Umbrella Companies and the New PAYE Liability Rules: What NHS Finance Teams Need to Know

From 6 April 2026, the rules governing umbrella company arrangements change significantly. New legislation introduces joint and several liability across labour supply chains – meaning NHS organisations and other end clients can now be held directly responsible for unpaid PAYE and National Insurance, even when those obligations nominally sit with an umbrella company or agency.

In a webinar held on 1 April 2026, Alastair Kendrick (AK Employment Tax Services Limited), walked NHS finance professionals through the practical implications of these changes, the financial risks involved, and the immediate steps finance teams should be taking to protect their organisations.

The key message shared with attendees was clear: financial risk has shifted firmly to the end client, and it’s essential to ensure that employment tax compliance is robust for all NHS organisations.

What’s changing, and what’s not…

The headline change is the introduction of explicit joint and several liability. Under the new rules:

• End clients (including NHS Trusts) can be pursued directly by HMRC for unpaid PAYE and National Insurance where an umbrella company or agency has failed to operate them correctly.
• HMRC has made clear it will actively pursue agencies and end clients, not just umbrella companies – in large part because many umbrella companies lack the assets to cover significant tax debts.
• The rules apply broadly to any labour supply arrangement, including limited companies and offshore intermediaries supplying workers.

Importantly, IR35 rules are not changing. Employment status assessments and CEST processes remain the same. Umbrella companies can still be used, but only where robust and ongoing compliance checks are in place.

Where the financial risks really sit

The scale of potential liability should not be underestimated. Exposure for end clients includes:

• Backdated PAYE and National Insurance contributions
• Interest and financial penalties on unpaid amounts
• In the most serious cases, liabilities running into hundreds of millions of pounds.

HMRC is particularly focused on what Alastair described as common avoidance models; most notably arrangements that pay workers at minimum wage through the payroll while topping up their income with tax-free ‘loan’ payments, a practice known as disguised remuneration.

A word of caution was also shared regarding HMRC’s ‘name and shame’ list: featuring on that list is not a guarantee of compliance. Independent due diligence is always required, regardless of whether a supplier appears on any approved or published register.

There is also a criminal dimension to be aware of. Once an NHS organisation identifies non-compliance and fails to act, it may become exposed to risk under the Criminal Finance Act. The obligation to act – and act promptly – is now a legal one.

The steps finance teams should be taking now

In our webinar, both speakers were clear that this is not a situation where finance teams can afford to wait. Below are the practical steps recommended for NHS organisations:

• Create and maintain a central register of all labour suppliers, covering agencies, umbrella companies, limited companies, and offshore entities.

Finance should own this register and ensure it is kept up to date. HR and Procurement should work closely alongside Finance to identify all supplier relationships.

• Carry out regular sample checks of worker payslips.

Quarterly checks are recommended as a minimum. Finance teams should verify that PAYE and National Insurance deductions are being applied correctly and consistently.

• Obtain written confirmation of PAYE and NI payment compliance from your suppliers.

This should be a standard part of supplier management. Written evidence provides a degree of protection and creates a clear audit trail.

• Treat refusal to provide evidence as a red flag, and act on it.

If a supplier declines to demonstrate compliance, the arrangement should be terminated. Reluctance to share payslip data or written confirmation is a serious warning sign that should not be ignored.

Key Dates

• 6 April 2026: New joint and several liability legislation comes into force.
• Earlier periods remain at risk: HMRC may still investigate activity prior to April 2026 where there is evidence of negligence or fraud.

Your next steps begin now…

These changes represent a fundamental shift in where employment tax risk sits within labour supply chains. NHS finance teams that have historically treated umbrella company compliance as an HR or Procurement matter now need to take ownership of it.

The good news is that the steps required are manageable. A central supplier register, routine payslip sampling, and written compliance confirmations are practical, proportionate measures – and they are now essential.

For organisations that have not yet reviewed their labour supply arrangements, the time to act is now.