Professional Passport’s “Fortis” System: A False Fix

Why Professional Passport’s “Fortis” System Won’t Fix the New HMRC Liability Rules

When the draft Finance Bill 2026 landed in July, it confirmed what many in the contracting and recruitment sector had feared for months — HMRC’s new Joint and Several Liability (JSL) rules will fundamentally reshape the umbrella market from April 2026 onwards.

Under these proposals, agencies and end clients could be held jointly liable for unpaid PAYE tax if an umbrella company fails to meet its obligations. This represents a seismic shift. Liability will no longer stop with the non-compliant umbrella; it will ripple up the supply chain, creating what is effectively collective liability — even when the agency or client has done nothing wrong.

In that context, it’s no surprise that solutions are already being marketed to “remove” or “insulate” firms from this risk. The most prominent of these so far is Professional Passport’s new system: Fortis.

What Fortis Promises

According to Professional Passport, Fortis offers agencies and end clients a “one-touch” system that creates a complete audit trail for every worker paid through an umbrella.

In short, the idea is this:

• The agency uploads timesheets to Fortis.

• Umbrella companies are alerted to run their payrolls.

• Fortis then produces reports showing all deductions and PAYE due for each worker.

• The agency pays the PAYE directly to HMRC, using the umbrella’s PAYE reference, while paying the remaining funds to the umbrella.

Professional Passport claims that this provides a fully documented and demonstrable evidence trail proving that PAYE has been paid — and therefore that the agency is protected from any collective liability under the new legislation.

It sounds neat in theory. Unfortunately, in practice it’s unlikely to work — legally, operationally, or commercially.

1. The Legislation Doesn’t Allow “Opt-Outs” of Liability

The most fundamental flaw in Fortis’s logic is that the JSL legislation doesn’t create an escape clause for agencies who can show they “did everything right.”

The current draft clauses make clear that if an umbrella fails to meet its PAYE liabilities, HMRC can pursue the agency or client for the full unpaid amount, regardless of intent, knowledge, or process. There’s no statutory “reasonable care” defence, no “safe harbour” language, and certainly nothing that recognises a private system like Fortis as a compliant workaround.

Put simply: even if an agency uses Fortis perfectly, pays every penny of PAYE via the correct references, and keeps pristine records, HMRC can still come knocking.

Audit trails may be good evidence of diligence, but under an absolute liability regime, diligence is not a defence.

2. It Adds More Work — Not Less

The whole appeal of umbrella companies has always been simplicity. Agencies offload payroll, compliance, and statutory deductions to specialists so they can focus on placements and margins.

Fortis reverses that. It pushes the administrative burden back onto agencies and end clients. They’ll now have to upload timesheets, cross-check deductions, reconcile multiple umbrellas, and make separate payments to HMRC.

For many, it will be simpler — and safer — to just run PAYE directly themselves. Why add a middleman when you could have full control, full visibility, and one point of compliance?

The irony is that Fortis, in trying to make the umbrella model compliant, may simply accelerate its demise.

3. HMRC May Not Accept Fortis’s “Evidence”

Professional Passport claims that paying PAYE directly to HMRC using an umbrella’s PAYE reference will prove compliance. But HMRC’s systems aren’t designed for this kind of split-payment model.

Will HMRC’s RTI systems correctly match those payments? Will the umbrella’s internal payroll reconcile perfectly with the agency’s figures? What happens if the umbrella makes a late correction or reallocation?

A single mismatch could render the entire “audit trail” meaningless — and once again, liability would fall squarely on the agency.

In short, Fortis relies on assumptions about how HMRC will process and interpret data that haven’t been tested, validated, or endorsed. That’s risky territory.

4. Fortis Doesn’t Remove Risk — It Moves It

At its core, Fortis doesn’t eliminate the risk of collective liability; it just shifts it around.

Agencies remain responsible for the accuracy of every calculation, every reference, and every transfer. If something goes wrong, they’ll have no defence under the legislation — only a complex paper trail showing that they followed a system that HMRC never endorsed in the first place.

In other words: Fortis doesn’t protect you from liability. It just gives you more paperwork to show once you’ve already been hit with it.

5. Commercial Resistance Is Inevitable

Even if Fortis did technically work, adoption will be a major challenge.

• Agencies will resist a system that adds layers of admin, risk, and cost.

• Umbrella companies may refuse to integrate if they perceive it as intrusive or revenue-reducing.

• End clients are unlikely to endorse a process that still doesn’t guarantee immunity.

For most, the cleaner, simpler path will be to reduce their reliance on umbrellas entirely — by moving to in-house PAYE or more direct engagement models.

6. The Credibility Question

It’s impossible to ignore the wider context. Professional Passport has spent years accrediting umbrella companies — including some that later faced serious tax-avoidance allegations.

Now, as HMRC clamps down on the very structures that thrived under that accreditation, Professional Passport is launching a new product designed to keep agencies in the same ecosystem — just with another layer of oversight.

Many in the industry see Fortis as less of an innovation and more of a survival strategy — a way to keep the accreditation model alive under a new regulatory regime.

That doesn’t mean the intentions are bad, but it does raise serious questions about motive, independence, and whether this is truly about compliance — or just about keeping a business model afloat.

7. The Real Solution Lies Elsewhere

The upcoming JSL regime is designed to eliminate non-compliant intermediaries by making everyone in the chain think twice about who they work with.

That means the real solution isn’t a proprietary platform — it’s structural change:

• Agencies bringing payroll in-house.

• End clients tightening control over supply chains.

• Fewer intermediaries between the worker and the company paying them.

• Transparent, single-point PAYE models that eliminate ambiguity altogether.

Fortis tries to preserve the existing system. But the truth is, the existing system is what HMRC is trying to dismantle.

Final Thoughts

Professional Passport Fortis is being marketed as a shield against the new collective liability landscape. But the draft legislation, the operational reality, and the commercial incentives all point to the same conclusion:

Fortis won’t fix the problem — because the problem is the model itself.

Rather than investing in complex workarounds, agencies and end clients would be better served by simplifying their engagement chains, bringing payroll functions closer to home, and accepting that the days of risk-free outsourcing to umbrellas are coming to an end.

In the post-April 2026 world, transparency and direct control will be the only real compliance tools that matter.

Everything else — including Fortis — is just noise.