Guides

UK Umbrella Company Reform 2026: What Joint and Several Liability Means for Recruitment Agencies

From 6 April 2026, HMRC can recover unpaid PAYE and NIC from any party in the labour supply chain, including your agency, if an umbrella company fails to pay. Here's exactly what Joint and Several Liability means for UK recruitment agency BD, PSL audits and client conversations.

TB Team Boilr

· August 15, 2026 · 16 min read

Abstract dark liquid-metal texture representing a shared chain of liability running through a labour supply chain

TL;DR

From 6 April 2026, a new Chapter 11 in Part 2 of ITEPA 2003 makes recruitment agencies and, in some cases, end clients jointly and severally liable for unpaid PAYE and National Insurance Contributions when a worker is engaged through an umbrella company [1] [3]. If the umbrella in your supply chain fails to pay - through fraud, insolvency or simple error - HMRC does not have to chase the umbrella first. It can come straight to your agency for 100% of the shortfall, and when HMRC was asked directly whether full due diligence would protect an agency from that liability, its answer was "No" [7]. There is no statutory reasonable-excuse defence [3]. HMRC estimates at least 700,000 workers used umbrella companies in 2022-23, with 275,000 of them engaged by non-compliant providers, and expects the reform to protect £2.8 billion in tax revenue by 2029-30 [4]. That is a hard, dated deadline your agency cannot opt out of - and, handled properly, a genuine reason to get back in front of clients as the "safe pair of hands" on their contractor panel before a competitor gets there first.

What Changes From 6 April 2026

Joint and Several Liability (JSL) is not a proposal or a consultation outcome anymore - it is confirmed legislation. HMRC published its policy paper "Umbrella company market: changes to Income Tax rules to tackle non-compliance" and the measure applies to payments made for umbrella-company workers' services on or after 6 April 2026 [1] [6].

Legal basis: a new Chapter 11 is inserted into Part 2 of the Income Tax (Earnings and Pensions) Act 2003 (ITEPA), with parallel provisions for Class 1 National Insurance Contributions [3].
What it covers: unpaid PAYE and NIC on payments made to workers engaged through an umbrella company - not IR35/off-payroll working through a personal service company, which remains a separate regime [5].
Who it targets: a new, deliberately broad statutory definition of "umbrella company" - anyone "that carries on a business... of supplying labour", which can capture employers of record and other labour-supply intermediaries beyond the traditional umbrella model [3].
Scope limit: the liability does not apply where every party in the chain - end client, agency and umbrella - is non-UK resident, but any UK-based party in the chain brings it into scope [5].

HMRC Goes to the Agency First, Not the Umbrella

The detail that changes the risk calculation most is enforcement order. The umbrella company remains the formal employer with the primary duty to operate PAYE correctly. But KPMG's read of the draft legislation is explicit: "HMRC have indicated that they will approach the agency / end client in the first instance, rather than the umbrella company, to recover any underpayment of PAYE" [3]. Your agency does not get to wait and see whether HMRC successfully recovers from a failed umbrella before the debt lands on your desk.

Why "We Used a Compliant Umbrella" Won't Be a Defence

This is the part that most agency owners get wrong when they first hear about JSL, and it is the single most important fact to brief every consultant on before April 2026.

No reasonable-excuse defence: there is no right of appeal or statutory defence against the liability for the relevant party - not even where fraudulent information was supplied by the umbrella [3].
Due diligence does not remove liability: when ContractorUK put the question to HMRC directly - would full due diligence protect an agency from JSL if the umbrella still failed to pay tax - the answer was unambiguous: "No" [7].
The test is strict, not fault-based: the operative question HMRC asks is "has the tax been paid?", not "did the agency do everything reasonably possible to check?" [7].
Indemnities have real limits: the FCSA, the umbrella sector's own accreditation body, warns that if the umbrella is insolvent, a contractual indemnity cannot be enforced, and HMRC will simply pursue whichever party in the chain is still solvent [8].

That does not make due diligence pointless. It changes what due diligence is for: not a legal shield, but a way to actually reduce the odds of ever being in this position, and to build a defensible record for if HMRC does come knocking. Working with an FCSA-accredited umbrella, for instance, does not transfer the statutory liability away from your agency, but it does mean the provider has already been tested against payroll, tax and worker-rights codes and is subject to ongoing reassessment [8].

Who Is Actually Liable: The Chain, Scenario by Scenario

The "relevant party" HMRC pursues depends on exactly how the supply chain is structured. Get this wrong on your own contracts and you will not know your real exposure until a debt notice arrives.

Supply chain scenario	Who HMRC can pursue first
UK agency contracts directly with the end client, worker engaged via umbrella	The recruitment agency [3]
No agency in the chain - end client engages the umbrella directly	The end client [3]
The contracting agency is non-UK resident	The end client [3]
The contracting agency is connected to the umbrella company	The end client [3]
Every party in the chain (client, agency, umbrella) is non-UK resident	Out of scope of JSL [5]
Umbrella collapses or is fraudulent before HMRC pursues it	The agency (or end client) becomes the practical first port of call [3]

The takeaway for most PSL-managing agencies is blunt: if you contract directly with the end client and place a worker through an umbrella, you are almost always the first name on HMRC's list, not the umbrella and not the client.

The Scale of the Problem HMRC Is Trying to Fix

JSL did not appear out of nowhere. It is HMRC's response to a market it says has become genuinely difficult to police provider by provider.

At least 700,000 workers were engaged through umbrella companies in 2022-23 [4].
Of those, at least 275,000 were engaged by umbrella companies that failed to comply with their tax obligations [4].
£500 million was lost to disguised remuneration tax avoidance schemes in 2022-23 alone, almost all of it facilitated through umbrella arrangements [4].
HMRC expects the reform to protect roughly £2.8 billion in tax revenue across the scorecard period to 2029-30 [4].
The market runs through an estimated 30,000 recruitment agencies and around 400 umbrella providers in the UK, which is precisely the scale HMRC says made provider-by-provider policing impractical [6].

Rather than trying to regulate several hundred umbrella providers one by one, the government's approach is to push the compliance incentive up the supply chain to the parties - agencies and end clients - who choose which umbrella to work with in the first place [2].

What This Means for Your Agency's Operations

Your PSL Needs a Hard Look, Not a Soft Update

Audit every umbrella company currently on your Preferred Supplier List, not just the top three by volume.
Check FCSA accreditation status directly on the FCSA members register, and treat "we've heard they're fine" as no longer acceptable.
Use the HMRC app to check an umbrella's Income Tax and NIC compliance record where possible [2].
Cut providers you cannot get clean, current evidence for, even if they are cheap or fast for candidates.

Your Contracts Need Updating

Build explicit rights into agency-umbrella agreements to receive regular PAYE evidence and RTI (Real Time Information) reporting data [9].
Add audit and inspection rights so you can actually exercise due diligence, not just request it.
Understand that indemnity clauses reduce comfort, not statutory exposure - price that into your risk appetite rather than treating an indemnity as a solved problem [8].

Your Consultants Need Briefing, Not Just Your Compliance Team

Every desk that places temp or contract workers through umbrella companies is in scope - not just the "back office" or the compliance lead.
Consultants need to know which umbrellas are approved, and why, so they stop recommending whatever a candidate arrives with.
Board-level understanding matters: this is now a financial exposure line item, not a tax-team footnote [9].

Your Client Conversations Need to Change

Clients running their own umbrella panels are exposed too, and many have not thought about it yet.
End clients that contract directly with an umbrella, or that use a non-UK or connected agency, carry the liability themselves.
An agency that can show a documented panel audit, live FCSA checks and updated contracts has a genuinely differentiated pitch versus one still running last year's umbrella list.

Manual Compliance Tracking vs a Signal-Led Approach

A spreadsheet and a compliance lead's memory can just about cover a handful of umbrella relationships. It breaks down once your agency is running multiple desks, a rotating PSL, and clients who each have their own approved-supplier rules on top of yours.

Task	Manual approach	boilr.ai-powered approach
Tracking which umbrellas on the PSL still hold current FCSA accreditation	Manual re-checks, if anyone remembers to do them	Companies tracks the account and any flagged supplier changes as part of enrichment
Knowing which clients run their own umbrella panel and are therefore exposed	Lives in one consultant's head, lost when they leave	Company Brain stores account-level context as shared agency memory
Spotting when a client's contractor headcount or umbrella usage changes	Nobody notices until the client raises it	Signals flags relevant account and hiring activity as it happens
Turning a panel audit into a client conversation	Ad hoc, inconsistent messaging across the desk	Tasks packages the readiness story into a verification-ready outreach draft

boilr.ai is not a tax or compliance tool, and it does not run PAYE checks or replace legal advice on your JSL exposure. What it does is make sure the account-level signal - "this client runs a large contractor book" or "this client hasn't updated its umbrella policy" - actually reaches a consultant's desk as a reason to call, instead of sitting unused in a spreadsheet nobody opens.

A 6-Step Practical Plan Before 6 April 2026

Map your supply chains: list every umbrella company your agency currently uses or recommends, and for each one, confirm whether your agency or the end client is the "relevant party" under the rules above.
Audit and rationalise your PSL: check FCSA accreditation and HMRC compliance status for every provider, and drop any you cannot get current evidence for.
Rewrite your umbrella agreements: build in explicit rights to PAYE evidence, RTI data and audit access, not just a payment schedule.
Brief every consultant on the desk: not just compliance staff - everyone who places candidates through an umbrella needs to know the approved-provider list and why it exists.
Build a per-client exposure snapshot: which clients run their own umbrella panel, which rely on your agency's PSL, and where the liability actually sits.
Turn readiness into outreach: use the snapshot to open real conversations with clients whose contractor exposure gives you a genuine, timely reason to talk, rather than a generic check-in.

KPIs to Track While You Roll This Out

Metric	What it tells you	Target
% of PSL umbrellas with current FCSA accreditation confirmed	How exposed your active panel is right now	100% before 6 April 2026
% of umbrella agreements updated with PAYE/RTI evidence rights	Whether your contracts actually let you exercise due diligence	All active agreements
% of client accounts audited for umbrella exposure	How many clients you can proactively brief	All active temp/contract clients
Number of compliance-led BD conversations opened	Whether the change is being used as a BD asset, not just risk management	Track weekly

How boilr Powers Compliance-Ready BD

boilr.ai runs as one AI sales employee per consultant, keeping your client and prospect accounts in view so a genuine, dated compliance trigger like JSL becomes a scored, ready-to-verify outreach task, rather than something a consultant has to remember to check manually:

Companies: enriches and monitors your target and client accounts so contractor-heavy books are visible at the account level, not buried in a spreadsheet.
Signals: flags relevant hiring and company activity as it happens, including growth in contract or temp headcount at tracked accounts.
Company Brain: stores which clients have been briefed on JSL, which have their own umbrella panel, and what worked in past compliance-led conversations - it survives consultant turnover.
ICP: lets you flag contract-heavy or umbrella-dependent clients as a priority segment while this transition plays out.
Tasks: turns the account research into a verification-ready outreach draft, so the consultant reviews and sends rather than starting cold.
Integrations: works alongside Bullhorn, RecruiterFlow and your existing CRM, so the account picture lives where your desk already works.

What boilr does not do: check PAYE records, confirm FCSA accreditation, draft indemnity clauses, or give you a legal opinion on where liability sits in a specific supply chain. That work stays with your compliance lead and, where it matters, a qualified employment tax adviser.

Turn UK umbrella company reform into your next client conversation, not just another compliance deadline. See how boilr.ai flags the accounts that need it.

5 Mistakes Agencies Are Making Right Now

Mistake #1: Assuming Due Diligence Is a Legal Shield

Why it fails: HMRC has confirmed directly that full due diligence does not protect an agency from JSL if the umbrella still fails to pay [7].

Fix: treat due diligence as risk reduction and evidence, not as a defence you can rely on.

Mistake #2: Waiting to See If HMRC Chases the Umbrella First

Why it fails: HMRC has indicated it will approach the agency or end client in the first instance, not the umbrella [3].

Fix: assume you are first in line and act on your own PSL now, not after a debt notice.

Mistake #3: Treating an Indemnity Clause as a Solved Problem

Why it fails: an indemnity cannot be enforced against an insolvent umbrella, and HMRC will still pursue whichever party is solvent [8].

Fix: use indemnities as one layer of protection alongside real supplier vetting, not instead of it.

Mistake #4: Leaving It to the Compliance Team Alone

Why it fails: every consultant who places a worker through an umbrella creates exposure, not just the people who sign off contracts.

Fix: brief the whole desk, and give consultants a clear, current approved-provider list.

Mistake #5: Filing This Under "Compliance", Not "BD"

Why it fails: a hard, dated, client-relevant compliance shift is a rare and genuine reason to reach out - treating it purely as risk management wastes the opportunity.

Fix: route the panel-audit and client-exposure signals to BD, not only to a compliance folder nobody opens.

A 3-Week Rollout Plan

Week 1: Map and Audit

List every umbrella company on your PSL and every client running their own panel. Confirm FCSA accreditation and check HMRC compliance status where possible.

Week 2: Rewrite and Rationalise

Cut umbrellas you cannot get clean evidence for. Update agreements with the providers you keep to include PAYE, RTI and audit rights.

Week 3: Brief and Convert

Brief every consultant on the desk on the new approved-provider list. Identify the 10-20 clients where your panel-audit readiness gives you a genuine reason to call, and book the first round of conversations.

Frequently Asked Questions

What is Joint and Several Liability for umbrella companies?

Joint and Several Liability (JSL) is UK legislation, effective for payments made on or after 6 April 2026, inserting a new Chapter 11 into Part 2 of ITEPA 2003. It allows HMRC to recover unpaid PAYE and Class 1 NIC from any "relevant party" in a labour supply chain - typically the recruitment agency, or the end client in certain scenarios - if an umbrella company fails to pay it [1] [3].

When does umbrella company JSL take effect?

6 April 2026. The rules apply to payments made on or after that date for services undertaken by umbrella company workers, under a new Chapter 11 of Part 2 ITEPA 2003 [3] [6].

Can a recruitment agency avoid JSL by doing thorough due diligence on its umbrella providers?

No, not entirely. HMRC has confirmed directly, in response to a question on exactly this point, that full due diligence does not remove an agency's liability if the umbrella still fails to pay the tax owed [7]. Due diligence reduces the practical risk of choosing a non-compliant provider and creates a defensible record, but it is not a statutory defence.

Who is liable if there is no recruitment agency in the supply chain?

The end client. Where a worker is engaged through an umbrella company directly, with no agency involved, the end client becomes the relevant party HMRC can pursue for unpaid PAYE and NIC [3].

Does JSL apply to IR35 or off-payroll working through a personal service company?

No. JSL specifically targets PAYE and NIC compliance in umbrella-company labour supply chains. IR35 and the off-payroll working rules for personal service companies remain a separate regime and are not directly affected by this legislation [5].

How much tax non-compliance is HMRC trying to address with this reform?

HMRC estimates at least 700,000 workers used umbrella companies in 2022-23, with at least 275,000 engaged by non-compliant providers, and that £500 million was lost to disguised remuneration schemes that year, almost all facilitated through umbrella arrangements. The reform is expected to protect around £2.8 billion in tax revenue by 2029-30 [4].

Does using an FCSA-accredited umbrella company remove my agency's liability?

No. FCSA accreditation does not transfer or remove the statutory liability from your agency. What it does is demonstrate the provider has been tested against payroll, tax and worker-rights codes and is subject to ongoing reassessment, which reduces practical risk and helps build a defensible due-diligence trail [8].

How does boilr help agencies respond to umbrella company reform?

boilr.ai tracks your client and prospect accounts and flags relevant signals, such as contract or temp headcount growth, so consultants see when a client is exposed to umbrella compliance risk or worth a proactive conversation. Company Brain keeps that context as shared agency memory, and Tasks turns it into a verification-ready outreach draft. It is not a substitute for PAYE checks, FCSA verification or qualified employment tax advice.

Sources

Information sourced from official UK government guidance, law firm and accountancy briefings, industry bodies and trade press as of August 2026.

Back to all articles