Umbrella reform: HMRC now comes to your agency first

An umbrella company in your supply chain deducts PAYE from a worker's wage and never sends it to HMRC. Under the rules that took effect on 6 April 2026, HMRC does not chase the umbrella for that money first. It comes to your agency, for the whole amount.

That is not a reading of the legislation. It is how HMRC describes its own approach: joint and several liability "will allow HMRC to pursue an agency in the first instance for any payroll taxes that a non-compliant umbrella company fails to remit to HMRC on their behalf."¹

HMRC's live guidance for agencies, updated in June once the rules were in force, puts it in one sentence with no hedging: "If we find an umbrella company has not paid the correct amount of PAYE to us, we'll recover it from you."³

Most of what has been written about this reform was written for accountants, and most of it landed before the rules were live. Five months in, the question for an operator is narrower. What do you need to be able to see, and how fast, to avoid learning about a default from a determination notice.

What actually changed on 6 April

The Finance Bill 2025-26 added a new Chapter 11 to Part 2 of the Income Tax (Earnings and Pensions) Act 2003. Where an umbrella company sits in a labour supply chain, the umbrella and a "relevant party" are jointly and severally liable for the PAYE due on payments to the worker.²

The relevant party is the employment agency that contracts with the end client. Where there is no agency in the chain, it is the end client instead. Joint and several means HMRC can take the entire amount from one party and leave that party to chase the others through the civil courts. The mechanism is a Regulation 80 determination, and it is addressed to you.² HMRC sets out how the amount itself is worked out in its own manual.⁴

You are not the backstop in this arrangement. You are the first door HMRC knocks on.

Why "our umbrella has always been fine" stopped being a position

Around 700,000 people in the UK are paid through umbrella companies.¹ HMRC forecasts this measure will bring in between £155 million and £715 million a year, which is a reasonable proxy for the size of the leak it was written to close.¹ That money is not going missing at the margins.

The reform did not make umbrella companies riskier than they were in March. It moved who pays when one of them fails. And the exposure does not fall with the number of providers you use. An agency running everything through one long-standing umbrella has concentrated the risk rather than reduced it, because a single default now lands whole, on one balance sheet, with no one else in the chain to share it.

What due diligence still buys you, and what it never will again

This is the part worth reading twice. Chapter 11 works on a strict liability basis. In Deloitte's analysis of the drafting, "a relevant party cannot discharge the liability through a reasonable excuse or care taken in prevention," which is a deliberate departure from the reasonable-care test that operators are used to under Chapter 10 and IR35.²

Read plainly: the due-diligence pack you signed at onboarding does not reduce what HMRC can collect from you by a single pound. It never will. That does not make checks worthless, but it does change what they are for.

The four checks, ordered by how fast they pay off

None of these need new software to start. The first one can be run this month against exports you already hold.

1. Reconcile what you paid against what was reported, per worker, per period

   This is the only check that can surface a default in the cycle it happens rather than a year later. The question is not whether a provider is compliant in the abstract. It is whether, for this worker and this week, the money you paid out matches what the intermediary reported. It is the same reconciliation that surfaces ghost workers on your own payroll, run against a different list.

2. Turn the approved-intermediary list into a block at the point of booking

   A register that a coordinator can place around is a document, not a control. If an unapproved umbrella can receive a placement at 7am because a shift needed filling, you will find out at audit.

3. Put a date on everything

   Because there is no reasonable-care defence, your records are not there to excuse the liability. They are there to prove when you spotted a problem and what you did next, which is what a recovery claim against another chain party will turn on. The artefacts worth retaining are listed separately.

4. Run the reconciliation on a schedule nobody controls

   A monthly job that fires whether or not anyone remembers, with the output going to someone outside the branch being reconciled. A check the reconciled party can quietly skip is not a check.

The full evidence model, including which artefacts to retain and why each one matters under joint liability, is set out on our UK umbrella reform page. This post is about the speed of detection. That page is about the records. The build that produces both is the attendance-to-payroll loop, because a per-worker payment trail is a by-product of reconciling attendance once rather than retyping it. HMRC also publishes its own labour supply chain assurance guidance, which is worth reading alongside your own controls.⁵

What this looks like if you do nothing

Nothing happens, for a while. Umbrella defaults are not announced. The worker is paid, the deduction appears on their payslip, and the gap between what was deducted and what was remitted sits somewhere you are not looking. The reform did not create that gap. It decided who pays for it, and it chose you.

None of this is tax or legal advice, and your own supply chain is the thing that matters rather than the general shape of the rules. Take the legal position from your advisers. The operational position is simpler: the sooner you can see a mismatch, the more choices you still have.

If you operate outside the UK as well, this is one of several dated obligations pulling in the same direction. We track them on the compliance page, including the EU Platform Work Directive and Dutch Wet DBA enforcement, both of which ask for the same thing this reform asks for: records that show what actually happened to a worker and a payment.

You cannot audit your way out of this one. You can only find out early enough to still have a choice.The rule, in one line