Compliance · Recruitment Agencies & End-Hirers · OPRaaS Platform
Buyers of temporary labour are asking a different question this year. Not which supplier is cheapest, but which assurance mechanism actually settles the matter. In procurement meetings the question usually arrives as a choice between accreditation schemes, as though one badge could close the file.
HMRC published the answer some time ago, in guidance that gets far less attention than the April reform. Its advice on applying supply chain due diligence principles states that checks should be “risk-based, relevant, reasonable, proportionate and most importantly, ongoing”, within a cycle it calls Check, Act, Review (HMRC, Use of labour providers).
The mechanism that makes this urgent is liability. Since 6 April 2026, unpaid PAYE in an umbrella chain no longer stops with the umbrella, so the value of an assurance layer is now measured by what it can show on any given day, not on the day it was tested.
Where the liability sits after April
Chapter 11 of Part 2 ITEPA 2003, inserted by Finance Act 2026, applies to payments made on or after 6 April 2026. Where an umbrella company forms part of a labour supply chain, the agency holding the contract with the end client, or the end client itself where no agency is involved, becomes jointly and severally liable with the umbrella for PAYE. This is distinct from older PAYE debt transfer powers, which required HMRC to establish specific conditions before moving a debt upstream.
“If we find an umbrella company has not paid the correct amount of PAYE to us, we’ll recover it from you.”
HMRC’s own impact assessment, published on 26 November 2025, estimates continuing costs to business of £21.7m a year and describes them as introducing regular due diligence checks, with agencies expected to take greater care in selecting and monitoring umbrella companies (HMRC policy paper). Selecting is a decision. Monitoring is a habit.
The same paper puts the affected population at approximately 30,000 agencies and 400 umbrella companies, covering around 700,000 workers. Those are HMRC’s own figures, and they describe a market where recruitment agencies now carry a tax exposure that was not theirs in March.
What accreditation is built to do
Independent assessment against a published standard remains one of the few reliable filters a buyer has. It removes providers unwilling to submit to scrutiny, it creates a shared vocabulary for what compliance means, and it gives a procurement team a defensible basis for a shortlist. None of that is diminished by what follows.
What an assessment produces, though, is a statement about a moment. Schemes assess on a defined cycle, and the more forensic the assessment, the more resource each round consumes. Even continuous checking at payslip level answers one question extremely well while leaving others open.
Consider what moves between assessments. New suppliers enter the chain. Workers change. Sub-contractors appear two tiers down. Financial health changes long before it changes visibly.
This is not a criticism of any scheme. It is a question of frequency.
How HMRC frames the cycle
The guidance sets out three stages, and reading them in order changes how an assurance programme is designed. Check establishes what you know at the point of engagement. Act is what you do about it. Review is the stage most programmes skip. The same framing, HMRC’s GfC12 principles, is applied inside Module 4 of the OPRaaS LSCA Self-Certification Course.
Check
Check covers the initial due diligence: who the supplier is, which entity actually employs the worker, and whether the PAYE reference on a payslip matches the business you believe is the employer. HMRC specifically recommends sampling agency worker payslips.
Act
Act is the decision that follows a finding. Guidance is explicit that checks limited to your immediate suppliers and customers may not be sufficient, so acting often means asking a supplier about the tier below them.
Review
Review is where the guidance uses its strongest language, stating that effective due diligence needs continuous monitoring and review, supported by live risk management that can stop harm before it occurs. A cycle with no review stage is a filing exercise.
Layers of assurance, not replacements
Organisations handling this well are not choosing between mechanisms. They stack them, and each layer answers a question the others cannot:
- Their own due diligence, covering the judgement calls that cannot be outsourced.
- Accreditation and certification, providing independent proof that a standard was met when tested.
- Continuous supply chain and financial assurance, producing a dated record of what happened in between.
Set out that way, the direction of travel after April is more assurance layers, not fewer. That is the argument end-hirers and public sector buyers are increasingly making to their own boards.
What the ongoing layer looks like in practice
OPRaaS, On-Pay-Roll-as-a-Service, is a systemised governance and workforce management partner for organisations that rely on temporary, contractor and contingent labour. Through the OPRaaS Virtual Compliance Director (OPRaaS VCD) solutions we embed senior governance leadership into your business without the cost of a full-time director, building audit-ready controls across JSL, IR35, CIS, GLAA, modern slavery and HMRC labour supply chain expectations, for end-hirers, recruitment agencies, umbrella companies, MSPs and public sector buyers.
Operationally that means right-to-work evidence captured at onboarding and re-run on every pay run, and RTI data sampled to detect duplicate National Insurance numbers across a supplier’s payroll. It means monitoring Companies House for director and ownership changes alongside Creditsafe for credit-risk deterioration, so a supplier’s financial position is tracked between assessments rather than discovered afterwards.
The output is an audit and evidence summary the OPRaaS VCD platform produces on demand, covering temps, freelancers, contractors, interims and consultants. OPRaaS is approved on the UK Government Commercial Agency (formerly Crown Commercial Service) frameworks including RM6310 Audit & Assurance Services (Lots 2 & 4), RM6219 Learning & Training Services DPS, and RM6237 Learning & Training Services DPS.
None of this replaces the accreditation a supplier already holds. It sits underneath it, which is the point. The OPRaaS labour supply chain assurance training and audit platform exists to make the review stage routine, and the wider LSCA compliance and solutions approach treats evidence as something you hold, not something you assemble under pressure.
There is no single mechanism that closes the file. What there is, now that liability has moved, is a record that keeps pace with a supply chain that never stands still, and an argument for owning your compliance as an asset.
Compliance is your asset. Evidenced daily.
Read next
“Why the UK youth employment squeeze is now a labour supply chain assurance question.“
Drawing on PAYE rules for labour supply chains that include umbrella companies from 6 April 2026, and Umbrella company market: changes to income tax rules to tackle non-compliance, both published by HM Revenue and Customs; Use of labour providers: advice on applying supply chain due diligence principles, published by HM Revenue and Customs; Chapter 11 of Part 2 ITEPA 2003 as inserted by Finance Act 2026; and the OPRaaS LSCA Self-Certification Course Module 4, Check, Act, Review.
Talk to OPRaaS about your supply chain.
Use the contact form in the sidebar to the right of this article, or email info@opraas.co.uk.
This article is editorial commentary by OPRaaS Limited (On-Pay-Roll-as-a-Service), drawing on published official guidance. It is general information, not legal, tax, employment or compliance advice. Obligations vary by organisation and engagement. Speak to a qualified professional before acting on any specific position.