The legal position changed on 6 April 2026
If your recruitment business or company uses umbrella companies to place or engage contractors, you now face direct PAYE liability for your umbrella suppliers' non-compliance. HMRC can recover unpaid payroll tax from you without first exhausting claims against the umbrella. There is no grace period.
Key facts at a glance
In force from
6 April 2026
No retrospective grace period
Who is on the hook
Agency, then end client
If umbrella cannot pay HMRC
Indemnities protect you?
No
Only if umbrella is solvent — most aren't
Until April 2026, the standard commercial position was simple: if your umbrella company failed to operate PAYE correctly, that was the umbrella's problem. Your contract with the umbrella included indemnity provisions, and as long as you had those in place, you were protected. That position is now legally dead.
The legislation that came into effect on 6 April 2026 introduces a formal debt transfer mechanism for umbrella PAYE non-compliance. When an umbrella company fails to deduct and remit PAYE and National Insurance correctly — whether through negligence, deliberate fraud, or insolvency — HMRC can bypass the umbrella entirely and recover the debt directly from the recruitment agency. If the agency cannot pay, the liability flows to the end client.
This article explains exactly how the debt chain works, who faces liability and under what circumstances, why your existing contractual protections are insufficient, and what the practical audit steps are to protect your business.
The supply chain: who sits where and why it matters
The liability chain follows the commercial structure. Understanding your position in it is the starting point for assessing your exposure.
Contractor
ProtectedWorks as a PAYE employee of the umbrella company. Receives net pay after tax deductions.
Umbrella Company
Liability riskEmploys the contractor. Collects gross pay from the agency, deducts PAYE and NI, remits to HMRC, pays contractor net.
Recruitment Agency
Liability riskThe fee-payer. Engages the umbrella and places the contractor with the end client.
End Client
Liability riskThe hirer. Receives the contractor's services. May have no direct relationship with the umbrella at all.
How HMRC pursues the debt: the three stages
The debt transfer is not a simultaneous joint claim — it follows a defined sequence. Understanding the sequence clarifies where your real risk sits.
Stage 1
HMRC pursues the umbrella
HMRC issues a demand to the umbrella company for unpaid PAYE and NI. This is the primary route. In most large-scale non-compliance cases, however, the umbrella is either insolvent, has entered liquidation, or has been dissolved — often deliberately, to evade recovery. Stage 1 becomes unavailable.
Stage 2
Debt transfers to the recruitment agency
Where the umbrella cannot or will not pay, HMRC issues a Regulation 97F notice (under the PAYE Regulations as amended) to the recruitment agency as fee-payer. This is a formal legal demand, not an informal request. The agency now owes the debt to HMRC directly. The agency's contract with the umbrella — including any indemnity clause — is irrelevant to HMRC's claim. They can continue to pursue the umbrella civilly, but HMRC will not wait.
Stage 3
Debt transfers to the end client
If the agency also cannot pay — or in cases where HMRC determines the agency was complicit in the arrangement — the liability flows to the end client as the ultimate beneficiary of the contractor's services. End clients with no direct relationship with the umbrella are not automatically immune. The legislation allows HMRC to reach through the chain to the hirer in defined circumstances.
Why contractual indemnities are not enough
This is the single most important point in the entire article, and the one most often misunderstood by agency directors and procurement teams.
A contractual indemnity with your umbrella gives you a civil right to claim money back from the umbrella if HMRC transfers the debt to you. It does nothing to prevent HMRC from issuing the debt transfer notice in the first place. And critically: when umbrella company PAYE fraud is involved, the umbrella is almost always insolvent or dissolved by the time HMRC acts. Your civil claim is against an entity with no assets.
You hold a legal right to recover money from an empty shell. HMRC holds a legal demand against you for the full unpaid amount, with statutory interest. The indemnity does not protect you from that demand.
Contractual indemnities remain a necessary part of your legal framework — they are the last line of protection if a solvent umbrella causes a compliance failure. But they cannot be your primary or only defence.
Six red flags that indicate a non-compliant umbrella
Non-compliant umbrellas do not always look obviously suspicious. Some operate for years presenting a professional facade. These are the indicators that should trigger enhanced due diligence or immediate removal from your PSL.
Take-home rates above 85% of gross
Standard PAYE umbrella take-home sits at 60–75% of gross depending on expenses and pension contributions. Rates above 85% almost always involve a disguised remuneration scheme — loans, trust arrangements, or offshore structures — that HMRC treats as unpaid PAYE.
Loan-based or trust-based pay models
Some umbrellas pay contractors via 'loans' from employee benefit trusts (EBTs) that are never intended to be repaid. HMRC classifies these as earnings. Any agency or client whose contractors were paid this way is now in scope for debt transfer.
Mini-umbrella company structures
Mini-umbrella fraud splits a workforce across many small companies, each individually claiming the Employment Allowance and VAT flat-rate scheme. HMRC is actively targeting this and pursuing agencies and clients who used these arrangements, even unknowingly.
Offshore payment elements
Any model where part of a contractor's pay flows through an offshore entity — Isle of Man, Jersey, or any non-UK jurisdiction — should be treated as high-risk regardless of how the arrangement is presented to you.
No FCSA or APSCo accreditation
Legitimate umbrellas operating standard PAYE hold accreditation from the Freelancer and Contractor Services Association (FCSA) or APSCo. Absence is not proof of non-compliance, but it is a material reason to conduct additional verification before continuing to use that umbrella.
Refusal to provide compliance documentation
A PAYE-compliant umbrella should readily provide payslip samples showing correct deductions, evidence of NMW compliance, and an annual compliance certificate. Reluctance or inability to produce these on reasonable request is a serious warning sign.
PSL audit checklist: six steps to protect your business
Whether you are a recruitment director reviewing your preferred supplier list or a corporate procurement lead with contractors on your workforce, these are the minimum steps you should take and document before the end of Q3 2026.
Umbrella PSL compliance audit — step by step
Check HMRC's published list of tax avoidance schemes
HMRC maintains a 'name and shame' register of promoted avoidance schemes (GOV.UK: Tax avoidance: Don't get caught out). Cross-reference every umbrella on your PSL against this list. If any appear, remove them immediately and seek specialist advice on retrospective exposure.
Verify FCSA or APSCo accreditation directly with the body
Do not rely on the umbrella's own claims of accreditation — check directly with FCSA (fcsa.org.uk) or APSCo (apsco.org). Accreditation lapses and is not always visibly removed from an umbrella's marketing materials. Verify current status and document when you checked.
Request a sample payslip and verify the pay model
A compliant umbrella pays NMW (or National Living Wage) as base salary and processes all additional pay as PAYE earnings. Request a sample payslip from a contractor placed through the umbrella and confirm that PAYE and National Insurance deductions appear correctly and proportionately to gross pay.
Require an annual PAYE compliance certificate
Leading compliant umbrellas issue annual PAYE compliance certificates signed by their auditor or accountant. Make this a contractual requirement for continued inclusion on your PSL. Any umbrella unwilling to provide this should be treated as high-risk.
Update supplier contracts to include PAYE warranties and indemnities
Your supply contracts with umbrella companies should include an express warranty that the umbrella operates standard, fully compliant PAYE, and a specific indemnity covering any PAYE debt transferred to your organisation by HMRC as a result of the umbrella's non-compliance. This is not a full defence, but it is a necessary component of your risk framework and gives you a contractual right of recourse.
Document every due diligence step with date and evidence
Documented checks are your primary defence. HMRC may seek to hold you liable even when you performed due diligence. Without documentation — dates, documents received, accreditation confirmations, payslip reviews — claiming 'we checked' carries no evidentiary weight in a dispute. Create a compliance record for each umbrella on your PSL and update it at least annually.
If you are a contractor: what this means for you
Contractors who work through umbrella companies are not personally liablefor the umbrella's failure to remit PAYE. Your income tax and NI obligation is discharged at source when the umbrella deducts it from your gross pay. Even if the umbrella never passes that money to HMRC, you are not the one who owes it.
However, non-compliant umbrellas create risks beyond tax: your employment rights, NMW entitlement, and pension auto-enrolment may all be affected by an umbrella operating outside the standard PAYE model. And if your agency pulls a non-compliant umbrella from their PSL to manage their liability exposure, your current engagement could be disrupted.
Practically: check your payslips. Verify that PAYE and NI appear proportionate to your gross. If your take-home looks too good to be true relative to what standard PAYE would produce, ask your umbrella explicitly how the difference is calculated. If you cannot get a straight answer, contact your agency about moving to a compliant alternative. If you are considering moving to your own limited company instead, see our inside vs outside IR35 guide.
Considering the move from umbrella to limited company?
For contractors whose clients now qualify as small companies under the updated £15M IR35 threshold, self-determining outside IR35 through your own PSC is back on the table. The limited company route removes you from the umbrella supply chain entirely — and unlocks the full salary-plus-dividend structure plus direct employer SIPP contributions.
Frequently asked questions
Does the April 2026 umbrella liability change affect contractors who operate through their own limited company (PSC)?
No. This legislation targets the three-party umbrella supply chain: contractor, umbrella company, recruitment agency or end client. If you operate through your own Personal Service Company, you are your own employer and are directly responsible for your own PAYE under the off-payroll working rules. The debt transfer mechanism is entirely separate from IR35 and does not affect PSC contractors or their clients directly.
If we did not know our umbrella was non-compliant, are we still liable?
HMRC's position is that ignorance of a supplier's non-compliance is not a defence to debt transfer. The legislation places a positive obligation on agencies and end clients to conduct due diligence on umbrella partners. If you cannot demonstrate that you took reasonable steps to verify compliance — accreditation checks, payslip reviews, compliance certificates — HMRC can still transfer the debt to your organisation regardless of intent.
This is not theoretical. HMRC has made clear that the April 2026 change is an enforcement measure, not a guidance update. The only meaningful protection is a documented due diligence process carried out and maintained on an ongoing basis.
Can we still use umbrella companies after April 2026?
Yes. PAYE-compliant umbrella companies remain a valid and widely used model for placing contractors. The April 2026 changes do not prohibit umbrellas — they transfer PAYE liability onto agencies and clients when umbrellas fail to operate correctly. The practical effect is that you must be selective about which umbrellas appear on your PSL and you need documented compliance checks to demonstrate due diligence. A good umbrella company will welcome this scrutiny.
How does HMRC decide whether to pursue the agency or the end client?
The legislation creates a sequential chain. HMRC first pursues the umbrella. If the umbrella cannot or will not pay — the most common scenario when umbrellas are involved in tax fraud is that they are insolvent or have dissolved — the liability transfers to the agency as fee-payer. The end client becomes liable only if the agency also cannot pay.
In practice, HMRC often issues debt transfer notices to agencies and end clients simultaneously to apply commercial pressure, particularly in cases involving large numbers of contractors or significant unpaid PAYE. Receiving a notice does not automatically mean you owe the debt — there is a formal process — but it demands immediate legal advice.
Are contractual indemnities with the umbrella enough to protect us?
No, and this is the most important point in the entire article. A contractual indemnity with the umbrella gives you a right to claim money back from that umbrella if HMRC transfers a debt to you. But if the umbrella is insolvent or has dissolved — which is almost always the case when large-scale PAYE fraud is involved — your indemnity is worthless. You have a civil claim against an empty shell.
Contractual indemnities are still necessary as part of a complete risk framework, but they are the final layer of protection, not the primary one. The primary protection is preventing HMRC from transferring the debt in the first place, which requires documented evidence that the umbrellas on your PSL genuinely operate compliant PAYE.
What should contractors do to protect themselves?
Contractors who work through umbrella companies are not personally liable for the umbrella's failure to remit PAYE — their tax obligation is discharged when the umbrella deducts it. However, contractors should still verify their umbrella is compliant because non-compliant arrangements can affect their employment rights, NMW compliance, and pension auto-enrolment.
Practically: request your payslips and verify that PAYE and NI appear correctly proportionate to your gross pay. Confirm your umbrella is FCSA or APSCo accredited. If your take-home seems significantly above what a PAYE calculation would produce, ask your umbrella explicitly how the difference arises. If you cannot get a clear answer, that is a red flag.
Related reading & tools