The April 2026 CIS Reforms: What Construction Firms Need to Know

On 6 April 2026, the Construction Industry Scheme changed in a way that does not feel cosmetic. New sections 62A and 62B of the Finance Act 2004 — inserted by the Finance Act 2026 — give HMRC three powers it did not have before. Each one shifts the risk landscape for any business that engages subcontractors. Together, they represent the most aggressive tightening of CIS enforcement since the scheme's last overhaul in 2007.

This post sets out what changed, what it actually means, and where the pressure points sit.

The legislative basis

The reforms sit inside Part 3, Chapter 3 of the Finance Act 2004 and the Income Tax (Construction Industry Scheme) Regulations 2005 (SI 2005/2045). They were announced at Budget 2025 and confirmed in HMRC's Tax Information and Impact Note "Tackling Construction Industry Scheme fraud," published on 26 November 2025.

Two new sections sit at the heart of the reform:

• Section 62A applies when a person makes a payment for construction operations and "knew or should have known" that a connected party had been, or would be, deliberately non-compliant with their CIS or PAYE obligations.
• Section 62B applies when a return is made containing a CIS credit and the person making the return "knew or should have known" that the credit had not been deducted, or that a deduction had been or would be deliberately not paid by the contractor.

HMRC's policy paper states explicitly that these measures were modelled on existing VAT countermeasures — specifically the Kittel principle from the CJEU case Axel Kittel v Belgium State (2006). The same legal architecture has been disrupting VAT supply-chain fraud for nearly twenty years. HMRC has now imported it into CIS.

The three new powers

1. Immediate Gross Payment Status removal

Under amended section 66(3) of the Finance Act 2004, HMRC can revoke Gross Payment Status with immediate effect where the test is met. There is no 90-day notice, no opportunity to remedy, and no warning before the change lands. New section 66(3A) prevents re-application for five years — up from the previous one-year ban.

The cashflow consequence is severe. Every subcontractor on a firm's books drops to a 20% or 30% deduction simultaneously. For a firm running on tight working capital, the effect can be catastrophic and locked in for half a decade.

2. Liability for the lost tax

Where the test is met, HMRC can assess the contractor for the full associated tax loss — calculated as 20% of the payment made or an amount equal to the CIS credit claimed. This is not a fine on top of the tax. It is the tax itself, now owed by the construction firm rather than recovered from the subcontractor.

3. A 30% penalty — and it can land on directors personally

A penalty of up to 30% of the lost tax can be imposed on the business and, separately, on its directors and officers personally. The HMRC policy paper is explicit: "The officers of the business could also be liable for these penalties."

A worked example shows the scale. If a contractor made a £1 million gross payment to a subcontractor without a CIS deduction, and the test was met, the business would face a £200,000 tax determination (20% of £1m) plus a penalty of up to £60,000 (30% of £200,000). That £60,000 can be charged to the company and personally to each director.

No graduated mitigation framework — equivalent to the prompted/unprompted disclosure reductions under Schedule 24 — has been published for these CIS fraud penalties. The 30% figure appears to be a standalone maximum.

Why the test is broader than it sounds

The phrase "knew or should have known" deserves close attention. As BDO has put it, this is an objective test: HMRC does not need to prove actual knowledge. The question is whether a reasonably diligent business in the same position would have recognised the risk.

BHP's analysis goes further, warning that the "should have known" limb "goes beyond you knew it was wrong — should have known can include careless, you didn't ask enough questions." That carries real consequences. Under Schedule 24 of the Finance Act 2007, careless conduct extends HMRC's enquiry window from four years to six. Deliberate conduct extends it to twenty.

Where the new test is met, then, exposure is not limited to the most recent return. It can reach back across years of arrangements that previously seemed settled.

The fiscal context

These reforms are not housekeeping. HMRC has published explicit revenue targets: £205 million in 2026–27, rising to approximately £765 million cumulatively over six years. Those numbers tell the operational story. The provisions exist to be used.

That ambition is matched by capacity. At Autumn Budget 2024, the Chancellor announced recruitment of 5,000 additional HMRC compliance officers, with a further 500 confirmed at Spring Statement 2025 — supported by £1.5 billion of investment, the largest compliance build in a decade. Construction is explicitly designated a priority enforcement sector. By Q3 2025/26, more than 500 of those new officers had been deployed.

What changed alongside, on the same date

The April 2026 CIS reforms did not arrive in isolation. Three further changes landed on or near 6 April 2026:

• Nil monthly returns reintroduced. Contractors are once again required to file a CIS300 for any month in which no subcontractor payments are made, unless HMRC has been pre-notified of a dormant period.
• Local authorities and certain public bodies exempted from CIS. Public sector contracts no longer require CIS deductions, removing an administrative cost that served little fraud-prevention purpose.
• Umbrella company joint and several liability. Under new Chapter 11, Part 2 of the Income Tax (Earnings and Pensions) Act 2003, recruitment agencies and end clients are now jointly and severally liable with umbrella companies for PAYE, NIC, and Apprenticeship Levy underpayments. HMRC projects £895 million in 2026–27 and £2.85 billion over five years from these provisions.
• Fair Work Agency launched 7 April 2026. A new enforcement body absorbing HMRC's national minimum wage enforcement, the Employment Agency Standards Inspectorate, and the Gangmasters and Labour Abuse Authority into a single unit.

The cumulative effect is a labour-market enforcement landscape that looks materially different from the one that existed in early 2025.

What this means in practice

The reforms close several familiar exits. "We used a payroll bureau" no longer transfers the risk: the firm that made the payment is the firm in scope of section 62A. "We didn't know" is harder to argue when HMRC has spent a decade publishing guidance on supply-chain assurance, including a 90-page document directed specifically at construction labour (covered in detail here). "It was the subcontractor's fault" still leaves the contractor with a tax determination.

The objective standard means the only durable answer to a "should have known" challenge is documented evidence of what the business actually did to identify and manage risk. That requires three things in combination: written processes, contemporaneous records, and an audit trail capable of being produced quickly when HMRC asks.

A short checklist for the next 90 days

1. Audit current subcontractor arrangements. Identify any continuous-deduction subs, any worker paid by the hour, and any role that has historically rotated between PAYE and self-employment.
2. Review every Gross Payment Status holder in the chain. GPS is now lost instantly under the new rules. Verify VAT compliance on every GPS-paid subcontractor.
3. Document supply-chain due diligence. GfC12's four-stage cycle is the natural framework. Self-certification by suppliers will not satisfy a "should have known" enquiry.
4. Review insurance. Status-risk and tax-liability cover at the right indemnity level is no longer optional for firms that engage CIS labour at scale.
5. Brief directors personally. Personal penalty exposure cannot be delegated. Board minutes recording the discussion are themselves a piece of evidence.

The bigger picture

Section 62A and 62B are not anti-fraud rules in the narrow sense. They are an enforcement architecture. The "should have known" standard, the Kittel lineage, the published revenue targets, the new compliance officers, GfC12 sitting in the background as the published benchmark — these things were sequenced deliberately. Each piece reinforces the others.

The firms that will struggle in 2026 and beyond are not the ones that got something wrong. They are the ones who cannot show, on paper, what they did to get it right.

---