Contractor Compliance (IR35)

Important disclaimer: This article is for informational purposes only. It does not constitute legal or tax advice. IR35 rules are complex, and their application depends on the specific facts of each engagement. Consult a qualified UK tax adviser or solicitor before making any compliance decisions.

If you engage UK contractors through intermediaries like personal service companies or limited companies, IR35 is one of the most important compliance areas you need to understand. Getting it wrong can mean backdated tax bills, penalties, and strained contractor relationships. This guide covers what the off-payroll working rules require from you as a business, how status is determined, what the paperwork looks like, and what good risk management actually means in practice.

What IR35 is

IR35 is the informal name for the off-payroll working rules. The legislation was introduced in 2000 to tackle tax avoidance through disguised employment specifically where workers operating through a personal service company (PSC) or their own limited company provide services to a client, but the working relationship resembles employment.

The question IR35 asks is a single, deceptively simple one: if this contractor were engaged directly by the client, without the intermediary in the picture, would they be an employee? If the answer is yes, the engagement is inside IR35 and employment taxes apply. If the answer is no, the engagement is outside IR35 and the contractor handles their own tax affairs.

IR35 assesses employment status for tax purposes only; it does not grant employment rights like holiday pay or sick leave. The rules apply contract-by-contract, meaning some of your engagements with the same contractor could be inside IR35 while others are outside.

The rules exist because working through a PSC historically allowed individuals to pay corporation tax and dividend tax rather than income tax and National Insurance, significantly reducing the tax take compared to direct employment. IR35 was designed to close that gap where the working relationship is substantively the same as employment, regardless of the corporate wrapper around it.

The 2021 reform: who determines IR35 status now

For most of IR35’s history, the contractor’s own PSC was responsible for deciding whether a given engagement fell inside or outside the rules. That changed with two rounds of reform: April 2017 for the public sector, and April 2021 for the private sector.

Since 6 April 2021, the responsibility for making IR35 status determinations has shifted to the end client for medium and large businesses. This is the most consequential change the rules have undergone. It moved the compliance burden from individual contractors to the organisations that engage them, and it shifted the tax liability chain accordingly.

The small business exemption

Not every business bears this burden. If your business qualifies as small under the Companies Act 2006, you are exempt from the reformed off-payroll rules. In that case, the contractor’s PSC remains responsible for self-determining their IR35 status, as under the original rules.

From 6 April 2025, the thresholds for a small company were updated. A business is now classified as small if it meets at least two of the following three criteria:

• Annual turnover not exceeding £15 million (previously £10.2 million)
• Balance sheet total not exceeding £7.5 million (previously £5.1 million)
• No more than 50 employees

These are current figures as confirmed by Keystone Law’s analysis of the Companies Act 2006 changes.

One timing point matters here. IR35 company size is assessed by reference to the prior financial year, not the current one. A business that drops below the new thresholds in its first financial year beginning on or after 6 April 2025 will not feel the practical effect until April 2027 at the earliest, depending on when its financial year starts and when accounts are due to be filed. According to HMRC, approximately 14,000 companies are expected to reclassify as small as a result of the threshold changes, with compliance obligations shifting back to their contractors’ PSCs.

Even if you qualify as a small business, misclassification by contractors in your supply chain can still create disruption and reputational risk. You should still understand the rules.

If your business is medium or large, you determine IR35 status. There is no grey area on this point.

The three IR35 determination factors

When you assess whether an engagement falls inside or outside IR35, three primary factors govern the analysis. These originate in employment law case law, most notably the 1968 ruling in Ready Mixed Concrete (South East) Ltd v Minister of Pensions and National Insurance, and have been refined through decades of tribunal decisions.

Personal service and the right of substitution

The first factor asks whether the contractor is obliged to perform the services personally, or whether there is a genuine right to send a substitute. Personal service is a hallmark of employment. If the client specifically requires this individual, and no one else would be acceptable, that points toward inside IR35.

A genuine right of substitution points in the opposite direction. The substitution right must be real, not cosmetic. If the contract contains a substitution clause but the working reality is that the client would never accept anyone other than the named contractor, the clause carries limited weight. Tribunals look at whether the right is genuinely exercisable in practice, not just whether it appears in the paperwork.

Following HMRC’s April 2025 update to the CEST tool, the definition of a genuine substitution right has been tightened further. To be meaningful, it must be unrestricted and genuinely exercisable, not contingent on the client’s approval in a way that effectively negates it.

Control

The second factor examines how much control the client exercises over the contractor. Control over how, when, and where work is performed is an employment indicator. Control over only the outcome of the work what is delivered rather than how it is delivered points toward genuine contractor status.

A contractor who is directed by a line manager, required to work set hours, and obliged to use the client’s tools and premises is exhibiting employment-like characteristics regardless of what their contract says. A contractor who sets their own schedule, uses their own equipment, and delivers an agreed output on their own terms presents differently.

The degree of control that actually exists in practice is what counts. Contracts that claim no control is exercised, while the working reality tells a different story, will not protect a business in an HMRC investigation.

Mutuality of obligation

The third factor is the most contested in case law. Mutuality of obligation (MOO) asks whether there is an obligation on the client to offer work and an obligation on the contractor to accept it. In a standard employment relationship, those mutual obligations exist. In a genuine contractor arrangement, they do not extend beyond the specific engagement.

The 2024 Supreme Court ruling in Professional Game Match Officials Ltd v HMRC (the PGMOL case) clarified this area significantly. The court confirmed that MOO always exists within an individual engagement because one party agrees to perform work and the other agrees to pay for it that is the basic wage-work bargain. The question for IR35 purposes is whether there is ongoing, wider mutual obligation beyond the specific contract. Where there is no obligation to offer further work and no obligation to accept it once an engagement ends, that supports an outside IR35 position.

MOO remains the factor most likely to be misunderstood or underweighted in a status determination. Do not dismiss it.

Additional factors

Beyond the three primary tests, HMRC and tribunals also consider several secondary factors. These include whether the contractor carries genuine financial risk (investing in their own equipment, being able to profit or make a loss), whether the contractor works exclusively for one client, how integrated the contractor is into the client’s organisation, and whether the client provides the tools and equipment used. None of these is individually determinative, but each forms part of the overall picture.

The Status Determination Statement

When you determine a contractor’s IR35 status, you are required by law to produce a Status Determination Statement (SDS) and provide it to the contractor and to any fee-payer in the contractual chain (typically the staffing agency) before the first payment is made under the engagement.

An SDS must do three things. It must state explicitly whether the engagement is inside or outside IR35. It must give the reasons for that determination, with reference to the factors considered. And it must be produced with reasonable care.

The reasonable care requirement is not a formality. Blanket assessments marking all contractors as inside or outside without individual review fail this standard. If HMRC determines that an SDS was issued carelessly, the determination carries no weight and the liability for unpaid taxes shifts back to the client.

Each new contract requires a fresh SDS. An SDS from a previous engagement does not carry over, even if the contractor is the same and the work is similar. If working arrangements change materially during an engagement, review and, where appropriate, reissue the SDS.

The disagreement process

Contractors have a statutory right to challenge an SDS they believe is incorrect. If a contractor raises a disagreement, you must consider the challenge and respond within 45 days, either maintaining the original determination or issuing a revised SDS. Failing to respond within that window removes your protection and transfers the tax liability to you as the client, regardless of the original determination.

Document every step of this process. If a challenge is raised and you maintain your determination, record the reasons. If you change it, document why.

The CEST tool

HMRC provides the Check Employment Status for Tax (CEST) tool as a means of working through an IR35 assessment. You input details of the engagement and the tool produces a determination: employed, self-employed, or unable to determine.

HMRC’s stated position is that it will stand by a CEST determination provided the information you entered was accurate and consistent with their guidance. That commitment offers a degree of protection.

The limitation is real, however. CEST has attracted substantial criticism since its launch, including from the House of Lords. HMRC updated the tool’s user interface in April 2025, but the underlying employment status logic was not changed. The core framework still does not fully capture the mutuality of obligation analysis as refined by recent case law, including the PGMOL ruling. According to analysis by Bauer and Cottrell, around one in five determinations continues to produce an indeterminate result and HMRC has acknowledged that an indeterminate result provides no protection.

Use CEST as a starting point, not as the final word. Document every input you make so you can demonstrate the accuracy of the information provided. For complex or high-value engagements, use the tool alongside specialist tax advice rather than instead of it.

Tax consequences of an inside IR35 determination

When an engagement is inside IR35, the fee-payer typically the staffing agency in a three-party arrangement, or the client in a direct engagement must deduct income tax and employee National Insurance contributions from the fees paid to the contractor’s PSC before payment is made. Employer’s National Insurance contributions must also be paid to HMRC, along with the Apprenticeship Levy where applicable.

Following the employer’s NIC rate increase in April 2025, the cost of an inside IR35 determination has risen further for fee-payers. Analysis by IT Contracting estimates that the April 2025 changes add over £1,000 to the HMRC liability for a typical inside IR35 engagement at a £500 per day rate.

From the contractor’s side, inside IR35 deductions typically reduce take-home pay by roughly 20 to 30 percent compared to working outside IR35 through a limited company. Factor these cost differences into rate negotiations and project budgets.

The end of double taxation

One longstanding flaw in the system was corrected from 6 April 2024. Previously, when HMRC investigated and found an engagement had been wrongly placed outside IR35, it collected the full underpaid tax from the business without offsetting the tax the contractor had already paid through their PSC. This created genuine double taxation.

From April 2024, HMRC’s offset mechanism applies. Where a business is found to have made an incorrect determination, taxes already paid by the contractor’s limited company are subtracted from the total arrears due. According to analysis by Qdos, this change cuts potential settlement liabilities by around 75 percent, reducing exposure from roughly 50 percent of contract value to approximately 10 percent for typical cases. The reform also applies retrospectively to cases going back to 2017.

Common IR35 mistakes and non-compliance risks

Many enforcement cases arise not from deliberate tax avoidance but from misunderstandings, poor documentation, or inconsistent working practices.

Typical mistakes include blanket assessments, failing to issue a valid SDS before the first payment, or relying on outdated assumptions about small business status. Businesses also frequently produce contracts that document a right of substitution or low control, while day-to-day management treats contractors like employees with fixed hours, mandatory use of internal systems, and integration into staff hierarchies. This mismatch is the single most common finding in HMRC investigations.

Non-compliance exposure includes backdated PAYE, employer NICs, interest, and penalties charged across multiple past tax years if reasonable care was not taken. Avoid schemes that claim to sidestep IR35 or payroll taxes. Stick to transparent, HMRC-compliant arrangements.

IR35 risk management for businesses

Compliance is not a one-off exercise. It needs to be embedded in how your business engages and manages contractors.

Start with a clear internal process for identifying off-payroll workers and triggering a status assessment before engagement begins. Every contractor working through a PSC who would be covered by the rules should go through the process. Skipping it because an engagement seems straightforward is not a defensible position if HMRC investigates.

Document everything. Keep the SDS, the evidence you considered in reaching your determination, the CEST output with the inputs you entered, any correspondence with the contractor about the determination, and any disagreement handling. If working arrangements change during the engagement, document that too and reassess if needed. Centralising your contractor records and keeping exportable transaction summaries in one place saves considerable time when HMRC comes calling; Ruul’s tax-ready document hub is built for exactly this.

Audit existing engagements periodically. A determination that was accurate at the start of a relationship may no longer be correct six months later. Contractors who were initially engaged on a project basis sometimes drift into arrangements that look more like employment over time. Working practices do not stay static, and your assessments should not either.

For larger contractor populations, or where individual engagements are high-value, consider an IR35 compliance audit. This involves a specialist examining your determination process, your SDSs, and the actual working arrangements for a sample of contractors. Identifying gaps before HMRC does is substantially less costly than remedying them afterwards. Having a structured view of your contractor workforce including profiles, project assignments, and document storage also makes audits significantly easier to navigate; Ruul’s contractor management tools are built around exactly that need.

HMRC can investigate back four years in standard cases, six years where it considers carelessness to have occurred, and up to 20 years in cases of deliberate fraud. The documentation you kept at the time of the engagement is your primary defence.

Managing IR35 risk across your supply chain

Multi-party arrangements involving clients, agencies, consultancies, and payroll providers can complicate who is responsible and who is the fee-payer for IR35 purposes.

Identify the true end client by looking at who really controls the work and benefits from services, not just the labels in contracts. Consider whether umbrella companies or agencies in the chain are genuinely providing contracted-out services or simply supplying labour.

Build IR35 clauses into contracts with agencies, covering responsibilities for status determination statements, information sharing, and tax indemnities. Poor documentation or misidentified roles can lead to unexpected tax liabilities, penalties, and strained relationships. HMRC examines actual working arrangements, not just what the contracts say.

Responding to HMRC IR35 enquiries

HMRC has increased IR35 compliance activity in sectors including IT, financial services, and engineering. Have a clear plan before an enquiry arrives.

Typical first steps include information requests about specific contractors, supply chain arrangements, and your overall IR35 internal processes. Do not ignore or delay responses, but do not provide rushed or incomplete information. Consider professional advice before replying.

Well-documented SDS decisions, CEST outputs, and training records help demonstrate reasonable care and can reduce potential penalties even if HMRC disagrees with some status decisions. Feed lessons learned from any enquiry back into your IR35 policy, training, and contract templates.

Non-UK businesses engaging UK contractors

If your business is based outside the UK, the off-payroll working rules may still apply to you. A loophole that existed at the time of the 2021 reform which exempted wholly overseas clients with no UK presence has since been closed. Where a non-UK business has any UK connection, whether through a UK branch, office, or otherwise, and where the contractor provides services in the UK, the rules can apply.

A UK connection broadly means having a permanent establishment, registered UK entity, or other presence that HMRC considers sufficient for tax purposes. Map out where work is physically carried out, which entity benefits, and whether local staff or a UK branch is involved.

The analysis for non-UK businesses is more complex than for UK-based clients, particularly around what constitutes a sufficient UK connection and how the rules interact with local employment law in the contractor’s jurisdiction. Qualified UK tax counsel is strongly recommended before scaling up UK contractor engagements.

The Agent of Record model and IR35

Some businesses engage UK contractors through an Agent of Record (AOR). In Ruul’s AOR model, Ruul contracts directly with the contractor rather than the business engaging the contractor as the end client. This structural change shifts where the IR35 analysis sits.

When Ruul contracts with the contractor, the IR35 determination question applies to the Ruul-contractor relationship, not to the relationship between the engaging business and the contractor directly. Businesses can use Ruul to work with UK and non-UK contractors without requiring the worker to set up their own limited company, which can be helpful where IR35 or local company law makes traditional PSC models less attractive.

This does not mean IR35 becomes irrelevant for businesses using an AOR model. It means the analysis is different, and the specific structural implications require professional guidance. If you are considering Ruul’s AOR model for UK contractor engagements, consult qualified UK tax counsel on the IR35 implications before the engagement begins. The AOR model also integrates with Ruul’s contractor onboarding workflow, covering KYC/AML verification, contract collection, and compliance checks before the first payment is made.

How IR35 interacts with contractor invoicing and payments

Once you have determined employment status, align your payment processes accordingly.

For inside IR35 roles, the deemed employer operates PAYE, accounts for tax and National Insurance, and provides payslips. For outside IR35 engagements, contractors invoice through their limited company and the client pays the gross amount without operating PAYE.

Platforms like Ruul can help businesses manage outside IR35 contractor payments globally, including automated invoicing, payment tracking, recurring billing, and fast payouts that integrate with your compliance framework. If you manage multiple contractors and need a clear view of your payment obligations across the board, Ruul’s contractor payments tooling handles compliant invoicing and multi-currency payouts within a single workflow.

Record keeping and tax readiness

Strong record keeping is often the difference between a manageable HMRC enquiry and a costly dispute.

Keep signed contracts, statements of work, SDS documents, CEST outputs with all inputs recorded, notes on verbal agreements about control or substitution, and all communication trails. Maintain clear records of payments, deductions, and invoices. Use systems that allow easy export of transaction histories for tax and audit purposes. Contractors should maintain records for at least six years; businesses should apply the same standard and consider extended retention for high-value or strategically significant engagements.

Platforms like Ruul can help centralise invoicing and payment data across multiple UK and international contractors, supporting tax readiness and simplifying reporting.

Conclusion

IR35 compliance requires accurate determination, documented evidence, and working practices that match contractual terms. Responsibilities differ between public sector, private sector, and small business clients, and you must monitor threshold changes and HMRC guidance over time.

For businesses engaging UK contractors internationally, Ruul’s AOR model changes the structural relationship but does not remove IR35 considerations. Consult qualified UK tax counsel on the specific implications. You can invoice without a company entity through Ruul, but always verify how this structure interacts with your IR35 obligations.

FAQs

How often should you review IR35 status for ongoing contractor engagements?

Review at key triggers: role changes, contract renewals, significant shifts in working patterns, or structural changes in your business. At minimum, review annually for long-running projects. A contract that started outside IR35 can drift inside if control, mutuality of obligation, or integration increases over time.

Does IR35 apply if the contractor is based outside the UK?

IR35 primarily focuses on work with a UK tax connection, which usually involves the contractor being tax resident in the UK or services being performed in the UK for a UK-connected client. If the contractor is overseas and work is performed wholly outside the UK, local employment and tax rules may be more relevant. Seek specialist cross-border advice.

Can you rely on an agency’s IR35 decision?

While agencies may assist with assessments, HMRC looks at who is the client and who should have taken reasonable care. End clients should not outsource responsibility entirely. Document how you collaborate with agencies on status determinations, including sharing working practice information and reviewing the agency’s reasoning.

What happens if a contractor disagrees with your Status Determination Statement?

Contractors can raise a formal disagreement in writing. You must consider their representations, review the facts, and respond within the statutory time frame of 45 days, either upholding or changing your decision with a recorded explanation.

How long should you keep IR35-related records?

Keep IR35 documentation including contracts, SDS decisions, CEST outputs, and correspondence for at least six years in line with standard HMRC record-keeping requirements. Consider extended retention for high-value or strategically important engagements to support any potential future enquiry.