IR35 Off-Payroll Rules: The Complete Guide for Scale-Ups with UK Contractors

If your company works with contractors based in the United Kingdom — whether or not you have a UK legal entity — IR35 is very likely your problem, not just theirs. IR35 is a UK tax rule originally introduced in 2000 to catch what HMRC calls 'disguised employment': workers who operate, in substance, as employees but bill through a Personal Service Company (PSC) to reduce their tax burden and avoid employer National Insurance Contributions. Since April 2021, the responsibility for determining whether a contractor engagement falls 'inside' or 'outside' IR35 has shifted from the contractor to the client company — including companies headquartered outside the UK.

Before the April 2021 reform, the determination burden sat with the contractor's own PSC. The reform — formally the extension of the off-payroll working rules under Chapter 10, ITEPA 2003 — moved that responsibility to medium and large private-sector clients. 'Medium and large' is defined by simple thresholds (turnover, balance sheet, employee count), which means most venture-backed scale-ups past Series A are squarely in scope the moment they engage a UK-based contractor. If your company determines a contractor is 'inside IR35' incorrectly — or fails to make a determination at all — you become liable for the PAYE income tax and employer National Insurance Contributions that should have been withheld, potentially backdated to the start of the engagement.

HMRC's official methodology for determination is the CEST tool (Check Employment Status for Tax), which evaluates three primary factors. First, control: does the client dictate how, when, and where the work is performed, or does the contractor have genuine autonomy over their working methods? Second, substitution: can the contractor send a substitute to perform the work, or is personal service required? A genuine, unfettered right of substitution is one of the strongest indicators of self-employment. Third, mutuality of obligation: is the client obligated to offer ongoing work, and is the contractor obligated to accept it? An engagement that is genuinely project-based, with no expectation of continued work beyond the current statement of work, points away from employment status.

Real HMRC investigations since 2021 show a consistent pattern: technology companies that scaled their contractor base quickly, without formalizing a determination process for each engagement, are disproportionately targeted. HMRC has specifically increased enforcement in sectors with high contractor density — software development, data engineering, and cybersecurity consulting — precisely the profile of most SaaS scale-ups hiring UK-based technical talent. Several publicly reported cases have resulted in six- and seven-figure settlements for companies that either never ran a CEST determination or ran one but failed to retain evidence of 'reasonable care' in reaching the conclusion — a separate and independently punishable failure under the legislation.

This is the detail most finance teams miss: even a correct IR35 determination doesn't protect the company if it can't demonstrate that the determination was made with 'reasonable care.' HMRC has successfully challenged determinations that were technically accurate but undocumented, treating the absence of a documented process as evidence of negligence. This means the compliance obligation isn't just about getting the right answer — it's about being able to prove, with a timestamped audit trail, how that answer was reached for every single contractor engagement.

For a scale-up managing a dozen or more UK contractor relationships simultaneously, doing this manually — a CEST run per engagement, stored in a shared drive, revisited only when someone remembers to — simply doesn't hold up under scrutiny. The engagements that get renewed quietly without a fresh determination are exactly the ones that accumulate the most retroactive exposure, because nobody revisits the classification as the working relationship evolves and starts looking more like employment over time.

The practical fix is to treat IR35 determination as a continuous compliance process rather than a one-time checkbox: run and document a CEST-equivalent assessment before every UK contractor engagement starts, re-run it at every significant contract renewal, and centralize the documentation so it's retrievable in minutes rather than reconstructed under pressure during an HMRC enquiry. Companies that automate this — generating both the risk score and the defensible paper trail — turn IR35 from a recurring liability into a routine, low-friction part of onboarding every UK contractor.