Construction subcontractor compliance: CIS verification, CDM 2015 and mandatory documents

Construction supply chains in the United Kingdom involve multiple tiers of subcontractors, each carrying distinct legal obligations around tax, health and safety, competence, and worker welfare. For principal contractors and clients, verifying subcontractor compliance is not discretionary good practice. It is a legal requirement enforced through HMRC, the Health and Safety Executive (HSE), and local building control authorities, with penalties that range from financial deductions to criminal prosecution.

According to the HSE's 2025 annual statistics, the construction sector accounted for 25 % of all fatal workplace injuries and 9 % of all non-fatal injuries in Great Britain, despite representing only 5 % of employees (HSE, Workplace fatal injuries in Great Britain 2025). Rigorous subcontractor vetting is the primary mechanism to reduce these figures and ensure regulatory compliance across the supply chain.

The regulatory framework for construction subcontracting in the UK

Three legislative pillars govern how contractors and subcontractors interact in the UK construction industry.

Construction Industry Scheme (CIS)

The CIS is a mandatory tax deduction scheme administered by HMRC. Contractors must verify each subcontractor with HMRC before making payments and deduct tax at the appropriate rate (20 % for registered subcontractors, 30 % for unverified subcontractors, 0 % for those with gross payment status). The contractor then remits these deductions to HMRC on behalf of the subcontractor.

Verification is performed through HMRC's online CIS service or the CIS helpline. Each verification returns a unique verification number that must be recorded and retained. The verification confirms the subcontractor's registration status and applicable deduction rate.

Construction (Design and Management) Regulations 2015

CDM 2015 places explicit duties on clients, principal designers, and principal contractors to ensure competent appointment of subcontractors (HSE, CDM 2015 guidance). Before appointing any subcontractor, the principal contractor must satisfy themselves that the organisation has the skills, knowledge, experience, and organisational capability to carry out the work safely.

This assessment goes beyond collecting certificates. It requires evidence of health and safety management systems, relevant training records, and a track record of safe working on comparable projects.

Building Safety Act 2022

The Building Safety Act introduced the Building Safety Regulator (BSR) within the HSE, with enhanced competence requirements for all duty holders involved in higher-risk buildings. From April 2024, principal contractors working on buildings over 18 metres must demonstrate their competence and that of every subcontractor in their supply chain to the BSR before work commences (Building Safety Regulator, GOV.UK).

Mandatory documents for construction subcontractors

The table below summarises the core documents that principal contractors must collect and verify for each subcontractor operating on UK construction sites.

CIS verification: the tax compliance cornerstone

CIS verification must be completed before making the first payment to any subcontractor. The process confirms three possible outcomes: registered (20 % deduction), gross payment status (0 % deduction), or unregistered (30 % deduction). The verification number issued by HMRC must be recorded on the contractor's monthly CIS return.

Common pitfall: CIS verification applies per contract, not per subcontractor relationship. A subcontractor engaged on three separate contracts requires three separate verifications. Contractors who reuse old verification numbers risk penalties for incorrect CIS returns.

The gross payment status test requires the subcontractor to demonstrate a turnover above GBP 30,000 (or an annual average of GBP 30,000 over three years for companies) and compliance with all tax filing obligations. Subcontractors can lose gross payment status at HMRC's annual review if they fall behind on tax payments.

CSCS cards: competence on site

The CSCS card scheme is the industry standard for demonstrating that workers have the appropriate training and qualifications for the tasks they perform. While not a strict legal requirement, virtually all major construction clients and principal contractors mandate CSCS cards for site access. The HSE considers CSCS cards as part of the evidence of competence required under CDM 2015.

Different card colours indicate different qualification levels: green (labourer), blue (skilled worker), gold (advanced craft), black (management), and white (professionally qualified). The principal contractor must verify that each subcontractor's workers hold cards appropriate to their role.

Modern slavery due diligence

Section 54 of the Modern Slavery Act 2015 requires commercial organisations with an annual turnover above GBP 36 million to publish an annual modern slavery statement. For construction supply chains, this obligation extends to verifying that subcontractors are not engaging in forced labour, debt bondage, or other forms of modern slavery (Modern Slavery Act 2015, legislation.gov.uk).

The construction sector was identified by the Gangmasters and Labour Abuse Authority (GLAA) as one of the three highest-risk sectors for labour exploitation in the UK. Principal contractors should request evidence of modern slavery due diligence from subcontractors regardless of their turnover threshold.

Right to work checks in construction

Employers in the construction sector must verify the right to work of every individual before they start work. Since 2022, digital right to work checks are available through certified Identity Service Providers (IDSPs) for British and Irish passport holders. For non-UK nationals, the Home Office online checking service provides real-time verification of immigration status.

The civil penalty for employing an illegal worker increased to GBP 45,000 per worker for a first offence and GBP 60,000 for repeat offences from February 2024. In construction, where subcontractors may bring workers onto site at short notice, establishing a pre-site-access verification process is essential.

Penalties for non-compliance

The enforcement landscape for construction subcontractor compliance involves multiple regulators, each with independent penalty powers.

HMRC CIS penalties

Failure to verify subcontractors results in the 30 % deduction rate being applied, reducing the subcontractor's cash flow and creating administrative complications for both parties. Late or incorrect CIS returns attract penalties starting at GBP 100 per month of lateness, escalating to GBP 1,600 after 12 months. Deliberate non-compliance can result in a penalty of up to GBP 3,000 per return and potential criminal prosecution.

HSE enforcement

HSE inspectors can issue improvement notices (requiring corrective action within a specified timeframe), prohibition notices (stopping work immediately), and prosecute under the Health and Safety at Work Act 1974. In 2024-25, the average fine for health and safety offences in construction exceeded GBP 150,000, with several cases resulting in fines above GBP 1 million for companies.

Building Safety Regulator

The BSR has the power to refuse building control applications, issue compliance notices, and prosecute duty holders who fail to meet competence requirements. For higher-risk buildings, the regulator can halt construction at any stage if subcontractor competence documentation is inadequate.

Automating subcontractor compliance verification

Managing compliance across a construction supply chain manually is error-prone and resource-intensive. A principal contractor working with 30 subcontractors faces approximately 250 document checks per year, each requiring verification of authenticity, validity dates, and scope of coverage.

The case for automation

Manual processes create three structural risks: documents expire between scheduled reviews, forgeries go undetected without systematic authenticity checks, and audit trails are incomplete when stored across emails and shared drives. A single expired employers' liability insurance certificate discovered during an HSE inspection can trigger a site shutdown.

Document verification platforms like CheckFile.ai automate the collection, validation, and monitoring of subcontractor compliance documents. Automated expiry alerts, real-time authenticity checks, and centralised audit trails reduce the compliance burden from hours per subcontractor to minutes. View pricing plans designed for construction supply chains.

Frequently asked questions

Does CIS apply to labour-only subcontractors?

Yes. CIS applies to all payments made by contractors to subcontractors for construction operations, regardless of whether the subcontractor provides labour only or labour and materials. The definition of "construction operations" under CIS is broad and includes site preparation, alterations, repairs, dismantling, and installation of heating, lighting, and power systems.

Can a principal contractor be prosecuted for a subcontractor's health and safety failings?

Yes. Under CDM 2015 Regulation 15, the principal contractor must plan, manage, and monitor the construction phase, including the work of subcontractors. If the principal contractor failed to ensure competent appointment or adequate supervision, they can be prosecuted alongside or instead of the subcontractor. The HSE has stated that "you cannot contract out your health and safety responsibilities."

What happens if a subcontractor loses their CSCS card?

Workers without a valid CSCS card should not be permitted on site until they obtain a replacement or a temporary confirmation of their qualification status from CSCS. Many principal contractors apply a grace period of 5 to 10 working days for replacements, but this must be documented and the worker's qualifications independently confirmed during the interim period.

How often should subcontractor compliance documents be reviewed?

CIS verification is per contract. Insurance certificates should be checked at renewal (annually). CSCS cards should be verified at each site induction. RAMS should be reviewed before each new task or significant change in method. As a minimum, a full compliance review of each subcontractor should be conducted every 12 months or at contract renewal, whichever comes first.

---

This article provides general information on construction subcontractor compliance in the United Kingdom. It does not constitute legal advice. Consult a solicitor specialising in construction law for advice tailored to your circumstances. Legislation current as of 29 March 2026.

See also: Industry verification guide | Vendor compliance certificate verification | KYB: complete guide to business entity verification