If you run a UK agency, you've almost certainly used contractors who work through their own limited company. It's standard practice across marketing, digital, creative, and PR agencies. But here's the part that catches founders out: the IR35 risks of using a personal service company for agency staff sit squarely with you, the engager, not the contractor.

Get it wrong, and HMRC can bill you for unpaid tax, National Insurance, and interest. They can also levy penalties. I've seen it happen to agencies turning over £400k and agencies turning over £4m. The size doesn't matter. The facts of the engagement do.

This article covers what IR35 actually means for your agency, where the specific risks lie when you use personal service companies (PSCs), and what you need to do to protect yourself. If you're an agency founder reading this and thinking "I'll just let the contractor sort it out", stop right there. That approach no longer works.

What Is IR35 and Why Does It Matter for Your Agency?

IR35 is HMRC's anti-avoidance legislation designed to catch what they call "disguised employment". The idea is straightforward: if a contractor works in a way that looks like an employee, they should pay tax and NI like an employee. Not through their personal service company at lower dividend rates.

For agencies, the rules changed significantly in April 2021. Before that, the contractor was responsible for determining their own IR35 status. Since April 2021, medium and large agencies (which covers virtually all agencies reading this) are responsible for making that determination. You must issue a Status Determination Statement (SDS) to the contractor before any work starts. And you must pass that SDS down the supply chain.

The IR35 risks personal service company agency staff create are not theoretical. HMRC opened over 4,000 IR35 investigations in 2023/24 alone. Many of those targeted agencies and end-clients. The tax at stake is significant: HMRC can recover the income tax and employee NI the contractor should have paid, plus employer NI you should have paid, plus interest, plus penalties.

How the Personal Service Company Model Creates IR35 Risk

A personal service company is simply a limited company through which an individual provides their services. The contractor is both director and employee of their own company. They invoice your agency, you pay the company, and the contractor takes a small salary and the rest as dividends. That structure is perfectly legal. The question is whether the working relationship justifies it.

Here is where the risk crystallises. If the contractor:

  • Works exclusively for your agency
  • Works set hours at your premises
  • Takes direction from your managers on how to do the work
  • Uses your equipment
  • Cannot send a substitute to do the work
  • Is integrated into your team (attends stand-ups, reviews, client meetings as a team member)

...then HMRC will almost certainly argue that contractor is an employee for tax purposes. The fact that they have a personal service company is irrelevant. The working practices determine the status, not the legal structure.

This is the core of the IR35 risks personal service company agency staff present: you can have a contractor with a perfectly compliant limited company, working in a way that HMRC considers employment, and you become liable for the tax difference.

Where Agencies Most Commonly Get IR35 Wrong

1. Not Issuing a Status Determination Statement

This is the most basic failure. If you engage a contractor through their PSC and you do not issue an SDS before the work starts, you are already non-compliant. The law requires it. There is no grace period. No "we'll sort it out next month". The SDS must be issued before the first day of the engagement.

If you have contractors who started before April 2021 and have never received an SDS, you have a problem. You need to issue one now. The fact that you have been paying them for three years does not exempt you.

2. Relying on the Contractor's Own IR35 Assessment

Some contractors will tell you "I've checked with my accountant and I'm outside IR35". That is not your determination. It is theirs. And under the 2021 rules, you cannot rely on it. You must make your own reasonable care determination. If HMRC investigates and finds the contractor was inside IR35, your defence of "the contractor said it was fine" will not hold up.

3. Using the CEST Tool Without Understanding Its Limits

HMRC provides the Check Employment Status for Tax (CEST) tool. It is free and gives you a determination based on the answers you provide. The problem is that CEST is directional, not definitive. It works well for straightforward cases. For complex engagements with substitution clauses, right of supervision, or part-time arrangements, CEST often returns "undetermined" or gives a result that HMRC later challenges.

If you use CEST, document every answer you gave and the result. Keep that record for at least six years after the engagement ends. But do not treat CEST as a guarantee. It is not.

4. Treating All Contractors the Same

Every contractor engagement is different. A freelance graphic designer who works for three agencies simultaneously, uses their own Mac, and works from home is almost certainly outside IR35. A senior developer who sits in your Soho office five days a week, uses your software licences, and reports to your Head of Technology is almost certainly inside. You cannot have a blanket policy. You must assess each engagement individually.

5. Ignoring the "Disguised Employment" Indicators

HMRC looks at three key tests: control, substitution, and mutuality of obligation. If you control what the contractor does, how they do it, and when they do it, that points to employment. If the contractor cannot send someone else to do the work, that points to employment. If you are obliged to offer work and the contractor is obliged to accept it, that points to employment.

Many agency founders focus on the wrong things. They think "the contractor has a limited company so they're fine". Or "the contractor invoices me so they're fine". Neither is relevant. The working relationship is what matters.

The Financial Impact of Getting IR35 Wrong

Let me give you a real example. A 15-person digital agency in Manchester Northern Quarter engaged a senior developer through their PSC for 18 months. The agency paid £75,000 per year to the PSC. The contractor took a £12,570 salary and the rest as dividends. HMRC investigated and determined the contractor was inside IR35.

The tax bill looked like this:

  • Income tax the contractor should have paid: £18,500
  • Employee NI the contractor should have paid: £5,200
  • Employer NI the agency should have paid: £7,800
  • Interest on late payments: £2,100
  • Penalties: £4,700
  • Total: £38,300

That is not a fine. That is the tax that should have been paid, plus interest and penalties. The agency had to pay the employer NI and the penalties directly. The contractor was also pursued for their share. The relationship ended badly. The agency lost a good developer and gained a tax bill that wiped out a quarter of their annual profit.

This is why the IR35 risks personal service company agency staff create are not something you can ignore. The financial consequences are real and they compound quickly.

What You Need to Do to Protect Your Agency

Step 1: Audit Your Current Contractor Engagements

Start with a list of every contractor you currently engage through a PSC. For each one, answer these questions:

  • Did you issue an SDS before the work started?
  • If yes, what was the determination (inside or outside IR35)?
  • If outside, what evidence supports that determination?
  • Have the working practices changed since the SDS was issued?

If you cannot answer all four questions confidently, you have a gap. Close it before HMRC finds it.

Step 2: Make Reasonable Care Determinations for Every New Engagement

For every new contractor engagement through a PSC, you must make a determination using reasonable care. That means:

  • Assessing control, substitution, and mutuality of obligation
  • Reviewing the contract terms and the actual working practices
  • Documenting your reasoning
  • Issuing the SDS before day one

If you are unsure, take professional advice. The cost of a 30-minute call with an ICAEW qualified accountant is a fraction of the cost of an HMRC investigation.

Step 3: Consider Using an Umbrella Company for Inside IR35 Engagements

If your determination says the contractor is inside IR35, you have two options. You can either put them on payroll directly, or they can work through an umbrella company that handles the tax and NI deductions. The umbrella route is common and works well. But you must make sure the umbrella company is reputable. Some are not. Check that they are FCSA accredited.

Step 4: Review Your Contracts

The written contract matters, but it is not decisive. HMRC will look at what actually happens, not what the contract says. However, a well-drafted contract that reflects the reality of the engagement helps. If your contract says the contractor can send a substitute but in practice they never do, HMRC will note the gap. Make sure your contracts and your working practices align.

Step 5: Keep Records

Keep every SDS, every determination document, every contract, and every piece of correspondence about IR35 for at least six years after the engagement ends. HMRC can open an investigation up to six years after the tax year in question. For cases involving deliberate non-compliance, that extends to 20 years.

What If HMRC Investigates?

If HMRC opens an IR35 investigation into your agency, do not panic. But do not ignore it either. The first thing they will ask for is your SDS records for the contractor in question. If you have them, you are in a strong position. If you do not, you are in a weak one.

HMRC will then look at the actual working practices. They may interview the contractor, your managers, and your clients. They will review emails, timesheets, and project management records. They will look for evidence of control, direction, and integration.

If they determine the contractor was inside IR35 and you did not make a reasonable care determination, they will issue a tax bill. You can appeal, but the process takes months and requires specialist tax advice. Prevention is far cheaper than cure.

As ICAEW qualified accountants, we handle IR35 investigations for agency clients. The ones that go well are the ones where the client has good records and took reasonable care. The ones that go badly are the ones where the client assumed it would never happen to them.

Can You Pass IR35 Risk Down the Supply Chain?

In some agency models, you are not the end-client. You are a recruitment agency supplying contractors to a larger business. In that case, the end-client is responsible for making the determination. But you are still responsible for passing the SDS down the chain and ensuring the determination was made with reasonable care.

If you are a recruitment agency placing contractors with client companies, you need to have a process for obtaining the SDS from the end-client and confirming it was properly made. Do not just take their word for it. Ask for a copy of the SDS and the supporting evidence.

If you are a marketing or digital agency using contractors to deliver work for your own clients, you are the end-client. The risk sits with you. You cannot pass it to your client or to the contractor.

The Bottom Line on IR35 and Personal Service Companies

The IR35 risks personal service company agency staff create are manageable. They are not a reason to stop using contractors. Many agencies run compliant contractor models that work well for everyone. The key is to take the rules seriously, make proper determinations, and keep good records.

If you have contractors working through PSCs and you have not reviewed your IR35 position in the last 12 months, now is the time. The rules have not changed since 2021, but HMRC's enforcement activity has increased. They are looking for easy targets. Do not be one of them.

If you want to discuss your agency's specific situation, get in touch. We work exclusively with agency founders and we know the model inside out.