In July 2025, the Government published draft legislation introducing a new Chapter 11 in Part 2 of the Income Tax (Earnings and Pensions) Act 2003, due to take effect from 06 April 2026. The measure, which will be mirrored for National Insurance Contributions, is designed to address widespread non-compliance in the umbrella company market, which has grown significantly since the rollout of the Off-Payroll reforms in 2021.
HMRC estimates that the tax loss caused by umbrella non-compliance is nearly £1 billion a year. In policy terms, this legislation is the "last resort." For over a decade, the Government has attempted to collaborate with the market—through guidance, collaboration with accreditation bodies, and nudges towards self-regulation—but mischief has persisted. Unregulated umbrellas and mini-umbrella company schemes eroded the Exchequer and distorted fair competition.
The response is statute. We are too far down the legislative path for further policy debate. The Government lost its patience, and the choices have been made. Only minor adjustments remain, and the direction of travel is set.
How legislation is drafted
Legislation is rarely crafted in a single stroke. As Professor Helen Xanthaki, one of the top experts in legislation, legislative drafting, and legislative quality in the UK, the Commonwealth, and the EU, explains in her published books and papers, drafting is phronetic—an iterative process where drafters focus not on perfect form but on effectiveness.
The goal is regulatory impact. Legislative "quality" is not about elegant words, but whether the statute produces the intended outcome. In this case, umbrella legislation is "goal legislation": it tells the market what outcome must be achieved—tax compliance—without prescribing the precise method. How agencies, umbrellas, and clients respond is up to them.
What is Joint and Several Liability (JSL)
At the heart of the new rules is Joint and Several Liability (JSL). This means that if an umbrella company fails to hand over PAYE to HMRC, other parties in the chain—agencies, and in some cases end clients—become equally liable for that tax.
To understand the risk, think of corporation tax. If you owed £1m on 01 January but gave it to someone else to pay on your behalf, you'd remain liable until HMRC received it. If the other party has pocketed the money instead, you'd still be on the hook. That is the essence of JSL: once the tax money is released down the chain, liability lingers until it lands with HMRC.
The challenges faced by the supply chain
For agencies and end clients, this creates a serious dilemma. Until now, umbrellas were viewed as a "zero-risk" outsourcing solution. But under JSL, that is no longer the case. Umbrellas are a "considerable-risk" route, and the risk shifts back up the chain.
Key challenges include:
- Lack of control: Clients and top agencies cannot oversee how umbrellas lower in the chain handle PAYE. They are left in the dark until it can be proven sometime later that the tax was paid, or when it hasn't and HMRC intervenes.
- Audit issues: Unless agencies pay PAYE directly to HMRC under the umbrella's PAYE reference, they cannot be 100% sure that there can never be a tax liability.
- Connected parties risk: If an agency and umbrella are deemed "connected," liability can bounce up to the client without their knowledge. It's not uncommon for non-compliant operators to use shadow directors, which can only be established through the exercise of HMRC's information collection powers.
In short, even diligent businesses could find themselves footing the bill for someone else's misconduct, because the companies are not in complete control of the risk.
Lessons from IR35 with zero risk
The IR35 reforms, which rolled out to the private sector in April 2021, provide a helpful comparison. Under the Off-payroll legislation, clients can control the risk by making their own IR35 status determinations and issuing an SDS to the worker and agency below them, thereby moving the tax risk to the agency.
For firms operating under IR35 regimes, the financial exposure is relatively small—typically under 10% of the fees paid for any individual contractor —due to the tax offsets introduced in April 2024. Crucially, those offsets have reduced the downside risk to a point where it is both manageable and proportionate, making blanket bans on "Outside IR35" contractors far more challenging to justify. It is also unlikely that misclassification will apply across an entire contractor workforce. If HMRC do challenge a firm, the firm also has multiple defences. It's precisely because the IR35 risk is now proportionate—and balanced against clear commercial benefits—that firms increasingly view "Outside IR35" engagements as a legitimate and sustainable option.
It's only due to the manageable risk balanced with commercial considerations that firms will still consider hiring contractors on an "Outside IR35" basis.
The Umbrella legislation is a different beast. If an umbrella fails to hand over PAYE/NIC, the liability is systemic—the tax has likely not been paid for all the contractors. More crucially, agencies and clients are not in complete control of whether the umbrella is compliant. That lack of control, coupled with the size of potential liabilities, means the risk is far greater than anything firms faced when off-payroll arrived.
As with IR35, many organisations are likely to adopt the safest possible approach. If umbrellas shift from being seen as "no-risk" to "considerable-risk," many businesses will simply refuse to engage with them. Short of solutions to negate the risk, blanket bans are a highly probable outcome.
Evolving compliance solutions
Some solutions are already being floated:
- Audit-based approaches. Audit trails can demonstrate after the fact that liabilities were (or were not) discharged. But the time lag in PAYE creates a window where agencies and clients are still exposed. The audit approach is like checking a hire car for scratches after the rental — practical, but it doesn't prevent accidents from happening.
- Ongoing due diligence. HMRC guidance already stresses supply chain assurance, but the new umbrella rules go further. There is no statutory defence. The tax debt becomes due when the worker is paid, and each party is immediately liable for the debt.
- Direct PAYE payments. One approach suggested is that agencies (or clients) transfer net monies to umbrellas and pay PAYE directly to HMRC. This approach appears to be the least risky, since it puts control firmly back in the hands of agencies and clients. Agencies don't have to do this, but if they want certainty, they may choose to do this.
Notably, when the Government consulted on potential solutions to solve the mischief, the Government considered, but rejected, an approach where agencies could avert risk through mandated due diligence – had they done so, then the audit approach would have been the ideal solution. Instead, it opted for strict Joint and Several Liability (JSL).
The behavioural effect is obvious: risk-averse firms will seek complete control by introducing policies and mechanisms that do not allow a potential liability under JSL to affect them. By contrast, the clearer IR35 framework post-April 2024—with offsets and established case law—means many organisations can already see that outright bans on "Outside IR35" contractors may be an overcorrection, and that a more balanced risk approach is achievable.
The reality due to JSL and the likely outcome
When the umbrella legislation is viewed through the lens of PAYE Regulations, the risks are easy to see. PAYE need not be remitted until the 22nd of the month following the payroll run. This time lag creates a window of liability accumulation for agencies and clients. Until they see proof of payment, they remain exposed.
The likely outcome?
- Clients and top agencies may move away from umbrellas to avoid risk. Some may insist on agency payroll or fixed-term employment contracts instead.
- Agencies may develop direct-to-HMRC payment systems, ensuring PAYE liabilities are discharged under the umbrella's tax reference.
- Umbrellas may be sidelined unless they can demonstrate models that fully protect upstream parties.
Whilst some firms may be content with taking on some risk, many firms will stand firm on zero risk approaches. For them, the sensible solution does not appear to lie in after-the-event audits, but in systems adapted that give agencies and clients complete control over tax remittance.
Legislative quality and effectiveness
The irony is that while some in the umbrella industry encouraged HMRC to introduce Joint and Several Liability (JSL) as a way of cleaning up rogue operators, and publicly championed their success in doing so, the apparent behavioural effect does not appear to have been fully anticipated. The result may be that umbrellas which fail to fully understand the interplay of different aspects of the tax statute will be marginalised entirely.
On the other hand, however, when the Government considers legislative quality in terms of the effectiveness of the new rules, it's arguable that the expected behavioural response achieves the intended goal of the legislation – which is to drive out the rogue operators and secure tax revenue for the Treasury.
Legislation can be a blunt instrument, and once enacted, the market must adapt to it. For agencies and clients, the direction of travel seems inevitable: unless you fully control the PAYE flow to HMRC, you are exposed. For umbrellas, survival may depend on reinventing themselves to ensure they are not sources of risk.
Timings and Next Steps
The final legislation will be published shortly after the Autumn Statement, which is currently expected to be on 26 November 2025. The Budget is typically laid before Parliament for First Reading a week later, so early December 2025 is the date when the final legislation will be known.
It is doubtful that the Government will backtrack on the introduction of JSL, given how far down the legislative process we now are, especially since the umbrella community asked for JSL.
Firms and agencies will probably wait until December 2025 before making firm decisions, which will then start being implemented in January 2025.
Contractors who are working on an Outside IR35 basis can expect to carry on doing so, and recent April 2024 changes have only reinforced that option as viable for both clients and agencies when managed correctly. Contractors working through an umbrella company may be required to use a different PAYE solution. It is not expected that there will be a sudden rise in firms hiring contractors via limited companies, but neither should we expect blanket prohibitions on "Outside IR35" engagements to hold indefinitely.