UK SSP Penalties: What Actually Happens When You Get It Wrong

The Fair Work Agency can fine you double what you underpaid in SSP, up to £20,000 per employee. But here's what catches teams out: they can come after six years of back payments all at once.

If you're running UK payroll for a mid-market company, whether directly or through an Employer of Record, the stakes just got higher. One wrong eligibility setting that hits ten employees for six months? You could be looking at £39,000 before you even call your lawyer. These mistakes surface faster now through data sharing between agencies, and when they do, the bills are bigger.

Let me walk you through what you'll actually face: the penalties, how they find you, and who pays when your EOR is involved.

The Numbers That Keep Finance Teams Up at Night

UK SSP underpayment penalties can hit 200% of what you underpaid, per worker. We've seen this catch out even careful teams.

The per-worker penalty cap is £20,000 under the current penalty framework.

They can dig back six years for SSP arrears under wage claim rules. That's six years of records you need to have ready, six years of calculations they'll scrutinise.

A worked scenario where SSP is underpaid by £50 per week for 10 employees over 26 weeks produces a total SSP shortfall of £13,000 before penalties or legal costs.

In that same scenario, a maximum 200% penalty would add up to £26,000, taking combined exposure to £39,000 before interest and advisory costs.

The Fair Work Agency publishes names of non-compliant employers. Once you're on that list, expect calls from procurement teams, candidates asking questions, and board members wanting answers.

When an EOR is the legal employer, they receive enforcement notices, but contractual indemnity terms determine whether costs pass through to the client company.

How These Penalties Actually Work in Practice

The penalty structure for SSP underpayment operates on a percentage basis tied to the shortfall amount. Employers who fail to pay the correct SSP can face penalties calculated at up to 200% of the underpaid amount for each affected worker. This means a £500 shortfall per employee could attract an additional £1,000 penalty per employee.

The £20,000 per-worker cap provides some ceiling on individual cases, but the real exposure comes from multi-employee scenarios. A systemic payroll configuration error affecting your entire UK workforce multiplies quickly. The penalty scales linearly with headcount until each worker's calculated penalty reaches the cap.

The six-year lookback is where teams get caught. Civil recovery for wage deductions works on a multi-year basis, so an enforcement action in 2026 can demand corrections back to 2020. This is why you need six years of clean records: absence data, eligibility decisions, calculation workings, the lot.

How Does the 200% Penalty Calculation Work?

The penalty percentage applies to the SSP shortfall, not to the employee's total wages or your overall payroll. If an employee was entitled to £116.75 per week in SSP but received £66.75, the weekly shortfall is £50. Multiply that by the weeks of absence, then apply the penalty percentage.

For a 26-week absence, that £50 weekly shortfall becomes £1,300 per employee. A 200% penalty adds £2,600, bringing the per-employee exposure to £3,900. With ten employees affected by the same calculation error, you're looking at £39,000 before you've paid a solicitor or attended a single hearing.

The per-worker cap of £20,000 only kicks in when the calculated penalty exceeds that threshold. In the example above, the £2,600 penalty per worker is well below the cap, so the full amount applies. The cap becomes relevant in cases involving longer absences or higher shortfall amounts per pay period.

What Does a Worked Example of SSP Exposure Look Like?

Consider a mid-market company with 200 UK employees where the payroll system incorrectly applies the three-day waiting period that was eliminated in April 2026. Every employee who takes sick leave loses three days of SSP they're now entitled to receive.

If ten employees take sick leave averaging 26 weeks each, and the daily SSP rate is approximately £24.65 for a 5-day week, the three-day error creates a shortfall of roughly £74 per absence. But the error compounds because the system also miscalculates qualifying days for employees with irregular schedules.

The actual shortfall per employee averages £50 per week over 26 weeks, producing £1,300 per worker. For ten employees, the total arrears are £13,000. At the maximum 200% penalty rate, the penalty adds £26,000. Combined exposure: £39,000.

Now consider that the same configuration error has been running since the system was set up in 2021. The six-year lookback means every affected employee from that period could be included in an enforcement action. If 30 employees were affected over five years with similar absence patterns, the exposure multiplies accordingly.

Why Do Multi-Employee Cases Create Disproportionate Risk?

SSP errors rarely affect just one person. When an eligibility rule is misconfigured, a waiting-day calculation is wrong, or qualifying-day logic doesn't account for variable schedules, the error replicates across your entire payroll population.

Teamed's analysis of payroll controls finds that single-employee SSP errors are typically bounded by that employee's absence duration. Systemic configuration errors, however, create multi-employee exposure that scales by headcount and pay periods. A mid-market employer with 200 to 2,000 employees can accumulate significant exposure quickly because the same error affects everyone who takes sick leave.

The per-worker penalty structure means your total exposure is essentially headcount multiplied by average shortfall multiplied by penalty percentage. There's no volume discount for making the same mistake repeatedly.

What Happens When the Fair Work Agency Comes Knocking

It usually starts with an employee complaint. Someone notices their SSP looks wrong, calls ACAS or complains directly, and suddenly you have an investigation. The FWA also spots patterns in payroll submissions or gets tipped off by other agencies when something looks off.

The investigation phase involves document requests. You'll need to produce absence records, payroll calculations, SSP eligibility assessments, and evidence of how qualifying days were determined. If your absence recording is inconsistent across UK sites or teams, this is where problems surface.

Following investigation, the FWA issues an assessment of arrears owed and any applicable penalty. This comes as a formal enforcement notice requiring repayment within a specified timeframe. The notice details the calculation methodology, the employees affected, and the penalty amount.

When Appeals Help (And When They Just Burn Time)

Employers can appeal enforcement notices, but the appeal process requires you to demonstrate either that the calculation is factually incorrect or that you had a reasonable basis for your SSP decisions. The burden of proof shifts to you to show your payroll practices were compliant.

Appeals require documentation. You'll need to produce the evidence pack that demonstrates how you calculated SSP, why you made specific eligibility decisions, and what controls were in place. If your records are incomplete or your processes were informal, the appeal becomes significantly harder to sustain.

The practical reality is that most appeals focus on penalty reduction rather than complete reversal. If you can demonstrate good faith efforts at compliance, prompt remediation once the error was identified, and cooperation with the investigation, you may achieve a lower penalty percentage. But the arrears themselves are harder to dispute if the calculation error is clear.

Can the Fair Work Agency Publicly Name Non-Compliant Employers?

Getting named publicly is separate from the fine. The Fair Work Agency publishes employer names when they find underpayments, including SSP. It's their way of making examples.

The naming threshold isn't purely financial. Employers can be named for underpayments that might seem modest in absolute terms but demonstrate systemic non-compliance or disregard for worker rights. The reputational impact often exceeds the financial penalty, particularly for companies in regulated industries or those with public-sector contracts.

For mid-market companies, public naming creates downstream effects beyond embarrassment. Procurement processes increasingly include labour compliance checks. Potential employees research employer reputations before accepting offers. Customers in certain sectors care about supply chain ethics. A naming decision can affect your ability to win contracts, hire talent, and maintain customer relationships.

How Does Naming Risk Affect Companies Using an EOR?

When you employ UK workers through an Employer of Record, the EOR is the legal employer that appears on payslips and HMRC records. If the EOR is named for SSP non-compliance affecting your workers, your company name may not appear in the public notice.

But reputational damage doesn't follow legal structures neatly. If your workers know they're employed through an EOR arrangement, and that EOR is publicly named for underpaying them, the association with your company is obvious. Your workers will know. Your competitors may know. Your customers may find out.

The practical question becomes whether your EOR agreement addresses naming risk and what remedies you have if your provider's compliance failures create reputational exposure for your business. Most standard EOR contracts don't explicitly cover this scenario.

Who Gets the Letter and Who Writes the Cheque

The legal employer receives the enforcement notice. In an EOR arrangement, that's the EOR provider, not your company. The EOR is responsible for operating PAYE payroll and statutory payments like SSP as the legal employer, even though you control day-to-day work and absence reporting.

But getting the enforcement notice and paying for it are two different things. Your EOR agreement has clauses buried in there about who pays when things go wrong. Those clauses decide whether you or your provider writes the cheque.

Teamed's analysis of EOR contracts finds that indemnity terms vary significantly across providers. Some agreements make the client responsible for any costs arising from information the client provided, including absence data. Others allocate responsibility based on whose error caused the problem. Still others are ambiguous enough that disputes become inevitable.

What Should Your EOR Contract Say About SSP Liability?

A compliance-first EOR agreement should explicitly address SSP calculations, SSP funding, penalties, and defence costs. You need clarity on several questions.

Who is responsible for configuring SSP eligibility rules correctly? If the EOR's payroll system miscalculates qualifying days, is that their error or yours? Who funds SSP payments, and is there a reconciliation process to ensure the amounts are correct? If an enforcement notice arrives, who pays the arrears, who pays the penalty, and who pays the legal costs to respond?

The absence of explicit terms doesn't mean you're protected. It means you'll be negotiating these questions under pressure when an enforcement action is already underway. That's not a position you want to be in.

If your current EOR agreement doesn't explicitly allocate responsibility for SSP compliance, Teamed recommends a contract renegotiation before the first FWA enforcement actions land. The time to clarify these terms is before you need them.

Controls That Stop SSP Issues Becoming Six-Year Problems

Start with a payroll audit that tests your SSP setup. Check who decides eligibility and how. If it's managers making judgment calls without clear rules, you have a problem. The biggest SSP disasters we see come from different sites applying different rules to qualifying days and waiting periods.

Examine your absence recording controls. Is sickness reporting handled consistently across UK sites and teams? Inconsistent capture of day-one and qualifying-day information creates calculation errors that replicate across your workforce. Centralised absence recording with clear approval workflows reduces this risk.

If you're using an EOR, request written confirmation of how they calculate SSP for your employees. Ask for documentation of their eligibility rules, their qualifying-day logic, and their process for handling employees with irregular schedules. If they can't provide clear answers, that's a red flag.

What Internal Controls Reduce SSP Risk?

Manager training matters more than most employers realise. Line managers are often the first point of contact when employees report sickness. If managers don't understand what information needs to be captured and when, the data feeding your payroll system will be incomplete or incorrect.

Documented approval workflows create audit trails. When an SSP eligibility decision is made, there should be a record of who made it, what information they considered, and what the outcome was. These records become your evidence pack if an enforcement action occurs.

Regular reconciliation catches errors before they compound. Compare your SSP payments against absence records monthly, not annually. A small calculation error identified in month one is a minor correction. The same error identified in year three is a six-figure problem.

What Does This Mean for International Employers with UK Staff?

For European headquarters employing UK staff, SSP compliance risk is operationally driven. UK statutory sick pay is administered through payroll rather than through a separate social security institution paying the worker directly. This means your UK payroll configuration is the control point, not your employment contracts.

If you're using an EOR for UK hires because you don't yet have the internal capability to maintain UK payroll and statutory absence compliance, that's a reasonable structure. But the EOR arrangement doesn't eliminate your risk. It transfers the operational responsibility while potentially leaving you with financial exposure through indemnity clauses.

Teamed's work with mid-market companies expanding into the UK consistently finds that SSP compliance requires attention to inputs, approvals, and audit trails. The employment contract establishes the relationship, but the payroll engine and absence workflow determine whether you're compliant.

For companies approaching the threshold where establishing a UK entity makes sense, direct control of SSP configuration becomes a core operational capability rather than an outsourced function. Teamed's graduation model helps companies identify when that transition point arrives, ensuring you're in the right structure for where you are while building toward where you're going.

If you're not sure your UK setup can handle SSP compliance, or if your EOR contract is vague about who pays when things go wrong, talk to an expert who can review your specific situation before you find out the hard way.