SB StartupBasket
All ideas
77 /100 GO Medium complexity

ChainTrail — umbrella PAYE evidence trail for UK recruiters

Collects contractor payslips every week and builds the HMRC file proving a recruiter checked its umbrellas.

Compliance SaaS EU UKCompliance-drivenSMBAI-agentSolo-builderStaffingPayroll
— views
Evaluation Scores
77/100

GO

Overall Score

17
Problem
12
Demand
12
Build
12
Distrib.
12
Revenue
8
Time
4
Defense

ChainTrail

1. One-liner

Collects contractor payslips every week and builds the HMRC file proving a recruiter checked its umbrellas.

2. Trend signal — why now?

On 6 April 2026, a new Chapter 11 of ITEPA 2003 — inserted by the Finance Act 2026 (c. 11) — made UK recruitment agencies jointly and severally liable for PAYE and NIC that an umbrella company in their supply chain failed to remit to HMRC.

HMRC’s own guidance page states it without softening:

“You’re responsible for making sure that the umbrella company operates PAYE correctly. If we find an umbrella company has not paid the correct amount of PAYE to us, we’ll recover it from you.”

Three things make this different from every other compliance duty I’ve written up:

  1. There is no reasonable-care defence. The IR35 rules have one. This does not. HMRC’s Employment Status Manual (ESM2420) describes joint and several liability with no mention of any defence, exemption or shield for the relevant party — and HMRC is not required to pursue the umbrella first.
  2. The debt is bigger than the margin. ESM2430 puts the recoverable amount at “the full extent of what the umbrella company should be treating as employment income… including any amounts that are paid as disguised employment income such as supposed loans.” Employer’s NIC, employee’s NIC, income tax, student loan — on gross contract value, not on the agency’s cut.
  3. The debt survives the umbrella’s death. Industry guidance is blunt: the debt does not disappear when a non-compliant provider dissolves. Phoenixing is the reason the rule exists, not an escape from it.

The scale of the exposure is HMRC’s own number: roughly 700,000 people work through around 500 umbrella companies, and in 2022/23 at least 275,000 workers — over a third — were engaged by umbrellas that failed to meet their tax obligations, costing the Exchequer about £500 million. That is now, mechanically, a recruiter liability.

Provenance:

3. The opportunity

The market has answered this rule with assurance products, and assurance is the wrong shape.

SafeRec is the strongest incumbent: real-time forensic payslip audit, cross-referenced against RTI submissions and HMRC tax accounts, with a drag-and-drop payslip audit tool. It is genuinely good technology. It has two structural holes, and they are the business:

Hole 1 — the incumbent is paid by the party it audits. SafeRec certification is bought by the umbrella company. The due-diligence report is then given to agencies at no cost. That is a lead-magnet economics model, and it produces the predictable coverage limit: the agency gets deep evidence on umbrellas that chose to be certified, and nothing on the ones that didn’t. The umbrella most likely to sink an agency is precisely the one that will never buy a certification.

Hole 2 — assurance is not a defence, and the market has started saying so out loud. The FCSA — the accreditation body itself — concedes that accreditation “does not remove an agency’s own responsibility under JSL,” and that what it provides is “a documented, independent reference point.” Industry analysis is harsher: no form of documentation or audit removes JSL risk; payslip checks, RTI validations and proof-of-payment statements do not constitute a statutory defence.

So what is an agency actually buying? Not immunity — that isn’t for sale. It is buying the record that it looked, continuously, at every umbrella it used, including the uncertified ones — because when HMRC opens a supply-chain enquiry, the agency that can produce a dated, per-worker, per-payslip trail negotiates from a completely different position than the agency that produces a folder of PDFs from onboarding day.

The gap in one line: every vendor sells a verdict on the umbrella; nobody sells the agency’s own evidence file, assembled from the workers it actually placed. HMRC literally instructs agencies to obtain payslips directly from workers. No product does that collection loop for a 6-person agency.

This is the same pattern as the scoring-vs-proving gap: when every vendor sells the number, the per-line-item evidence is unbuilt.

4. Target market

  • Primary customer: Owner-director or operations/compliance manager at a UK recruitment agency placing 20–400 contractors through umbrella companies — construction, industrial, driving, healthcare, IT contract. 1–30 internal staff. £2M–£40M turnover, most of which is pass-through contractor pay.
  • Why they buy: They carry absolute liability for a tax debt computed on gross contract value, generated by a company they don’t own, don’t control and can’t audit — and they have no compliance department. The trade press describes agencies trimming PSLs and demanding evidence; that is a scramble, not a solution. A £300k assessment ends a 6-person agency.
  • Rough TAM reasoning: 36,057 UK recruitment companies; ~79.5% are micro-businesses under 10 employees. Not all use umbrellas — contract/temp desks do. A defensible serviceable base is 6,000–10,000 agencies with live umbrella supply chains. At £250/mo average that’s a £18M–£30M ceiling. I only need 3% of it.
  • Why now for them: The rule went live 6 April 2026 and is roughly 150 days old. PSLs are being trimmed right now. HMRC has published the manual and issued a policy paper prodding inert agencies. The first enquiry wave is the forcing event, and nobody wants to be assembling evidence retrospectively when it lands.

5. Product sketch (MVP)

  • Worker payslip capture loop — every contractor gets a weekly WhatsApp/SMS/email nudge; they forward or photograph the umbrella payslip. That’s the whole ask on the worker. No app, no login.
  • Payslip parse and anomaly flag — reads gross, deductions, employer name, PAYE reference, net, holiday pay. Flags what HMRC’s own guidance names as red flags: employer name that doesn’t match the KID, PAYE reference changing between payslips (the mini-umbrella-fraud tell), unexplained or bundled deductions, holiday pay that never gets paid out, net below minimum wage.
  • Net-pay tie-out — asks the worker once a month to confirm the amount that actually hit their bank matches the payslip net, and whether it arrived as one payment or several. Split payments are a classic disguised-remuneration signature.
  • Umbrella entity watch — Companies House monitoring on every umbrella on the PSL: new incorporations sharing directors, director changes, overseas directors, dissolution and phoenix patterns, VAT registration status, insurance and accreditation expiry.
  • The JSL evidence file — the actual deliverable. Per umbrella, per worker, per pay period: what was checked, when, what was found, what the agency did about it. Exportable as a dated PDF bundle the moment HMRC asks.
  • Escalation pack — when a flag fires, generates the letter to the umbrella demanding RTI evidence with a response deadline, and logs the reply or the silence. Silence is itself evidence the agency acted.
  • PSL risk board — one screen ranking every umbrella the agency uses by live risk, so the director knows which supplier to drop before the debt accrues.

6. AI angle — what’s load-bearing

Remove the AI and this is a shared inbox and a spreadsheet — which is exactly the thing agencies are failing at today.

The load-bearing work is extraction and normalisation across chaos. There is no standard umbrella payslip. Every provider formats differently, and workers submit phone photos, PDFs, forwarded emails and screenshots. Turning a blurry photo of a payslip from an umbrella you’ve never seen into structured fields — gross, employer PAYE ref, each deduction line, holiday accrual, net — at 400 workers × 52 weeks is 20,800 documents a year per mid-size client. That is a vision-model job and it was not economically viable before cheap multimodal inference.

The second AI job is cross-document reasoning: noticing that worker A’s PAYE reference changed in week 14 while worker B’s didn’t, that three “different” umbrellas share a registered address, that holiday pay has accrued for 30 weeks and never been paid. That’s pattern detection over a corpus, not a rules table.

7. Localization angle (if any)

This is a UK-only play by construction — the duty is a UK statute. That’s a feature, not a limit: the regulatory specificity is the moat against generic global compliance SaaS, and the market is big enough (36,000 agencies) to support a £3–5M ARR business without leaving the country.

The one adjacent expansion that isn’t a stretch: the same JSL logic lands on end clients where no agency sits in the chain (HMRC’s ESM2425 examples make the client the relevant party in direct-contract cases). Same product, different buyer, larger wallet.

8. Business model — path to $1M–$5M ARR

  • Pricing: Tiered on contractors monitored, not seats. £149/mo up to 25 contractors · £349/mo up to 100 · £749/mo up to 300 · £1,500/mo above. Roughly £6–£10 per contractor per month — noise against a £120–£200/week agency margin per contractor, and rounding error against the liability.
  • ACV: ~£4,200 realistic blended.
  • Rough math to $1M ARR: ~190 agencies at £349/mo = £795k ≈ $1.0M. Under 200 customers out of 6,000+ addressable.
  • Rough math to $5M ARR: ~900 agencies at a blended £4,400 ACV, or 600 agencies plus the end-client/MSP tier where deals run £1,500–£3,000/mo. Needs the MSP channel to open — MSPs monitor dozens of downstream agencies.
  • Expansion path: contractor count grows with the agency; add the escalation/legal-pack tier; add end-hirer seats (the client wants the same file); annual prepay at 2 months free.

9. Go-to-market wedge — first 100 customers

  1. The PSL-trimming moment, mined from public sources. Agencies are actively cutting umbrellas off their PSLs right now. Scrape UK recruitment agencies from Companies House SIC 78200/78100 filtered to £2M+ turnover, cross-reference against REC and APSCo member directories, and target contract/temp desks. ~4,000 named agencies with a director’s name and address. Direct mail plus email — “here is the evidence file HMRC will ask you for; you have none of it.”
  2. Ride an HMRC enquiry wave with a free exposure report. Offer a one-off free “JSL exposure snapshot”: give me your umbrella list, I check every entity against Companies House for the phoenix and shared-director patterns, and return a ranked risk list in 48 hours. It’s a genuine deliverable, it costs me minutes, and it converts because most agencies discover an umbrella they can’t defend. This is the wedge — lead with the finding, not the demo.
  3. Sell through the accountants and payroll bureaux who serve recruiters. Recruitment-specialist accountants (Recruitment Accountants, Alto, Harold Sharp and dozens of regional firms) are publishing JSL warnings to their client bases and have no tool to sell alongside the warning. Revenue share, 15–20%. Each firm has 30–200 agency clients.
  4. Contrarian content against the assurance narrative. Every incumbent says “use an accredited umbrella and you’re fine.” The FCSA itself concedes accreditation doesn’t remove the agency’s responsibility. A well-sourced piece titled “Your umbrella’s accreditation is not your defence” aimed at agency directors, seeded into REC/APSCo LinkedIn circles and ContractorUK comment threads, is cheap and lands because it’s true and quotable.
  5. MSPs and staffing consolidators as multipliers. An MSP managing 40 downstream agencies has 40× the exposure and an existing budget line. Ten MSP deals is most of the way to $1M.

10. Build complexity — justification

Medium. The payslip parser is off-the-shelf multimodal inference; the Companies House API is free and public; the worker-nudge loop is Twilio/WhatsApp Business API. No custom models, no HMRC integration required (and none available — agencies cannot query another company’s tax account, which is exactly why worker-side collection is the only path).

The genuine work is (a) reliable extraction across dozens of unstandardised payslip layouts, (b) the evidence-file data model that has to be defensible and immutable, and (c) worker response rates — a product where the data comes from people who don’t pay you needs real engagement design. Two people, 12–16 weeks to a v1 that a 50-contractor agency can run for real.

11. Gating checklist

GatePass?Note
Legal in target market✅Helps agencies meet an HMRC-stated expectation; workers consent to share their own payslips.
Ethical — no harm / dark patterns✅Detects underpayment of workers as a side effect. Worker sees their own flags.
Market exists (evidence above)✅Statute in force, 36k agencies, funded incumbent already selling adjacent product.
1–5 person team can build this✅Two people, 12–16 weeks.
Launchable with <$50K / ₹40L✅Inference + messaging + Companies House API. Well under £20k to first revenue.

12. Feasibility score

AxisWeightScoreNotes
Problem intensity2017/20Absolute liability, no defence, debt on gross value, survives supplier insolvency. Existential for a micro-agency. Not 19 — it’s a tail risk until an enquiry lands, and tail risk always sells worse than a weekly bleed.
Demand evidence1512/15Statute in force, HMRC manual published, PSLs visibly being trimmed, funded incumbent (SafeRec, 3,500+ agencies). Docked for the absence of direct agency-owner complaint quotes — I searched and could not source them; trade press is vendor-authored.
Build feasibility1512/15Off-the-shelf AI + public APIs, but multi-format extraction and an evidentiary data model are real work. 12–16 weeks.
Distribution clarity1512/15Named, scrapeable list (Companies House SIC + REC/APSCo directories), a free exposure report that produces a genuine finding, and accountant channel. Not 14 — recruitment agency owners are hard to reach and heavily marketed to.
Revenue mechanics1512/15£6–10/contractor/mo is defensible against margin and trivially against liability. £1M needs <200 customers. Docked because the incumbent’s £0 price to agencies anchors expectations badly.
Time to first revenue108/10The free exposure report converts fast; pilots inside 6–8 weeks. Not 9 — agency directors buy on renewal and enquiry cycles.
Defensibility104/10Honest score. The mechanic is copyable and a funded incumbent is one product decision away. The only real moat is accumulated cross-agency umbrella intelligence — which compounds, but not by month 3.
Total10077/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · sales-heavy

Needs someone who can build a reliable document-extraction pipeline and someone who can sell fear-adjacent compliance to sceptical, marketed-at agency directors. Domain knowledge helps but is learnable — the statute is short and HMRC’s manual is public.

Key assumptions to validate (3–5)

  1. Assumption: Agencies will pay for an evidence trail that explicitly does not grant immunity. How to test: 25 calls with agency directors placing 50+ contractors. Pitch it honestly — “this doesn’t protect you, it proves you looked” — and see if that framing survives. If they only want a guarantee, the category is unsellable and I should know in two weeks.
  2. Assumption: Contractors will forward payslips weekly at >60% response. How to test: Run the nudge loop manually with one friendly agency’s 30 contractors for 4 weeks. Measure response decay in weeks 3–4, not week 1.
  3. Assumption: The free exposure report finds something alarming in most agencies’ PSLs. How to test: Run the Companies House pattern check against 20 real agency umbrella lists. If fewer than half surface a genuine flag, the wedge doesn’t convert.
  4. Assumption: SafeRec’s free-to-agency model doesn’t simply absorb this. How to test: Ask 10 agencies already using SafeRec what coverage they have on their uncertified umbrellas. If the answer is “all of ours are certified,” my gap is smaller than I think.

Risk flags

  1. Incumbent absorption: SafeRec has the payslip-audit technology, the agency relationships and a £0 price point to agencies. If they add worker-side collection for uncertified umbrellas, my differentiation evaporates. This is the single biggest risk and it is why defensibility scored 4.
  2. Free-lead-magnet price anchor: When the best-known tool in the category costs agencies nothing, charging £349/mo requires a sharp, provable distinction. The pitch has to be “SafeRec tells you about the umbrellas that paid to be checked; I tell you about the ones that didn’t.”
  3. Data supply depends on non-customers: Workers provide the data and have no contractual relationship with me. Response-rate collapse is a product-killer, not a metric miss.
  4. Regulatory drift: HMRC could publish a safe-harbour or statutory defence, which would reshape what agencies need to keep. It would probably increase demand for a structured file — but it could equally specify a format I don’t produce.
  5. Enforcement timing: If HMRC’s first enquiry wave is slow and quiet, urgency decays and this becomes a vitamin. The rule being 150 days old cuts both ways.

14. Structured verdict

Score:                  77/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical founder who can ship a document-extraction pipeline,
                        paired with someone who can sell compliance to UK agency directors
Time to revenue:        6–10 weeks (free exposure report → paid pilot)
Capital to launch:      £15–20k ($20–26K)
Top 3 assumptions to validate first:
  1. Agencies pay for evidence that isn't immunity — 25 director calls, honest framing
  2. Contractor payslip response rate >60% sustained to week 4 — manual pilot, 30 workers
  3. Free exposure report surfaces a real flag in >50% of PSLs — run against 20 agency lists
Kill criteria:
  - Abandon if <5 of 25 agency directors will pay for a documented trail once told plainly
    that it confers no statutory defence
  - Abandon if contractor payslip submission drops below 50% by week 4 of the manual pilot
  - Abandon if SafeRec (or an FCSA-backed equivalent) ships worker-side collection covering
    uncertified umbrellas, free to agencies, before v1 launch

15. Next step — 1-week validation sprint

  • Day 1–2: Pull 4,000 UK recruitment agencies from Companies House (SIC 78200/78100, £2M+ turnover). Hand-build the umbrella PSL for 20 of them from their own websites and job ads. Run every umbrella entity through the Companies House phoenix/shared-director/dissolution pattern check. Count how many of the 20 have at least one umbrella with a genuine red flag.
  • Day 3–4: Send those 20 agencies their free exposure report, unsolicited, with the flags spelled out and no pitch attached beyond “reply if you want the rest.” Measure reply rate. Book calls.
  • Day 5: On every call, use the honest framing — this does not give you a defence, it gives you the file that proves you looked — and ask for £349/mo. Count how many say yes to a paid pilot.

Falsifiable outcome: ≥50% of the 20 PSLs contain a sourceable red flag, ≥6 of 20 agencies reply to a cold exposure report, and ≥3 commit to a paid pilot at £349/mo after being told plainly it isn’t immunity. Fewer than 3 commitments and the category is an assurance market that only wants guarantees — which I cannot sell — and I drop it.

Interested in a detailed proposal?

Get a deep-dive with market research, competitive analysis, and implementation roadmap.

Contact us

info@startupbasket.ai