"Verifying a subcontractor" means two different things depending on who is saying it. To an accountant it means the HMRC check that sets the CIS deduction rate. To a contracts manager it means the whole set of checks that decide whether this firm is safe to appoint and safe to pay.
Both matter, and they run on different clocks. HMRC verification is a one-off tax check tied to payment. The competence and insurance checks are tied to mobilisation and have to be maintained for the life of the engagement. Confusing the two is how a subcontractor ends up correctly verified for tax and uninsured on site.
What HMRC verification actually does
Under the Construction Industry Scheme, HMRC's guidance for contractors is direct: "Before you can pay a new subcontractor, you'll need to 'verify' them with HM Revenue and Customs (HMRC)."
Verification does one thing — it tells you which deduction rate to apply. Per HMRC's internal CIS manual, since 6 April 2007 the rate is 20% for a "matched" subcontractor and 30% for an "unmatched" one. Subcontractors registered for gross payment generally have no deduction applied: Finance Act 2004 s.61(1) attaches the deduction duty to a "contract payment", and s.60(2) and (4) take a payment outside that definition — s.60(2) provides that a payment "is not a contract payment if any of the following exceptions applies in relation to it", and s.60(4) is the exception that applies where the person to whom the payment is made "is registered for gross payment when the payment is made". (Sections 60(5)-(6) carve out some partnership situations, which is why this is the general rule rather than an absolute one.)
It does not tell you whether they are insured, competent, or qualified to do the work. It is a tax status check, nothing more.
What you need to hand
HMRC requires your own details — "your Unique Taxpayer Reference (UTR)", "the reference number for your HMRC accounts office", and "your HMRC employer reference" — plus the subcontractor's, which differ by trading structure:
- Sole trader: UTR and National Insurance number (temporary numbers beginning 'TN' or two digits are not accepted).
- Limited company: company name, company UTR and registration number.
- Partnership: nominated partner details, trading name and partnership UTR.
The detail that catches people out is HMRC's exact-match rule: "The details you provide to verify the subcontractor must exactly match the details the subcontractor used to register with HMRC." A trading name that differs from the registered name, or a director's UTR used in place of the company's, returns an unmatched result — and unmatched means 30%, not "try again later." Collect the registered details, not the ones on the invoice header.
When re-verification is required
This is the part most often missed. HMRC's guidance requires you to re-verify a subcontractor you have used before "if you have not included them on a CIS return in the current or last 2 tax years."
So a subcontractor who worked for you in 2023, dropped off your returns, and comes back in 2026 needs verifying again. A subcontractor appearing on your monthly returns continuously does not. The practical trigger is not the calendar — it is the gap in your own returns, which means the answer lives in your payment records rather than in a diary reminder.
The four checks that run alongside it
HMRC verification tells you how to pay them. These tell you whether to let them start.
1. Competence. CDM 2015 Regulation 8(3) puts the duty on the appointer: "A person who is responsible for appointing a designer or contractor to carry out work on a project must take reasonable steps to satisfy themselves that the designer or contractor fulfils the conditions in paragraph (1)" — the skills, knowledge, experience and organisational capability test. A prequalification questionnaire is the usual evidence.
2. Employers' liability insurance. A statutory requirement under the Employers' Liability (Compulsory Insurance) Act 1969, section 1 of which requires every employer carrying on business in Great Britain to "insure, and maintain insurance, under one or more approved policies with an authorised insurer or insurers against liability for bodily injury or disease sustained by his employees." HSE guidance confirms the minimum: "You must be insured for at least £5 million." Check the certificate is current and names the entity you are actually contracting with.
3. Operative credentials. CSCS cards appropriate to the work, plus any trade-specific registration — Gas Safe, NICEIC, and so on. These are industry and scheme requirements rather than statutory ones, but a client audit will ask for them.
4. RAMS. Risk assessments and method statements specific to the work on your site, reviewed before mobilisation.
A jurisdiction note. Regulation 3 applies CDM 2015 "in Great Britain". Northern Ireland has its own instrument — the Construction (Design and Management) Regulations (Northern Ireland) 2016, in operation since 1 August 2016 — so if you work there, check the NI position rather than assuming the regulation numbers cited here apply. The same boundary applies to the employers' liability duty in check 2: section 1 of the 1969 Act carries an E+W+S extent marker and bites on "every employer carrying on any business in Great Britain", with Northern Ireland covered by its own equivalent legislation.
Sequencing: what has to happen before what
The checks are not interchangeable and they do not all belong at the same moment.
Before appointment: competence check, insurance certificates, trade registrations. This is the Regulation 8(3) window — the point at which you decide whether this firm can do the work at all.
Before mobilisation: RAMS reviewed and accepted, CSCS cards checked against the actual operatives arriving, site induction booked.
Before first payment: HMRC verification. This one can genuinely wait until payment, which is why it drifts to the end. The failure mode is treating it as the only gate and letting it stand in for the others.
Throughout: insurance renewal dates, card expiry, CIS re-verification triggers, RAMS revisions when scope changes. All four of the pre-start checks decay. None of them are one-off.
What to record
Verification is only as good as the record of it. For each subcontractor:
- The HMRC verification reference and the date, plus the rate returned
- The date of the last CIS return they appeared on — this is what drives re-verification
- Insurance certificate copies with expiry dates, not just "seen"
- The competence evidence and who assessed it
- RAMS received and review dates
The common gap is a check performed and not recorded. Under Regulation 8(3) the duty is to take reasonable steps you can point to. A verification you did but cannot evidence is, at audit, indistinguishable from one you skipped.
The failure worth designing against
A subcontractor is verified with HMRC in March, correctly set at 20%, and paid without issue for eight months. In July their employers' liability policy lapses. Nothing in the CIS process notices, because CIS has nothing to do with insurance. The gap surfaces when a client auditor asks for current certificates in November — or worse, when someone is injured.
The two systems have to be separate but simultaneous. Verification answers a tax question once. Everything else needs a review date.
For the document-by-document version of the pre-mobilisation set, see our subcontractor onboarding documents guide. For what CIS verification involves in more depth, see our CIS verification for subcontractors guide. For insurance checking specifically, see how to verify subcontractor insurance, and for the competence framework, our subcontractor compliance checklist.
SubComply is being built to hold all of this in one place — verification status, insurance expiry, card validity and RAMS sign-off per subcontractor, with the review dates tracked rather than remembered. Join the waitlist to be notified when it launches.
Sources
- GOV.UK — What you must do as a CIS contractor: verify subcontractors
- HMRC CISR71020 — the rate of deduction under the Construction Industry Scheme
- Finance Act 2004, section 60 (contract payments and the gross-payment exception)
- Finance Act 2004, section 61 (deductions on account of tax)
- The Construction (Design and Management) Regulations 2015 (SI 2015/51), Regulation 8
- The Construction (Design and Management) Regulations 2015 (SI 2015/51), Regulation 3 (application in Great Britain)
- The Construction (Design and Management) Regulations (Northern Ireland) 2016 (SR 2016/146)
- Employers' Liability (Compulsory Insurance) Act 1969, section 1
- HSE — Employers' Liability (Compulsory Insurance) Act 1969: a guide for employers (HSE40)
This guide is for informational purposes and does not constitute legal advice. CIS treatment depends on your specific contractual arrangements — consult a qualified accountant for tax questions and a health and safety professional for CDM questions.
Last reviewed: 23 September 2026