Under JSL, why should agencies test umbrella payroll data against records they already hold?

News · Recruitment agencies · OPRaaS Platform

Umbrella payroll data has become the evidence many recruitment agencies rely on to show that PAYE is being operated correctly beneath them. That reliance carries a tension. A payroll check can only test the file it is given, yet under the new joint and several liability rules the agency can be asked to pay any PAYE the umbrella has not paid, including on workers the file left out.

Writing in The Global Recruiter on 13 October 2026, just over six months after the rules took effect, Crawford Temple argued that the JSL debate has dwelt on who pays HMRC and too little on where the data behind each check comes from. His illustration is an agency funding 500 workers through an umbrella while the payroll file supplied for checking covers 450. Every calculation can pass. The other 50 are never tested.

That is the difference between accuracy and completeness. A review of umbrella payroll data can confirm the sums for the people inside it. It cannot confirm that the file holds every worker the agency paid for, or that the deductions it shows ever reached HMRC.

What the JSL rules mean for agencies relying on umbrella payroll data

The new joint and several liability rules for umbrella arrangements, introduced by Finance Act 2026, which inserts Chapter 11 into Part 2 ITEPA 2003, have effect for payments made on or after 6 April 2026. They are distinct from older PAYE debt transfer powers, and they apply to new and existing supply chains alike.

HMRC’s guidance on PAYE rules for labour supply chains that include umbrella companies says the agency contracting with the end client, or the end client where no agency is involved, is responsible for making sure the umbrella operates PAYE correctly. Where the umbrella underpays, HMRC says it will recover the shortfall from that business. The umbrella stays liable alongside it.

The same page tells umbrella companies to provide the agency or end client with the information needed to check their PAYE. OPRaaS’s reading, not HMRC’s stated position, is that this describes what the umbrella must hand over. It does not decide what the check should cover.

The liable business decides what its check covers. Umbrella payroll data is one thing to test, not the limit of the test.

Why accurate umbrella payroll data can still be incomplete

Completeness gaps rarely announce themselves. A file may omit workers who were moved to a different employing entity, carry a PAYE reference that changed mid-assignment, or present deductions that look correct on the payslip and were never paid over. The arithmetic stays clean throughout.

HMRC’s guidance on mini umbrella company fraud describes one pattern that can produce gaps like these. It explains that organised crime groups break one umbrella into many small limited companies, that workers may be moved between them without being told, and that the companies are often short-lived. HMRC warns that agencies may need to issue new key information documents regularly.

Its employment business guidance separately tells them to look for differences between the employer’s name on the latest key information document and the latest payslip.

Those signals need not appear in a payroll file. A report built from umbrella payroll data will reflect whatever population and entity the umbrella chose to include.

A check that starts from the umbrella’s file can prove the sums are right. Only records the umbrella does not control can show nobody is missing.

Three reference points that sit outside the umbrella’s own file

HMRC’s guidance on responsibilities for employment businesses working with umbrella companies points in the same direction, although it does not frame it this way. Read together with its fraud guidance, it suggests three reference points that do not rely on the file the umbrella chooses to send:

1. What the agency funded. The worker list, approved timesheets, assignment rates and payments to the umbrella set the expected population for each pay period before any payroll file arrives.
2. What the worker received. HMRC tells employment businesses to obtain payslips and reconciliation statements directly from workers, and to check that the assignment rate matches the money sent to the umbrella.
3. What HMRC holds. HMRC encourages workers to compare payslip deductions with their personal tax account and National Insurance record, which only the worker can see.

The first tests completeness. The second tests what the worker was told. The third can reveal deductions never reported to HMRC, but it cannot show that reported tax was paid, so the agency still needs evidence from the umbrella of what it paid HMRC. Only the first is wholly outside the umbrella’s control. The second starts with documents the umbrella issues, which is why HMRC says to get them from the worker. The third depends on what the umbrella reports.

Temple’s own answer is for agency-originated timesheet data to drive the payroll calculation itself. That is one operating model among several. Whichever model an agency chooses, Chapter 11 offers no general due diligence defence. The value of matching these records is finding a shortfall early, while it can still be put right.

Where the reconciliation work falls each pay period

Starting from umbrella payroll data does not remove the work. It moves it. Someone at the agency still has to match the provider’s reports to the agency’s master records, investigate every exception and confirm the liability was settled, often weekly.

The burden is not spread evenly. The relevant party is whoever holds the contract with the end client, which may be one of the recruitment agencies or, in a neutral-vend model, an MSP facing the same matching at higher volume. End-hirers become relevant parties where they contract directly with the umbrella, or where the contracting party is non-UK resident or connected with the umbrella.

Compliant umbrella companies have a stake too. An umbrella that can reconcile its payroll to the agency’s funded headcount, worker by worker, gives its clients a reason to keep it on the panel. Public sector buyers, meanwhile, are likely to ask their agencies to show that reconciliation rather than describe it.

The topic Mapping JSL to LSCA controls and JSL Readiness in Module 11 of the OPRaaS LSCA Self-Certification Course makes the same distinction between presence and proof. It notes that saying “we audit payslips” is weak without a defined sample size, independent review, an escalation threshold and a record of findings.

How the OPRaaS audit platform and OPRaaS VCD support umbrella payroll data checks

OPRaaS, On-Pay-Roll-as-a-Service, is a systemised governance and workforce management partner for organisations that rely on temporary, contractor and contingent labour. The OPRaaS Virtual Compliance Director (OPRaaS VCD) serves end-hirers, recruitment agencies, umbrella companies, MSPs and public sector buyers across temps, freelancers, contractors, interims and consultants.

The OPRaaS audit platform puts structured questions to the umbrella companies and agencies in a supply chain, on areas such as PAYE, payslips and fraud controls, and holds the evidence behind each answer. Answers are scored, and evidence counts towards the score. Each audit then produces a PDF report with that evidence linked.

Alongside the platform, the OPRaaS VCD runs a quarterly risk-check cycle on the umbrella preferred supplier list, covering payslips, credit scores, director changes and VAT registration, with Companies House used for director and ownership changes and Creditsafe for credit-risk changes. The findings feed the evidence file the OPRaaS VCD signs off.

OPRaaS is named as a supplier on the UK Government Commercial Agency (formerly Crown Commercial Service) Audit and Assurance Services Two framework (RM6310), Lot 2: External Audit and Lot 4: Other Independent Assurance, and is registered on the RM6219 Learning and Training Services and RM6237 Low Value Purchase System dynamic purchasing systems. The OPRaaS LSCA platform is available on G-Cloud 15 (RM1557.15), Lot 2b: Software as a Service.

What board directors at agencies should ask before the next pay run

For board directors at recruitment agencies and MSPs, the useful question is simple. For each umbrella on the panel, does the last pay period’s umbrella payroll data cover every worker the business funded? If the answer depends on the umbrella’s own report, the agency is checking accuracy and assuming completeness.

The Data and analytics control family in the Module 11 JSL Readiness topic of the OPRaaS LSCA course sets out the operational version of this discipline, from defined anomaly triggers to documented investigation outcomes.

Compliance is your asset. Evidenced daily.

Read next

“Payslip verification is what tells you whether the tax shown was ever paid to HMRC.“

This article draws on Crawford Temple’s piece in The Global Recruiter, published on 13 October 2026, HMRC’s guidance on PAYE rules for umbrella supply chains, HMRC’s guidance on responsibilities for employment businesses working with umbrella companies, HMRC’s guidance on mini umbrella company fraud, HMRC’s GfC12 guidelines on labour supply chain assurance, Finance Act 2026 and Module 11 of the OPRaaS LSCA Self-Certification Course.