Umbrella company compliance: the 2026 debt transfer trap

Umbrella company compliance used to seem so simple. For years, the comforting line has been: “We use an umbrella provider, so they are responsible for PAYE and NIC.”

These days, that belief is risky.

HMRC’s direction of travel is clear. The government has highlighted the staggering scale of non-compliance – including £500 million lost to disguised remuneration schemes (almost all facilitated by umbrella companies) and hundreds of millions more lost through mini-umbrella company (MUC) fraud and other schemes that abuse umbrella structures.

To close that gap, the focus is shifting. Rather than chasing “rogue” umbrella companies that vanish after the event, the new rules make it easier to collect from the parties higher up the labour supply chain who have the assets to pay.

That creates the Umbrella Debt Transfer Trap. This article explains how this trap occurs, what the new rules achieve, and what a sensible, defensible response looks like.

What is an umbrella company?

An umbrella company employs a contractor and runs their pay through PAYE. This is done even though the contractor works day-to-day for the end client (often via an agency). It’s designed to reduce admin in the supply chain by putting contractors on the umbrella’s payroll, so the end client doesn’t repeatedly have to set up short-term workers as employees.

From 6th April 2026, new legislation in the Income Tax (Earnings and Pensions) Act – otherwise known as ITEPA 2003 – introduces definitions and rules aimed specifically at umbrella arrangements. The key point for end clients is straightforward: if PAYE and NIC are not accounted for properly by the umbrella, HMRC can pursue other relevant parties in the supply chain for the full amount that should have been paid.

Don’t treat umbrella companies as a compliance ‘buffer’

Many end clients treat umbrella companies as a compliance buffer, assuming the risk lies entirely with them.

However, HMRC is focused on outcomes rather than intent. If PAYE and NIC are not being accounted for properly somewhere in the chain, the key question becomes: where can the debt realistically be recovered?

That’s why joint and several liability (JSL) matters. It changes the old assumption that liability stops at the umbrella company. HMRC operates as a creditor like any other – it will pursue the most realistic route to recovery. In a complex supply chain, this means the “relevant parties” in the chain, including the recruitment agency and, in some cases, the end client (i.e. you!)

What “joint and several liability” means in the real world

Joint and several liability is a recovery tool. Where an umbrella company fails to account for PAYE and NIC correctly, HMRC can pursue another relevant party.

For end clients, the practical implications are uncomfortable:

• No automatic “we did our checks” protection. The rules are mainly designed to ensure HMRC can recover unpaid tax. So even if you’ve carried out sensible due diligence on the umbrella company, HMRC may still issue an assessment to the agency or end client if PAYE/NIC goes unpaid. Due diligence still matters – but it doesn’t guarantee you’re protected.
• The “deep pocket” reality. HMRC prioritises speed of recovery. It will often focus on the entity with the most accessible assets – which can be the end client.
• The ESM2400 Manual. HMRC’s updated Employment Status Manual (ESM2400 onwards) sets out how these rules are intended to operate in practice, including examples of who counts as a “relevant party”.

The double payment scenario: paying the umbrella, then paying HMRC

What catches some people off guard is the double payment dynamic.

You pay for labour through the usual route – the umbrella company invoices via the agency and everything appears “in order”. The umbrella should then operate PAYE and NIC correctly. But if it pockets the funds, “phoenixes” into a new entity, or collapses, a tax gap opens up.

In these situations, HMRC’s attention will move up the chain. In many cases, the end client is the most realistic route to recovery, so you can end up paying:

• Once to the supply chain for the labour cost.
• Again to HMRC for the tax that should have been paid.

That’s why umbrella company compliance is balance sheet risk, not a paperwork issue.

The true cost: it’s rarely just “the missing PAYE”

The final bill is rarely just the tax that’s owed. Typically you’ll have to pay:

• Interest – backdated and accruing.
• Penalties – based on behaviour. As a guide, careless errors attract 0–30%, deliberate errors 20–70%, and deliberate and concealed errors up to 100% of the extra tax due.
• Internal and reputational costs – senior management disruption and the risk of being linked to tax avoidance.

“Accredited” does not mean “safe”

Even if an umbrella company has trade-body accreditations and impressive testimonials, these are not the same as HMRC approval. If a provider turns out not to be PAYE compliant, HMRC will focus on the unpaid tax. They won’t be interested in whether the umbrella company has third-party accreditations.

Red flags that end clients should treat as urgent

Common umbrella company compliance warning signs that you should investigate immediately include:

• Unusually high take-home pay compared to what you’d expect via PAYE
• Papers that don’t reconcile – payslips, invoices, and bank payments that don’t match.
• Non-taxable elements – any hint of “loans”, “advances”, or “credit facilities”.
• Unnecessary complexity – multiple linked entities or offshore links.
• A lack of transparency – reluctance to provide payroll reporting or RTI evidence.

What to do now about umbrella company compliance

When it comes to umbrella company compliance, your goal is defensibility. You should be able to map your supply chain and describe, in one sentence, exactly where PAYE is operated and what evidence you hold that it is correct. To do this correctly, you should:

• Map your full supply chain so that you know every entity involved.
• Strengthen your contracts to include meaningful audit rights and indemnities.
• Review evidence rather than branding – always reconcile payslips and payment flows.
• Make sure that red flags are handled by your finance or legal teams, and not just by procurement.

Need help with umbrella company compliance? Speak to THP

If you’re an end user of umbrella companies, we suggest you check your supply chain as soon as possible.

If you have any questions about umbrella company compliance, JSL exposure, or what “reasonable care” looks like in practice, please talk to THP. We can help you review your supply chain and identify any weak areas that could cause problems in the future.