A firm I audited last year had taken on a labour supplier the ordinary way. Somebody knew somebody. The rates were sensible, the men turned up, the invoices arrived on a Friday. Nine months in, the supplier stopped answering the phone, and the company on all those invoices turned out to have filed nothing with anybody since the week it was incorporated.
Nothing came of it. That was last year.
What changed in April
Start with the scheme, because plenty of people operate it every month without ever having had it explained. The Construction Industry Scheme — everybody calls it CIS — makes the firm paying for construction work take a slice off the top of what it pays its subcontractors and send that straight to HMRC as an advance on the subcontractor’s tax bill. Thirty per cent if the subcontractor isn’t registered with HMRC. Twenty if they are. And nought — paid in full, nothing withheld — if they hold what’s called gross payment status.
Gross payment status is the one every firm of any size wants, and it is granted on a compliance record: returns filed on time, tax paid on time, and since April 2024 your VAT counted in too. Lose it and twenty per cent of the labour value of every invoice you raise stops arriving. You get it back from HMRC eventually. Eventually is the problem.
Since 6 April this year there has been a second way to lose it, and this one has nothing to do with your own filing. Where HMRC can show that a business knew — or should have known — that a payment it made or received was connected with the fraudulent evasion of tax, it can cancel that business’s gross payment status immediately, make the business liable for the tax that was lost, and charge a penalty of up to thirty per cent of that lost tax. The penalty can land on the directors and other connected persons as well as on the company. And where the status goes on those grounds, you cannot apply for it again for five years. Until April it was one.
The dangerous half of the sentence
“Knew” isn’t your problem. If you knowingly joined in a fraud you need a solicitor, not a better filing system.
“Should have known” is the whole of this piece. HMRC says openly that the measure is modelled on the equivalent rules in VAT, which the courts have long read as an objective test — it doesn’t turn on what was actually in your head, but on what the facts in front of you ought to have told a reasonable firm in your position. Rates that undercut everyone else by a distance. A company incorporated six weeks before it started invoicing you. Three different company names invoicing over two years for the same gang of men.
Not one of those proves anything by itself. Put them in a row in front of an inspector three years after the fact and they stop looking like coincidences. The defence you will want — that you did look, and the firm checked out at the time — isn’t an argument about your honesty. It’s an argument about evidence.
Read the government’s own sentence again
There is a line in the policy paper HMRC published alongside this measure that is worth reading twice. It says the change “should not impact compliant businesses in the construction industry who undertake the due diligence required to ensure those they contract with in the supply chain are not engaged in supply chain fraud”.
Note the condition. Not compliant businesses. Compliant businesses that undertake the due diligence required. Due diligence being nothing more exotic than checking who you are dealing with before you deal with them, and being able to show later what you checked. Good practice, until April. Now it is the thing standing between your firm and five years of getting paid eighty per cent.
The question worth asking this week
Here it is: take the labour supplier you took on most recently. Can you produce today, without ringing anybody, a dated record of what was checked before they were paid a penny — and who checked it?
In most firms I look at, the answer sits in four places and one person. The HMRC verification sits in the payroll software. The insurance certificate is an attachment on an email in a commercial manager’s inbox. Somebody looked the company up on Companies House and formed a view that was never written down. Nobody re-checked after the first month, because nothing tells anyone to. And the commercial manager who did the checking left in March; his mailbox was closed in April.
The firm may well have done everything right. It simply can’t show it, and under this test showing it is the job.
What a fix looks like
Small, as usual. This is not an argument for a supply-chain assurance platform with a dashboard nobody opens. Three things. One onboarding record for every firm you pay: what was checked, on what date, by whom, with the document attached rather than described. A clock on the things that expire — insurance, verification, whatever you re-check each year — so it happens because the system raised it, not because someone remembered. And an append-only trail: entries dated when they were made, never quietly edited afterwards.
That last one sounds like a technicality and isn’t. A folder can be tidied up the week the letter arrives. A dated log can’t. That is the whole distance between evidence and a story.
None of it is a big build. All of it has to sit inside the way your commercial team already takes on suppliers, which is why the off-the-shelf version ends up half-used.
Where this doesn’t apply
If you carry your own labour and subcontract nothing, none of this touches you. If you’re small enough that you personally take on every firm you pay and could name all nine from memory, your record is your memory and it will probably hold — though memory doesn’t survive you retiring, and it reads poorly across a meeting-room table. And if you already run proper supplier onboarding with dated evidence attached, you have passed; ignore the rest.
It’s the firm in the middle I’m talking to. Fifty to three hundred people, a dozen labour suppliers, two taken on in a hurry the week a programme slipped, and a filing system that is the memory of whoever was in the office that day. Since April, that arrangement carries a five-year penalty. Get in touch.