Services

Why CXC

Resources

Connect

IR35 Compliance for Medium and Large Businesses:

How to Avoid Fines and Keep Your Organisation Out of HMRC's Crosshairs

IR35 Compliance is no longer optional, and HMRC is actively targeting medium and large organisations. New rules came into force in April 2026 – is your business ready?

TRUSTED BY

What Changed in April 2026 - Act Now

Two significant changes came into force on 6 April 2026 that every medium and large organisation engaging contractors needs to be aware of:

Small company threshold increase:

The turnover and balance sheet thresholds used to determine small company status increased to £15m and £7.5m respectively, reclassifying approximately 14,000 companies.

If your organisation has moved from medium to small, the responsibility for IR35 status determination reverts to the contractor’s PSC – but you still need to confirm your prior year figures before assuming exemption applies, as size is assessed by reference to the previous financial year.

Umbrella company PAYE rules:

Agencies that supply workers through umbrella companies are now responsible for deducting PAYE directly, rather than paying the umbrella company gross.

End users are now jointly and severally liable if an umbrella provider fails to account for PAYE and NICs correctly. If you engage workers through umbrella companies, your due diligence obligations have materially increased.

Not sure how these changes affect your business?

IR35 Is Here to Stay

The landscape of IR35 has changed, and it’s not going away. Although not officially stated, HMRC appears to be focusing on public sector organisations. Past cases show that even companies with established procedures have faced penalties due to inconsistent application of IR35 rules. This highlights the need for not just having robust processes, but ensuring they are properly enforced to avoid fines and compliance issues.

Is HMRC Making an Example?

If you’re among the FTSE 250 companies still lacking a robust compliance strategy, you could be next in line. HMRC seems to be set on making an example out of big names in the industry. Don’t let your company become a cautionary tale. Being under investigation can damage your reputation, disrupt your operations, and lead to significant financial penalties.

CXC Comply is here to help you navigate these challenges and stay ahead of the curve.

The Consequences of Getting IR35 Wrong

HMRC has begun sending compliance check letters across industries, probing the processes companies use to assess employment status. If they find gaps, they won’t hesitate to launch full investigations. Make no mistake—this is no longer a drill.

The financial and operational stakes are sky-high.

The Financial Penalties: What’s at Risk?

If HMRC concludes that your organisation has made incorrect IR35 determinations, the financial fallout can be devastating. Not only will you be liable for 100% of the unpaid taxes, National Insurance Contributions, and Apprenticeship Levy, but you’ll also face additional fines depending on the severity of the error:

30% of unpaid tax if HMRC deems you were careless, but unaware.

70% of unpaid tax if you knew but failed to act.

100% of unpaid tax if it’s found that you deliberately tried to conceal the issue.

Example: For instance, if a contractor earns a day rate of £500, the End-Hirer could be responsible for unpaid tax and national insurance contributions, estimated at £24,420. Additionally, penalties ranging from £7,326 to £24,420 may be imposed, depending on the severity determined by HMRC following an investigation. This means the total estimated liability could range from £31,746 to £48,840 for a single inaccurate determination per year. This figure excludes potential interest and late filing fees, which may also be applied.

The Non-Financial Risks: More Than Just Money

The costs go beyond the financial. Missteps with IR35 can tarnish your reputation and have lasting repercussions:

Reputational Damage: HMRC can publicly name companies that fail to comply, exposing your brand to negative press.

Contractor Relationships: Contractors, agencies, and other partners may avoid working with you, seeing your company as high-risk and opting for competitors instead.

Competitive Disadvantage: A poor track record on compliance can exclude you from government contracts and preferred supplier lists, putting you at a distinct disadvantage in your industry.

Contractual Breaches: Non-compliance may even breach existing contracts, opening you up to legal claims and liabilities.

Public Sector Nightmares: A Glimpse of What’s Coming?

HMRC is already hitting the public sector with massive fines, sending a clear message: Compliance is critical for all entities – and you could be next. The following cases highlight the seriousness of non-compliance, and signal an era of increased scrutiny across sectors.

£87.9 Million – Department of Work and Pensions (DWP):

Incorrect assessments using HMRC’s CEST tool led to a nearly £88 million fine.

£33.5 Million – The Home Office:

Misclassification between 2017 and 2021 resulted in a £29.5 million fine and an additional £4 million penalty.

£4.3 Million – NHS:

Misuse of the CEST tool and incorrect classification resulted in a £4.3 million penalty.

£86.5 million – Defra (Department for Environment, Food and Rural Affairs)

Paid HMRC £86.5 million in back taxes in 2022 for off-payroll errors.

£6.2million – HS2 (High Speed Two):

Paid HMRC £6.2million for mismanaging IR35 off-payroll rules.

£12.5million – The Ministry of Justice:

Paid £12.5 million for “incorrect” IR35 determinations.

£19 Million – Natural Resources Wales (NRW)

A £19 million tax settlement was paid following HMRC’s investigation into NRW’s use of specialist contractors.

Next case on the chopping block...

The next HMRC crackdown is just around the corner – prepare or risk the spotlight.

Will You Be the Next Target for HMRC?

Picture this: You’re a public company, relying on specialist contractors to meet critical project demands without committing to full-time hires. It’s efficient, flexible – and it keeps costs down.

Until HMRC steps in, raising questions about off-payroll compliance and IR35. Suddenly, you’re looking at a massive tax bill, interest, and potential penalties. Investors are wary, and stakeholders are questioning your compliance processes. With an investigation underway, reputational risk rises, and now you’re scrambling to assure the board this won’t turn into a financial and operational setback. Could you be next on HMRC’s list?

The Message is Clear: Compliance is critical for all entities – and you could be next.

HMRC’s actions show they mean business, and businesses need to act now to avoid falling into the same traps. IR35 compliance isn’t just a checkbox – it’s a necessity to protect your organisation from financial ruin and reputational harm.

CXC Comply is your partner in this volatile, uncertain environment, helping you stay compliant and prepared for whatever comes next. Remember, relying on CEST won’t shield you from HMRC.

Tips for Complying With IR35 Rules

To safeguard your organisation’s hiring practices for UK contractors under IR35 regulations and prepare effectively for any potential audits, it is crucial to implement the following measures:

Know whether IR35 applies to your business

Correctly classify all UK contractors

Don't rely only on CEST - Mitigate your risk by working with an experienced compliance partner — like CXC.

Stay on top of future legislative changes - including April 2026 updates: The IR35 landscape changed materially in April 2026. New umbrella company PAYE rules shifted deduction responsibility to agencies, and updated small company thresholds reclassified thousands of businesses. Compliance processes that were fit for purpose in 2024 may need revisiting now.

Mitigate Risk with CXC Comply

CXC Comply offers a comprehensive solution that includes worker classification, risk assessment, and ongoing compliance management. Our team of experts will work closely with you to establish processes that demonstrate your organisation’s proactive approach to IR35 compliance. While no system can prevent HMRC scrutiny, having clear evidence of due diligence is crucial in defending against claims of non-compliance or negligence.

With CXC Comply, you gain access to industry-leading expertise and technology that mitigates your IR35 risk.

CXC Comply:

Trusted by Global Leaders, Proven by Results

CXC has 30+ years history of mitigating co-employment, misclassification, and financial risk for medium and large enterprises. We have a world-class compliance platform that has been deployed by the world’s Number 1 technology company, the world’s Number 1 med-tech company, the UK’s largest privately held software company and Israel largest IT Software company.

We do it better, faster and and have the track record to prove it.

years of operation

Services to

100+

countries

Programs from

30 to 3,000

workers

98%

client retention rate

Saving costs from

6-14%

99%

payroll accuracy

FAQ's

What is IR35 compliance process for a medium or large organisation?

The IR35 compliance process starts with identifying engagements supplied through a personal service company or other intermediary. The client then assesses employment status, records its reasons, shares the decision with the relevant parties and makes sure the correct tax treatment is applied.

Confirm scope and company size. Public authorities are within scope. A private or voluntary sector company is generally small if it meets at least two of the current limits: turnover of no more than £15 million, a balance sheet total of no more than £7.5 million and no more than 50 employees. Timing and group rules also apply.
Assess each engagement. Review the contract and the actual working arrangements for that assignment.
Use CEST where helpful. Enter accurate information and keep the result with the assessment record.
Issue the SDS. Give the worker and the organisation the client contracts with the determination and its reasons before payment for the worker’s services.
Track the SDS. Make sure it reaches the correct party in the labour supply chain.
Apply the decision. When the rules apply, the deemed employer must deduct PAYE Income Tax and employee National Insurance, and pay employer National Insurance and the Apprenticeship Levy where relevant.

Reasonable care means showing how the decision was reached, who checked it and which contract and working-practice facts were considered.

What must be included in a Status Determination Statement?

A Status Determination Statement, or SDS, records the client’s IR35 decision for a specific engagement and explains the reasons behind it. The client must give it to the worker and the organisation it contracts with. It should reach the supply chain before payment for the worker’s services.

The legal minimum is the determination and the reasons for it. A useful SDS record should also include:

The worker, client, intermediary and engagement details.
Whether the off-payroll working rules apply.
The contract terms that influenced the decision.
The working arrangements considered, including control, personal service and financial risk.
Supporting evidence, such as the completed questionnaire and any CEST output.
The decision date and the name or role of the reviewer.
Instructions for raising a disagreement.

Pepare a new SDS when a new engagement or a material change requires a fresh decision. Keep each version, its supporting evidence and the date it took effect. If the worker or deemed employer challenges the decision, the client must respond within 45 days. If it misses that deadline, responsibility for PAYE Income Tax and National Insurance moves to the client.

How often should IR35 status determinations be reviewed?

IR35 determinations should be reviewed when a specific change could affect the contractor’s status. This includes contract renewals, changes to the work, increased client control, or changes to substitution rights.

Complete a new review when there is a:

Change in the scope, deliverables or responsibilities.
Change in the client’s supervision, direction or control.
Change to the right of substitution or how it works in reality.
Contract renewal or extension.
Change in working location, equipment or tools provided.

The review should compare the current arrangements with the facts used for the original decision. If the status changes, issue a new SDS, state the effective date and send it to the relevant parties in the supply chain.

HMRC recommends regular reviews, but it does not prescribe a 12-month rule. An annual check can be a sensible internal control for long assignments, with more frequent reviews for higher-risk roles. Each engagement still needs its own decision. Applying one result to every contractor in a role without checking individual facts may show a lack of reasonable care.

What does HMRC's "reasonable care" standard require in practice?

Reasonable care means making an informed IR35 decision using the contract and the real working arrangements, then keeping enough evidence to explain it. The work should be completed by people who understand employment status and know when to ask for further review.

HMRC’s Guidelines for Compliance 4 (GfC4) supports the following controls:

Train hiring managers and anyone involved in status decisions.
Use a documented assessment process across the organization.
Collect working-practice information from people who know the engagement.
Keep the SDS, reasons, questionnaires and any CEST output together.
Refer finely balanced or “unable to determine” cases for further review.
Operate a client-led disagreement process with a 45-day response deadline.
Track SDS distribution through the labour supply chain.
Audit the process and sample decisions at intervals suited to the workforce.

Using CEST or an external adviser can support the process, but the client remains accountable for applying the rules correctly. If the client does not take reasonable care, it remains responsible for PAYE until a valid SDS is issued. HMRC may also charge interest and behaviour-based penalties when tax returns contain inaccuracies. Penalties can reach 100% of the potential lost revenue in deliberate and concealed cases.

What are the financial penalties for IR35 non-compliance?

IR35 non-compliance can lead to unpaid PAYE Income Tax and National Insurance, employer National Insurance, the Apprenticeship Levy where applicable, interest and penalties. Penalties range from zero to 100% of the potential lost revenue, based on the organisation’s behaviour and how the error is disclosed.

Cost or penalty	Trigger	Who may be liable
PAYE and employee National Insurance	An inside-IR35 payment was made without the required deductions	The deemed employer, or the client while liability remains with it
Employer National Insurance and Apprenticeship Levy	The engagement should have been processed through payroll	The deemed employer
Interest	Tax and National Insurance were paid late	The party liable for the underpayment
Inaccuracy penalty	A return was wrong because of careless or deliberate behaviour	The organisation that submitted the inaccurate return
Umbrella PAYE liability from 6 April 2026	An umbrella fails to account correctly for PAYE	The umbrella and the agency nearest the client, or the client when it contracts directly with the umbrella

There is no inaccuracy penalty where the organisation took reasonable care. The maximum rises to 100% for a deliberate and concealed error. HMRC’s GfC4 guidance shows the records and controls it expects organisations to produce during a compliance check.

What IR35 risks arise from engaging workers through umbrella companies?

Workers employed and paid through an umbrella company are usually outside the off-payroll working rules. However, new PAYE rules from 6 April 2026 give agencies and some end clients direct exposure when an umbrella fails to account for PAYE correctly.

The main risks are:

Unpaid PAYE and National Insurance. The umbrella and the agency with the end-client contract are jointly and severally liable. The end client carries that liability when it contracts directly with the umbrella.
Tax avoidance or fraud. Mini-umbrella arrangements, disguised remuneration and unexplained deductions can create financial and reputational risk.
Weak supply chain checks. Missing contracts, unclear payment flows or poor evidence of PAYE operation can hide problems.
Incorrect worker route. If the worker is supplying services through a personal service company rather than being employed by the umbrella, the off-payroll working rules may apply and the client may need to issue an SDS.

The agency or end client should verify the chain, confirm how workers are employed and paid, review payslips and payment information where appropriate, and keep evidence of its checks. HMRC does not publish or approve a list of compliant umbrella companies. Warranties and indemnities can support the arrangement, but they do not prevent HMRC from recovering unpaid amounts from a jointly liable party.

What are the most common IR35 risk management failures in large organisations?

The most common failure is using blanket determinations instead of reviewing each engagement. This can leave the organisation unable to show reasonable care, especially when contractors with the same title have different contracts or working arrangements.

Blanket determinations. One result is applied across a department without checking each engagement, weakening the SDS and the evidence behind it.
Relying on the contract alone. HMRC considers the real arrangement. A substitution clause carries little weight when substitution is restricted or would not work in practice.
Failing to share the SDS. The client remains responsible for PAYE until the worker and the organisation it contracts with receive the determination and reasons.
Missing the disagreement deadline. If the client does not respond within 45 days, PAYE responsibility moves to the client.
Leaving assessments unchanged. Renewals, new duties or changes in control can make an earlier decision unreliable.
Weak umbrella checks. From 6 April 2026, an agency can be jointly liable for an umbrella’s unpaid PAYE. The end client is jointly liable when it contracts directly with the umbrella.

HMRC’s GfC4 guidance is a useful reference for checking training, records, decision-making, SDS distribution, disagreements and internal audits. Organisations should compare their process with that guidance and fix gaps before the next payment or engagement review.

How should organisations manage IR35 risk across a large contractor population?

Managing IR35 across a large contractor population requires one process that records each engagement separately and gives teams a consistent way to assess, approve and review decisions. Central oversight helps the organisation track deadlines and evidence without treating similar job titles as identical cases.

The process should include:

A central contractor register. Record the worker, intermediary, engagement dates, supply chain, status decision, SDS date, payment route and next review date.
Trained assessors. Use an internal team or specialist provider with a documented method. Hiring managers should supply the working-practice facts because they know how the engagement operates.
Supply chain checks. Confirm which party pays the worker, whether PAYE is being operated and whether an umbrella or agency sits in the chain. Record follow-up checks and any exceptions.
A disagreement process. Give each case an owner, record the contractor’s reasons and respond within 45 days with either a new SDS or reasons for keeping the original decision.
Internal audits. Sample assessments, payment records and SDS distribution. Use HMRC’s GfC4 guidance to check whether the process is being followed.

Dedicated resources or a managed service can help when assessment and tracking volumes exceed the capacity of HR, Procurement or Tax teams. The organisation still needs governance and access to the evidence.

Audit readiness provides a useful check. The organisation should be able to produce each SDS, the facts behind the decision, proof of distribution, payment treatment and the record of any disagreement without rebuilding the file after HMRC asks for it.

What is the IR35 contractor onboarding process for a medium or large organisation?

IR35 contractor onboarding should establish the worker’s engagement route, assess status and confirm the payment treatment before work begins. The SDS must reach the worker and the organisation the client contracts with before payment if the client wants PAYE responsibility to pass to the intended deemed employer.

Verify the engagement route. Confirm the worker’s intermediary, Companies House details and the parties in the supply chain. Check insurance and VAT registration where relevant. Make sure the legal employer completes right-to-work checks where required.
Complete the IR35 assessment. Use the contract and information from the hiring manager about how the work will operate. CEST can support the decision when the answers are accurate.
Issue the SDS. Give the written determination and reasons to the worker and the organisation the client contracts with. Record when each party received it.
Finalise the contract. Make sure the terms agree with the assessed working arrangements, including deliverables, control, substitution, equipment, location and financial risk.
Confirm payment arrangements. State the rate, invoicing process and tax treatment in writing. If the rules apply, confirm which party will operate PAYE from the first payment.

An inside-IR35 contractor may continue to work through a personal service company with deemed employment deductions, or the supply chain may offer agency PAYE or umbrella employment. If a valid SDS has not been passed to the relevant parties, the client remains responsible for PAYE, employee and employer National Insurance and any applicable Apprenticeship Levy.

What documents must be collected during IR35 contractor onbaording?

IR35 contractor onboarding records should cover two areas: documents that confirm the engagement and documents that support the status decision. The records collected should suit the engagement route and the organisation’s requirements.

Engagement and business documents

Signed contract and engagement letter or statement of work
Personal service company incorporation and Companies House details
VAT registration details, when applicable
Professional indemnity or public liability insurance required for the work
Right-to-work evidence held by the legal employer where a check is required

IR35 evidence documents

Working-practice information completed or confirmed by the hiring manager
The CEST output or other assessment record
The SDS and proof that it was sent to the worker and relevant supply-chain party
Written representations and responses from any disagreement
Scope, deliverables, duration and changes made during the engagement

Keep the records complete, dated and linked to the relevant engagement. HMRC requires detailed records but does not set one specific retention period for every IR35 document. Many organisations use six years as a practical tax-record period, subject to their legal advice and other obligations. Under UK GDPR, personal data should be kept only for as long as the organisation can justify and protected through an appropriate retention policy.

How should inside IR35 determinations be communicated to contractors during onboarding?

An inside-IR35 decision must be communicated through a written SDS that states the determination and the reasons for it. The worker and the organisation the client contracts with must receive it. A conversation before or alongside the SDS can help the contractor understand the decision and payment arrangements.

The communication should cover:

The decision and reasons. Explain which contract terms and working arrangements led to the inside-IR35 result. Avoid sending a CEST result without context.
The disagreement process. Tell the contractor where to send their representations and that the client must respond within 45 days. The response must either confirm the decision with reasons or issue a new SDS.
The payment route. Explain who will operate PAYE and how the agreed rate will be processed. Options may include agency PAYE, umbrella employment or continued use of the contractor’s personal service company with deemed employment deductions.

The client should also explain when the decision takes effect and provide a contact for questions. Rates and payment options should be confirmed before the contractor accepts the final terms where possible. This gives the contractor time to understand the effect on take-home pay and decide whether to continue. It can also prevent avoidable disputes or onboarding delays caused by an unexplained SDS.

How can a managed IR35 compliance service reduce risk and administrative burden?

A managed IR35 compliance service can handle the assessment workflow, SDS administration, supply chain checks and recordkeeping across a large contractor population. This gives internal teams a consistent process and an organised evidence trail, while the client keeps responsibility for oversight and for making sure the rules are applied correctly.

A managed service can support:

Individual assessments. Each personal service company engagement is reviewed using its contract and working arrangements.
SDS administration. Determinations are drafted, issued, recorded and passed to the relevant parties.
Supply chain checks. Agency and umbrella arrangements are reviewed, with evidence and follow-up actions recorded.
Disagreement management. Representations are logged, reviewed and answered within the 45-day deadline.
Audit-ready records. Assessments, SDS versions, evidence, payment routes and reviews are kept in one compliance record.

This support can be useful when contractor volumes create more work than HR, Procurement, Tax or Legal teams can absorb alongside their usual responsibilities. Some organisations keep the full process in-house. Others use an external provider for all engagements or for finely balanced cases, internal audits and supply chain reviews.

The client remains accountable even when work is outsourced, so it should understand the provider’s method, review results and keep access to the records. CXC Comply supports worker classification, SDS management, supply chain reviews and ongoing IR35 administration for organisations that want an independent process without building a dedicated internal function.

Compliance Success Story: Contractor Classification For a Global Tech Giant

This well-know global technology company grappled with the task of precisely categorising over 150 Independent Contractors worldwide to comply with UK legislation, necessitatingaccurate classification within its vast network of directly engaged contract workers.

The collaboration between CXC and the company resulted in the successful implementation and launch of the IR35 module within a 12-week sprint.

The Challenge

This technology company faced a significant challenge concerning its extensive network of contract workers situated around the globe, a majority of whom were directly engaged and identified by the company.

Within the scope of UK legislation, the company urgently needed to accurately classify all Independent Contractors for IR35 compliance. This entailed correctly determining the employment status of over 150 Independent Contractors.

The Solution

To address this challenge, CXC assembled a dedicated team for project delivery and IT development. Their task was to construct and configure a dedicated IR35 classification module tailored for the company’s needs. This module was seamlessly integrated into CXC’s Independent Contractor Classification Platform – CXC Comply.

The collaboration between CXC and the company resulted in the successful implementation and launch of the IR35 module within a 12-week sprint. This endeavour involved close coordination with stakeholders from various departments within the company, including Finance, Legal, Technology, and Operations. In February 2021, the platform went live, with CXC’s Support and Account Team Members equipped with company-approved tools and equipment.

To ensure the successful uptake of the new system, CXC devised a comprehensive plan encompassing communication, training, and escalation procedures for all relevant stakeholders within the company. This was further bolstered by regular training sessions conducted by CXC on their platform, which facilitated a smooth transition for company personnel.

The Outcome

CXC’s solution empowered the technology company with a centralised overview of their contract workforce, ensuring accurate classification. This, in turn, mitigated potential risks such as penalties, fines and legal disputes.

Starting with 150 workers to classify, the project grew to, and resulted in, the accurate classification of over 250 UK workers for IR35 purposes within the company.

Through this collaboration, a strong and productive relationship was cultivated between CXC and the company. This rapport paved the way for the expansion of the program to an additional 18 countries globally, including in the regions of Europe, The Middle East, Africa, Asia, and Latin America.

The success of the program hinged on the precise classification of workers. To facilitate this, CXC worked closely with the company’s Employment Tax Team, to develop bespoke independent contractor classification frameworks for each respective country and region that were in scope of the service. The frameworks included a comprehensive list of questions which had been reviewed, weighted, and signed off by both the company’s Employment Tax Team and Legal Team. To support the classification assessments, CXC also conducted a compliance vetting process, which required the independent contractor to provide evidence of their right to work within the stated country and provide respective company documents to support their stated engagement type. With both processes running simultaneously, the client was able to effectively engage independent contractors, whilst mitigating the associated risks. These tests played a crucial role in identifying any instances of misclassified employees.
Since this engagement, the IR35 landscape has continued to evolve. The April 2026 changes to umbrella company PAYE rules and small company thresholds have added new layers of complexity for organisations managing contractor populations at scale. CXC Comply has been updated to reflect these changes, ensuring clients remain compliant as the regulatory environment shifts.

IR35 Classification the Easy Way

We know keeping up with compliance requirements can be tricky.

That’s why we’ve created a digital platform that checks three of the most important compliance boxes when it comes to hiring contractors. We call it CXC Comply.

CXC is here to help you navigate these urgent changes with confidence and precision. Secure your business against potential penalties – Book a FREE consultation now!