Joint and Several Liability: The Simple Guide

What's Happening to Umbrella Legislation?

From 6 April 2026, new legislation means that if an umbrella company fails to pay the correct tax to HMRC, the financial responsibility does not stay with the umbrella. It transfers automatically and without exception to the recruitment agency or end client that used them.

This is called Joint and Several Liability (JSL), and it's the biggest change to the flexible labour market in a generation.

Why Has This Happened?

Non-compliant umbrella companies have cost HMRC hundreds of millions in unpaid tax each year, many linked to organised fraud, while workers have been denied basic employment rights. The government's solution is direct: make the businesses that choose which umbrellas to work with financially responsible for what those umbrellas do.

Who Is Responsible for What?

Think of a building contractor who hires a specialist subcontractor to complete part of a project. The subcontractor takes the payment, does not do the work properly, and disappears. The main contractor is the one who must answer for it, because they were the ones who brought the subcontractor onto the job. The client does not carry that responsibility.

That's the logic here. Whoever brought the umbrella into the supply chain carries the liability if the umbrella fails.

In most cases, that's the recruitment agency. If there's no agency in the chain, or the agency is based overseas or connected to the umbrella, the end client becomes responsible. Where a Managed Service Provider (MSP) sits closest to the client, the liability lands there instead.

Will Due Diligence Protect You?

No, and this is the most important thing to understand. HMRC has confirmed that even thorough due diligence provides no legal defence if the umbrella does not pay.

None of the following offer protection on their own:

•       Conducting regular audits

•       Using an accredited umbrella

•       Reviewing payslips that look compliant

•       Receiving Real Time Information (RTI) data from the umbrella

That last point matters particularly. RTI data provided by the umbrella only shows what the umbrella claims to have paid. It does not confirm what has actually been remitted to HMRC. Independent verification is the only way to know the difference. 

Due diligence still has a role: it helps exclude bad actors and supports compliance with other laws. But it is not a legal shield under the new legislation.

What Doesn't Change?

Quite a lot, reassuringly. Umbrella arrangements remain a viable model. Agencies are not deemed the employer. Existing worker contracts don't need rewriting. No software changes are required. CIS and IR35 rules are unaffected. For anyone already working with a genuinely compliant umbrella, day-to-day operations stay the same.

What Should You Do?

Agencies should review which umbrella companies they work with and ask hard questions about how compliance is demonstrated, not just annually but continuously.

End clients should understand who in their supply chain holds the liability and ensure their agencies are working with verified, compliant providers.

Workers should be cautious of any umbrella promising unusually high take-home pay. If it can't be explained simply and clearly, it's a warning sign.

How BoostPay Is Responding: SafeRec Accreditation

BoostPay has secured accreditation with SafeRec (www.saferec.co.uk), the real-time payslip auditing platform used across the umbrella sector.

SafeRec independently verifies every payslip against HMRC's own Real Time Information (RTI) system, confirming that the Income Tax, National Insurance and pension deductions shown on a payslip match what has actually been paid to HMRC. Any discrepancy is flagged immediately.

This gives everyone in the supply chain something that due diligence alone cannot provide: live, independent proof of compliance. Not an annual audit. Not a badge on a website. Verifiable evidence, at the point of payment, that the tax has been paid.

•       For agencies: continuous visibility of payroll compliance, demonstrable to end clients

•       For end clients: independently verified supply chain assurance, not just assurances

•       For workers: confirmation that payslip deductions are genuinely being paid to HMRC

Due diligence is no longer enough on its own. Real-time, independent verification is what the new compliance landscape demands and it is what BoostPay's SafeRec accreditation delivers.

The Bottom Line

The April 2026 changes reward businesses that have always done things properly. If you're working with BoostPay, you're already in the right place.

Want to know more? Contact the BoostPay team to discuss how the new rules affect your business and how our SafeRec accreditation protects everyone in your supply chain.