In Part One of the Beyond the SafeRec Certification Series, we described the unusual wave of umbrella acquisitions we began examining during the first months of 2026: the recurring approaches, the valuations being discussed and the questions those transactions raised about ownership and control. At the same time, another part of the SafeRec framework was doing exactly what it had been designed to do: giving recruitment agencies independent visibility of the payroll being processed for their workers.

From the beginning, SafeRec Certification was designed around more than auditing an umbrella company and awarding it a certification. We wanted recruitment agencies to have an ongoing audit trail that they could independently reconcile against information only they hold. An umbrella company knows what payroll it has processed and SafeRec knows what has been submitted through its audit controls, but the recruitment agency knows something equally important: how many workers are sent to that umbrella company, how many workers are expected to be paid, and how much money it has transferred for those workers.

That is why the SafeRec Platform and the monthly reports we send to agencies have always been an integral part of the certification framework. They allow agencies to see which workers and payslips have been audited and compare that information against their own worker and payment records. The purpose is not simply to tell an agency that the payroll SafeRec received passed an audit; it is to give the agency the visibility needed to satisfy itself that the population being audited corresponds with the population it actually expected the umbrella company to process.

As agencies increasingly used that visibility during 2026, some of those reconciliations began raising questions. In particular, agencies identified occasions where workers they expected to see within the audited payroll were not represented there. A discrepancy of this kind can arise for a range of reasons, including routine operational factors. What became significant was not any individual discrepancy in isolation, but the emergence of similar discrepancies across a few reconciliations.

Continuous audit and visibility

From the outset, SafeRec Certification was designed to provide more than a point-in-time assessment of an umbrella company. Legal and operational review is combined with ongoing payroll auditing, reconciliation against Real Time Information submitted to HMRC and monthly checks of the umbrella company’s HMRC tax account.

All PAYE references operated by a certified umbrella company must be disclosed and brought within the relevant audit controls. The requirement is therefore not simply to submit payroll for audit, but to ensure that the complete payroll population that should fall within those controls is represented.

The SafeRec Platform and monthly reporting provide an additional layer of transparency. Recruitment agencies can see the workers and payslips being audited and compare that information with the workers they have placed through the umbrella. This visibility is provided free because it forms part of the control itself: it allows the audited population to be compared with the population the supply chain expects the umbrella to be processing.

When agencies started asking questions

A temporary interruption in payroll data does not necessarily indicate a compliance issue. Occasionally, an update or technical issue involving an umbrella company’s payroll software can interrupt the transmission of payslips, in which case SafeRec works with the relevant provider to restore the data flow.

What we began examining during this period was different. Particular workers were not represented within the audited payroll while other payroll information from the same umbrella company continued to arrive normally. Initially, we addressed those enquiries with the umbrella company. The relevant payroll was reprocessed and the payslips were audited and appeared on the SafeRec Platform. From the agency’s immediate perspective, the payslips it had asked about were now visible.

After this happened on a number of occasions, however, we changed the way we approached the next enquiry. Rather than asking the umbrella to address the discrepancy first, we asked the recruitment agency to contact the workers and obtain copies of the payslips they had already received.

The distinction mattered. We were no longer looking only at the payroll record that appeared after a query had been raised. We were examining the document issued to the worker when the original payment was processed, before the umbrella had been asked to explain its absence from the audit.

Those copies provided a different view of what had happened.

What the original payslips showed

The documents identified two distinct situations that required further explanation. In some cases, the worker’s payslip named a different employing entity from the umbrella company the recruitment agency understood was employing them. In others, the expected umbrella remained named as the employer, but the payslip displayed another PAYE reference associated with that company. In some cases, differences in the payslip format also indicated that another payroll system may have been used.

The question was therefore no longer simply why a payslip had not appeared within the audit. The documents raised a further question: why did the original payslip identify an employing entity or PAYE reference that had not been disclosed to SafeRec and was not represented within the expected audit controls?

Reprocessing the payroll after an enquiry could result in a record subsequently appearing on the Platform. It did not, by itself, explain the employer, PAYE reference or payroll route shown on the document originally issued to the worker. It is important to be precise about what this established. A different employer or an undisclosed PAYE reference does not, on its own, prove that tax was unpaid or that a tax avoidance arrangement was operating. Establishing either would require further evidence.

For SafeRec, however, the discrepancy itself required an explanation. Complete disclosure of the relevant payroll arrangements and PAYE references is a requirement of certification. Where information identified through an enquiry indicates that a relevant employing entity, PAYE reference or payroll arrangement may not have been disclosed, SafeRec must establish the position and determine whether its certification requirements have been met.

Three arrangements the supply chain needs to understand

The clearest way to understand what these findings can mean in practice is to separate three different payroll arrangements. None should automatically be treated as evidence of fraud or tax avoidance. The common issue is a difference between the employment or payroll arrangement understood by the supply chain and the arrangement actually being operated.

1. An umbrella company passes the employment to another intermediary

In this type of arrangement, a recruitment agency may send funds to an umbrella company on the understanding that the umbrella employs and pays the workers. Funds relating to some workers may instead be passed to another intermediary that employs those workers and processes their payroll.

From the recruitment agency’s perspective, very little may appear to have changed. Its contract may remain with the umbrella company, payments may still be made to that business and its due diligence may have been conducted against that business. The worker’s employment and payroll, however, may sit with a different legal entity further down the chain.

This distinction is important because compliance checks and payroll auditing carried out on the original umbrella company cannot provide evidence of payroll operated by another employer. It also means that simply checking where the agency sent the money does not necessarily establish who ultimately employed and paid the worker.

This is where visibility of the audited worker population becomes important. Through the SafeRec Platform, an agency can compare the workers it knows it has funded through an umbrella with the workers whose payroll has actually been audited through that umbrella. If a worker the agency expected to be employed and paid by the umbrella is not represented within that audited population, the discrepancy can be identified and investigated rather than the agency having to rely solely on the arrangement it was told was in place.

Workflow 1 Declared Umbrella Payroll vs Actual Employing Entity.png

2. An agency declares direct PAYE employment but uses another employer

The same issue is not limited to umbrella companies. It can also arise where a recruitment agency tells an MSP or end client that a worker is employed and paid directly by the agency through its own PAYE payroll, with no intermediary involved.

On the face of it, that declaration provides some reassurance. The MSP has been told who the employer is, that PAYE is being operated directly by the agency and that there is no umbrella company or other intermediary further down the chain. The risk is that the declaration is then treated as sufficient evidence of the arrangement, without the employment and payroll position being independently verified.

But the arrangement being operated in practice can be different. Funds may instead be passed by the recruitment agency to another intermediary that employs the worker and processes their payroll. The agency may remain the supplier visible to the MSP while the employment and payroll activity sits with another business that the MSP may not know is involved.

During separate supply-chain investigations, SafeRec has encountered situations where workers were presented to the business further up the supply chain as being employed directly by a recruitment agency under its own PAYE, while the employment and payroll information available to us indicated a different arrangement. We have also encountered situations where information available to us indicated the involvement of intermediary arrangements that had not been disclosed to the business further up the supply chain.

The important point is that “we employ the worker directly under PAYE” is a declaration, not evidence of the employment arrangement on its own. An MSP should not need to assume that the statement is incorrect, but its compliance framework should be capable of independently confirming that the agency making the declaration is genuinely the employer and that the worker is being processed through that agency's PAYE payroll.

The same payroll visibility available for umbrella companies can also be applied to agency PAYE. Using Internal Payroll Audit inside the SafeRec platform, agencies can upload their internal PAYE payroll data and share those audit results with their entire supply chain. For an MSP, this provides an audit trail supporting the declaration that the worker is genuinely employed and paid directly by the agency, rather than through an undisclosed intermediary.

The principle is therefore the same whether a worker is described as umbrella PAYE or direct agency PAYE: visibility should follow the worker. The label given to the arrangement should never be the end of the enquiry; the supply chain should be able to evidence who actually employs the worker and through whose PAYE payroll they are being paid.

Workflow 2 Declared Agency PAYE vs Actual Employing Entity.png

3. The umbrella remains the employer but uses another PAYE reference

The third arrangement is different because the employing entity can remain the same. An umbrella company may operate more than one PAYE scheme, with one disclosed and included within the expected audit controls while another is not.

Workers processed under the disclosed PAYE reference would appear within the audited payroll and on the SafeRec Platform. Other workers could instead be processed by the same company under another PAYE reference that had not been disclosed. Because the employer name could be identical in both cases, checking the company name alone would not necessarily reveal the difference.

This distinction also matters when considering evidence that PAYE liabilities have been settled. Evidence relating to the PAYE position under one disclosed reference should not, by itself, be treated as evidence of the position under every other PAYE reference that the same employer may operate. The relevant PAYE reference therefore forms an important part of understanding which payroll and liabilities the evidence relates to.

There is nothing inherently wrong with operating multiple PAYE schemes. SafeRec requires all PAYE references operated by a certified umbrella company, together with the relevant payroll, to be disclosed and brought within the audit. By reconciling the workers visible on the SafeRec Platform with the workers an agency has funded, a discrepancy can be identified even where the employer name itself appears entirely correct.

Workflow 3 One Employer, Two PAYE Schemes.png

How SafeRec responded; why the wider acquisition activity remained relevant to our enquiries

The ownership activity described in Part One formed part of the wider context in which these questions arose. We therefore considered ownership and control alongside the payroll evidence where relevant, while assessing each case independently on its own evidence and circumstances. A change of ownership does not, by itself, indicate a payroll or compliance issue.

SafeRec asked the relevant businesses to explain the discrepancies identified and provide the information necessary for us to complete our enquiries. During the same wider period, we also introduced additional controls that applied across our certified umbrella population.

The overwhelming majority of certified umbrella companies cooperated with those requirements. In other cases, SafeRec was unable to obtain the information or assurance necessary to resolve the questions identified, while some businesses chose not to continue under the additional controls introduced during the wider period.

The circumstances differed from business to business and should not be grouped together. Certification may cease for a range of reasons, and the matters described in this article should not be taken as applying to every business whose SafeRec Certification ended during this period.

Accounting for every worker

SafeRec already receives and audits the payroll data and payslips processed by certified umbrella companies. What these cases demonstrated was why the audit must also be capable of establishing whether the payroll being presented represents the complete worker population that should fall within those controls.

The Platform provides an additional point of visibility. Where a recruitment agency identifies that a worker it has placed through an umbrella is not represented within the audited population, SafeRec can investigate why. In the cases described in this article, we eventually changed the order of that investigation: before approaching the umbrella, we asked the agency to obtain the payslip the worker had originally received. That allowed us to examine how the worker had been processed before the umbrella knew a question had been raised.

Those original documents identified differences that required explanation, including the employing entity named, the PAYE reference displayed and, in some cases, indications of a different payroll system. We could then compare that evidence with the information being provided through the SafeRec audit and ask the umbrella company to explain the discrepancies identified.

Accounting for every worker was not a new objective introduced because of these cases. It was one of the reasons SafeRec was designed around continuous payroll auditing, complete PAYE disclosure and supply-chain visibility from the outset. What happened during this period demonstrated why each of those controls matters.

But the documents answered only part of the question. They showed us what had happened in the cases we examined; they did not explain the wider market behind it. We wanted to understand how these arrangements were being presented commercially, what was being offered to recruitment businesses and, crucially, what people might be prepared to explain to a prospective customer that they would be unlikely to explain to a compliance organisation.

To answer that question, we needed to approach the market differently.

That is where Part Three begins: Going Undercover.