'Knew or Should Have Known': How HMRC's New CIS Test Actually Works

A handful of words sit at the centre of the April 2026 CIS reforms: "knew or should have known." Every new enforcement power introduced by sections 62A and 62B of the Finance Act 2004 — immediate Gross Payment Status removal, recovery of the lost tax, and the 30% personal penalty for directors — turns on whether that test is met.

Construction firms and their advisers have understandably focused on the consequences. The standard itself deserves at least as much attention. It is not new in tax law, it does not mean what most people think it means, and it has eighteen years of case law behind it that tells you exactly how it gets applied.

Where the test came from

HMRC's policy paper on the CIS reforms states explicitly that the new measures were "modelled on VAT countermeasures that have been effective at disrupting supply chain fraud losses." That is a reference to the Kittel principle, which originates in the 2006 Court of Justice of the European Union decision Axel Kittel v Belgium State.

The Kittel case held that a taxable person who knew or should have known that their transaction was connected with VAT fraud could be denied the right to deduct input VAT — even where they themselves had not committed the fraud. It moved the question from "did this firm break the rules?" to "should this firm have spotted that someone else in the chain was breaking the rules?"

That shift is the heart of what 6 April 2026 brought into CIS. The objective: same architecture, same evidential burden, same cultural change. HMRC has been refining the Kittel approach in VAT for nearly two decades. The case law is mature, and HMRC understands exactly how to run these arguments.

It is an objective test

This is the single most important point to understand about the new CIS provisions. BDO's analysis is unequivocal: "This is an objective test and does not require HMRC to prove actual knowledge. Instead HMRC will consider whether, based on the facts, a reasonable business should have recognised the risk."

BHP's commentary makes the same point with sharper edges. The "should have known" limb "goes beyond you knew it was wrong — should have known can include careless, you didn't ask enough questions." In other words, it is open to interpretation, and the interpretation belongs to HMRC in the first instance.

GfC12 — HMRC's January 2025 guidance on labour supply chain assurance — captures the implication directly. In language clearly aimed at construction firms relying on intermediaries, it states that "an entity cannot put itself outside the Kittel test by deliberately not asking questions." Wilful blindness is not a defence. Outsourced ignorance is not a defence. A firm that chose not to look does not get the benefit of not having seen.

What 'should have known' looks like in practice

Eighteen years of Kittel jurisprudence in VAT, alongside HMRC's own published guidance, gives a clear picture of the indicators that move a case from "could not reasonably have known" into "should have known." For CIS purposes, the most likely flags include:

• Subcontractors with no other clients. A worker who appears on the firm's CIS300 month after month, year after year, with no evidence of trading elsewhere, is one of HMRC's primary indicators of disguised employment.
• Self-employed accounts that show no normal trading indicators. No tools, no equipment purchases, no public liability insurance, no marketing — these are features HMRC's BIM66205 manual identifies for "closer examination."
• Substitution clauses workers have never heard of. A contract that confers a right of substitution is worth nothing if interviewed operatives say they could not actually exercise it. HMRC will treat it as a sham, applying the principle in Autoclenz v Belcher [2011] UKSC 41.
• Continuous deduction subs paid gross through an intermediary. If GPS is being used to remove deductions from workers who would otherwise be deduction status, the chain itself becomes a flag.
• Suppliers refusing to provide chain visibility. GfC12 is explicit that opacity in a labour supply chain is itself a risk indicator that triggers the obligation to investigate.
• Timesheets and hourly rates dressed up as contracts for services. The method of payment is one of HMRC's standard tests under the Ready Mixed Concrete framework. Hourly billing with timesheets is a powerful employment indicator regardless of what the contract says (covered in detail here).
• Workers wearing contractor-branded PPE or driving contractor-liveried vehicles. Markel Tax flags these as physical evidence inspectors look for during site visits — clear signals of integration into the contractor's organisation.

None of these on their own decides a case. Together, they paint the picture HMRC needs to argue that a reasonable business would have seen the risk.

The role of GfC12

GfC12 — "Help with labour supply chain assurance" — was published on 16 January 2025 and updated on 26 March 2026. It runs to roughly 90 pages and is the longest Guidelines for Compliance product HMRC has ever issued.

The timing matters. GfC12 was published more than fifteen months before the new enforcement powers in sections 62A and 62B took effect. The sequence was deliberate. HMRC published a detailed specification of what reasonable supply-chain assurance looks like, gave the construction industry over a year to engage with it, and then activated the powers that punish firms that did not.

KPMG draws the connection most directly: a business that cannot show it considered GfC12, or had equivalent arrangements in place, may find that HMRC concludes reasonable care was not taken when assessing penalties. That conclusion affects both the rate of penalty and the lookback window. Under Schedule 24 of the Finance Act 2007, careless conduct opens a six-year window. Deliberate conduct opens twenty.

For full coverage of what GfC12 actually requires, see our GfC12 explained post.

How HMRC will actually run these cases

A common misconception is that the new powers will be triggered by dramatic, fraud-led investigations. In practice, the entry point will look much more routine. HMRC's existing tools all feed into the new framework:

• Connect, HMRC's analytics platform, cross-references CIS300 returns against self-assessment filings, RTI data, VAT returns, Companies House records, and bank data. Discrepancies are the first flag.
• The one-to-many letter campaign issues batches of nudge letters to contractors with risk indicators. The 2024 campaign gave recipients 45 days to respond. Silence is treated as a "prompted" disclosure trigger and escalates to formal compliance checks.
• IEC27 operative letters initiate parallel evidence-gathering directly with workers. HMRC asks operatives the same status questions — control, substitution, financial risk, exclusivity — and compares their answers against the contractor's account and the written contract.
• The whistleblower reward scheme, expanded in 2025, now offers 15–30% of tax recovered over £1.5 million. That changes the economics of disgruntled workers, competitors, and former employees reporting suspected non-compliance.
• VAT cross-referencing on Gross Payment Status holders has applied since April 2024. HMRC's own estimate is that 16% of GPS holders would fail the test if VAT compliance were assessed.

By the time a "should have known" determination lands, HMRC will typically already have a detailed picture of the chain. The compliance check is often the formality that follows the analysis, not the start of it.

Worker testimony beats contract terms

This deserves emphasis on its own. Under Autoclenz v Belcher [2011] UKSC 41, where there is a discrepancy between a written contract and the reality of the working relationship, the reality wins. A substitution clause that workers have never been told about is treated as a sham. A "self-employed" label means nothing if the worker is told what to do, when to do it, and how.

HMRC's IEC27 process is designed to find exactly these mismatches. The questions are simple, direct, and aimed at lived experience: Who tells you what to do? Can you choose your own hours? Have you ever sent a substitute? What happens if work is defective? The answers carry significant evidential weight, particularly when they contradict the paper position.

Advisory firms consistently warn operatives to decline phone calls and insist on written correspondence with HMRC. The advice is sound — but it does not change the underlying point. A construction firm whose supply-chain assurance depends on contracts the workers have never read does not have supply-chain assurance.

Building a defensible position

The shape of a defensible position under the new test is now reasonably well understood. Five elements appear in nearly every advisory commentary:

Documented supply chain due diligence at engagement. Companies House checks, insurance verification, VAT and CIS status checks, market-rate price testing, and CEST records. Done before the relationship starts and recorded contemporaneously.

Independent verification rather than supplier self-certification. GfC12 is explicit on this point: a firm should "select your own sample, rather than a sample provided by your supplier." A document produced by the supplier confirming their own compliance does not discharge the obligation. It demonstrates that the obligation was not discharged.

Continuous monitoring rather than point-in-time review. The reality of a working arrangement drifts over time. A worker who started genuinely self-employed can become a disguised employee through the steady accretion of small changes — fixed hours, supervised work, integration into the team. A monitoring process needs to catch the drift before HMRC does.

Auditable records, organised per operative. Compliance is only useful if it can be produced. The inspection-readiness package — assessments, contracts, payslips, check-ins, status records — needs to be assembled before HMRC asks, not in response to the request.

Board-level oversight. Personal penalty exposure makes director awareness a legal issue, not a corporate-governance nicety. Documented board attention to supply-chain risk is itself evidence of reasonable care.

What this means

The "should have known" test does not punish bad luck. It punishes the absence of inquiry. Eighteen years of Kittel case law in VAT shows the pattern clearly: the firms that lost were the ones that could not produce a contemporaneous record of what they did to identify risk. Not the firms that failed to find every problem — the firms that did not look.

Construction now sits inside the same framework. The architecture is in place, HMRC has the resources to use it, and the published revenue targets confirm the intent. The question construction firms will be asked is not whether their supply chain was perfect. It is whether they took reasonable steps to find out.

---