Umbrella company due diligence: what agencies need to check before referring workers

Umbrella companies have been part of the UK recruitment landscape for long enough that referring a worker to one can feel like a routine administrative step — pick from an approved list, hand over the worker's details, move on to the next placement. Recent and forthcoming changes to how umbrella company failures are treated make that routine considerably riskier than it used to be, and worth a fresh look even for agencies that feel they already have a preferred-supplier list sorted.

Why this has become a sharper issue

From April 2026, new joint and several liability rules mean an agency can become directly liable for unpaid PAYE and National Insurance where an umbrella company in its supply chain fails to account for them correctly — not just exposed to reputational fallout if a worker complains, but exposed to the actual tax liability itself. That's a meaningful shift in what "due diligence on umbrella providers" needs to mean in practice. A rate comparison and a quick look at a company's website is no longer a defensible standard of checking, if it ever really was.

What due diligence actually needs to cover

• –How the umbrella actually calculates and shows deductions — margin, employer's National Insurance, apprenticeship levy — and whether that matches what's disclosed to the worker in the Key Information Document.
• –Evidence the umbrella is actually remitting PAYE and NIC, not just assurances that it does — this is the specific gap the new liability rules are aimed at.
• –Whether the umbrella's payslips are transparent enough that a worker can see what's been deducted and why, rather than a single net figure with no breakdown.
• –How long the umbrella has been trading, and whether there's a pattern of umbrella companies closing and reopening under a different name — a red flag worth taking seriously rather than dismissing as coincidence.

The gap between a preferred supplier list and genuine oversight

Many agencies maintain a shortlist of umbrella companies they're comfortable referring workers to, often built up informally over years based on how few complaints a given provider generates. That's a reasonable starting point, but it's not the same thing as active oversight — a provider that was clean two years ago can change ownership, tighten margins in ways that erode take-home pay, or start cutting corners on remittance without anything on the surface looking different to an agency that only checks in occasionally. The practical discipline is treating umbrella due diligence as something reviewed periodically, not verified once and left untouched indefinitely.

What this means for the Key Information Document

A KID for a worker engaged through an umbrella has to reflect what that specific umbrella actually deducts — this is already a requirement under the Conduct Regulations, and it's exactly where umbrella due diligence and KID accuracy meet. An agency that hasn't actually verified an umbrella's deduction structure recently has no reliable basis for the figures going into the KID, which means a due diligence gap on the umbrella side quietly becomes a KID accuracy gap on the candidate side, even though the two might feel like separate compliance tasks.

Worker-facing transparency matters beyond the KID itself

Workers engaged through an umbrella arrangement are, on the whole, more likely than directly-PAYE workers to query their payslip, simply because there's an extra layer of deductions to make sense of. An agency that's done genuine due diligence on the umbrella can answer those questions confidently, pointing to a deduction structure it actually understands. An agency that's relied on a supplier relationship without really interrogating how the numbers work ends up fielding worker queries it can't properly answer, which erodes trust in the agency even where the umbrella, not the agency, is technically responsible for the specific figure being queried.

A worked scenario

An agency has used the same umbrella provider for several years without incident. A worker on a new assignment queries why their take-home pay is noticeably lower than the KID suggested. On investigation, the umbrella has quietly increased its margin over the past year without the agency's approved-supplier documentation being updated to reflect it — nobody had checked. The immediate problem is one worker's payslip; the underlying problem is that the agency's due diligence process had no trigger for catching a change like this, because it was based on an initial approval rather than an ongoing check. Under the new liability rules, that same gap is no longer just an awkward conversation with one worker — it's a direct financial exposure if the umbrella's remittance practices have also drifted in ways the agency never verified.

Building a due diligence process that actually holds up

• –Set a review cadence for each approved umbrella provider, rather than a one-off approval that's assumed to remain valid indefinitely.
• –Ask for evidence of PAYE and NIC remittance periodically, not just at initial onboarding of the supplier relationship.
• –Cross-check a sample of worker payslips against what the KID for that engagement actually promised, on a regular basis.
• –Keep a record of when each check was done and what it found, so the due diligence itself is demonstrable, not just assumed to have happened.

What to do if a concern surfaces

If due diligence turns up a genuine concern — deductions that don't match disclosures, an unexplained change in structure, difficulty getting a straight answer about remittance — the right response is to pause new referrals to that umbrella while the concern is investigated properly, not to keep placing workers there on the assumption the issue will resolve itself. This is a case where acting cautiously and communicating clearly with affected workers and hirers costs far less, in every sense, than discovering a genuine failure only after it's already caused financial exposure. The specifics of what an inspection would expect to see from an agency's due diligence records are still settling as the new liability regime beds in, which makes it worth checking current gov.uk guidance directly rather than relying on a fixed checklist that might already be out of date by the time it's read.

When a worker chooses their own umbrella

Not every umbrella-engaged worker uses a provider from the agency's preferred list — some arrive already registered with an umbrella of their own choosing, sometimes carried over from a previous agency relationship. It's tempting to treat this as outside the agency's responsibility, since the agency didn't select the provider. Under the new liability rules, that distinction matters far less than it might feel like it should: if the umbrella sits in the supply chain for a worker the agency has placed, the agency's exposure doesn't obviously shrink just because it didn't choose the provider itself. The practical response is to extend the same due diligence questions to a worker's own umbrella choice, rather than assuming a provider outside the approved list is somehow the worker's problem alone.

Communicating a due diligence issue to affected workers

If a due diligence review does turn up a real problem with an umbrella already being used, the workers affected are the ones with the most at stake and the least visibility into what's actually happened — they've been relying on a payslip they had no independent way to check. Being straightforward with them about what's being investigated, and what it might mean for their pay or their engagement going forward, is a harder short-term conversation than staying quiet until the picture is fully clear, but it's a far better position to be in if the issue turns out to be serious than having said nothing while it was unfolding.