A letter with a reference starting CFSS has started landing on construction company desks. HMRC believes you took the wrong amount of tax off at least one subcontractor last year, and the clock started the day the letter was dated.
TL;DR: HMRC published guidance on 18 September 2026 for contractors receiving letters about incorrect CIS deduction rates applied between 6 April 2025 and 5 April 2026. You have 45 days to check your records and report any error. Miss that window and anything HMRC finds afterwards counts as a prompted disclosure, which raises the minimum penalty.
Why Has HMRC Written to You About CIS Deductions?
Because its records suggest you applied the wrong rate to a subcontractor payment in the 2025-26 tax year. The letter explains why HMRC thinks there may be an error and how to correct it (GOV.UK, 2026).
This is a "one to many" letter, the same prompt-first approach HMRC used for undeclared rental income. It is not a formal compliance check, and there is no box to tick to say you looked and found nothing. Recipients are asked to verify the CIS tax status of their subcontractors and review their records within 45 days of the letter (KPMG, 2026).
What we see most often is contractors filing the letter under "look at it later", because nothing in it demands a reply. The 45 days run whether you answer or not.
What Are the Correct CIS Deduction Rates?
There are three, and which one applies depends entirely on what HMRC's verification service returns for that subcontractor. Gross payment status means no deduction at all. Registered subcontractors without that status are paid under deduction at 20%. Anyone HMRC cannot identify or who is not registered for the scheme is deducted at 30% (GOV.UK CIS 340).
The 30% rate is not a penalty rate. It is the default HMRC applies when a match fails, which is why a typo in a UTR or a company name that has changed since incorporation can quietly push a subcontractor into the higher band for a whole year.
Both directions of error show up in these letters. Deduct 20% where HMRC returned 30% and you owe the shortfall. Deduct 30% where 20% applied and your subcontractor has been short-paid all year.
The Verification Rule That Causes Most of These Errors
A contractor must verify a subcontractor before paying them unless that subcontractor was last included on a monthly return in the current or two previous tax years (GOV.UK CIS 340).
Read that again, because the exemption is narrower than most people assume. "We have used them for years" is not the test. The test is whether they appeared on one of your returns inside that window. A trusted subcontractor you last engaged in 2021 and called back in 2025 needs verifying again, and if you paid them at the old rate you have an error on every return since.
Verification runs through HMRC's free CIS online service or commercial software. It takes minutes per subcontractor and produces the reference number you should be recording against the payment.
What Happens If You Ignore the 45-Day Window?
HMRC may open a compliance check, and any error it finds at that point is treated as prompted rather than unprompted. That distinction is worth real money.
For a careless inaccuracy, the maximum penalty is 30% of the tax at stake either way. But an unprompted disclosure can be reduced as far as 0%, while a prompted one cannot go below 15% (HMRC Compliance Handbook CH82470). Telling HMRC inside the window is what keeps the floor at zero.
There is a second exposure behind the penalty. Where deductions were not made correctly, the contractor is still responsible for paying that amount to HMRC, even though the money was never withheld from the subcontractor. Relief is available, but only if you satisfy HMRC that reasonable care was taken or that the failure was an innocent error.
How Do You Tell HMRC About a CIS Error?
Use the online form on the guidance page. You need your business name, your UTR, the CFSS reference from the letter, and details of any underpaid tax. HMRC reviews what you send and aims to contact you within 28 working days (GOV.UK, 2026).
Reporting the error is a separate job from fixing the return. To correct the monthly return itself, log in to your CIS online account or your software, select the affected month, amend the subcontractor's figures and resubmit. If you would rather do it by phone, HMRC's internal guidance routes correction requests to the CIS helpline on 0300 200 3210 (HMRC CISR66620).
One question clients always ask is whether owning up invites a wider look at the business. In our experience the bigger risk runs the other way: a contractor who cannot show a verification trail is the one who gets the follow-up.
Your Action Plan Before the 45 Days Run Out
Work backwards from the letter date, not from the date you opened it. The review itself is narrow enough to finish in an afternoon for most SME contractors.
- Pull every CIS300 return filed between 6 April 2025 and 5 April 2026 and list each subcontractor paid.
- Re-verify every one of them through the CIS online service and compare the rate returned against the rate you actually applied.
- For any mismatch, calculate the difference, correct the return, and report it using the online form before day 45.
- Check whether each subcontractor was on a return in the current or previous two tax years, because that is where the unverified ones hide.
Carelessness is HMRC's largest single behavioural category in the tax gap, at 35%, ahead of plain error at 16% and evasion at 12%, with small businesses accounting for 62% of the £59.2 billion total for 2024-25 (GOV.UK, 2026). Campaigns like this one exist because that is where the money is, and they are cheap for HMRC to run. Expect more of them.
Frequently Asked Questions
What is the CFSS reference on my HMRC letter?
It is the identifier HMRC uses to match your response to the campaign record. You need to quote it on the online form, so keep the letter rather than scanning and binning it.
I deducted 30% when it should have been 20%. What now?
Your subcontractor has overpaid tax through you. Correct the affected returns so the figures on their record are right, refund the excess to them, and adjust what you pay HMRC. They can then reclaim through their own return.
Can I still be penalised if I correct the error myself?
Yes, but at a much lower level. A careless inaccuracy disclosed unprompted can be reduced to 0%, whereas the same error found by HMRC after the 45 days carries a minimum of 15% of the tax at stake.
Does a deduction rate error affect my gross payment status?
It can. Your filing and payment record feeds into HMRC's compliance test for gross payment status. The stakes went up in April 2026: where HMRC cancels that status because a business knew or should have known a payment was connected to tax fraud, the wait to reapply is now five years rather than one (Johnston Carmichael, 2025). Our guide to CIS nil returns covers what else changed in that reform.
If a CFSS letter has arrived and you are not sure which of last year's subcontractors were verified properly, get in touch. We can run the 2025-26 returns against HMRC's verification records, quantify any under or over-deduction, and handle the disclosure inside the 45 days. We do the same review for contractors preparing for the right to work checks that extend to subcontractors on 1 October, and for businesses working out where they sit in a labour supply chain.