100 days into JSL, umbrella due diligence is the price of a PSL place

News · Recruitment Agencies & End-Hirers · OPRaaS Platform

Umbrella company due diligence has become the price of a place on a preferred supplier list, one hundred days into the Joint and Several Liability regime that reached the umbrella market on 6 April 2026. The lists that recruitment agencies and end-hirers rely on are shorter than they were in the spring, and the umbrellas still on them share one trait. They can show their compliance, not merely assert it.

That verdict comes from recent trade commentary. Writing in ContractorUK on 14 July 2026, Ashley Olliver reviewed how the regime is bedding in and reported that compliance has become the entry requirement for a supplier list, rather than the point of difference it once was. It is a small phrase with a large consequence for anyone who chooses the umbrellas in their chain.

What 100 days of JSL has actually changed

The clearest change is the direction of scrutiny. Under JSL, the unpaid PAYE and National Insurance of a non-compliant umbrella can be recovered from a party further up the chain, so the recruitment agency or end-hirer that admitted the umbrella now carries the bill if the check was thin.

Faced with that, managed service providers and larger agencies have put their umbrella partners through real examination, and preferred supplier lists have been trimmed to the providers whose evidence of compliance is forthcoming and robust.

HMRC has put the tax at stake at around £2.8 billion over the five years to 2029-30, on figures reported by ContractorUK, which gives a sense of how seriously the department is treating umbrella tax compliance. For the businesses that pick the umbrellas, umbrella company due diligence has moved from an onboarding formality to a standing condition of doing business.

Why a clean contract does not move the JSL exposure

Here is the part that catches boards out. JSL is a strict liability regime, and the OPRaaS Labour Supply Chain Assurance course is blunt about what that means: you cannot contract it away, and an accreditation logo is not a shield. A signed warranty and a membership badge describe an intention to comply. They do not, on their own, prove that the right PAYE was paid on the worker on shift this week.

The legislative chain is worth stating in full, because senior tax readers can conflate it with older powers. The new joint and several liability rules for umbrella arrangements were introduced by Finance Act 2026, which inserts Chapter 11 into Part 2 of ITEPA 2003, with effect for payments made on or after 6 April 2026. This is the umbrella-market regime, distinct from the long-standing PAYE debt transfer powers under the PAYE regulations.

Who carries that liability follows a simple rule. Where an umbrella contracts directly with the end-hirer, the end-hirer is the relevant party; where an intermediary sits in between, the agency or managed service provider holding the client contract usually is. So the party with the least payroll visibility can be squarely in the firing line for a bill it never ran. That is why umbrella company due diligence becomes a record to keep, not a defence to plead.

Where umbrella company due diligence quietly slips down the chain

Delegation is where the discipline erodes. When an agency assumes the umbrella verified the worker, the umbrella assumes the end-hirer did, and the end-hirer relies on the agency, responsibility feels shared and can end up carried by no one.

The reported picture 100 days in is that the non-compliant models JSL was meant to squeeze out have moved down the chain rather than disappeared, towards the smaller agencies with limited compliance resource, some of whom, on industry accounts, may still be unaware the rules apply to them at all.

That is where exposure gathers. A compliant-looking timesheet, a framework that promises compliant onboarding, a supplier’s word that the workers were checked: each describes the system working as intended. Evidence that a named umbrella paid the correct PAYE for a named worker last month is a harder thing to hold. That evidence is what this due diligence exists to produce.

What good umbrella company due diligence evidence looks like

This is the ground the OPRaaS LSCA Self-Certification Course Module 11 covers, in its topic on mapping JSL to assurance controls. The course turns JSL from a legal concept into an operating model by organising thirteen JSL Readiness questions into four control families:

• Governance. Who owns the risk, who is mapped as the legal employer, and who approved the umbrella and the model.
• Process and contracts. What checks are built into onboarding, prohibited-model tests, audit rights and escalation routes.
• Data and analytics. How unusual net-to-gross pay, repeated deductions and clusters of micro-entities are detected and tracked.
• Worker-facing controls. How a worker can challenge pay and surface a hidden problem before HMRC has to.

The course is explicit on the standard. A yes to a readiness question only has value when it is backed by documented scope, ownership, frequency and evidence. Saying you audit payslips is weak without a defined sample, an independent reviewer, a threshold for escalation and a record of findings. That is the difference between a supplier file that describes good umbrella company due diligence and one that proves it happened.

How the OPRaaS Virtual Compliance Director keeps it evidenced

This is the work the OPRaaS Virtual Compliance Director (OPRaaS VCD) platform is built to carry. It embeds senior governance leadership into an agency, end-hirer or public body without the cost of a full-time director, and builds audit-ready controls across PAYE, right-to-work, IR35, CIS and modern-slavery duties that stay current as workers and umbrellas change.

Two examples make that due diligence concrete. Payslip and RTI data are sampled by the platform to surface unusual net-to-gross patterns and unexplained deductions, the very signals the course places in its data-and-analytics control family, with each exception recorded, investigated and closed.

At the same time, each labour supplier is monitored against Companies House for director and ownership changes, and against Creditsafe for credit-risk moves such as county court judgments and financial-strength downgrades, so an umbrella heading for trouble is visible while there is still time to act.

OPRaaS, On-Pay-Roll-as-a-Service, is a systemised governance and workforce management partner for organisations that rely on temporary, contractor and contingent labour, from recruitment agencies and end-hirers to umbrella companies, managed service providers and public sector buyers. It is approved on the UK Government Commercial Agency (formerly Crown Commercial Service) frameworks including RM6310 Audit & Assurance Services (Lots 2 & 4), RM6219 and RM6237 Learning & Training Services DPS.

What boards and agencies should be asking after 100 days

The question for a board is not whether a supplier says every umbrella was checked, but whether the organisation could evidence it for a named worker, in a named chain, on the day HMRC asks. That is umbrella company due diligence at board level. A Regulation 80 determination rarely arrives with warning. By then the record either exists or it does not.

For recruitment agencies, end-hirers and public sector buyers who already assure their labour supply chain on a regular cadence, adding umbrella company due diligence to that rhythm is a small step rather than a new programme.

The thirteen JSL Readiness questions in Module 11 of the OPRaaS LSCA course set out the operational version of this discipline, one control family at a time, for any organisation that wants to move from a yes on a form to a yes it can prove.

Under strict liability, a signed contract and an accreditation badge describe an intention to comply. Only a dated record of the check shows it happened, and JSL is settled from the record, not the intention.

Compliance is your asset. Evidenced daily.

Read next

“Own your compliance as an asset.“

Drawing on the ContractorUK review of 14 July 2026 on how the umbrella Joint and Several Liability regime is bedding in; Finance Act 2026 and Chapter 11 of Part 2 ITEPA 2003 via legislation.gov.uk; HMRC’s stated policy intent for the umbrella JSL regime; and the OPRaaS LSCA Self-Certification Course Module 11.