Joint and Several Liability for Umbrella Companies: What Agencies and End Clients Need to Know from 6th April 2026
On 6th April 2026, HMRC gained the power to pursue agencies and end clients for unpaid PAYE and National Insurance Contributions when umbrella companies fail to remit statutory deductions. Joint and several liability for umbrella company arrangements is now law, and the enforcement direction published on 17th April 2026 makes clear that HMRC intends to collect aggressively from parties with deeper pockets.
This isn't a theoretical risk. If an umbrella company in your contractor supply chain defaults on £400,000 in PAYE and NIC, HMRC can now pursue your agency, your end client, or both for the full amount. Your contractual indemnities with the umbrella won't stop HMRC knocking on your door. They only determine who you can sue afterwards.
The change didn't attract the attention of the Employment Rights Act, but the exposure is real and immediate, with HMRC expecting to protect £2.8 billion from umbrella non-compliance through these new enforcement powers. If you're using umbrella arrangements anywhere in your contractor supply chain, your liability position changed the moment the Finance Bill 2025/26 provisions came into force.
Quick Facts: UK Umbrella Company JSL Rules
Joint and several liability for unpaid PAYE and NICs on UK umbrella arrangements took effect on 6th April 2026, creating immediate supply-chain exposure for agencies and end clients. HMRC can assess underpaid PAYE for up to 4 years in standard cases, extending to 6 years where HMRC alleges carelessness, and up to 20 years where deliberate behaviour is alleged. End clients can face tax exposure even without a direct contract with the umbrella company, because supply-chain liability attaches through agency-mediated payment structures. Contractual indemnities do not prevent HMRC collection under joint and several liability because HMRC's statutory recovery powers operate independently of commercial risk allocation. The enforcement direction published on 17th April 2026 signals HMRC's intention to pursue early enforcement action to establish precedent.
What Is Joint and Several Liability for Umbrella Companies?
Joint and several liability for umbrella companies is a UK tax enforcement mechanism that allows HMRC to recover unpaid PAYE and employee/employer National Insurance Contributions from any party in a contractor labour supply chain. Under these rules, HMRC doesn't need to exhaust recovery options against the defaulting umbrella before pursuing agencies or end clients.
The statutory change sits within the Finance Bill 2025/26 and closes a gap HMRC has been targeting since the 2020 Off-Payroll Working reforms. Previously, when an umbrella company failed to remit PAYE and NIC, HMRC's primary recourse was against the umbrella itself. If that company was insolvent or had disappeared, the tax revenue was often unrecoverable.
Now, HMRC can pursue the full unpaid amount from any liable party in the chain. The agency that introduced the umbrella. The end client that received the worker's services. Both simultaneously if HMRC chooses. The liability is joint and several, meaning each party can be held responsible for 100% of the debt, not just their proportional share.
This matters because umbrella companies operate on thin margins and some have historically failed to remit statutory deductions, with £500 million lost to disguised-remuneration tax-avoidance schemes facilitated by umbrella companies in 2022-23. When they collapse, the unpaid tax doesn't disappear. It now transfers up the supply chain to parties with assets worth pursuing.
Who Can HMRC Pursue Under the New JSL Rules?
HMRC can pursue three categories of parties under the new joint and several liability rules: the umbrella company itself, recruitment agencies that placed contractors via the umbrella, and end clients who received the worker's services.
The rules apply regardless of whether the engagement is assessed as inside IR35 or outside IR35. The liability trigger is the umbrella's PAYE and NIC default, not the IR35 status determination. An outside-IR35 engagement paid through a non-compliant umbrella creates the same JSL exposure as an inside-IR35 engagement.
End clients face liability even when they have no direct contractual relationship with the umbrella company. If your agency uses an umbrella you've never heard of, and that umbrella fails to remit statutory deductions, HMRC can still pursue you. The supply-chain liability attaches through the agency-mediated payment and employment structure.
This creates a practical problem for procurement and legal teams. You can't manage risk you can't see. Multi-agency contractor supply chains, where each agency introduces its own umbrellas or secondary suppliers, multiply the number of potential failure points—workers with multiple agency relationships are more than twice as likely to be paid through umbrella companies compared to single-agency workers. Each additional intermediary increases the probability of an unknown umbrella entering the chain and triggering collection action.
How Does JSL Work in Practice?
Here's a worked example. An umbrella company processes payroll for 50 contractors placed by a recruitment agency at your organisation. The umbrella defaults on £400,000 in PAYE and NIC over 18 months before anyone notices. The umbrella enters administration with minimal assets.
Under the new rules, HMRC can pursue your organisation for the full £400,000. They can pursue the agency for the same amount. They can pursue both simultaneously. The fact that your contract with the agency includes an indemnity clause doesn't prevent HMRC from collecting from you. It only gives you a contractual claim against the agency after you've paid HMRC.
This distinction between HMRC collection and commercial recovery is critical. HMRC's statutory recovery powers operate independently of how the parties allocate liability between themselves in private contracts. You can have the most comprehensive indemnity clause ever drafted, and HMRC will still pursue you if you're the party with accessible assets.
The practical implication is that indemnities are necessary but insufficient. They protect you from bearing the ultimate economic burden if your counterparty can pay. They don't protect you from HMRC's initial collection action, the cash flow impact, the management distraction, or the reputational damage.
What Does HMRC's 17th April Enforcement Direction Signal?
HMRC's enforcement direction published on 17th April 2026 signals an intent to establish precedent through early enforcement action. The direction outlines HMRC's priorities for pursuing supply-chain liability and makes clear that agencies and end clients should expect active enforcement.
HMRC has just handed agencies the bill, and they're not planning to be polite about collecting it.
The enforcement direction indicates HMRC will prioritise cases involving clear non-compliance patterns, significant unpaid amounts, and parties with recoverable assets. This isn't a theoretical framework waiting for test cases. HMRC has the statutory power and has signalled the operational intent.
The timing matters. HMRC typically pursues early enforcement to establish legal precedent and signal seriousness to the market. Agencies and end clients who assume enforcement will be slow or lenient are miscalculating their risk exposure.
How Should You Review Vendor Contracts and Supply Chains Now?
Joanna Castens, Chief Legal Officer, Teamed: "The end client still remains liable for payroll mistakes, for payroll problems, even though they outsource it to a third party. If clients want to rediscuss their contractual terms, which I would advise for any client to do, especially around liability for payroll mistakes, they now will have little time to go through the legal renegotiations."
The window for contract renegotiation is narrow. Agencies and end clients need to act now, not when HMRC sends the first assessment notice.
Start by inventorying every umbrella company in your supply chain. This sounds straightforward but rarely is. Agencies often introduce umbrellas without explicit end-client approval. Secondary suppliers introduce their own umbrellas. The result is supply-chain sprawl where no single party has complete visibility.
For each umbrella identified, verify their accreditation status with bodies like FCSA or Professional Passport. Request evidence of PAYE and NIC payment compliance, not just registration. Accreditation provides some assurance but isn't a guarantee. The providers that don't do the best job with their payroll will have very little time to adapt.
Contractual updates should address four areas. First, indemnities that explicitly cover JSL exposure with appropriate financial backing. Second, audit rights that allow you to verify PAYE and NIC remittance on demand. Third, breach notification requirements with tight timelines. Fourth, exit clauses that allow immediate termination for compliance failures without penalty.
A defensible umbrella governance process requires documented due diligence, verification of PAYE references, and evidence of real-time remittances. Post-6th April 2026, HMRC can prioritise recovery from parties with deeper pockets. Your documentation of reasonable diligence may influence HMRC's enforcement decisions.
What Are the Alternatives to Umbrella Arrangements?
The JSL rules create a structural incentive to reconsider umbrella usage entirely. Three alternatives deserve evaluation: direct employment, Employer of Record arrangements, and compliant PSC engagements.
Direct employment makes sense when the role is business-critical, expected to last 12 months or longer, and you want full payroll control. You become the legal employer, run PAYE directly, and eliminate intermediary-driven tax risk. The trade-off is administrative burden and the commitment of an employment relationship.
Employer of Record arrangements work when you need to employ people in countries where you have no local entity, or when you want compliant payroll from day one without building local infrastructure. An EOR becomes the legal employer, handling payroll, statutory taxes, and employment compliance while you direct day-to-day work. Teamed operates EOR coverage in 187+ countries with a headline fee of $599 per employee per month and zero FX markup contractually guaranteed.
For Europe and UK mid-market companies, replacing umbrella usage with EOR or direct employment shifts compliance control toward the employer model. This reduces dependency on third-party payroll intermediaries that can fail to remit statutory deductions. Based on Teamed's work with over 1,000 companies on global employment strategy, the Graduation Model provides a framework for moving from contractor arrangements to EOR to owned entities as circumstances warrant.
Compliant PSC engagements remain viable when working practices support genuine independence and contractual terms match those practices, though misclassification risks require careful management. The key is robust status determination and governance under the UK off-payroll framework. PSCs are paid gross, subject to IR35 outcomes, rather than through umbrella PAYE.
The right choice depends on your specific circumstances: the nature of the work, the expected duration, your risk tolerance, and your operational capacity. What's changed is that umbrella arrangements now carry supply-chain liability that didn't exist before 6th April 2026.
Do the JSL Rules Apply to Both Inside-IR35 and Outside-IR35 Engagements?
Yes. Joint and several liability exposure applies regardless of whether a contractor engagement is assessed as inside IR35 or outside IR35. The liability trigger is the umbrella's PAYE and NIC default, not the IR35 status conclusion.
This surprises some organisations that assumed outside-IR35 determinations insulated them from payroll tax risk. They don't. If an outside-IR35 contractor is paid through an umbrella that fails to remit statutory deductions, the end client and agency face the same JSL exposure as they would for an inside-IR35 engagement.
The distinction matters for understanding your risk surface. Every contractor paid through an umbrella creates potential JSL exposure, not just those where you've made an inside-IR35 determination.
Frequently Asked Questions
What is joint and several liability for umbrella companies?
Joint and several liability for umbrella companies allows HMRC to recover unpaid PAYE and National Insurance Contributions from any party in a contractor supply chain, including agencies and end clients, when an umbrella company fails to remit statutory deductions. Each liable party can be pursued for the full unpaid amount.
When did joint and several liability for umbrella companies come into force?
Joint and several liability for umbrella company PAYE and NIC came into force on 6th April 2026 under provisions in the Finance Bill 2025/26. HMRC published its enforcement direction on 17th April 2026.
Who can HMRC pursue under the new JSL rules?
HMRC can pursue umbrella companies, recruitment agencies, and end clients for unpaid PAYE and NIC. End clients face liability even without a direct contract with the umbrella, because supply-chain liability attaches through agency-mediated payment structures.
Do the JSL rules apply to inside-IR35 and outside-IR35 engagements?
Yes. JSL exposure applies regardless of IR35 status. The liability trigger is the umbrella's failure to remit PAYE and NIC, not the IR35 determination. Both inside-IR35 and outside-IR35 engagements paid through non-compliant umbrellas create identical supply-chain exposure.
What is the alternative to using umbrella companies in 2026?
Alternatives include direct employment for business-critical long-term roles, Employer of Record arrangements for compliant employment without local entity infrastructure, and compliant PSC engagements where working practices support genuine independence. Each option shifts compliance control away from third-party payroll intermediaries.
What Should You Do This Quarter?
The JSL rules are live. Your exposure exists now, not at some future enforcement date. Three actions matter immediately.
First, audit your umbrella supply chain completely. Identify every umbrella company touching your contractor workforce, including those introduced by agencies without your explicit approval. You can't manage risk you can't see.
Second, review and renegotiate vendor contracts. Update indemnities, add audit rights, tighten breach notification requirements, and ensure exit clauses allow immediate termination for compliance failures. The renegotiation window is narrow.
Third, evaluate whether umbrella arrangements remain the right structure for your higher-value engagements. For roles where compliance failure would create material exposure, direct employment or EOR may offer a lower-risk path forward.
If you're managing contractor supply chains across multiple countries and want to understand how EOR or direct employment might reduce your JSL exposure, talk to an expert at Teamed. We help mid-market companies determine the right employment structure for each market, then execute it, from first hire to their own presence in-country.
