A recruitment agency supplies you with two contractors. The agency pays an umbrella company, and the umbrella company issues payslips showing income tax and National Insurance deducted every week. Then it never hands that money to HMRC. Eighteen months later, HMRC works out what's missing and sends the bill to the agency. If there's no UK agency in the chain, it sends the bill to you.
That stopped being a hypothetical on 6 April 2026.
TL;DR: From 6 April 2026, recruitment agencies (and in some cases end clients) are jointly and severally liable for PAYE and National Insurance an umbrella company fails to pay HMRC. There's no reasonable care defence and no right of appeal. Due diligence won't discharge the liability, but it's still the only way to reduce the exposure.
What Changed for Umbrella Companies on 6 April 2026?
The umbrella company still has the primary duty to operate PAYE. What changed is that it's no longer the only party HMRC can pursue. Under new provisions inserted into the Income Tax (Earnings and Pensions) Act 2003, a "relevant party" further up the labour supply chain is jointly and severally liable for any PAYE shortfall.
Joint and several liability means HMRC doesn't have to chase the umbrella company first, or at all. It can go straight to the relevant party for the full unpaid amount and leave that party to recover from the umbrella, which by then has usually been dissolved.
The rules apply to payments made to umbrella company workers on or after 6 April 2026 (HMRC policy paper, 2026). HMRC estimates around 30,000 agencies and 400 umbrella companies fall within scope.
Who Actually Picks Up the Bill?
The default relevant party is the recruitment agency that contracts directly with the end client. If you're a business hiring through a single UK agency, the liability sits with that agency, not with you.
The end client becomes the relevant party in three situations: where it contracts directly with the umbrella company, where it contracts with an agency that isn't UK resident, and where it contracts with an agency connected to the umbrella company. Where neither the end client nor the nearest agency is UK resident, liability falls on the UK resident agency closest to the end client in the chain.
In our experience, the businesses most exposed are the ones that believe they have no umbrella exposure at all, because they've only ever signed a contract with a single agency and never asked what happens below that line. Offshore intermediaries and connected-party structures are exactly where the risk concentrates.
Why Won't Due Diligence Protect You?
This is the part that catches people out, so it's worth being blunt about it. There is no reasonable care defence, no reasonable excuse defence, and no right of appeal against the liability. Being given fraudulent information by the umbrella company doesn't discharge it either.
That's a deliberate departure from the off-payroll working rules, where a client who takes reasonable care in reaching a status determination can shift responsibility down the chain. Here, the liability is absolute once the conditions are met.
So why bother with due diligence? Because it changes your commercial position rather than your legal one. Good checks let you spot a failing umbrella before the arrears build, exit the arrangement, and pursue a contractual indemnity against a supplier that still has assets. Weak checks leave you finding out when the HMRC determination lands, by which point the umbrella has usually gone.
How Big Is the Problem HMRC Is Chasing?
Large enough to justify absolute liability, on the government's own numbers. HMRC analysis found umbrella companies were used to engage at least 700,000 workers in 2022 to 2023, and that at least 275,000 of those workers were engaged at some point by an umbrella that failed to meet its tax obligations (HMRC, 2026).
HMRC data also shows £500 million was lost to disguised remuneration avoidance schemes in 2022 to 2023, almost all of it facilitated through umbrella companies.
The Exchequer expects to recover £715 million in 2026 to 2027 from the new rules, falling in later years as behaviour changes. Set against that, HMRC puts the ongoing compliance cost across all affected businesses at £21.7 million a year, which tells you how much checking the government expects agencies and clients to be doing.
What Should You Check Before the Next Payroll Run?
Start by working out whether you have umbrella workers at all, because plenty of businesses do without knowing. Ask each agency in writing whether any supplied worker is engaged through an umbrella or other intermediary, and get the umbrella's name and company number.
HMRC frames supply chain assurance as a cycle of check, act and review rather than a one-off exercise (HMRC guidance, 2026). In practice:
- Map the full chain rather than your immediate supplier alone, identifying every intermediary between you and the worker
- Get evidence that PAYE is reaching HMRC rather than simply appearing on a payslip, such as RTI submission confirmations
- Screen each umbrella against HMRC's published list of named avoidance schemes and promoters, while remembering HMRC states absence from that list is not approval
- Add audit rights, information-sharing obligations and termination clauses to agency contracts at the next renewal
What we see most often is a business with strong onboarding checks and no ongoing monitoring. The umbrella that passed vetting in March is not necessarily the umbrella paying HMRC in November.
The Payslip Warning Signs HMRC Published in August
On 25 August 2026 HMRC published guidance for agency workers, contractors and anyone paid through an umbrella or payroll company on how to spot payslip fraud (HMRC, 2026). It defines the fraud simply: a payslip or Construction Industry Scheme deduction statement showing deductions that were never paid over to HMRC.
The warning signs HMRC lists are worth circulating to anyone who manages contractors, because they're visible from the outside:
- Payslip formats that keep changing, or a different employer name appearing on them
- Workers being moved frequently between payroll or umbrella companies
- Vague deductions described as "admin adjustments"
- Net pay that doesn't reconcile to hours worked
- Missing Key Information Documents, or a payslip portal that stops working
One question clients always ask is whether a worker will raise the alarm. Usually not, because the payslip looks correct. The gap only shows when deductions are compared against the worker's Personal Tax Account, which is what HMRC is now asking workers to do. Our guide to CIS nil returns covers the equivalent duty on the construction side.
Frequently Asked Questions
Does this apply if I only use one UK recruitment agency?
The liability sits with that agency rather than with you, provided the agency is UK resident and isn't connected to the umbrella company. You should still confirm in writing whether umbrella companies are being used below that agency, because a failure there is a commercial risk to your labour supply even when the tax bill isn't yours.
Can I appeal an HMRC determination if the umbrella company lied to me?
No. The legislation gives no right of appeal against the liability and no defence based on reasonable care, reasonable excuse, or fraudulent information supplied by the umbrella. Your remedy is contractual, against the umbrella or the agency, which is why indemnity and audit clauses matter more than they used to.
What if the umbrella company is based offshore?
Where the end client contracts with a non-UK resident agency, the end client becomes the relevant party. Where neither the client nor the nearest agency is UK resident, liability moves to the UK resident agency closest to the end client. Offshore structures move the exposure up the chain rather than removing it.
Is this the same as the off-payroll working rules?
No. Off-payroll working (IR35) determines whether a contractor working through their own company should be taxed as an employee, and a client who takes reasonable care can shift responsibility. These umbrella rules deal with money that was already deducted and never paid over, and reasonable care is irrelevant. Both sets of rules can apply to the same workforce.
How far back can HMRC go?
The new liability applies only to payments made on or after 6 April 2026. Earlier periods are dealt with under existing PAYE and debt transfer powers, which are narrower but not non-existent. If you have historic umbrella exposure, treat it as a separate question from the new regime. For related employer PAYE obligations, see our short-term business visitors guide and our note on PAYE settlement agreement deadlines.
Not sure whether the umbrella companies below your agencies are actually paying HMRC what your workers' payslips claim? Get in touch and we'll map your labour supply chain, tell you where the joint and several liability lands, and set up the ongoing checks that keep it visible. We work with UK employers and advise on payroll compliance across contractor-heavy sectors.