Who is liable if an umbrella company does not pay PAYE?

Who is liable if an umbrella company does not pay PAYE?

The umbrella company remains the employer, and the primary duty to run PAYE properly still rests there. Once it fails, HMRC starts looking for the relevant party. Which business that turns out to be depends on the shape of your contractual chain.

What counts as a connection is not left to interpretation. Section 993 of the Income Tax Act 2007 supplies the meaning, so common ownership or control will satisfy it. Where the client and the contracting agency both sit outside the UK, HMRC works down to the UK agency closest to the client.

ESM2420 confirms that HMRC will pursue the relevant parties for unpaid amounts. It leaves room to pursue the umbrella company where that is appropriate. None of this turns on fault. A business that paid every invoice on time, suspecting nothing, can still open the post to find an assessment.

Does due diligence protect you if the umbrella company defaults?

It does not. No statutory defence exists for due diligence, supplier audits, or membership of an accreditation scheme. Neither the GOV.UK guidance nor the Employment Status Manual offers a reasonable care let-out. Should the umbrella company in your chain fail to pay, you are liable however carefully you chose it.

Clients find this hard to accept, so it is worth setting out what checks actually buy. They lower the odds of contracting with a bad operator in the first place. They also give you something to put in front of HMRC about your own conduct. What they will not do is extinguish a liability that has already crystallised.

A harder consequence follows from those words, joint and several. Suppose you have paid the umbrella company the gross amount, tax included, and the umbrella company simply keeps it. HMRC can still collect that unpaid PAYE from you. Your money has gone and the liability survives. Recovery then means a civil claim against a business that has just demonstrated it does not pay what it owes.

For a sense of scale, HMRC’s own estimate puts the Exchequer gain at £715 million in 2026 to 2027. That says something about how actively these powers are likely to be used.

What changed under the umbrella company rules in April 2026

Until 6 April 2026 the umbrella company carried the PAYE liability by itself. Whatever went wrong further down the chain stayed down the chain. Agencies and hirers faced reputational risk and little else.

That protection has gone. HMRC’s guidance now puts it plainly: where an umbrella company has not paid the correct amount of PAYE, HMRC will recover it from the agency or the end client. On the income tax side the change arrived through Finance Bill 2025-26, inserting a new Chapter 11 into Part 2 ITEPA 2003. The National Insurance side runs through regulations made under section 4A of the Social Security Contributions and Benefits Act 1992.

Three things decide whether you are in scope:

1. Whether the worker was paid on or after 6 April 2026. If so, the rules apply, whenever the contract was signed.
2. Whether the chain is new or existing, because both are covered and nothing has been grandfathered.
3. Whether you knew an umbrella company was involved, which turns out not to matter at all.

Certain arrangements do sit outside the rules. These include workers using their own personal service company under the off-payroll working and IR35 rules. Managed service company arrangements, salaried members of an LLP, and workers already treated as employed by an agency also fall outside. None of that amounts to a safe harbour. ESM2440 sets out the purported umbrella company rules, which can pull an arrangement back into scope where a business gives the impression it employs a worker when it does not.

Why care homes and other direct hirers carry more risk than they realise

Here is the part most coverage skips. For Chapter 11 to apply, the word “umbrella” does not have to appear anywhere.

HMRC’s guidance states that when it refers to an umbrella company, this includes any business supplying labour under a contract of employment. The test sits in ESM2415. An intermediary is an umbrella company where it employs the worker and carries on a business of supplying labour, regardless of what it calls itself.

Picture two care homes, both booking agency nurses, both receiving a weekly invoice that looks much the same.

The first home uses a nursing agency that employs its nurses directly on contracts of employment, with nobody else in the chain. On HMRC’s definition that agency is an umbrella company. Because the home contracts straight with it, the home is jointly and severally liable for any PAYE the agency fails to pay.

The second home uses an agency that introduces nurses employed by a separate umbrella company. Since the agency holds the contract with the home, the agency is the relevant party, and the home is not exposed.

Same sector, same shift, same hourly rate, entirely different tax position. Nothing on the invoice will tell you which one you are, and in our experience almost nobody has asked. When we put the question to one client’s agency earlier this year, a straight answer took eleven days to arrive.

HMRC expects around 30,000 agencies and 400 umbrella companies to be affected, covering roughly 700,000 workers. Social care feels it first, because direct booking is normal there. The same logic reaches construction, logistics, warehousing and hospitality.

The due diligence questions we put to an agency

Below is the list we work through before a client signs or renews. The first four establish your position in the statute. Numbers five to seven mirror the contract clauses HMRC suggests businesses consider.

1. Who employs the worker, and on what kind of contract? We want the employing entity’s name and company number.
2. Is anyone else in the chain between us and that entity, and if so, who are they?
3. Are you connected to the employing entity within the meaning of section 993 of the Income Tax Act 2007?
4. Is every entity in the chain UK resident?
5. Will you give us the payslip of a named worker of our choosing, on request?
6. Will you show evidence of PAYE returns filed and payments actually made to HMRC? Deductions shown on a payslip are not what we are asking for.
7. Do you sub-contract any part of the supply, and will you obtain our written authorisation first?
8. Does the employing entity appear on HMRC’s published list of named tax avoidance schemes, promoters, enablers and suppliers?
9. Do the employing entity’s Companies House filings and financial position match what you have told us?

Question six is usually where the conversation gets interesting. A compliant supplier produces the evidence without fuss, and hesitation is information.

Ask at the outset, then sample again partway through. Chains change quietly, and an answer given in April proves nothing about October.

What an indemnity clause does not achieve

By all means put an indemnity in the contract. HMRC itself suggests agencies seek one from umbrella company directors, and it beats having nothing. Just be clear about what you have bought.

An indemnity does not move the tax liability anywhere. Chapter 11 decides who is jointly and severally liable, and your contract with a supplier does not bind HMRC.

The running order is the real difficulty. HMRC assesses you, you pay, and only afterwards do you start chasing your supplier. By then the money has left your account, and you are an unsecured creditor with a legal bill in front of you.

From there the arithmetic only worsens. An umbrella company that failed to remit PAYE is rarely sitting on the funds to settle your claim. By the time HMRC reaches you it may already be in liquidation. Directors who have given a personal indemnity are harder to walk away from, though you still have to sue them.

Treat the clause as a backstop, and as evidence that you took care. Choosing suppliers you have verified, then checking that the tax keeps reaching HMRC, is what genuinely reduces exposure.

What to do before your next agency invoice

1. Map every entity between your organisation and the worker, noting which one holds the contract of employment.
2. Obtain written confirmation of whether any agency in the chain is connected to the employing entity or sits outside the UK.
3. Add the payslip, PAYE evidence and sub-contracting clauses at the next renewal, rather than losing months waiting for an annual review.
4. Sample a few payslips against what you were invoiced. A correct deduction on a payslip proves a deduction and not a payment.

Keep the answers on file. Since no due diligence defence exists, the point of that file is not to argue the liability away. It is to show HMRC how you conduct yourself, to catch a failing supplier early, and to support any later claim against them. Our payroll and staff benefits guidance covers the employer duties sitting alongside this, and our note on what triggers an HMRC compliance check explains how these reviews tend to start.

Conclusion

Unpaid umbrella company PAYE stopped being somebody else’s problem on 6 April 2026. HMRC can recover it from the agency contracting with the end client, or from the end client where no agency exists. Checking carefully first is no defence. Establish in writing which business actually employs the people working in your building, because that answer decides whether the bill can land on your desk.