Umbrella Company Liability Has Already Shifted. Here's What's Coming Next.

Since 6 April 2026, HMRC has been able to recover unpaid PAYE and National Insurance from your organisation - not just from the umbrella company that failed to pay it. That's already live. What's coming in 2027 is bigger: statutory regulation of the umbrella sector itself, and early signals suggest the current defence most businesses rely on - “we didn't know” - won't hold up.

Here's what's changed, what's proposed for 2027, and where the actual exposure sits depending on how your supply chain is structured.

Key Takeaways

• Since 6 April 2026, HMRC can recover unpaid PAYE and NICs from your organisation if an umbrella company in your supply chain fails to pay - not only from the umbrella company itself.
• Liability sits with the agency where one is used in the supply chain, or directly with the end client where there is no agency.
• From 2027, umbrella companies face statutory regulation under the Employment Rights Act 2025, expected to include licensing and a mandatory due diligence requirement.
• Early signals suggest there will be no “reasonable excuse” defence for not knowing about non-compliance further down the supply chain.
• A defensible position rests on three things: visibility of which umbrellas are actually in use, recurring verification of their compliance status, and enforceable contract terms.

Already in Force: Joint & Several Liability

Since April, if an umbrella company in your supply chain fails to pay the correct PAYE or NICs, HMRC can recover the shortfall from further up the chain - the recruitment agency, or your organisation directly if there's no agency involved. Fault isn't the test. Position in the chain is.

• Agency in the chain: HMRC pursues the agency first.
• No agency - direct engagement: liability sits with your organisation.
• Applies whether or not you had any visibility of the shortfall when it happened.

What Actually Triggers It

Liability isn't limited to obvious fraud. It's triggered whenever HMRC can't collect from the umbrella company itself - which covers a wider range of scenarios than most procurement teams assume:

• The umbrella company becomes insolvent before settling its PAYE liability.
• Deliberate tax avoidance or non-compliance further down the chain.
• Straightforward non-payment or miscalculated NIC contributions - no intent required.

2027: The Bigger Change Most Businesses Aren't Tracking Yet

JSL is a tax-collection measure. What's coming in 2027 is structural: the Employment Rights Act 2025 brings umbrella companies under statutory regulation for the first time, placing them under broadly the same conduct standards that already apply to recruitment agencies. Three developments are worth knowing now, while the detail is still being consulted on:

• Enforcement moves to the Fair Work Agency (FWA) - a new body expected to absorb existing enforcement functions, including labour-supply licensing along the lines of the current GLAA regime. Industry expectation is that umbrella companies will need to be licensed or formally approved to operate.
• Government has said it's “minded to introduce” a statutory due diligence requirement - turning what's currently good practice into a legal obligation, with penalties attached for businesses that can't evidence it.
• Early signals point to no “reasonable excuse” defence being available. Businesses won't be able to argue they didn't know what was happening further down their own supply chain - which is precisely the defence most current due diligence processes are quietly built on.

None of this is finalised - secondary legislation and statutory guidance are still to come. But the direction of travel is settled, and it points the same way JSL already has: toward the end client and agency carrying more of the risk, not less.

Where The Exposure Actually Sits

• Direct engagement, no agency: you carry the liability outright, and will likely carry direct regulatory obligations under the 2027 framework too.
• Sourced through an agency: the agency is HMRC's first point of contact, but a non-compliant supply chain remains a governance risk your organisation owns - and one a board would reasonably expect to be visible.
• MSP or multi-tier arrangements: liability generally sits with the party closest to the end client, but the 2027 due diligence requirement is expected to demand visibility across every tier, not just the one you contract with directly.

Building A Position That Holds Up To Scrutiny

Whatever your structure, a defensible position rests on three things:

Visibility

Knowing which umbrella companies your contractors are actually using today, not which ones were approved when the relationship began.

Verification

Evidence of each provider's compliance status, checked on a recurring basis rather than once at onboarding.

Enforceability

Contract terms with agencies and umbrellas that require ongoing compliance, with a clear process if a provider's status changes.

Most gaps we see aren't the result of bad decisions - they're the result of a check that was done once, correctly, and never repeated.

Why This Isn't Likely To Ease Off

HMRC has estimated that non-compliance in the umbrella company market costs the Exchequer at least half a billion pounds a year. That's the underlying reason enforcement has moved from consultation to legislation twice in two years - and why the sensible planning assumption is further tightening, not a pause.

If you use umbrella contractors and haven't reviewed your arrangements in the last six months, now is the time.

Get in touch for more information, here.

FAQs

We already have an approved supplier list - does that cover us?

It's a starting point, not a defence on its own. Most exposure comes from how current the list is and whether it's actively re-verified, not from whether one exists. A list built two years ago and never revisited won't meet the due diligence standard proposed for 2027.

Is this the same as IR35 or off-payroll working rules?

No. IR35 concerns employment status determinations. JSL and the 2027 framework concern who's liable, and who's regulated, when an umbrella company in the chain doesn't meet its obligations. Many businesses are managing both at once.

What's a realistic timeline to prepare?

Start now. JSL is already live, so the immediate priority is closing gaps in visibility and verification. The 2027 framework raises the bar again, but a due diligence process built to today's standard largely carries you into the next phase.

What should we do first?

Map your actual supply chain - which umbrella companies your contractors use today. From there, Owen Daniels can help you build a due diligence and contract review process that stands up to scrutiny under both the current and incoming rules.