If you have received an HMRC letter with a reference beginning CFSS, it means HMRC's records suggest you applied the wrong CIS deduction rate to subcontractor payments in 2025/26. You must either tell HMRC how much tax you underpaid, with your calculation, or explain why you disagree, using HMRC's online form.
HMRC will review what you submit and aims to contact you within 28 working days. There is a deadline printed on the letter itself, so do not ignore it. This guide walks through what the letter is, the three CIS deduction rates, the most common mistake behind a wrong rate, and a clear step-by-step for replying before your date.
What is the CFSS letter and why did HMRC send it?
HMRC has begun writing to contractors whose records indicate they may have used the wrong Construction Industry Scheme (CIS) deduction rate on payments made to subcontractors between 6 April 2025 and 5 April 2026 (the 2025/26 tax year). The letter reference number begins with the characters CFSS.
The letter is a nudge, not yet a formal compliance check. HMRC is inviting you to review your own records and put things right. To respond you will need your business name, your Unique Taxpayer Reference (UTR), the letter and its reference number, and your 2025/26 CIS details.
You have two options:
- Agree there was an under-deduction: tell HMRC how much tax you underpaid and show how you worked it out, using HMRC's online form.
- Disagree: explain why your figures are correct, again through the online form.
What are the three CIS deduction rates for 2025/26?
Under CIS, a contractor deducts money from a subcontractor's payment and passes it to HMRC as an advance towards that subcontractor's tax and National Insurance. There are three rates, and which one applies depends on the subcontractor's status with HMRC. These rates are unchanged for both 2025/26 and 2026/27.
| CIS status | Deduction rate | When it applies |
|---|---|---|
| Registered, standard (net payment) status | 20% | Subcontractor is registered for CIS and you have verified them with HMRC. |
| Unregistered or unverified | 30% | Subcontractor is not registered for CIS, or you could not verify them before the first payment. This is the higher, default rate. |
| Gross payment status | 0% | Subcontractor holds gross payment status; you pay them in full and they settle their own tax via Self Assessment or Corporation Tax. |
If you are unsure whether someone should be inside CIS at all, read our guide on CIS versus PAYE and employment status before you pay them. Getting the employment status wrong is a separate, and often costlier, problem.
Deductions apply to the labour element only
This is where a lot of contractors slip up. The CIS deduction is calculated on the labour element only. You must exclude:
- VAT charged by the subcontractor
- The cost of materials the subcontractor paid for
- Plant and equipment hire
- Fuel (except fuel for travelling)
- The CITB levy
So if a subcontractor invoices you for labour plus materials, you strip out the materials and VAT first, then apply the rate to what is left. Our breakdown of CIS materials versus labour shows exactly how to split a mixed invoice so you deduct on the right figure.
Why does the wrong rate usually happen?
By far the most common cause of a CFSS letter is not verifying a subcontractor before the first payment. You must verify each subcontractor with HMRC (through the online CIS service or your CIS software) before you pay them for the first time. If you cannot verify them, HMRC's rule is simple: you must deduct at 30%.
What happens in practice is that a contractor assumes a new subcontractor is registered, applies 20%, and only later finds HMRC had no verified record. That leaves a 10 percentage point gap on every labour payment, which is exactly the pattern HMRC's data flags.
The £8,000 labour worked example
Say you pay an unverified subcontractor £8,000 of labour during 2025/26:
- Correct deduction at 30% = £2,400
- What you actually deducted at 20% = £1,600
- Under-deduction HMRC can now recover from you = £800
That £800 is money you should have withheld from the subcontractor and paid to HMRC but did not. Crucially, HMRC recovers it from the contractor, not the subcontractor (more on that below).
What should you do by the date on your letter?
Work through these steps in order. The response deadline is stated on the letter itself, so start as soon as it arrives.
- Pull your CIS records and CIS300 returns for 6 April 2025 to 5 April 2026. Line up each subcontractor payment against the rate you applied. Our guide to the CIS monthly return (CIS300) explains what each return should contain.
- Re-verify each subcontractor through the online CIS service to confirm the rate HMRC held for them during the year. Note their verification numbers.
- Work out any under-deduction on the labour element only, comparing the correct rate to the rate you used, subcontractor by subcontractor.
- Reply through HMRC's online form: either report the total you underpaid with your calculation, or explain why you disagree. Keep a copy of everything you submit.
If the numbers are large or you are unsure which subcontractor sat on which status, get an accountant to reconcile the year before you file a figure. A wrong self-declared number is hard to walk back.
What happens next, and the cost of ignoring it?
After you respond, HMRC reviews your submission and aims to contact you within 28 working days. Ignoring the letter is the worst outcome. If HMRC opens a formal compliance check and finds an error, that error is treated as prompted rather than unprompted, which can mean higher penalties than if you had corrected it yourself.
There is a second sting that catches contractors out. Where you under-deducted, HMRC recovers the CIS tax that should have been deducted from you, the contractor, not from the subcontractor who was underpaid on the deduction. In the worked example above, HMRC comes to you for the £800, even though the subcontractor received more cash than they should have. On top of the tax, HMRC can charge penalties and interest, so the total bill can climb quickly. Our overview of HMRC interest and penalties shows how those add up.
How do you correct a CIS300 monthly return error?
If your review turns up a genuine error in a submitted CIS300 return, you correct it rather than leaving it. The route depends on your software and how far back the error goes, but the principle is the same: report the corrected figures to HMRC and pay any additional deduction due. If your letter relates to specific months, address those returns directly as part of your reply.
Keep in mind the wider CIS deadlines while you are in your records: the CIS300 is due by the 19th of each month for the tax month ending on the 5th, a nil return is required if you made no payments in a month, and late filing triggers an automatic penalty starting at £100. Payment and deduction statements must reach each subcontractor within 14 days of the end of the tax month.
How do you stop this happening again?
Three habits prevent almost every wrong-rate letter:
- Verify before you pay. Never make a first payment to a subcontractor without verifying them. If verification fails or is pending, deduct 30% until it is confirmed.
- Keep verification numbers. Record HMRC's verification reference and the confirmed rate against each subcontractor, and re-check status when it changes.
- Reconcile monthly. Each month, tie your payments, deductions and CIS300 together before you file, so a wrong rate is caught in weeks, not years.
If a subcontractor keeps hitting the 30% rate, it may be worth them applying for gross payment status. See how to apply for CIS gross payment status for the qualifying tests.
Get the reply right the first time
A CFSS letter is manageable if you respond accurately and on time, but the calculation has to be right, because HMRC recovers any shortfall from you. Zmartly is a CIMA-regulated firm and our qualified accountants handle CIS reconciliations, wrong-rate letters and CIS300 corrections for contractors every week. If you would rather hand this over, see our CIS contractor accounting service or read our full construction tax guide for builders.
Book a free call with Zmartly and we will review your letter and 2025/26 CIS records before your deadline.
Frequently asked questions
What does a letter with a reference beginning CFSS mean?
It means HMRC's records suggest you applied the wrong CIS deduction rate to subcontractor payments made in 2025/26. You must either tell HMRC how much tax you underpaid, with your calculation, or explain why you disagree, using HMRC's online form. HMRC aims to reply within 28 working days.
Does HMRC recover under-deducted CIS from the contractor or the subcontractor?
From the contractor. Where you deducted too little, HMRC recovers the CIS tax that should have been deducted from you, not from the subcontractor, even though the subcontractor received more cash than they should have. HMRC can also add penalties and interest.
What CIS rate should I use if I could not verify a subcontractor?
30%. You must verify each subcontractor with HMRC before the first payment. If you cannot verify them, or they are not registered for CIS, you must deduct at the higher 30% rate on the labour element until their status is confirmed.
Is the CIS deduction taken from the whole invoice?
No. The deduction applies to the labour element only. You exclude VAT, the cost of materials the subcontractor paid for, plant and equipment hire, fuel (except fuel for travelling) and the CITB levy before applying the rate.
