The Pensions Regulator explained for employers
The Pensions Regulator issued 20,677 fixed penalty notices to non-compliant employers in a single six-month period, each carrying a flat fee of £400 regardless of company size [1]. More than 22 million workers have been placed into a workplace pension since automatic enrolment began in 2012, and the body responsible for policing that system is the Pensions Regulator [2].
The Pensions Regulator, often shortened to TPR, is the UK public body that protects workplace pensions. For an employer, it is the authority that decides whether payroll has met its auto-enrolment obligations, and the authority that fines the business when it has not [3].
This article explains what the Pensions Regulator is, the pension schemes it oversees, the duties it enforces through payroll, the compliance timeline every employer must follow, and how its enforcement powers escalate when an employer falls behind.
Key takeaways
- The Pensions Regulator protects workplace pensions and enforces automatic enrolment for every UK employer, with no minimum company size.
- Its remit covers defined benefit schemes, defined contribution schemes, master trusts and public service pension schemes.
- A new employer's duties start on the day the first member of staff begins work, not on a later staging date.
- Non-compliance triggers a fixed penalty of £400, then escalating daily fines from £50 to £10,000 depending on workforce size.
- Every employer must submit a declaration of compliance within five calendar months of the duties start date, and re-enrol staff every three years.
What the Pensions Regulator is
The Pensions Regulator is a public body set up by government whose primary goal is to protect people's savings in workplace pensions [2]. It sits separately from HMRC. HMRC administers PAYE, National Insurance and Real Time Information, while the Pensions Regulator oversees the pension side of payroll, principally automatic enrolment [4].
The regulator's stated aims are to make sure employers enrol their staff and pay contributions, to protect savings held in workplace schemes, and to improve the way those schemes are run [2]. It carries statutory powers to fine employers, ban trustees who are not fit to serve, and prosecute offences in the criminal courts [5].
The schemes it oversees
The regulator's remit extends across three broad scheme types. Its supervision reaches defined benefit (DB) schemes, defined contribution (DC) schemes including the master trusts used by most small employers, and public service pension schemes such as the Local Government Pension Scheme [6].
Master trusts matter most to the typical small business, because a master trust is a single scheme shared by many unconnected employers, and the regulator authorises and supervises each one before it can accept members [2]. For an SME choosing a workplace pension, that authorisation is the assurance that the scheme has passed the regulator's governance tests. Payroll teams handling this across several employers often lean on a multi-client payroll dashboard that records which scheme each client uses.
How it fits alongside payroll
Automatic enrolment is a payroll process, not a one-off administrative task. Every pay period, payroll software must assess each worker, enrol those who qualify, calculate contributions on qualifying earnings, and deduct them [7]. HMRC-recognised UK payroll software runs that assessment automatically at each payrun and flags any worker who has crossed an enrolment threshold [4].
The duties the regulator enforces
The core duty is to place eligible workers into a qualifying pension scheme and pay into it. To do that, an employer must first classify every worker into one of three categories each pay period [7]. The category depends on age and earnings, and a worker can move between categories as pay changes.
The table below sets out the three categories and the duty attached to each for the 2026-27 tax year.
| Worker category | Age and earnings | Employer duty |
|---|---|---|
| Eligible jobholder | Aged 22 to State Pension age, earning above £10,000 | Must be enrolled automatically, employer contributes |
| Non-eligible jobholder | Aged 16 to 74, earning between £6,240 and £10,000, or above the trigger but outside the 22 to SPA band | May opt in, employer must then contribute |
| Entitled worker | Aged 16 to 74, earning below £6,240 | May ask to join, no employer contribution required |
The earnings trigger for automatic enrolment sits at £10,000 a year, and the qualifying earnings band runs from £6,240 to £50,270 [8]. Contributions are calculated only on earnings inside that band, at a minimum of 3% from the employer and 5% from the worker, totalling 8% [8]. Businesses embedding these calculations into their own systems typically use an HMRC-recognised payroll API so the assessment logic stays current as thresholds change.
The compliance timeline every employer follows
The regulator sets fixed deadlines around enrolment, and missing any of them is what usually triggers enforcement. A new employer's duties begin on the day the first member of staff starts work, a date the regulator calls the duties start date [9]. Employers who took on their first worker on or after 2 April 2017 have immediate duties, with no later staging date to wait for [10].
The following deadlines apply to every employer.
| Duty | Deadline |
|---|---|
| Declaration of compliance | Within 5 calendar months of the duties start date |
| Re-enrolment of opted-out staff | Third anniversary of the duties start date, within a 6-month window |
| Re-declaration of compliance | Within 5 calendar months of the third anniversary |
| Remit contributions to the provider | Within 22 days of the end of the tax month |
The declaration of compliance is a formal statement to the regulator confirming what the employer has done, and it is required even when no staff needed enrolling [11]. Every three years the cycle repeats through re-enrolment, when workers who previously opted out must be put back into the scheme and a re-declaration filed [12]. The regulator treats a missed re-declaration as seriously as a missed initial declaration [12].
How the regulator enforces the rules
Enforcement follows a defined ladder that grows more expensive at each step. It begins with a warning and ends, in the most serious cases, in the criminal courts [3].
The table below sets out the escalation.
| Step | Action | Cost |
|---|---|---|
| 1 | Compliance notice | A statutory instruction to put things right |
| 2 | Fixed penalty notice | £400 flat fee, any size of employer |
| 3 | Escalating penalty notice | £50 to £10,000 per day until the breach is fixed |
| 4 | Civil enforcement | Court recovery of unpaid contributions |
| 5 | Criminal prosecution | For wilful non-compliance or false declarations |
The escalating daily rate is tied to workforce size, running from £50 a day for one to four workers up to £10,000 a day for employers with 500 or more staff [1]. The regulator publishes a compliance and enforcement bulletin every six months showing how often it has used these powers, and the numbers run into the tens of thousands of notices per period [13]. An employer that disagrees with a penalty has 28 days to ask for a review before appealing to the Tribunal [3].
One offence sits outside the ladder and carries its own weight: inducing a worker to opt out of the pension scheme, or making opt-out a condition of employment, is a criminal offence in its own right [4]. Accountants running enrolment for several businesses often route the work through a payroll bureau platform that keeps an audit trail of every assessment and notice, which is the record the regulator asks to see.
Staying on the right side of the regulator
Most enforcement action stems from process failures rather than deliberate avoidance. The regulator's own guidance points to the same recurring gaps: employers who stop re-assessing staff after an opt-out, employers who miss the triennial re-enrolment, and employers who file a declaration late [7]. Each of these is a payroll task that can be automated.
For a small business running its own payroll, the practical defence is software that assesses every worker each pay period and surfaces the enrolment and re-enrolment dates before they pass [9]. For a platform building payroll into its own product, the same logic belongs in a UK payroll engine that returns the correct worker category and contribution for any pay period. A fuller walkthrough of the mechanics sits in the Moonworkers guide to auto-enrolment explained.
Conclusion
The Pensions Regulator is less a distant authority than a permanent fixture of the payroll cycle. Its duties attach to every employer from the first day of the first hire, and they never lapse: assess, enrol, contribute, declare, re-enrol, repeat. The £400 fixed penalty is deliberately small enough to apply to a corner shop and the £10,000 daily rate large enough to concentrate the mind of a national employer.
The pattern across the regulator's enforcement bulletins is that compliance is rarely a question of intent and almost always a question of process. An employer that runs a clean, automated assessment at every payrun, and files its declarations on time, will meet the regulator's expectations without ever needing to think about the enforcement ladder at all.
Frequently asked questions
What is the difference between the Pensions Regulator and HMRC?
HMRC administers the tax side of payroll: PAYE income tax, National Insurance and Real Time Information submissions. The Pensions Regulator oversees the pension side, principally automatic enrolment, scheme governance and the declaration of compliance. An employer answers to both, and the two bodies enforce different obligations, so meeting HMRC's RTI deadlines does not discharge the pension duties owed to the regulator [4].
Does the Pensions Regulator apply to a business with only one employee?
Yes. Automatic enrolment has no minimum company size, so a business with a single member of staff who meets the eligible jobholder criteria must enrol that person and pay contributions [9]. The only common exception is a company whose sole worker is also its only director with no employment contract, which may fall outside the duties. The declaration of compliance is still required even when no one needs enrolling.
How much can the Pensions Regulator fine an employer?
The first financial penalty is a fixed £400, applied at a flat rate to any size of employer [1]. If the breach continues, an escalating penalty notice adds a daily fine of £50 to £10,000 depending on the number of workers, and it keeps growing until the employer complies. Serious or wilful cases can proceed to civil recovery or criminal prosecution.
When does a new employer's pension duties start?
A new employer's duties begin on the duties start date, which is the day the first member of staff starts work [10]. Employers taking on their first worker on or after 2 April 2017 have immediate duties, so there is no grace period before the assessment and enrolment obligations apply. The declaration of compliance must then follow within five calendar months of that date.
