Contractor management in the UK: IR35, compliance, and payment rules

Key takeaways

• Employees, contractors, and freelancers each have different legal, tax, and compliance obligations, making correct workforce classification in the UK essential for managing risk and controlling costs.
• Contractors and freelancers are not separate legal categories under UK law. Both are generally self-employed arrangements, but their status depends on the actual working relationship rather than the title used.
• Choosing the right workforce model requires assessing factors such as control, project duration, integration, substitution rights, and financial risk. Misclassification can result in significant financial penalties, backdated taxes, employment claims, and reputational damage, making regular classification reviews and strong documentation critical.
• A structured decision framework, supported by compliant contracts, IR35 assessments, and ongoing governance, helps organisations engage talent confidently while staying compliant with UK employment and tax regulations.

Contractor management in the UK is a compliance-intensive discipline shaped by IR35, employment status law, and HM Revenue and Customs enforcement, rather than simply an administrative process. 

This is a critical reality today given the immense scale of the UK contingent workforce. Organisations increasingly rely on contractors to fill skills gaps, complete time-limited projects, and rapidly adjust their resourcing. So as contractor engagements grow, so does the need to classify, onboard, pay, and document each worker correctly.

This responsibility became even more significant on 6 April 2021, when the private-sector off-payroll working rules changed. Medium and large organisations became responsible for deciding the IR35 status of contractors working through intermediaries, moving a major part of the tax and compliance risk directly to the employer.

Organisations must now manage three connected risks: 

1. incorrect IR35 determinations
2. employment status misclassification
3. payment or tax non-compliance. 

Mistakes here can lead to unpaid tax, National Insurance contributions, interest, penalties, or worker claims, especially when internal departments use disjointed systems.

This guide explains the UK rules on IR35, legal employment status, onboarding processes, and programme audits. After reading it, HR and procurement leaders will be able to review their current contractor programme, identify gaps, and set clearer controls for compliant growth.

Understanding IR35 and off-payroll working rules in the UK

IR35 governs how certain contractor engagements through intermediaries are assessed for tax. Under the off-payroll working rules, responsibility depends on the client’s size, the engagement structure, and each party’s role in the supply chain. These distinctions determine how each engagement should be treated under the current framework.

What IR35 is and why it matters for engager organisations

IR35 is the common name for Chapter 8 and Chapter 10 of the Income Tax (Earnings and Pensions) Act 2003. Chapter 8 applies mainly where a worker’s personal service company remains responsible for the decision, while Chapter 10 covers off-payroll working in the public sector and affected private-sector organisations. The term comes from the Inland Revenue press release that introduced the policy in 2000.

Other must-know information about IR35:

• The rules target arrangements where a person provides services through an intermediary, usually a personal service company, but would be an employee if engaged directly. 
• Their purpose is to ensure these “disguised employees” pay broadly the same Income Tax and National Insurance as direct employees. Each engagement must be assessed on its real terms and working practices.
• As mentioned above, since April 2021, medium and large private-sector organisations have been responsible for determining the IR35 status of affected contractors. For the 2026–27 tax year, an organisation is generally treated as medium or large for IR35 purposes if it meets at least two conditions: annual turnover above £10.2 million, a balance sheet total above £5.1 million, or more than 50 employees. Small private-sector clients are generally exempt, so responsibility stays with the contractor’s intermediary.
• If the decision is wrong, HMRC can recover unpaid Income Tax and National Insurance from the deemed employer. Interest and penalties may also apply.

How off-payroll working rules changed in April 2021

Before April 2017, IR35 applied to contractors working through personal service companies, but the contractor’s company was generally responsible for deciding whether the rules applied and paying any tax due. 

In April 2017, that responsibility moved to public-sector organisations for contractors they engaged. On 6 April 2021, the same approach was extended to medium and large private-sector organisations.

A Status Determination Statement, or SDS, is a written record of the engager’s decision about a contractor’s tax status and the reasons for that decision.

• The engager must send it to the contractor and the fee-payer, which is often an agency.
• In practice, this should be completed before work begins so the correct tax treatment can be applied from the first payment.
• The engager must take reasonable care when making the determination. This means reviewing the contract, actual working arrangements and relevant facts before reaching a decision. 
• Blanket determinations that place contractors inside or outside IR35 without considering differences between engagements do not meet this standard.

The April 2021 rules are mainly set out in Chapter 10 of the Income Tax (Earnings and Pensions) Act 2003, supported by the Off-Payroll Working (Prevented Avoidance) Regulations 2021. 

If the engager does not take reasonable care or issue a valid SDS, it may become the deemed employer. It can then be responsible for the Income Tax and National Insurance that should have been deducted.

The IR35 status determination process – and who is responsible

Where Chapter 10 applies, the client is responsible for deciding whether a contractor engagement falls inside or outside IR35. The decision must reflect the real working arrangement, not only the written contract. The engager must explain the outcome in the Status Determination Statement so the fee-payer can apply the correct tax treatment.

CXC Global’s interpretation of HMRC guidance uses the three-factor IR35 test:

1. Mutuality of obligation:Is the client required to offer work, and is the contractor required to accept it?
2. Control:Does the client decide what work is done and how, when or where it is completed?
3. Substitution:Does the contractor have a genuine, unconditional right to send a qualified substitute?

No single factor decides every case. There are also secondary factors like financial risk, provision of equipment, integration, and exclusivity that affect the result.

HMRC’s Check Employment Status for Tax tool, known as CEST, is a free online tool that provides an IR35 determination based on the answers entered. HMRC states it will stand behind the result if the inputs are accurate. However, CEST does not consider mutuality of obligation, which is a significant limitation, and tribunal decisions have found against HMRC’s own CEST outcomes in some cases.

Because of these complexities, engagers managing large contractor populations often rely on specialist IR35 advisers and indemnity insurance. Whatever method is used, the importance of documenting the process is critical. The SDS must set out the clear reasons for the determination, not just the outcome, and must be reviewed if working arrangements change.

Employment status, worker rights, and agency worker regulations

IR35 determines tax treatment, while employment status determines legal rights. An engagement can fall outside IR35 for tax purposes and still give the individual worker rights under UK law. These two frameworks must therefore be assessed separately.

The three-tier UK employment status framework

UK law recognises three main employment statuses:employee, worker and self-employed independent contractor.

Each carries different rights, tax duties and levels of legal protection. The CXC Global UK Employment Status Framework separates them as follows:

1. Employee: An employee works under a contract of employment and receives the highest level of statutory protection. Rights can include unfair dismissal protection, statutory redundancy pay, maternity or paternity leave, paid holiday and a written statement of employment terms. Income Tax and National Insurance are normally deducted through Pay As You Earn.
2. Worker: A worker sits between an employee and a self-employed contractor. Workers are entitled to the National Minimum Wage, paid annual leave under the Working Time Regulations 1998, protection from unlawful wage deductions and automatic pension enrolment where eligible. They usually provide the service personally and do not have a genuine right to send a substitute.
3. Self-employed independent contractor: A genuine contractor runs their own business and has the lowest level of statutory employment protection. They normally control how the work is delivered, carry financial risk and may have a genuine right to provide a substitute. They are responsible for their own tax and National Insurance through Self Assessment or their company.

Crucially, employment status for legal rights is determined by the actual nature of the relationship. So having a contract describing someone as a self-employed contractor does not automatically make them one if the practical reality resembles employment. UK tribunals and employment courts will still look through the contractual label to assess the substance of the engagement.

Employment status tests and the factors that determine them

UK law does not use one single test to decide whether someone is an employee, worker or self-employed. Courts and tribunals assess the full working relationship using factors developed through case law. CXC Global’s four-factor employment status test focuses on:

1. Personal service:Must the person perform the work, or can they send a genuine substitute?
2. Mutuality of obligation:Is the organisation expected to provide work, and is the person expected to accept it?
3. Control:Who decides what is done and how, when and where it is completed?
4. Integration:Is the person managed, presented and equipped like part of the organisation?

Several cases have shaped how these factors are applied.

• Ready Mixed Concrete v Minister of Pensions and National Insurance established core conditions for a contract of employment. 
• Autoclenz Ltd v Belcher confirmed that courts can look beyond the written contract, while 
• Uber BV v Aslam showed that the practical reality of the relationship can support worker status despite self-employed wording.

Other evidence may include financial risk, equipment, freedom to work for other clients, and the ability to refuse assignments. HMRC’s Employment Status Manual can support the assessment, but it reflects HMRC’s view and does not bind a tribunal. The outcome still depends on the full facts.

A contract that describes someone as self-employed is therefore not enough. If the organisation controls the work, requires personal service, and treats the individual as part of its workforce, a court may still find employee or worker status. The same review is needed when an intermediary sits between the worker and the hirer.

Agency worker regulations and intermediary arrangements

Many UK contractor engagements involve an agency or intermediary in the supply chain:

• When individuals are supplied by a temporary work agency to work under a hirer’s supervision and direction, they may fall under the Agency Workers Regulations 2010. 
• Under these rules, agency workers gain equal treatment in basic working conditions, including equal pay and annual leave, after a 12-week qualifying period.

Tracking this AWR 12-week qualifying period is essential:

• The right accrues after 12 calendar weeks in the same role with the same hirer, though the clock may reset if the worker takes a break of more than six weeks or moves to a substantively different role. 
• Genuinely self-employed contractors who control their own work generally fall outside this definition, but the boundary requires careful assessment.

Agencies can no longer bypass this equal pay requirement using older contracting models. The “Swedish derogation,” which is a pay-between-assignments model that exempted workers from equal pay rights, was abolished in April 2020 under the Good Work Plan reforms. Engager organisations must ensure their supply chain no longer relies on this outdated structure.

Beyond worker rights, intermediaries also affect IR35 tax obligations. Where a contractor is engaged through an agency, the engager must issue the Status Determination Statement to both the contractor and the agency. The agency, as the fee-payer, is then responsible for operating PAYE if the determination is inside IR35. The practical implication is that engager organisations must understand the full supply chain for every contractor engagement, not just their direct contractual relationship.

Contractor onboarding, payment, and tax obligations

Compliance only works when legal requirements are built into the way each contractor engagement is managed. Status decisions must lead to clear actions, approvals and records throughout the engagement. This turns legal obligations into a consistent operating process rather than a one-time assessment.

Right-to-work checks and onboarding requirements for contractors

Right-to-work checks should be completed before a contractor begins work. Under the Immigration, Asylum and Nationality Act 2006 and the Immigration Act 2014, employers must prevent illegal working. Although the statutory duty centres on employees, directly engaged contractors should also be checked, especially where employment status is unclear.

The check should use accepted evidence, such as a passport, a biometric residence permit, or a Home Office share code. Digital checks are available for people with settled, pre-settled or Frontier Worker status. Copies must be kept, with follow-up checks for time-limited permission.

Following legislative increases under the Illegal Migration Act 2023, the civil penalty is now up to £45,000 per illegal worker for a first breach, although this penalty figure remains subject to change. Criminal liability can also apply where the organisation knew, or had reasonable cause to believe, that the person did not have the right to work. These consequences make complete records essential.

The CXC Global UK Contractor Onboarding Checklist has five mandatory steps:

1. Complete and document the right-to-work check.
2. Complete the IR35 assessment and issue the Status Determination Statement where required.
3. Sign the written contract before work begins.
4. Verify the Unique Taxpayer Reference or company registration number.
5. Confirm payment terms and the invoicing process in writing.

Professional indemnity insurance should also be confirmed where it is relevant to the work. Once the onboarding requirements are complete, the contractor can move into the correct payment and engagement process.

Contractor payment structures and tax obligations

Once onboarding is complete, the payment model must reflect both the contractor’s status and the way the engagement is structured. For contractors operating through an intermediary, two main models apply.

• Outside IR35 – gross invoice model: The contractor’s personal service company invoices the engager or agency, which pays the invoice without Pay As You Earn deductions. The company remains responsible for Corporation Tax, Value Added Tax where registered, and the contractor’s Income Tax and National Insurance. The engager has no Pay As You Earn obligation.
• Inside IR35 – deemed employment payment model: The fee-payer, usually the agency or the engager in a direct arrangement, must deduct Income Tax and employee National Insurance before payment. It must also pay employer National Insurance, currently 15% above the secondary threshold for 2026–27, and the Apprenticeship Levy where applicable.

Directly engaged sole traders fall outside the off-payroll working rules because no intermediary is involved. However, the engager must still assess whether the individual is genuinely self-employed. A Unique Taxpayer Reference may support the checks, but it does not prove status or determine whether Pay As You Earn applies.

VAT-registered contractors normally charge Value Added Tax at 20%, which a VAT-registered engager may recover where allowed. Registration is required when taxable turnover exceeds £90,000, although businesses below that threshold may register voluntarily.

Where Pay As You Earn applies, the fee-payer must submit a Full Payment Submission through Real Time Information on or before the payment date. Records should then be retained under the correct legal period, with a six-year central policy used where appropriate.

Building a compliant contractor engagement lifecycle

Contractor compliance does not end once onboarding is complete. It must continue through every stage of the engagement, from the first assessment to final offboarding. 

The CXC Global UK Contractor Engagement Lifecycle brings these duties into five sequential phases:

1. Pre-engagement: Map the supply chain, complete the IR35 and employment status assessments, issue the Status Determination Statement where required, complete the right-to-work check, sign the contract and confirm payment terms.
2. Onboarding: Verify the Unique Taxpayer Reference or company registration details, confirm professional indemnity insurance where relevant, approve system access and complete the onboarding checklist.
3. Active engagement: Process invoices or Pay As You Earn payments correctly, monitor the Agency Workers Regulations 12-week qualifying period and review status if the working arrangement changes.
4. Extension or variation: Reassess IR35 when the role, contract terms or working practices change materially. Issue an updated Status Determination Statement and contract amendment before the new arrangement begins.
5. Offboarding: Process the final payment, complete Pay As You Earn reporting, issue a P45 where required, remove system access and confirm record retention.

The framework applies whether the contractor is engaged directly or through an agency. Large contractor programmes benefit from a centralised system that tracks lifecycle stage, IR35 status, agency-worker service and document completion. This creates a reliable record for future compliance reviews and audits.

The CXC UK Contractor Compliance Audit Framework

A well-designed contractor lifecycle is only effective if each stage is followed consistently and supported by evidence. The next step is to test how well those controls work across the organisation’s current contractor population. 

The CXC UK Contractor Compliance Audit Framework provides a structured way to identify gaps, confirm ownership, and prioritise corrective action before weaknesses create tax, employment rights, or audit risks.

The CXC UK Contractor Compliance Audit – six dimensions

The audit reviews six areas that show whether contractor controls work in practice. Each dimension tests the evidence on file and warning signs that point to a gap.

1. IR35 governance: Confirm that every affected engagement has an individual IR35 assessment, a reasoned Status Determination Statement and a review trigger for material changes. Ask whether it reached the contractor and fee-payer before work began. Red flags include missing statements, blanket decisions and pre-April 2021 determinations that have not been reviewed.
2. Contract quality: Check that every contractor has a current agreement matching the real work, including scope, substitution rights, control and financial risk. Ask whether it reflects the actual location, hours and method of work. Red flags include expired agreements, employee-like instructions and substitution clauses that cannot be used.
3. Employment status and worker rights: Confirm that legal status has been assessed separately from IR35. Ask whether possible workers receive the correct rights and whether the Agency Workers Regulations 12-week period is monitored. Red flags include no second assessment, automatic self-employed labels and missed qualifying dates.
4. Right-to-work compliance: Check that directly engaged contractors have verification on file and that time-limited permission is rechecked. Ask whether digital checks are used and records can be produced for audit. Red flags include missing evidence, expired documents and no review process.
5. Payment and tax compliance: Confirm that outside-IR35 contractors are paid against gross invoices and inside-IR35 payments go through Pay As You Earn. Ask whether Full Payment Submissions are timely, Value Added Tax invoices are retained, and payment records are complete. Red flags include gross inside-IR35 payments, late reporting and records kept only in email.
6. Documentation and audit readiness: Check that assessments, contracts, right-to-work evidence and payment records sit in one system with clear owners and retention rules. Ask whether records are kept for the required periods, including six years where applicable for tax records. Red flags include scattered files, unclear ownership and records assembled only after an enquiry begins.

Common compliance gaps in UK contractor programmes – and how to fix them

The audit framework shows where contractor controls are weak and what needs to be corrected. Across UK contractor programmes, CXCl commonly sees five recurring gaps that create tax, worker-rights and audit risk.

1. Blanket IR35 determinations: Some organisations place every contractor inside IR35 without assessing each engagement. This does not show reasonable care and may not provide a defence during an HMRC review. Fix it by completing an individual assessment, recording the reasoning in the Status Determination Statement and reviewing the decision when working arrangements change.
2. IR35 and employment status are treated as one test: IR35 determines tax treatment, while employment status determines legal rights. Using one assessment for both leaves part of the risk unaddressed. Fix it by using a two-track process for every engagement: one IR35 review and one separate employment status assessment.
3. Agency Workers Regulations service not monitored: Agency workers can cross the 12-week qualifying point through rolling assignments or extensions. Fix it by tracking start dates, breaks and role changes, then triggering an equal-treatment and pay review before the threshold is reached.
4. Right-to-work checks missed for contractors: Directly engaged contractors are often excluded from onboarding checks because they are treated only as suppliers. Fix it by making verification a required onboarding step, retaining the supporting evidence and rechecking time-limited permission before it expires.
5. Payment records kept for too short a period: Missing invoices, Pay As You Earn records, Full Payment Submissions or Value Added Tax records can weaken an HMRC response. Fix it through a documented retention policy, central storage and a named owner, with payment and tax records kept for at least six years where required. This is especially important because HMRC enquiries may reach back up to 20 years in cases of deliberate non-compliance.

How CXC supports compliant contractor management in the UK

The April 2021 off-payroll working changes made UK contractor management more complex for medium and large organisations. Tax status, worker rights, onboarding, payment and record retention now need to operate as one connected process. When these responsibilities are split across teams and suppliers, gaps can remain hidden until an HMRC review or tribunal claim begins.

CXC Global addresses this through its UK Contractor of Record model. It manages IR35 assessments, compliant contracts, Pay As You Earn where required, Agency Workers Regulations monitoring, right-to-work checks and payment administration across the engagement lifecycle. This gives organisations one accountable process instead of separate controls for each contractor or agency.

CXC Comply supports that model by keeping the resulting evidence organised, current and ready for review. Engagement records are maintained systematically rather than gathered only after a problem arises. This improves audit readiness and gives decision-makers a clearer view of compliance across the contractor population.

With more than 30 years of contingent workforce experience across over 100 countries, CXC Global combines deep UK knowledge with an operating model built for international programmes. As HMRC scrutiny and worker-status claims increase, organisations will need stronger controls before they expand their contractor workforce. A structured compliance foundation allows them to scale without carrying unresolved regulatory risk into future engagements.

Frequently Asked Questions

Managing contractors in the UK at scale requires consistent controls across status, contracts, payments and records. CXC Global can help assess your current programme, address compliance gaps and build a clearer operating model for direct and agency engagements. 

Contact CXC Global today to discuss your UK contractor management needs.

Share to:

Wish your contractor management was less… messy?

At CXC, we simplify the way you manage your contingent workforce. From contractors and SOW to EOR/AOR, our flexible solutions handle compliance, payroll, and onboarding, so you can focus on scaling, not red tape.

Speak to our team

Share