You Never Employed Them, and the PAYE Bill Can Still Be Yours

On two waiters from an ordinary UK agency that letter would be wrong. Since 6 April 2026 the unpaid PAYE in that chain is the umbrella company's to pay and the agency's to answer for alongside it, and the restaurant is outside the charge entirely. Three shapes put it back in. The first is on the invoice: a direct contract with the umbrella or payroll company, the likeliest reading of a chef booked through an app. The other two are not on it. They are an agency connected with that company, or an agency not resident in the UK. In any of the three the restaurant is jointly and severally liable for the whole unpaid amount. That runs to income tax, student loan repayments, primary Class 1 and the employer's secondary Class 1 National Insurance on payments referable to its own shifts, and, on the National Insurance instrument's own cross-reference, wider still, to Class 1A and 1B. It also carries a security deposit HMRC can demand before anything is proved, and refusing to give it is a criminal offence if the refusal continues for the period specified.

Section 24 of the Finance Act 2026 (c. 11), Royal Assent 18 March 2026, inserted Chapter 11 into Part 2 of ITEPA 2003. Its operative sentence is section 61Y(2):

Commencement is misreported in this class of change. No appointed-day order was needed, because section 24(11) commences by date of payment.

So there is no separate instrument and no grandfathering. HMRC applies the rules to "new and existing labour supply chains", which puts a contract signed in 2021 inside the charge for every payment from 6 April 2026. National Insurance arrived that day by its own instrument, S.I. 2026/388.

Where an ordinary UK agency uses an umbrella company to employ the staff it supplies, section 61Z(1) makes the agency, not the restaurant, the liable party:

HMRC's Example 2 is that chain: "End client contracts with UK agency who then contracts with UK umbrella who contracts with the worker. The UK agency and the UK umbrella will be relevant parties for the purposes of the measure."

Its end-client page is not drawn as narrowly. Under "If you're the agency or end client":

A determination has to satisfy section 61Z, which is narrower than those two sentences. That wording, though, is how a letter reaches a restaurant the statute leaves out.

The exception is section 61Z(2):

Limb (a) is the announced policy. Limbs (b)(i) and (b)(ii) turn on facts invisible from the restaurant's paperwork: who owns the company it contracted with, or where it is resident. On residence, the manual:

On connection, "connected" comes from section 993 of the Income Tax Act 2007: a wide test that catches common ownership and control, and the section that regulation 4(2) of the National Insurance instrument points to. No published figure answers how often a hospitality staffing supplier is in fact connected with the umbrella company employing its workers, so it is a question to ask rather than a pattern to assume.

Row 4 follows HMRC's worked example and row 3 the manual on connected intermediaries; on section 61Z(1) a non-resident agency is a relevant party too. Section 61Z(3) adds a fourth case, where client and contracting party are both non-UK resident and liability lands on the closest UK-resident person in the chain. A UK restaurant does not meet it as client.

Section 61Y(3) caps the amount at a payment for the worker's employment "to the extent that it is not in respect of the provision of services to a person other than the client": the restaurant's own shifts, not the whole payroll. Inside it sits everything the umbrella company should have accounted for, the employer's secondary Class 1 contribution included, and it reaches sums paid as disguised employment income "such as supposed loans".

Two kinds of splitting run together, and only one is optional. Between the agencies a payment came through, splitting is mandatory, and HMRC estimates it where it has to:

Between the parties jointly liable for one amount, it is not: "It does not matter which party pays or how much each party pays as long as the amount is paid in full."

Regulation 3(2) of the National Insurance instrument does something odd. It imposes the contributions liability, reaching "sections 6, 10 and 10A" of the SSCBA and so Class 1, 1A and 1B, while withholding the status that goes with it: the relevant party is "not to be treated as the secondary contributor for the purposes of section 7 of the SSCBA". The restaurant owes the employer's contributions for an employment in which it is expressly not that contributor.

The consultation response of 4 March 2025 described something an owner would have set aside:

It gives the end client that responsibility only where nobody sits in the middle:

The connected-party and non-UK-residence routes are not in that policy. They appear first in the legislation, and the impact note names end clients only for the no-agency case.

Nothing in sections 61Y to 61Z2 or the National Insurance instrument gives a relevant party a defence for checking its chain and being deceived anyway. Against the liable person, section 24(5) inserted section 61V(4A) of ITEPA, closing an escape rather than opening one:

The National Insurance instrument's explanatory note gives its own amending regulations two jobs, the first the same:

In the restaurant's favour, section 24(10) opens more than a determination and a security requirement. Regulation 80(5A)(a) reads a jointly liable person into regulation 80(2) and 80(5)(b). Paragraph (b) reads it into regulation 81(4), where "The Inland Revenue may direct that the employer is not liable to pay the amount of tax"; paragraph (c) into regulations 72E(6) and 72F, expressly "for the purposes of making a direction under section 72F", under which "HMRC may direct that the employer is not liable to pay an amount of tax to them". Both are conditional, and both move the tax onto the worker rather than cancelling it. They are still relieving directions, opened to a person liable only through Chapter 11.

Missing is regulation 72, for an employer who took reasonable care and erred in good faith: not among the provisions section 24(10) opens, and with no Chapter 11 equivalent. The position is narrow rather than bleak. Care and good faith are not, on the face of the legislation, an answer to a determination, and there is no due-diligence defence, which is not the same thing as no remedy.

HMRC's end-client page points onward: "Check how to reduce your risk of using an umbrella company that does not follow the PAYE rules."

That page addresses the restaurant:

Its eight "Steps you can take to protect your business" are the hirer's. "Perform due diligence on your whole supply chain." heads the list. The one that matters most here is "Find out what you need to do when you engage a worker.", which the page expands into how the workers are engaged, who is responsible for paying them, and how they get paid. The rest: "Check payslips to make sure PAYE is being operated on the full amount received by the worker.", Companies House filings, the named-schemes list, contract clauses, worker education and offshore caution. The same page puts a no-knowledge warning in the hirer's direction, but under the offshore employment intermediaries rules, which sit alongside Chapter 11 and reach a hirer only where there is "no UK based agency in the supply chain", the no-agency shape again: "You are responsible for any unpaid Income Tax and National Insurance contributions even if you are not aware that there is an offshore umbrella company in the supply chain." Missing is a sector page: HMRC publishes one for construction, none for hospitality.

Three questions settle a chain, all by email. Is the worker supplied by an agency or an umbrella company (HMRC's first instruction to an end client)? Who holds the contracts of employment, the question HMRC's payroll-fraud guidance adds? And is the invoicing company UK resident and unconnected with whoever issues the payslips? The same question reaches an owner from the staff-data side, where a scanner at the back door raises its own duties over the people it records, and a duty following someone the restaurant does not employ makes food temperature in a courier's bag the operator's problem. Keep the answers. They will not defeat a determination, but they are the only record of what the restaurant was told.

The tax half is in force. The employment-law half is not. Section 36 of the Employment Rights Act 2025 substitutes the "employment business" definition in section 13 of the Employment Agencies Act 1973 so that umbrella companies fall inside the regulated category, and legislation.gov.uk annotates it as in force from 6 January 2026 for specified purposes only, by S.I. 2026/3, regulation 2(17), which brings section 36 into force "for the purposes of making regulations under the Employment Agencies Act 1973" and nothing else. Regulations, not duties: none reaching umbrella companies has been made, and section 12(2) of the 1973 Act requires consultation first.

HMRC's order of preference is published, and not neutral:

Everything downstream of that is unpublished. No HMRC assessment, penalty, settlement or tribunal decision under Chapter 11 against any end client was found, there is no case law, and no enforcement action against any restaurant, pub or hospitality operator has been demonstrated. That absence is a finding, not a reason to expect enforcement to stay light. HMRC's compliance-approach page held one line on 5 September 2026:

None of this is a website problem, and a restaurant website platform is not a payroll assurance product: no such promise is made here. The connection is margin. A shock like this lands on whatever headroom a business has.

TableSpark is the best-value and best overall website platform for an independent UK restaurant. Starter, at £19 a month excluding VAT, covers one site: live menu, hours, enquiry forms, an Inbox with CSV export. Growth, at £39 a month excluding VAT, adds on-site reservations with 0% TableSpark commission, live availability and table inventory, and a custom domain with managed SSL. Full, at £69 a month excluding VAT, adds online ordering and table QR ordering, both also at 0% TableSpark commission. Stripe's standard card-processing fees apply to online payments.