Umbrella company joint and several liability: what your back-office system should now check

You have now processed pay runs for two quarters under the umbrella joint and several liability rules. Since 6 April 2026, your agency has been jointly and severally liable for amounts payable under PAYE by an umbrella company, covering Income Tax, Student Loan repayments and Class 1 NICs. Your back office should run checks every pay period from data you already hold, not an annual questionnaire. We build recruitment back-office and payroll software, and we can show what that means.

We designed and built Octopaye, HMRC-recognised payroll software for the temporary recruitment sector that processes 15,000 timesheets in under a minute. We also built Infinitemp, the recruitment back office for NLG RPO with timesheets, invoicing, export to payroll and compliance management for temporary healthcare staff, which eliminated errors associated with Excel and included a Xero integration. Our founder Andy Jones has a background in recruitment and umbrella payroll software and has built and sold businesses himself.

This is not legal or tax advice. Agencies should confirm their position with their own adviser.

The liability in plain terms

Finance Act 2026 section 24, given Royal Assent on 18 March 2026, inserted a new chapter on umbrella companies into the Income Tax (Earnings and Pensions) Act 2003, with effect for payments made on or after 6 April 2026 (see legislation.gov.uk). HMRC’s guidance says the rules apply to new and existing labour supply chains (gov.uk).

The relevant party becomes, alongside the umbrella company, jointly and severally liable for amounts payable under PAYE. The umbrella remains the employer. Normally the relevant party is the agency contracting with the end client. Where several agencies sit in the chain, only the one contracting with the client is liable (HMRC Employment Status Manual ESM2425). The end client can be the relevant party in specific cases, such as contracting directly with the umbrella.

The liability covers the worker’s Income Tax, Student Loan repayments, and primary and secondary Class 1 NICs, including disguised employment income such as supposed loans (HMRC Employment Status Manual ESM2430). The NICs element comes from the Social Security Contributions (Umbrella Companies) Regulations 2026 (SI 2026/388), in force 6 April 2026. There is no knowledge, fault or due-diligence condition. HMRC’s guidance states that if an umbrella has not paid correct PAYE, “we’ll recover it from you”. The government’s March 2025 consultation response said no mandatory due diligence requirement, and no accreditation, including FCSA, is a statutory defence.

The government’s November 2025 policy paper estimated about 30,000 agencies, 400 umbrella companies and 700,000 workers affected. The Employment Rights Act timeline lists regulation of umbrella companies among measures taking effect in 2027, but the liability rules are already live. HMRC’s compliance-approach page (ESM2435) notes more information will come in due course.

What HMRC recommends agencies check

HMRC’s guidance for employment businesses asks agencies to check that the assignment rate on umbrella reconciliation statements matches what the agency sent, obtain payslips directly from workers, and look for unexplained deductions (skimming) and National Minimum Wage underpayment (gov.uk).

Further checks listed: VAT registration and Companies House details match the umbrella; bank account name matches; employer’s liability insurance in place; claimed accreditation genuine; GLAA licence where required; whether payroll outsourced; and keep records of checks.

HMRC lists warning signs of mini umbrella fraud, including frequent PAYE reference changes and employer names differing between key information document and payslip. Good-practice guidance says payslips should show employer PAYE reference, tax code, year-to-date figures, and any rolled-up holiday pay separately from gross pay. HMRC suggests contract clauses requiring umbrellas to provide payslips for named workers on request, evidence of PAYE returns filed and payments made, and director indemnity.

Our recommendation: checks that run every pay period

The legal explainers exist. The gap is turning HMRC’s guidance into checks that run from data the agency already holds, with evidence stored. Many agencies still depend on spreadsheets and goodwill.

When we built Infinitemp for NLG RPO, we replaced Excel-based timesheet and invoicing processes with a system that exported to payroll and managed compliance for temporary healthcare staff. In our view, matching only works reliably when the format is agreed upfront, because many agencies receive payslips or reconciliation as PDF or email, not structured data. We recommend contracting for machine-readable reconciliation files each pay run, including PAYE reference, employer name, rates and holiday pay breakdown.

The table below maps HMRC-recommended checks and our suggested automation labels to data source, frequency and automatability.

Check	Source of data	How often	Automatable?
Assignment rate matches reconciliation	Agency sent rate vs umbrella statement	Every pay period	Yes
Payslip obtained and reviewed	Worker payslip (contractual feed)	Every pay period	Partial (retrieval yes, review human)
Unexplained deductions or skimming	Payslip and reconciliation	Every pay period	Partial (flag outliers)
NMW underpayment	Payslip hours and rates	Every pay period	Yes, if payslip data arrives structured
VAT and Companies House match	HMRC VAT check and Companies House API	Monthly or on change	Yes
Bank account name matches	Umbrella bank details	Onboarding and change	Partial (change alerts automatic, verification manual)
Employer’s liability insurance	Umbrella document	On expiry	Partial (expiry reminders automatic, document review manual)
Accreditation genuine	FCSA or other register	On expiry	Partial (reminders automatic, register check manual)
GLAA licence if required	GLAA register	On expiry	Partial (reminders automatic, register check manual)
PAYE reference change	Payslip vs prior period	Every pay period	Yes
Employer name mismatch	KID vs payslip	Every pay period	Yes
Holiday pay separate	Payslip format	Every pay period	Yes

What still needs a human? Reviewing unexplained deductions, judging whether a margin outlier is contractual, and investigating mini umbrella fraud signals require judgement. Automation should surface the exception, not replace the compliance manager.

What to do this month

You are six months into the rules, so a one-off setup is not enough. This month, take these steps:

1. Review your standard umbrella contract and add clauses requiring structured reconciliation and payslip data each pay run, as HMRC suggests.
2. List every umbrella in your live supply chain and record its PAYE reference, employer name, VAT number, Companies House number, insurance and accreditation expiry.
3. Map which data you already hold in your back office and which you receive only as PDF or email.
4. Run a manual assignment-rate versus reconciliation match for the last two pay periods to gauge error rate.
5. Speak to your software provider about automating the table above, or talk to us about a bespoke recruitment back-office build.

Building systems that hold the evidence

We have built integrations with Bullhorn, Salesforce, FreeAgent and Xero, on Node.js, Angular and AWS. If your agency runs Bullhorn, our Bullhorn developer work may help. The aim is to keep compliance evidence inside the system of record, not a separate spreadsheet.

For agencies automating payroll, billing and timesheets, our article on how to automate payroll, billing and timesheets covers practical patterns. If you want to discuss your back office, contact us.

Frequently Asked Questions

Who is liable under the umbrella company rules from April 2026?

The relevant party is normally the recruitment agency that contracts with the end client, liable alongside the umbrella for unpaid PAYE. Where several agencies sit in the chain, only the one dealing with the client is liable, per HMRC manual ESM2425. The end client can be liable in specific direct-contract cases. The umbrella remains the employer.

Is FCSA accreditation a defence?

No. The legislation has no due-diligence condition, and HMRC says it will recover unpaid PAYE from the agency. The government consultation response confirmed no mandatory due diligence, and no accreditation, including FCSA, gives a statutory defence. Agencies must still carry out checks, but membership alone does not remove liability.

Does it apply to existing supply chains?

Yes. HMRC guidance states the rules apply to new and existing labour supply chains for payments made on or after 6 April 2026. Contracts predating the rules are included, but payments made before that date are not covered. Agencies should review umbrellas used for years, not only new onboarding.

What does the liability cover?

Liability covers amounts payable under PAYE: the worker’s Income Tax, Student Loan repayments, and primary and secondary Class 1 NICs. It includes disguised employment income such as supposed loans, per ESM2430. The NICs element derives from SI 2026/388. There is no requirement of fault or knowledge for the agency to be liable.

What data should we ask umbrellas to provide contractually?

HMRC suggests clauses for payslips on request, evidence of PAYE returns filed, and director indemnities. Our recommendation goes further: contract for machine-readable reconciliation statements each pay period, with PAYE reference, employer name, rates and holiday pay breakdown. This lets automated checks run without manual rekeying from PDFs.

If your agency is still matching umbrella payslips in spreadsheets, now is the time to move that control into your back office. We build systems that keep compliance evidence with the transaction, and you can explore a tailored build at bespoke recruitment back-office software or start a conversation at our contact page.