If you run a UK agency, you have almost certainly hired contractors through an umbrella company. It is a standard setup across marketing, digital, creative, and recruitment agencies. The contractor joins an umbrella, the umbrella invoices you, and the umbrella handles PAYE and NI. Simple, right?

Not quite.

Many agency founders assume that using an umbrella company removes IR35 risk entirely. It does not. The IR35 umbrella company agency contractors relationship is one of the most misunderstood areas of off-payroll working. And HMRC knows it.

This article explains exactly where the risk sits, what documentation you need, and how to structure your contractor engagements so you do not end up with a tax bill you did not see coming.

The Common Setup: How Umbrella Companies Work in Practice

Here is how most agencies use umbrella companies.

You need a senior developer for a six-month project. They do not want to run their own limited company. They join an umbrella company instead. The umbrella becomes their employer on paper. You pay the umbrella a weekly or monthly rate that covers the contractor's pay, employer NI, apprenticeship levy, and the umbrella's margin. The umbrella runs payroll, deducts tax and NI, and pays the contractor a net salary.

From your side, you receive one invoice from the umbrella. You process it through your accounting system, pay it, and claim the cost against corporation tax. No payroll setup. No P32 filing. No hassle.

On the surface, this looks clean. And for many engagements, it is. But the compliance nuance is where agency owners get caught out.

Where the IR35 Risk Actually Sits

The critical point is this: the umbrella company is not the party responsible for determining the contractor's IR35 status.

Under the off-payroll working rules (Chapter 10 of ITEPA 2003), if your agency is a medium or large company, you are responsible for issuing a Status Determination Statement (SDS) to the contractor before work starts. That responsibility sits with the end-client or the agency acting as the deemed employer. The umbrella company is just the payroll intermediary.

If HMRC investigates and decides the contractor was inside IR35, the liability for unpaid tax and NI falls on the fee-payer. In a standard agency-umbrella-contractor chain, the fee-payer is usually the agency. Not the umbrella. Not the contractor.

I have seen agency founders say "but we used an umbrella" as if that was a get-out-of-jail card. It is not. HMRC will look at the actual working relationship, not the invoicing structure.

What HMRC Looks For

HMRC will examine three core tests when determining whether a contractor would be an employee if they were engaged directly:

  • Substitution: Can the contractor send a substitute, or must they do the work personally? If the contract says "personal service only", you are heading towards inside IR35.
  • Control: Does the agency (or end-client) control when, where, and how the contractor works? If they are managed like a permanent employee, IR35 is likely.
  • Mutuality of obligation (MOO): Is the agency obliged to offer work, and is the contractor obliged to accept it? Ongoing rolling contracts with no end date are a red flag.

These tests apply regardless of whether the contractor is paid through an umbrella, their own limited company, or directly on payroll. The payment mechanism does not change the employment status.

The Documentation You Must Have in Place

If you hire contractors through an umbrella company, you need three things documented before day one:

1. A Status Determination Statement (SDS)

You must issue an SDS to the contractor before they start. This document sets out your conclusion on whether the engagement is inside or outside IR35, and the reasons for that conclusion. HMRC can request to see these statements in an investigation. If you cannot produce them, you are already behind.

Use the CEST tool (Check Employment Status for Tax) as a starting point. It is free and gives you a reference number. But CEST is directional, not definitive. For complex arrangements, get a professional contract review from a specialist employment solicitor or an ICAEW qualified accountant who works with agencies.

2. A Contract That Reflects the Reality

Your contract with the umbrella must match how the contractor actually works. If the contract says the contractor controls their own hours but they are actually expected to be in your Soho office from 9 to 6 every day, the contract is meaningless. HMRC will look at the working practices, not the paperwork.

We see this mismatch all the time. Agency founders buy a standard "outside IR35" contract template off the internet, but the contractor is managed exactly like a permanent employee. That is a compliance time bomb.

3. Evidence of How the Contractor Operates

Keep records that demonstrate the contractor is genuinely in business on their own account. This includes:

  • Their own professional indemnity insurance
  • Evidence they work for multiple clients (not just your agency)
  • Their own tools and equipment (not your agency laptop)
  • No entitlement to holiday pay, sick pay, or pension contributions from you

If the contractor uses your equipment, works exclusively for you, and is managed by your account director, you have an inside IR35 engagement regardless of the umbrella.

What Happens When HMRC Investigates

HMRC can open an IR35 enquiry up to four years after the tax year ends. For cases involving careless or deliberate behaviour, that extends to six or even twenty years.

If HMRC determines the contractor was inside IR35, they will assess the fee-payer (your agency) for unpaid:

  • Income tax (at the contractor's marginal rate)
  • Employee NI (at 8% on earnings above the primary threshold)
  • Employer NI (at 13.8%)
  • Interest on late payments
  • Penalties (up to 100% of the tax due in serious cases)

To give you a real-world example: if you paid a contractor £80,000 through an umbrella over two years, and HMRC decides it was inside IR35 all along, the additional tax and NI could easily exceed £25,000. Plus interest. Plus penalties. And that is just for one contractor.

Multiply that by five or ten contractors, and you are looking at a six-figure liability that your agency insurance almost certainly does not cover.

Can an Umbrella Company Protect You? Sometimes.

There is one scenario where an umbrella company does shift the risk away from your agency. If the umbrella is set up as the deemed employer and takes on the responsibility for issuing the SDS, then the liability sits with them. But this is rare. Most umbrella companies explicitly state in their terms that they do not take on IR35 liability. They are payroll providers, not risk absorbers.

You need to read your umbrella contract carefully. Look for clauses that say "the client confirms that this engagement is outside IR35" or "the client accepts responsibility for the status determination." If you see those, the umbrella is passing the risk back to you.

Some specialist umbrella companies do offer "IR35-insured" services. They will review the contract, issue the SDS, and take on the liability. But those services cost more, and you need to verify the insurance is genuine and not just a marketing line.

Practical Steps for Agency Owners Right Now

If you currently hire contractors through umbrella companies, here is what I would do this week:

Step 1: List every contractor you currently have through an umbrella. Note their start date, rate, and whether you issued an SDS. If you did not issue an SDS, that is your first priority.

Step 2: Review the working practices for each contractor. Do they use your equipment? Are they managed by your team? Do they work set hours? If the answer to any of these is yes, you need to either restructure the engagement or accept it is inside IR35 and pay them through your payroll instead.

Step 3: Check your umbrella contract. Look for the IR35 liability clause. If the umbrella has passed the risk back to you, factor that into your risk assessment.

Step 4: Speak to your accountant. If you work with an ICAEW qualified firm like Agency Founder Finance, we can review your contractor arrangements and tell you where the gaps are. If you do not have an accountant who understands agency contractor models, now is the time to find one.

Step 5: For any new contractor engagements, issue an SDS before the contractor starts. Use CEST as a baseline, but get a professional review for anything borderline.

The Bottom Line on IR35, Umbrella Companies, and Your Agency

Umbrella companies are a legitimate and efficient way to engage contractors. They save you payroll admin and give contractors a clean payment structure. But they do not protect you from IR35.

The IR35 umbrella company agency contractors relationship is only safe if you have done the compliance work on the front end. Issue the SDS. Check the working practices. Make sure the contract matches reality. And if you are not sure, get help before HMRC comes knocking.

If your contractor mix has changed in the last 12 months, or if you are planning to hire contractors through an umbrella for the first time, ask your accountant before you issue the first purchase order. A 30-minute review now could save you tens of thousands in penalties later.

For more guidance on contractor compliance, see our full IR35 guide for agency owners. If you want to discuss your specific setup, get in touch with our team.