This one has been widely misreported, so it is worth being precise about what changed on 6 April 2026.
Agencies and end clients have not been made responsible for running umbrella payroll. The umbrella company keeps the primary duty to operate PAYE. What changed is who else can be pursued when it does not.
How does the liability work?
From 6 April 2026, where an umbrella company fails to account for PAYE income tax and Class 1 National Insurance on a worker’s pay, another party in the labour supply chain is jointly and severally liable for the shortfall.
Joint and several means exactly what it says. HMRC can pursue that other party for the full unpaid amount and does not have to chase the umbrella first. Recovering it from the umbrella afterwards is your problem, and if the umbrella has failed, it is not a recovery you will make.
Which party is liable depends on the chain. Broadly, it is the party contracting directly above the umbrella. Where there is a recruitment agency, that is the agency. Where the end client engages the umbrella directly, it is the end client.
The measure was legislated in Finance Bill 2025-26 through a new chapter of ITEPA 2003, with equivalent National Insurance provisions.
Does this affect employers of record?
It can, and this is the point most often missed.
Arrangements marketed as employers of record frequently fall within the statutory definition of an umbrella company. A business using an EOR to engage workers may find itself exposed if that provider fails to operate payroll correctly.
Overseas parties in the chain add further risk. Where a party above the umbrella is not UK resident, liability can land on a client that would not have expected to carry it.
What does adequate due diligence look like?
The rules are aimed squarely at the businesses that decide which umbrellas sit in their supply chains, on the reasoning that they are best placed to keep non-compliant operators out. Choosing an umbrella is no longer a procurement formality.
Practical steps, in rough order of value:
- map the chain properly, including any parties you do not contract with directly and any overseas entities
- reduce the number of providers you use, because each one is a separate exposure
- verify that PAYE and NIC are actually being paid over, rather than accepting assurances that they will be — ask for evidence, periodically, in writing
- check accreditation as a baseline, while recognising it is not a substitute for your own checks
- put contractual indemnities in place, while recognising an indemnity from a failed company is worth nothing
- consider whether some workers belong on your own payroll or an agency payroll instead
That last option deserves more attention than it usually gets. It brings employment status, IR35 and worker rights questions with it, but for a small population of long-term workers it can be simpler and cheaper than managing the risk.
What is still to come?
The PAYE liability rules are a separate measure from the wider statutory regulation of the umbrella sector, which is expected to follow with a licensing-style regime.
The tax risk moved in April 2026. The employment standards question is still in progress. Businesses that use umbrella labour at any scale should assume both will tighten further.
Frequently asked questions
Who is liable for PAYE on umbrella workers from April 2026?
The umbrella company retains the primary duty to operate PAYE. From 6 April 2026, the party contracting directly above the umbrella in the supply chain — usually the recruitment agency, or the end client where there is no agency — is jointly and severally liable for any PAYE and Class 1 NIC the umbrella fails to pay.
Does HMRC have to pursue the umbrella company first?
No. Joint and several liability means HMRC can recover the full amount from either party. There is no requirement to exhaust recovery against the umbrella before approaching the agency or client.
Are employers of record caught by these rules?
Often, yes. Many EOR arrangements fall within the statutory definition of an umbrella company. Businesses using an EOR should check the definition against their specific arrangement rather than assume the label puts them outside the rules.
Does using an accredited umbrella remove the risk?
No. Accreditation provides a credible baseline of assurance about a provider’s practices, but the statutory liability sits with you regardless. It supports your due diligence rather than replacing it.
Should we move workers onto our own payroll instead?
It is worth modelling. Direct engagement removes the supply chain exposure but brings employment status, IR35, holiday pay and employment rights considerations that need assessing first. For a small number of long-term workers it is frequently the simpler answer.