filed (see below)

Monthly CIS returns are a separate obligation that many smaller contractors are unaware of. If you've made payments to subcontractors in a month, you must file a CIS return with HMRC for that month — even if the amounts are small, and even if no tax was deducted because all your subcontractors are Gross status. Late filing penalties are:

• £100 for a return that is one month late
• £200 for two months late
• £300 (or 5% of any deductions, whichever is higher) for six months late
• Up to £3,000 for twelve months late

HMRC can trigger a CIS compliance check at any time, not just when something goes wrong. It can be initiated by a return anomaly, a referral, or random selection. When that happens, HMRC requests your records, and if you don't have them, it becomes much harder to demonstrate that you met your obligations.

Common mistakes and how to avoid them

The mistakes below are the ones that most often leave contractors exposed to HMRC scrutiny. Most come down to skipping the verification step or failing to document it properly.

Paying Gross without verifying. The subcontractor says they're registered Gross. You take their word for it. No verification number is obtained, no record is kept. Where a payment like this turns out to be connected to fraud, the April 2026 rules mean HMRC does not need to prove you knew, only that you should have known. Not verifying leaves you without the evidence that could otherwise support your position, which is a significant risk if HMRC does look into the payment.

Assuming an old verification still applies. CIS status is not permanent. A subcontractor can lose Gross status if they fail to file returns, fail to pay tax on time, or fall below HMRC's compliance threshold. Per HMRC's guidance, you generally don't need to re-verify a subcontractor who was included on a CIS return you filed in the current tax year or in either of the two tax years before that. Outside that window, though, or if you have reason to think their status may have changed, a verification from some time ago may no longer reflect where they stand today, so re-verify before paying them.

Applying the wrong deduction rate. If you pay Gross without verifying and the correct rate was 20% or 30%, you risk being pursued for the shortfall. HMRC's general practice is to collect from the contractor, who holds the records obligation, rather than from the subcontractor who misstated their status.

No verification number on file. Some contractors run a verbal check or a rough online lookup without noting the resulting verification number. This leaves you in much the same position as not checking at all: without a recorded verification number, you have little evidence that you checked, which weakens your position considerably if HMRC asks.

How Subchecked handles CIS verification

Subchecked connects to HMRC's Government Gateway on your behalf using a single connection you authorise once. When you add a subcontractor to a project, Subchecked runs the CIS verification automatically and stores the result in your project's audit trail — verification number, date of verification, and deduction status confirmed.

The verification record is retrievable at any time: for your accountant, for your own records, or when HMRC requests documentation in a compliance check. Every record is timestamped, giving you a clear, ready-made audit trail.

Subchecked also flags when a subcontractor may be due for re-verification, so you're not relying on memory to track HMRC's rules on when a fresh check is needed.