Umbrella Supply Chain tax laws are changing - what is changing and what does it mean for you?

Updated for the UK’s draft umbrella legislation scheduled to take effect from 6 April 2026 (subject to the Finance Bill 2025–26 becoming law). This plain-English guide explains what’s changing, who’s at risk, and what to do next.

Quick overview

From 6 April 2026, where a worker is paid via an umbrella company and that umbrella fails to operate PAYE/NICs correctly, HMRC can recover the unpaid amounts from others in the supply chain — typically the agency closest to the end-client, or, if there’s no agency, the end-client. This is Joint & Several Liability (JSL). The aim is to clamp down on non-compliance (for example disguised remuneration/loan schemes and mis-handled holiday pay) and close the tax gap.

For end-users and recruitment agencies, this is a nudge to tighten controls around which umbrellas you permit workers to use — both to avoid tax exposure and to stay ahead of any labour-supply continuity issues. For anyone working through non-compliant umbrellas, it’s a flashing red warning. Expect agencies and end-clients to challenge umbrella choices and insist on switches before April 2026. You may also face personal financial risk if a provider collapses.

What exactly is changing

The Joint & Several Liability rule — in a nutshell

Under the new rules, if an umbrella in your chain under-deducts or fails to pay PAYE/NICs, HMRC can seek recovery from others in that chain. In practice, that means the nearest agency to the end-client or, where no agency is involved, the end-client may be pursued for the shortfall. The rules apply to payments made on or after 6 April 2026.

Even if you paid the umbrella on a gross basis (i.e. your invoice included monies intended for tax and NICs), if PAYE/NICs are not correctly operated, the bill can still land with you.

What counts as non-compliance?

Risks include disguised remuneration (loan schemes), incorrect holiday-pay treatment, and other mechanisms that depress taxable pay or misreport deductions. The change is designed to shift incentives so buyers of labour (agencies/end-clients) only use providers that can evidence correct payroll.

Who is in scope — and when end-clients can be liable

• Umbrella in the chain: The JSL rule applies where workers are employed by an umbrella supplying labour into a client (directly or via agencies).
• Agencies: HMRC can pursue the agency that holds the contract with the end-client if the umbrella fails to account for PAYE/NICs.
• End-clients: Where there’s no agency, the end-client can be pursued.
• Start date: Rules apply to money paid to workers on or after 6 April 2026 (subject to the legislation completing its passage).

Why the change is happening

Government analysis points to widespread umbrella usage with significant pockets of non-compliance creating a sizeable tax risk. JSL is the chosen enforcement lever after consultation, signalling that liability can move up the chain to the most controllable point — the agency or end-client — to deter the use of high-risk providers.

Risks to end-clients and agencies

1. Financial exposure
   If PAYE/NICs are mishandled by the umbrella, HMRC may recover the shortfall from you, even though you’ve already paid the umbrella’s invoices.
2. Operational disruption
   As PSLs tighten, non-compliant umbrellas may exit the market quickly. If one collapses, you risk missed payrolls, worker disputes, and project delays while you re-paper assignments.
3. Reputational damage
   News that workers went unpaid or that HMRC sought recovery from a high-profile hiring organisation can undermine candidate trust and vendor relationships.

Risks to contractors

1. Non-payment risk
   If your umbrella folds, wages and holiday pay can be at risk, and HMRC may still expect the correct tax to be paid.
2. Forced provider switches
   Expect agencies and clients to challenge your umbrella choice and, where needed, ask you to switch to a vetted provider before April 2026. This protects the whole supply chain.
3. Admin friction (short term, worth it)
   You may have to complete a new registration, portal setup and ID checks, P45 and New Starter forms — a small price to avoid bigger problems later.

Signals of a compliant umbrella (FCSA/SafeRec)

Independent accreditation is the quickest trust signal.

• FCSA Accreditation — industry-recognised standards with annual independent assessment; check the public member directory to verify status.
• SafeRec Certification — live/payroll-at-source auditing with a public directory of certified umbrellas and tooling for PSL management/monitoring.
• 
  

Best practice: choose umbrellas that are FCSA-accredited or SafeRec-certified, ideally both, and verify on the public registers. Organisations in the supply chain should save certificates/screenshots to the audit file and re-check quarterly.

The documents that protect you (KIDs, payslips and reconciliations)

Key Information Document (KID)

A KID explains pay, deductions, holiday and benefits and should be issued before work starts. Ensure the KID matches the actual engagement route (umbrella PAYE vs PSC vs agency PAYE) and reflects the real rates and deductions. File it with the assignment documents.

Payslips and reconciliations

Before paying an umbrella, sample a redacted payslip and a simple invoice-to-payslip reconciliation showing: taxable gross, PAYE, employee NICs, employer NICs, Apprenticeship Levy, holiday pay and the umbrella margin. Keep this with your PSL evidence; it’s your first line of defence if HMRC asks questions.

What end-clients and agencies should do now

1. Make someone accountable
   Appoint a risk owner (Finance/HR Ops/Compliance). Put umbrella compliance on your risk register and audit plan.
2. Lock a vetted PSL
   Require umbrellas to be FCSA-accredited or SafeRec-certified (preferably both). Verify on the public registers, save evidence, and re-verify quarterly with diary reminders for certificate expiry.
3. Tighten onboarding
   Confirm the route (umbrella PAYE vs PSC vs agency PAYE).
   Issue a KID before day one and re-issue if anything material changes.
4. Check the money flows
   Sample payslip and reconciliation before approving payments.
   Only pay the umbrella named in your contract, to a UK business account in that name.
5. Maintain an audit trail
   Keep a central folder with accreditation proof, KIDs, payslip/reconciliation samples, quarterly PSL reviews and compliance communications.
6. Prepare a contingency plan. If an umbrella fails or falls off your PSL:

• Pause new timesheets to that entity and brief workers the same day.
• Switch to a pre-vetted alternate; re-paper assignments rapidly.
• Verify first payslips from the new provider before releasing bulk payments.

What contractors should do now

Spend 15 minutes to future-proof your pay:

• Accreditation: choose an umbrella that’s FCSA-accredited or SafeRec-certified (ideally both). Verify the listing on the public register.
• Payslip clarity: keep each payslip; check it shows taxable gross, PAYE, EE/ER NICs, Apprenticeship Levy, holiday pay and margin.
• Holiday pay policy: confirm accrued vs rolled-up, and when it’s paid.
• Who gets paid: your agency/client should pay the umbrella named in your contract — no third-party or overseas accounts.
• KID in hand: make sure you received a Key Information Document before you started. If the route changed, ask for a new one.
• Red flags: loan/credit schemes to boost net pay, routine “expenses” that depress taxable pay, requests to split payments, or refusal to share a reconciliation. If you see these, ask to switch provider before your next timesheet.

FAQs

Does this replace IR35/off-payroll rules?

No. This targets PAYE compliance in umbrella arrangements. IR35/off-payroll still applies to PSC engagements. Different rules, different risks.

Will end-clients always be liable?

No. HMRC may pursue others in the chain. Often that’s the agency nearest the end-client; where there’s no agency, the end-client can be pursued. Facts and evidence will determine the outcome.

What if my umbrella collapses?

Workers: contact your agency immediately and switch to a vetted umbrella; keep your KIDs, payslips and contract.
Clients/agencies: activate your contingency plan, re-paper assignments, and verify first payslips before releasing payments.

Is accreditation mandatory?

No law mandates a specific accreditation. But many organisations treat FCSA and/or SafeRec as due-diligence benchmarks because they provide independent assurance (and in SafeRec’s case, live payroll auditing). Always verify on the public registers.

Key takeaways

• From 6 April 2026, liability for unpaid PAYE/NICs in umbrella chains can move up the chain — to the nearest agency or, if no agency, the end-client.
• Expect tougher PSLs and provider switches ahead of April 2026; non-compliant umbrellas may disappear quickly, risking worker non-payment and project disruption.
• End-clients/agencies: name a risk owner, require FCSA/SafeRec accreditation, verify deductions with payslip/reconciliation sampling, and keep a central audit trail.
• Contractors: verify your umbrella now, keep payslips and KIDs, and be willing to switch if your provider can’t evidence compliance.

How Crucial People can help

At Crucial People, we help smart-buildings employers and contractors stay compliant without losing flexibility. We can:

• Map your labour supply chain and stress-test your PSL
• Verify accreditation (FCSA/SafeRec) and diarise re-checks
• Help you prepare a contingency playbook so a provider failure doesn’t stop payroll
• We can even handle your Umbrella payroll for you so you are de-risked.

Our compliance promise

Crucial People partners only with umbrella companies that hold current FCSA or SafeRec accreditation — ideally both. We verify listings on the official registers and review providers quarterly as part of our PSL governance.

Ready to de-risk your contractor supply chain?

Message us for a 20-minute readiness review, a PSL template, and a one-page checklist you can share with Finance/HR.

Contact us on 0203 154 9422 or info@crucial-people.com