HMRC says that, generally, security workers are employees for tax purposes and should ordinarily be on the payroll, with income tax and NICs deducted and paid over to HMRC.  

The letter warns that “criminals operating complex supply-chain frauds are infiltrating security supplies in all sectors” and may seek to exploit the business and its workers by keeping the tax and NICs they deduct from the workers’ pay.    

HMRC is asking employers to: 

• check that their security workers are correctly registered for pay as you earn (PAYE) and NICs;
• make sure their workers’ pay fully accounts for income tax and NICs; and 
• if other parties provide the business with security workers, check who needs to operate PAYE on the workers’ earnings. This could be the security business, another security company, an agency or a recruitment company. 

The business is asked to act by 2 August 2025. If changes are required to earlier tax declarations, the business may still be able to make an unprompted disclosure to HMRC. Whether a disclosure is prompted or unprompted can affect the amount of any penalty charged by HMRC. 

Further information  

• Template letter provided by HMRC 
• PAYE and payroll for employers: Introduction to PAYE
• ESM2039: Agency and temporary workers: agency legislation
• Advice on applying supply chain due diligence principles to assure your labour supply chains
• 10 things about due diligence: supply chain assurance
• Compliance checks: penalties for inaccuracies in returns or documents (CC/FS7a)