HMRC CISCOMPLIANCEUK.
HMRC compliance checks under CIS look at three things: were the right deductions taken (verification, deduction rate, reverse-charge VAT), were the returns filed on time, and does the CIS300 record reconcile to the bank statements and the company P&L. Where it doesn't, HMRC issues an assessment — often with a penalty escalator behind it. We match you with construction accountants who handle the response, restructure the verification and filing process so it doesn't happen again, and run penalty appeals where there's a reasonable excuse to argue.
HOW CIS COMPLIANCE ACTUALLY WORKS
Verification is the foundation. Before the first payment to a new subcontractor, you have to verify them with HMRC — their UTR, name, NI number (sole trader) or company registration number (limited company), and trading name. HMRC matches the data to their records and tells you the deduction rate (0%, 20%, or 30%). The verification reference is what you keep on file. The rate is valid for the rest of the current tax year plus the next two — so a verification done in March 2024 covers all payments through to 5 April 2027 unless HMRC notifies you of a change. After two unused years, re-verify before the next payment. Verification gaps and rate-mismatches are the single biggest compliance issue HMRC finds.
Monthly CIS300 filing is the second pillar. Every month, on or before the 19th of the following tax month, you file the CIS300 with each subcontractor paid in the period reported with their gross labour, materials, and deduction. Nil returns count — if you're registered as a contractor, every month needs a CIS300 even if no payments happened. The £100 penalty fires automatically at one day late. Three months in a row late and the escalator gets expensive (£200, then £300 or 5%, then 70-100% of deductions for deliberate failures).
The payment-and-deduction statement is the third pillar — issued to each subcontractor within 14 days of the tax month end, telling them what was paid, deducted, and at which rate. They use it on their own self-assessment to claim CIS suffered. Failing to issue statements doesn't trigger an automatic HMRC penalty but does generate compliance complaints from subcontractors who can't reconcile their tax position, which is what brings HMRC into the picture.
Reconciliation between the CIS300 record, the P&L sub-contractor cost line, and the bank statements is what HMRC looks for in a check. The numbers should align across all three: total gross paid to subcontractors per CIS300 = sub-contractor cost on the P&L (gross figure, before deduction) = bank payments to subcontractors (net of deduction) plus the deductions paid to HMRC. Discrepancies usually mean either some payments went off-CIS (penalty + assessment for unaccounted deductions), the P&L is misclassified (capitalised into WIP, materials line, etc.), or the CIS300 itself has errors (under-reported subcontractors, wrong rates).
Reverse charge VAT for construction interlocks with CIS. Where you're VAT-registered and the customer is VAT-registered and the supply is within CIS, the customer accounts for the VAT — your invoice is net of VAT with a reverse-charge note. Errors on the VAT side (charging VAT when reverse charge applies, or applying reverse charge when the customer is the end-user) usually mean errors on the CIS side too, because the same supply is being mis-described twice. HMRC checks tend to start with one side and discover the other.
COMPLIANCE TRIP-WIRES SPECIFIC TO CONSTRUCTION
The penalty escalator under CIS is the steepest in the HMRC penalty regime outside fraud. £100 fixed at 1 day late. £200 fixed at 1 month late. £300 (or 5% of deductions, whichever is higher) at 6 months late. Same again at 12 months — and at 12 months HMRC can determine the failure as deliberate, in which case the penalty becomes 70% of deductions for the month (or 100% for deliberate-and-concealed). A single late nil return is £100; a six-month gap of unfiled CIS300s on a busy contractor with significant deductions can run to £30,000+.
Reasonable excuse is the appeal ground that works, but HMRC interprets it narrowly. Acceptable excuses: serious illness or hospitalisation of the responsible person, bereavement, fire or flood destroying records, an HMRC system outage you can document via service status logs or SAR. Not acceptable: pressure of work, the bookkeeper being away, software trouble that wasn't HMRC's, finding the rules confusing, or "I forgot." The appeal goes in within 30 days of the penalty notice and HMRC's first response usually settles the matter unless the case is sent to internal review.
CIS300CC is the continuation form for months with more than 100 subcontractors paid. The HMRC online service has a hard cap; firms paying large numbers of subbies through Excel-style submissions hit the cap silently — the return goes through with the first 100 records and the others are lost. Visible on the HMRC acknowledgment if you check; invisible if you don't. We see this on busy refurbishment outfits and on landscaping firms during peak summer.
Deemed contractor status applies to non-construction businesses that spend more than £3m on construction in a 12-month period — they have to register as CIS contractors and operate the scheme even though their main business isn't construction. Property investment firms, large retailers expanding stores, schools and councils running building programmes all fall into this. The trigger is missed in-house far more often than HMRC catches it; when HMRC does catch it, the assessment covers all the unaccounted-for deductions across the period plus penalties.
CIS-registered limited companies that go dormant or stop construction work need to formally close their CIS contractor registration. The default position is that the registration stays open and HMRC continues to expect monthly returns — including nil returns. Firms that stopped construction work two years ago and never deregistered occasionally find themselves with 24 months of £100 penalties for missed nil returns, which they didn't know they had to file because the firm wasn't trading. The closure form takes 24-48 hours; preventative.
HMRC compliance check letters need careful response, particularly the opening letter which sets the scope. Volunteering documentation outside the scope of the request opens new lines of enquiry. Refusing to provide information that's plainly within scope triggers formal information notices and harder enforcement. The art is responding precisely to what was asked, with proper supporting evidence, in the time period given (usually 30-60 days for the first request, sometimes shorter). Front-loaded responses with full evidence close most checks at the first letter; defensive or piecemeal responses extend the check and surface more findings.
CIS COMPLIANCE IN PRACTICE
Six months of unfiled CIS300 returns due to a bookkeeper handover that nobody noticed. By the time the firm engaged us, two penalties had escalated into the 6-month tier (£300 + 5% of deductions × 2). Total demand: £4,800. Reasonable excuse appeal failed (correctly — bookkeeper continuity is the contractor's responsibility). We negotiated a Time to Pay arrangement spreading the £4,800 over 12 months, restructured the CIS filing into a monthly accountancy retainer so it didn't recur, and got the firm verified on a clean 12-month track for a future GPS application.
HMRC compliance check identified seven subcontractors paid over a 14-month period without CIS verification on file. Total gross labour paid: £180,000. HMRC's position: deduct at 30% for all of it (£54,000) since the contractor couldn't prove the lower rate applied. We pulled HMRC's own records via SAR for each of the seven subbies, established that six of them had been verified at 20% by other contractors during the period (so HMRC's own data showed the right rate), and that the seventh had a documented gross-payment status. Final assessment: £4,200 (one verification gap on a partially-undocumented period for one subbie) vs £54,000 originally proposed.
Property investment company spending £4.2m on construction over an 18-month period had not registered as a CIS contractor — director thought CIS only applied to construction firms, not property investors. HMRC compliance check identified the deemed-contractor status and issued an assessment covering 24 months of unaccounted deductions (~£890,000) plus failure-to-register penalty. We confirmed the deemed-contractor calculation, registered the firm retrospectively, identified that the contractors paid were almost all GPS-registered (so the deductions would have been 0% on the dominant portion), reconstructed the CIS300 record from invoices and bank statements, and reduced the assessment to ~£18,000 for the genuinely-unregistered subbies plus a smaller failure-to-register penalty negotiated down on first-offence basis.
CITIES WE COVER
Compliance pressure varies by city — we see different issue patterns depending on the local construction mix and HMRC office activity:
HMRC CIS Compliance:Common Questions
Most checks settle in 3-9 months. Simple ones with a single issue (a verification gap, one set of late returns) often close at the first or second letter. Multi-issue checks involving reverse charge VAT, employee/subcontractor reclassification, or large deemed-contractor exposures can run 12-18 months and sometimes go to internal review or first-tier tribunal. Front-loading the first response with proper evidence shortens the timeline materially.
On a single late or incorrect monthly return, the headline maxima are: £100 + £200 + £300 (or 5% of deductions, whichever higher) + £300 (or 5%, again) + at twelve months 70-100% of deductions for deliberate or deliberate-and-concealed failures. So a single month's £20,000 of deductions filed twelve months late and treated as deliberate could carry £14,000-£20,000 of penalties on its own. Cumulative cluster penalties run higher.
Yes, on reasonable excuse or special circumstances grounds. Reasonable excuse: serious illness, bereavement, fire or flood, HMRC system outage. Not acceptable: pressure of work, software trouble that wasn't HMRC's, the bookkeeper being away, finding the rules confusing. Special circumstances is broader — used where there's a unique factor that makes the standard penalty disproportionate, but HMRC applies it sparingly. Appeal within 30 days of the penalty notice; first response usually decides the outcome.
Risk-scoring across data they hold: late returns, large variances between CIS300 totals and bank/P&L figures, gross payment status applications (compliance test triggers a check), reverse charge VAT discrepancies, large refunds. Random checks happen but most are risk-driven. Late and incorrect returns are by far the biggest risk indicator; clean filings rarely attract attention.
On the verification gap itself, HMRC's default is to treat the payments as having required 30% deduction. So if you paid an unverified subbie £20,000 gross and only deducted £4,000 (20%), HMRC's starting position is that £6,000 (the 30% rate) was due, the £2,000 shortfall is your liability. Where the subcontractor was actually entitled to 20% (verified by another contractor in the same period, or holding GPS), we can usually recover the position via SAR-based evidence — HMRC's own records show the correct rate.
Yes if you spend more than £3m on construction operations within any rolling 12-month period — that's the deemed contractor threshold. Property investors, large retailers refurbishing stores, public bodies running building programmes, schools, charities — all caught if they cross the threshold. Once you're a deemed contractor the full CIS regime applies: register, verify subbies, file CIS300 monthly, issue payment-and-deduction statements, the lot.
Errors on a CIS300 are corrected by filing an amended return for the month concerned through HMRC's CIS service. Common errors: wrong deduction rate applied (the verification record didn't match the rate used), subcontractor missing from the return, gross labour figure wrong. The amendment doesn't restart the late-filing penalty clock if the original was on time, but if the amendment shows under-reported deductions, those become payable plus interest from the original due date. Major restatements often surface the underlying compliance issues that triggered the error in the first place.
No, if you're a contractor as defined by the regime — which is broader than people think. Anyone whose business includes construction operations and who pays subcontractors for construction work is a contractor under CIS. Even a small builder hiring one occasional sparky needs to be registered. The £3m deemed-contractor threshold only applies to non-construction businesses; for construction businesses, the threshold is the first subcontractor payment. Operating without registration is the route to the largest CIS exposures HMRC pursues.