An employer stays legally responsible for PAYE even when a bureau or accountant runs the payroll, but the bureau has duties of its own. A bureau that deals with HMRC for clients must register as a tax adviser, with payroll only businesses that have no agent services account due to register between 18 November 2026 and 17 February 2027. It also needs client authorisation, clear written terms on who does each task, data protection and record keeping controls, and, if it handles wages or tax payments, proper client money arrangements.

Who is legally responsible when a bureau runs payroll?

GOV.UK is blunt: an employer is legally responsible for completing all PAYE tasks even if it pays someone else to do them, and is responsible for collecting and keeping employee details for the provider. Regulation 67B of the Income Tax (PAYE) Regulations 2003 requires a Full Payment Submission on or before each payment to an employee, and HMRC charges monthly late filing penalties of £100 for 1 to 9 employees, £200 for 10 to 49, £300 for 50 to 249 and £400 for 250 or more, with no penalty for the first failure in a tax year or where all payments are reported within three days of payday. The penalty rules are in PAYE late filing and payment penalties.

Relying on a bureau is not itself a defence. Under paragraph 23(2)(b) of Schedule 55 to the Finance Act 2009, reliance on another person is not a reasonable excuse unless the employer took reasonable care to avoid the failure. In practice the penalty falls on the client, and the client then looks to the bureau’s engagement terms and insurance for recovery, which is why the allocation of tasks needs to be written down.

Does a payroll bureau have to register with HMRC?

Yes, if it deals with HMRC on clients’ behalf in the course of business. HMRC’s guidance says anyone who interacts with HMRC about someone else’s tax affairs and is paid for it must register as a tax adviser, and that registration happens through an application for an agent services account. Registration is being phased in. Under HMRC’s manual at MTAR10800 the window for advisers who solely provide payroll services and do not have an agent services account runs from 18 November 2026 to 17 February 2027. A bureau that also provides tax or accounts services which involve dealing with HMRC falls into an earlier tranche. Businesses have three months from the start of their window to apply and may continue to act while a registration made in time is processed.

HMRC says the agent services account gives access to PAYE for employers, that it can take 40 working days to receive one, and that once registered the agent must get authorisation from each client before acting. The conditions HMRC checks, and the consequences of suspension, are covered in tax adviser registration with HMRC.

Which tasks should the engagement letter allocate?

Disputes between bureaux and employers often turn on who was supposed to do something. The engagement terms should state, task by task, whether the bureau or the employer is responsible for:

  • Real Time Information: sending each FPS and any Employer Payment Summary on time, and the cut off date for the employer to supply starters, leavers, hours and changes. See RTI: FPS and EPS.
  • Payslips: section 8 of the Employment Rights Act 1996 gives workers the right to an itemised pay statement at or before payment, showing gross pay, fixed and variable deductions, net pay and, where pay varies with time worked, the hours worked.
  • Year end: P60s by 31 May and expenses and benefits returns by 6 July, as GOV.UK sets out; see payroll year end tasks.
  • Paying HMRC: the amount due must reach HMRC by the 22nd of the month, or the 19th if paying by post. If the employer pays, the bureau should say so in writing each month.
  • Automatic enrolment: assessing staff, enrolling them and submitting contributions. The Pensions Regulator says advisers can complete the declaration of compliance for a client, but it remains the employer’s legal duty and must be made within five months of the duties start date. See automatic enrolment duties.
  • Minimum wage checks: whether the bureau checks pay against the National Minimum Wage, and on what information about hours.

What records must be kept, and for how long?

GOV.UK says employers must keep records of pay and deductions, reports and payments to HMRC, leave and sickness absence, taxable expenses and benefits, and Payroll Giving documents for three years from the end of the tax year they relate to, and that HMRC may estimate what is owed and charge a penalty of up to £3,000 where records are incomplete. Minimum wage records are separate: regulation 59 of the National Minimum Wage Regulations 2015 requires records sufficient to show the minimum wage was paid, kept for six years from the end of the following pay reference period and producible as a single document for each pay reference period.

Because the bureau often holds the only complete copy, the terms should say who keeps which records, in what format, and what happens on termination. ICAEW’s retention guidance suggests that firms keep PAYE files for the current year plus six further years as best practice, rather than the three year minimum; see how long practices should keep client files.

How does data protection apply to a payroll bureau?

Payroll data includes bank details, National Insurance numbers, salaries and sickness absence, so a breach can do real harm. Whether the bureau is a controller or a processor depends on its role. The ICO’s example of an accountant doing a client’s books treats the accountant as a controller because professional obligations, such as reporting malpractice, mean it does not act only on the client’s instructions. A bureau that genuinely processes payroll only on the employer’s instructions may be a processor, in which case Article 28 of the UK GDPR requires a written contract setting out the subject matter, duration, nature and purpose of processing and obliging the bureau to act only on documented instructions, keep the data secure under Article 32, assist with data subject requests and delete or return the data at the end. Either way, Article 32 requires appropriate technical and organisational security measures.

Are payroll bureaux within the money laundering rules?

Regulation 11(c) of the Money Laundering Regulations 2017 defines an external accountant as a firm or sole practitioner who by way of business provides accountancy services to other persons. HMRC supervises accountancy service providers that are not supervised by a professional body, and its guidance says trading while unregistered is a criminal offence. A practice already supervised normally runs payroll clients through the same due diligence and risk assessment as other clients. A standalone bureau should get a clear view from HMRC or its professional body on whether its services bring it within scope, rather than assume they do not.

What if the bureau handles wages or tax payments?

Money a firm holds or receives for a client is clients’ money. For ICAEW firms, the clients’ money regulations require the client’s identity to be verified before holding money for them, money received to be paid immediately into a designated client bank account that the bank has acknowledged in writing, and client account reconciliations at least once every five weeks with records kept for at least six years. Operating the client’s own bank account is not clients’ money if the client has given written authority acknowledged by the bank and the firm keeps adequate records. Many bureaux prefer that route, or arrange for the employer to pay staff and HMRC directly. See client money rules.

How does a missed submission play out, and what are the common mistakes?

Illustration only. A bureau runs a monthly payroll for a client with 12 employees. The client emails a new starter’s details late, the bureau runs the payroll a week after payday and the FPS is late in two months of the same tax year. The first failure in the tax year attracts no penalty, so the client is charged one £200 penalty for the second month. Whether the client can recover it from the bureau will turn on the written cut off dates and whether the bureau or the client missed them.

Common mistakes are:

  • no engagement letter, or one that says “payroll services” without listing tasks and deadlines;
  • not preparing for tax adviser registration before the payroll window opens;
  • paying wages through the firm’s office account instead of a client account;
  • treating automatic enrolment as the pension provider’s job; and
  • keeping payroll data indefinitely, or deleting it before the employer’s record keeping period ends.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.