Verify a CIS Subcontractor Before Paying Their Invoice (UK)

A subcontractor's invoice has landed in the AP inbox. Before that payment goes out, the rule is direct: verify a CIS subcontractor before paying an invoice unless the two-year rule excuses the call. The verification confirms one of three deduction rates (0% gross, 20% standard, 30% higher) and returns a verification number the contractor records against the supplier. That number is V followed by 10 digits (for example, V1234567890). Where HMRC cannot match the subcontractor to its records, the same number comes back with a trailing letter (V1234567890A), which is the explicit unmatched marker and the cue to deduct at 30%.

The two-year rule is more precise than its loose paraphrase. Re-verification is not required where the subcontractor has already been included on the contractor's CIS300 monthly return in the current tax year or in either of the two previous tax years, and the deduction rate has not changed since the last verification. The deduction-rate caveat carries weight: a status change at HMRC's end can collapse the exemption and force a fresh verification regardless of how recently the subbie was on a return.

The verification record itself must be retained for at least three years after the end of the tax year it relates to, alongside the V-number, the deduction rate, the verification date, and the identifiers used. That retention window is the audit trail HMRC will ask for if the contractor's CIS process is ever reviewed.

This article walks the verification step end-to-end as a discrete AP control. It covers the scope check that decides whether a verification is needed, the supplier identifiers the call needs from the inbound invoice, the two routine channels for running it (with the helpline as a narrow fallback), how to read the result and where to record it, the triggers that force a re-verification, and the four failure modes the AP team will encounter in practice. Skip the control and HMRC will assess the deduction that should have been made, with penalties for failing to operate CIS correctly. The contractor cannot, in most cases, recover the under-deducted amount from the subcontractor after the fact, so the liability sits squarely on the deductor.

When Verification Is Required — and When the Two-Year Rule Excuses It

Verification is required before paying any subcontractor for construction operations within the contractor's CIS deduction obligation, where the contractor has not previously verified that subcontractor or where the two-year rule does not apply. That rule is the single biggest filter on whether the AP team picks up the phone, opens the GOV.UK service, or runs the in-product verification, so it is worth stating with the precision HMRC uses rather than the loose version that circulates on practitioner blogs.

HMRC's verify-subcontractors guidance on GOV.UK is explicit on the trigger: a UK contractor must re-verify a subcontractor they've used before if they have not included them on a CIS return in the current or last two tax years. Read carefully, that has two limbs. First, an inclusion test against the contractor's own CIS300 history: the subcontractor has appeared on a return submitted in the current tax year or in either of the two preceding tax years. Second, a stability test on the rate: the deduction rate has not changed since the last verification. Both limbs must hold for the exemption to apply. Either one falling away means a fresh verification before the next payment.

The deduction-rate caveat is where the bookkeeper most often gets caught. If HMRC has notified the contractor that a subcontractor's rate has changed, for example because the subbie has lost gross payment status or because the contractor has been issued a correction, the exemption falls away regardless of how recently the subbie was on a return. The notification is the trigger; the contractor must re-verify before paying the next invoice and switch the supplier-master rate to whatever the new verification returns.

HMRC also reserves the right to direct re-verification at any point, outside the two-year window and outside any rate change. In practice this is a written instruction sent to the contractor, and the only reasonable response is to action it before the next payment run. There is no facility to push back on a directed re-verification, and a failure to comply sits in the same liability bracket as paying without verifying at all.

There is also a quietly significant operational quirk in the GOV.UK service itself. The CIS online service drops verification details from view once they age past the two-year window, which means a subbie still in active use can come up as "Unknown" or as needing verification when a bookkeeper checks the supplier list at month start. Strictly the rule may not require a fresh call where the inclusion-and-rate-stability test still holds; practically, the cleanest move is to re-verify and capture a fresh V-number, because the supplier-master record is a more useful audit trail when the verification number is current than when the bookkeeper has to argue from memory that the rule excused the call.

That same logic underpins the safer-interpretation heuristic many bookkeepers run as policy: re-verify every active subcontractor annually, usually as part of the new-tax-year review or a year-end reconciliation, regardless of the strict rule. It is a small amount of extra work for a much cleaner audit trail, and it avoids the awkward conversation with a reviewer about whether the inclusion test held for a particular subbie three returns ago. For contractors with a stable subcontractor base it pays for itself in administrative simplicity; for contractors paying ten or more subbies a month it falls out naturally as a bulk verification at month start.

A small but useful side-point: the CIS tax month runs from the 6th of one calendar month to the 5th of the next, so "the current tax year" and "previous two tax years" in the rule are measured against tax months ending on the 5th of April, not against calendar years. When the rule sits close to a year boundary, that distinction can move a verification decision by a fortnight either way.

The control runs at the invoice stage, not at supplier-onboarding alone. When an invoice from a subcontractor arrives in the AP inbox, the bookkeeper's first question is whether the supplier-master record carries a verification within the two-year window, with a stable rate, and matching the identifiers on the invoice. If so, the rule excuses a fresh call. If any of those conditions fail, the verification runs before the payment is approved, not after.

The Supplier Identifiers HMRC Wants From the Invoice

The verification call is only as clean as the identifiers it is keyed to. Get the data right at the supplier-master stage and the verification returns a clean rate and a usable V-number; get it wrong and the call comes back unmatched, the contractor applies 30%, and the AP team is on the phone to the subbie chasing a registration correction. The identifiers HMRC wants vary by the subcontractor's legal form.

For a sole trader, the verification needs the subcontractor's UTR (Unique Taxpayer Reference, ten digits), their National Insurance number, and the trading name as it appears on HMRC's record. The trading name is the snag-point: if the sole trader registered with HMRC as "James Whitfield" but invoices as "Whitfield Groundworks", HMRC matches against "James Whitfield". Many sole-trader subbies do not realise that distinction matters, and a name-mismatch unmatched response is the most common avoidable failure mode in the verification call.

For a limited company, the verification needs the company's UTR, the Companies House Reference Number (CRN, eight characters; Scottish, Northern Irish, and LLP companies carry a two-letter prefix), and the registered company name as it appears on HMRC's record. Registered name, again, not trading style: "Trotter Roofing Limited" registered with HMRC may be invoicing under "Trotter Roofing" or "TR Roofing", and the call has to be keyed to the registered version.

For a partnership, the verification needs the partnership's UTR plus the UTR of one of the partners. The data set differs slightly between general partnerships and LLPs (LLPs also have a CRN and are formed under the LLP Act 2000), so the bookkeeper checks the partnership's HMRC registration documentation rather than guessing. If the contractor's first dealing with a partnership subbie does not produce a copy of the partnership's CIS registration confirmation, asking for it as part of supplier onboarding is the cleanest move.

Across all three forms, HMRC enforces an exact-match test. A typo in the UTR returns unmatched. A name that does not exactly correspond to HMRC's record returns unmatched. A sole trader who has just incorporated but is still invoicing under their old sole-trader UTR returns unmatched (the sole trader UTR is no longer attached to a CIS registration once the limited company is registered, and the limited company has a different UTR). The verification is forensic about what it sees, so the supplier-master record needs to be just as forensic about what it stores.

Take a worked example. A groundworking subbie sends an invoice for site preparation on a small residential development to the main contractor's AP team. The invoice carries the subbie's trading name, address, and bank details, but no UTR and no NI number. The bookkeeper cannot run the verification from what is on the invoice alone: they need to request the UTR and NI as part of supplier onboarding, capture them on the supplier master, confirm the trading name on the invoice matches the registered name on the subbie's HMRC documentation, and only then run the verification. An electrical subbie invoicing under a limited-company name needs the same sequence, with the company UTR and the CRN replacing the sole-trader UTR and NI.

The point of structure is that the AP cycle splits the work cleanly. The bookkeeper extracts the identifiers from the inbound invoice (or from the supplier-onboarding paperwork if the invoice does not carry them), captures them on the supplier-master record, and only then runs the verification call. The verification is a check against the supplier-master record, not against the invoice itself, so any error in the capture step propagates into the call. That is the lever where most of the avoidable unmatched results actually come from.

Pulling those identifiers off the invoice cleanly is exactly what Invoice Data Extraction does — given a subcontractor invoice (or a batch of them) and a prompt naming the fields wanted, it returns a structured row per invoice with UTR, CRN, registered company name, and NI where the subbie has printed it, ready to feed into the supplier-master record before the verification call runs. That is one concrete piece of automated supplier-identifier capture from subcontractor invoices in a workflow that otherwise depends on the bookkeeper retyping fields out of a PDF.

Some subcontractors will print their UTR and CRN on the invoice as a courtesy; many will not, particularly newer subbies who do not realise the contractor needs them for the verification call. In either case, the AP team needs to obtain the missing identifiers as part of supplier onboarding before the first payment can be processed, because trying to run the verification on partial data simply produces an unmatched result and a 30% deduction the subbie will then chase the contractor to correct.

The Two Routine Channels (and the Helpline Fallback)

Before getting into the channels themselves, one correction. A fair amount of practitioner content still describes three peer channels: GOV.UK, software, and a helpline call. That framing is out of date. HMRC withdrew routine telephone verification in April 2017. Today the two routine channels are the HMRC CIS online service via Government Gateway, and approved CIS software. The CIS helpline still exists, but it sits as a narrow fallback for limited circumstances, capped at around ten verifications per call, and is not a daily AP channel for any contractor running more than a handful of subbies. Treat it as the option of last resort, not a peer of the online channels.

The HMRC CIS online service. Free, accessed through the contractor's Government Gateway login, and the channel of choice for any contractor without CIS-enabled accounting software. The contractor needs to be enrolled for the CIS online service in addition to having a Government Gateway login: a contractor newly registered for CIS will sometimes find their Gateway login active but the CIS service unenrolled, and the enrolment step (which involves an activation code posted to the registered address) needs to land before the verification can run. Once enrolled, the service supports up to 100 verifications in a single submission, returning the deduction rate and the V-number against each subcontractor in the batch. For a small or mid-sized contractor running a spreadsheet supplier master and a manual payment run, this is the workhorse channel.

Approved CIS software. BrightPay, Sage 50 (CIS module), Xero UK (CIS feature), QuickBooks UK (CIS feature), and FreeAgent all carry HMRC-approved CIS verification built into the contractor side of the product. The verification step typically runs inline as part of supplier setup: the bookkeeper adds the subbie's identifiers to the contact record, clicks verify, and the software calls HMRC's CIS service in the background and writes the V-number and deduction rate back against the supplier record.

The same products also support bulk CIS verification through approved software, which is the one feature that genuinely changes the shape of the workflow at scale. A contractor paying twenty subbies a month can fire a single bulk verification at month start, refresh every active supplier's deduction rate and V-number in one pass, and run the payment cycle from the refreshed list rather than verifying each subbie one-at-a-time during the week. Each product's CIS feature lives in a slightly different place in the menu, but the underlying call to HMRC is the same; the choice of software is largely a question of what the contractor is already running for invoicing and payroll.

The HMRC CIS helpline (0300 200 3210). This is the narrow fallback for limited circumstances. It is useful where the contractor is not enrolled for the CIS online service yet (for example, a newly registered CIS contractor still waiting for their activation code), where a verification has failed repeatedly via the online channels and needs a human at HMRC to investigate, or where the contractor is responding to an HMRC-issued correction that names a specific subbie. The cap of around ten verifications per call rules it out as a daily channel for anyone with a reasonable subcontractor base, and the call queue at peak periods (the days before the 19th of each month, when CIS300 returns are due) is long. Treat the CIS verification helpline as the HMRC fallback, not the routine route.

Picking the right channel for the setup. A contractor running approved CIS software runs the verification in-product as part of supplier setup or a month-start refresh, and that is the cleanest workflow because the V-number lands directly on the supplier record without re-keying. A smaller contractor or bookkeeper without CIS software (or one whose accounting package is not on HMRC's approved list) uses the GOV.UK CIS online service directly, copying the V-number and rate back to the supplier master by hand. The helpline gets reserved for the edge cases above. None of these is wrong; the choice is driven by what the contractor already runs and how many subbies sit on the active list.

Reading the Result — Deduction Rates, the V-Number, and Where to Record It

The verification call returns two things: a deduction rate and a verification number. Each goes onto the supplier-master record, alongside a small handful of supporting fields, and stays there for the audit trail. Treat that capture as the unglamorous core of the control: every other element of the article is preparing the call or recovering from it failing, but this is the field-level discipline that makes the verification worth running in the first place.

The three deduction rates. A 0% gross rate means the subcontractor holds gross payment status: no CIS deduction is made, and the contractor pays the labour element of the invoice in full. A 20% standard rate applies to a subcontractor registered for CIS but not holding gross status: the contractor deducts 20% from the labour element and remits it to HMRC as part of the monthly CIS300 return. A 30% higher rate applies where the subcontractor is unregistered for CIS or returns unmatched against HMRC's records: the contractor deducts 30% from the labour element. The rate applies to labour only, not materials, and the labour-versus-materials split itself sits in the CIS invoice requirements that sit alongside the verification step along with the rate's interaction with the Domestic Reverse Charge. This article stays scoped to the verification step itself rather than re-explaining the deduction mechanics.

The V-number format. The verification number is V followed by ten digits (for example, V1234567890). HMRC issues a fresh V-number on every successful verification call, so a subbie verified twice in twelve months will have two different V-numbers on the contractor's records, one per call. Where HMRC cannot match the subcontractor to its records, the same number comes back with a trailing letter (for example, V1234567890A). That letter is the explicit unmatched marker: it tells the AP team that the higher 30% rate applies and that the subbie needs to correct their HMRC registration data before the next call has any chance of returning a clean result.

What the AP team records. Against every subcontractor's supplier-master record, the bookkeeper captures the V-number, the deduction rate, the verification date, and the identifiers used in the call (the UTR, the NI number for sole traders, or the CRN for limited companies). If the bookkeeper runs the safer-interpretation policy of annual re-verification, a next-review date sits alongside as a calendar trigger. Each of those fields is a contemporaneous record of what the contractor did and when, and together they form the audit trail that backs the deduction decision.

Where this lives in practice. In approved CIS software, the V-number and deduction rate land on the supplier or contact record automatically when the in-product verification runs: BrightPay, Sage 50, Xero UK, QuickBooks UK, and FreeAgent each carry a CIS subcontractor section on the contact card with these fields pre-built. The verification date populates from the call timestamp. For smaller contractors or bookkeepers running a manual supplier master in Excel or Google Sheets, the same fields go on as columns: V-number, deduction rate, verification date, identifiers used, optional next-review date. The format is less important than the discipline of capturing every field on every verification, every time.

Three-year retention. Verification records must be kept for at least three years after the end of the tax year they relate to. A verification run in October 2025, for example, falls in the tax year ending 5 April 2026, and the record must be retained until at least 5 April 2029. In approved CIS software, this happens automatically through the product's archive, though most bookkeepers also export an annual audit-trail spreadsheet as a documented backup that does not depend on the software vendor remaining in service. For spreadsheet-based supplier masters, the retention rests on the bookkeeper not deleting old verification rows when a subbie becomes inactive: archive the row, do not remove it, until the three-year tail has elapsed.

The audit trail point. The V-number is the contractor's evidence that they ran the verification on a specific date and applied the rate HMRC actually returned, not the rate the contractor assumed or remembered. Without it, a future HMRC review of the contractor's CIS process has nothing to corroborate the deduction decision against, and the burden of proof that the right rate was applied to the right subbie shifts onto the contractor with no contemporaneous record to lean on. The few seconds it takes to write the V-number to the supplier master is the cheapest insurance available against an awkward audit conversation.

The V-number and deduction rate also feed forward into the contractor's monthly CIS300. The same fields the AP team captured at verification appear against each subbie on the return, and clean verification capture is what makes preparing the CIS300 monthly return from your subcontractor invoice batch a mechanical exercise rather than a reconciliation puzzle.

Failure Modes — and the AP Response to Each

In day-to-day AP, four scenarios cover the bulk of what goes wrong on a CIS verification. The unmatched response, where HMRC cannot match the subbie at all. The sole-trader-incorporated case, where the subbie's legal form has changed since the contractor last verified them. The lost-gross-status case, where a verification that previously returned 0% now returns 20% or 30%. And the paid-without-verifying case, where the control was skipped and the contractor needs to know what HMRC is going to do about it. Each has its own playbook.

Unmatched verification

The unmatched response is what HMRC returns when it cannot match the UTR-and-name combination supplied to its records. The verification comes back at the higher 30% rate, the V-number carries a trailing letter (the V1234567890A pattern), and the supplier-master record needs to reflect that explicitly so the next bookkeeper to look at the file knows what they are looking at.

Three causes account for almost all unmatched results in practice. A typo in the UTR is the easiest to fix: re-key against the source document and re-run the call. A name mismatch with HMRC's record is the most common: the subbie has registered under one name (sole trader's full legal name, limited company's registered name) and is invoicing under another (a trading style, an abbreviation, the name of the founder rather than the company). The cure is to identify HMRC's exact registered name and re-verify against that. The third cause is that the subbie is not registered for CIS at all, in which case no amount of re-verification will move them off the 30% rate until they actually register.

The AP response is preventative: apply 30% on the imminent payment, record the V-number-with-letter-suffix and the verification date on the supplier master so the audit trail is intact, and contact the subbie with the specific issue (registration name correction, registration with CIS, UTR correction) so they can fix it at HMRC's end. Once the subbie has corrected their data, re-run the verification: the new call will return either 20% or, if they hold gross status, 0%, and the rate moves on the next payment, not retroactively.

Sole trader incorporated since the last verification

A subcontractor who started as a sole trader and has since incorporated must be treated as a brand-new CIS subcontractor under the limited company's UTR. The sole trader's UTR no longer applies once the limited company is the legal entity issuing the invoice, and HMRC's CIS registration sits against the limited company, not the sole trader.

The AP response is to update the supplier-master record with the limited company's UTR, the CRN, and the registered company name, then re-run the verification call against those new identifiers. The call returns a fresh V-number and rate, which replace the sole trader's old verification on the supplier master. The most common error here is carrying the old V-number across when the new invoice's bank details have changed to the limited company's account; if the bank details have changed, the legal entity has almost certainly changed too, and the old V-number is no longer valid for the new payment. Pay the limited company's invoice using the limited company's verification, not the sole trader's.

The bookkeeper also has a choice on the supplier-master record itself: archive the sole trader's record (do not delete it, given the three-year retention obligation on verifications under the old UTR) and create a fresh record for the limited company, or repurpose the existing record by updating the identifiers. The cleaner option is the first, because it preserves the audit trail of payments made under the sole trader's UTR cleanly separated from payments made under the limited company's.

Subcontractor lost gross payment status

A subbie who previously verified at 0% gross can have status withdrawn at any point. HMRC's annual review can revoke status where the subbie has missed VAT or PAYE compliance thresholds; fraud cancellation removes status with little notice; and the 2024 and 2026 changes to CIS gross payment status tightened the compliance requirements further, which means more subbies have moved off gross status in recent years than the long-term baseline would have suggested. The contractor only finds out via the verification call, which on re-verification returns the new rate (typically 20%, occasionally 30% if the subbie's CIS registration has lapsed entirely).

The AP response is sequential: re-verify before the next payment runs, switch the supplier-master rate to 20% (or 30% if the subbie is also flagged unmatched), update the verification date and capture the new V-number. The next payment to that subbie is then made at the new rate, and the contractor remits the deduction through the next CIS300. The contractor does not retroactively adjust historical payments made at the old gross rate; the rate change applies prospectively from the date HMRC notified the contractor of the change or from the date of the re-verification, whichever is earlier.

Paid without verifying

The fourth scenario is the consequence the control is built to prevent. If the contractor pays a CIS-scope subcontractor without having verified them, or pays them at the rate from a stale verification when a fresh one was required, HMRC will assess the deduction that should have been made. The assessment can extend to interest on the under-deducted amount and to penalties for failing to operate CIS correctly. In most cases the contractor cannot recover the under-deducted amount from the subcontractor after the fact, because the legal liability for the deduction sits on the deductor, not on the deductee.

The practical implication is that the verification step has to be a hard gate in the payment-approval workflow. Not a soft check the AP team can skip when month-end is busy, not a follow-up the bookkeeper plans to run after the BACS run has gone, and not an approximation based on what the subbie verified at six months ago when the invoice value was lower. Build the verification into the supplier-onboarding step before any payment is ever made, into a month-start refresh for active subbies, and into the payment-approval checklist itself so that no invoice is released without a current verification on file. The cost of running the control is fifteen minutes a month; the cost of skipping it is the under-deducted amount, plus interest, plus a penalty.

Where the Verification Result Feeds Next

The verification step is one record in a longer chain of CIS controls. Once the V-number and the deduction rate are sitting on the supplier-master record, they move out into a handful of neighbouring workflows: the contractor's monthly CIS300 return, the subcontractor's own end-of-year reconciliation, and the adjacent AP controls that share the same supplier set. This section points at each in turn so the reader leaves with the verification step located inside the bigger picture, without this article over-stepping into topics that have their own siblings.

Into the contractor's monthly CIS300 return. The deduction rate and V-number captured at verification feed straight into the CIS300 for every subbie paid in that tax month. The return reports the deduction taken from each subcontractor's labour element, attributed against the verification number on the supplier record, and remits the deductions to HMRC. The verification step is the upstream input; the CIS300 is the downstream report. The cleaner the verification capture, the more mechanical the return-preparation workflow becomes.

Onto the subcontractor's side of the same transaction. The deductions a subbie suffers are not a final tax cost: they are credit against the subbie's eventual liability. Sole-trader subcontractors recover their deductions through their self-assessment return, and how the subcontractor reconciles CIS deductions on their own self-assessment walks that reconciliation in detail. Limited-company subcontractors take a different route: they offset suffered deductions against their own PAYE liability through the Employer Payment Summary, and a limited-company subcontractor's CIS132 offset against PAYE through the EPS walks the offset mechanics. Both articles are written for the subcontractor's accountant rather than the contractor's AP team, but knowing the path the deduction takes on the other side of the invoice helps the contractor's bookkeeper answer the inevitable questions from subbies querying their net pay.

Adjacent AP control on plant-hire invoices. The contractor's CIS-registered subbies do not always invoice for pure construction labour. Where a subcontractor's invoice covers plant hire on Construction Plant-hire Association (CPA) terms with an operator included, the operator-labour element is in scope of CIS where the supply is treated as construction services, and the verification step still applies to that element. The walk-through on processing UK plant-hire invoices on CPA terms in AP covers how the AP team splits the labour and the hire on the invoice and how the CIS deduction lands on the labour part. The verification on file for the subbie is the same record that supports the deduction on the plant-hire invoice as on a pure-labour invoice; one verification, multiple invoice types.

The verification step is the smallest link in the CIS workflow but the one HMRC checks first if a contractor's CIS process is ever reviewed. Run it cleanly and every subsequent record (the monthly return, the deduction statement issued to the subbie, the supplier-master audit trail) is corroborated by it. Skip it and the rest of the chain has no anchor, which is exactly the position no contractor wants to be in when a CIS compliance review lands.