Remote Work and Permanent Establishment Risk: A 2026 Guide

A single remote hire can trigger a foreign tax liability your finance team never budgeted for. When an employee works from a home office in another country — closing sales, signing contracts, or simply representing the company day to day — tax authorities can treat that activity as a permanent establishment (PE), exposing the employer to corporate tax, penalties, and back-filing obligations in a jurisdiction it never intended to operate in. This guide breaks down how remote work creates PE risk, which roles are most exposed, and how an Employer of Record (EOR) structurally avoids the problem instead of just managing around it.

What Permanent Establishment Means for a Remote-First Company

Permanent establishment is a tax concept, not an immigration or labor-law one. Most countries’ tax treaties (many modeled on the OECD Model Tax Convention) define a PE as a “fixed place of business through which the business of an enterprise is wholly or partly carried on.” Historically that meant an office, a branch, a factory, or a construction site. The problem for remote-first companies is that tax authorities have steadily widened how “fixed place of business” gets interpreted, and a home office can now qualify.

There are generally three routes to PE exposure that matter for a distributed workforce:

• Fixed-place PE — a location habitually used for the company’s business, which in several jurisdictions can include an employee’s home office if it is used regularly and the company effectively directs work from or through it.
• Dependent agent PE — an employee or representative who habitually concludes contracts, or plays the principal role leading to contracts being concluded, on the company’s behalf in that country, even without a fixed location.
• Service PE — recognized in some tax treaties (and common across parts of Africa, Asia, and Latin America) when employees provide services in a country for longer than a specified number of days within a 12-month period, regardless of whether there’s a fixed office.

None of these require the company to lease an office, register a branch, or send anyone on a business trip. A single engineer, account manager, or country lead working full-time from their apartment can be enough.

Why Remote Work Specifically Raises the Risk

Traditional PE risk was mostly a function of deliberate expansion: a company chose to open an office or send staff on assignment, and tax and legal teams were looped in before it happened. Remote hiring inverts that. A hiring manager posts a role, a candidate in another country applies, and the company extends an offer — often with no tax review at all, because the hire looks identical to a domestic one from inside the company’s HR system.

Several factors compound the exposure:

• Duration and regularity. A remote employee isn’t a short business trip; they work from the same home office for months or years, which is exactly the “habitual” and “fixed” pattern tax authorities look for.
• Seniority and function. Sales, business development, and country-lead roles are highest-risk because they involve negotiating or concluding deals — the core trigger for dependent agent PE. Purely internal, non-client-facing roles (e.g., backend engineering) carry lower but not zero risk.
• The OECD narrowed the guesswork in late 2025. The November 2025 update to the Commentary on the OECD Model Tax Convention introduced the clearest home-office PE framework to date. It sets a 50% working-time threshold: if an employee works from a home office for less than half their total working time over a 12-month period, that location is generally not treated as a fixed place of business. Above that threshold, the analysis gets closer scrutiny. The update also requires a genuine commercial reason for the arrangement — working from home purely to save on office costs doesn’t count, but a home office used to directly serve local customers or suppliers does — plus a baseline “degree of permanency” before a home office counts as a place of business at all.
• The new framework cuts both ways. It gives employers a clearer test to self-assess against (useful for the risk framework below), but it also means informal “as long as it’s remote, it’s probably fine” assumptions built on older, vaguer guidance are no longer a safe read. Bilateral tax treaties still govern in practice — for a US-linked hire, for example, the relevant Treasury Technical Explanation for that specific treaty takes precedence over the general OECD Commentary — so the new threshold is a starting point for the analysis, not a substitute for checking the actual treaty.

What It Actually Costs a Company to Get This Wrong

PE exposure isn’t a hypothetical compliance footnote — it has direct financial consequences if a tax authority determines, often retroactively, that a PE existed:

• Corporate income tax on profits the tax authority attributes to the local activity, calculated using the local jurisdiction’s rules for allocating income to a PE — frequently a blunt, employer-unfavorable formula rather than the company’s actual local margin.
• Penalties and interest for failing to register, file, or withhold, often assessed from the date the PE is deemed to have started, not the date it was discovered.
• Retroactive payroll and withholding obligations, since a PE finding frequently triggers a parallel review of whether local payroll tax and social security should have been withheld on the employee’s compensation all along.
• Double taxation risk if the home country doesn’t fully credit tax paid abroad, particularly where no tax treaty exists between the two countries or the treaty’s PE threshold differs from domestic law.
• Legal and advisory costs to unwind the exposure, which for a genuine cross-border dispute routinely runs into the tens of thousands of dollars before any tax bill is even settled.

Because assessments are often retroactive, a company can operate for two or three years assuming everything is fine, then receive a bill covering the entire period plus interest. This is the scenario that makes PE risk worth solving proactively rather than discovering it in an audit.

How Employer of Record Structurally Removes the Risk

An Employer of Record avoids PE risk by changing who the legal employer is, not by managing the risk around an existing structure. When you hire through an EOR, the remote worker is legally employed by the EOR’s own local entity — an entity that already has tax nexus, already runs local payroll, and already files locally as a matter of course. Your company enters into a services agreement with the EOR and directs the person’s day-to-day work, but you are not the entity of record for tax and employment purposes in that country.

This matters because most PE tests hinge on whether the foreign company itself is conducting business through a fixed place or a dependent agent in that country. With an EOR:

• The worker’s home office is the EOR’s registered employment relationship, not your company’s fixed place of business.
• Payroll tax, social security, and statutory benefits are handled by the EOR’s compliant local entity from day one — see our global payroll compliance checklist for what that ongoing obligation actually involves even once an EOR is in place.
• Contract-signing authority, where it matters for dependent-agent analysis, sits with a properly structured employment relationship rather than an employee acting as an undisclosed extension of a foreign parent.

This is different from a PEO arrangement, where your company typically remains the legal employer of record in a co-employment structure. A PEO can simplify payroll administration, but it generally does not remove PE exposure the way a true EOR does, because the underlying legal employer often stays the client company. If PE risk specifically is the concern — as opposed to payroll administration convenience — an EOR is the more direct fix. For a deeper walk-through of when a PEO makes sense versus an EOR or a full local entity, see our PEO vs. foreign subsidiary comparison.

It’s worth being precise here: no structure is a 100% guarantee against every conceivable tax authority interpretation, and how “employer” is defined for tax purposes can differ from how it’s defined for labor law. But using a properly licensed EOR with a genuine local entity is the standard, tax-authority-recognized way to avoid triggering PE through remote headcount, and it’s why global hiring teams default to it for exactly this reason.

A Practical Risk Framework Before You Hire Remotely

Before extending an offer to a candidate in a new country, run through a short internal check:

1. What will this person actually do? Client-facing, contract-negotiating, or revenue-generating roles carry materially higher PE risk than purely internal support functions.
2. What share of their time is spent working from home? Under the OECD’s 2025 framework, staying under the 50% working-time threshold is a meaningful (though not absolute) risk reducer; is the home-office arrangement built around a genuine local business reason, or just convenience?
3. How long is this expected to last? A three-week project engagement is a different risk profile than an open-ended full-time hire.
4. Does a tax treaty exist between the two countries? Treaty terms (including specific day-count thresholds for service PE) vary significantly and change the analysis.
5. Will the company have more than one person in that country? Risk compounds with headcount and with the presence of any shared local infrastructure, even informal ones like a company-paid co-working membership.
6. Who is the legal employer of record? If it’s your own entity (or no entity at all), the exposure sits with you directly. If it’s a compliant EOR’s local entity, that exposure is structurally addressed as part of the arrangement.

None of this is a substitute for advice from a qualified local tax advisor on a specific hire — PE determinations are fact-specific and treaty-dependent, and this guide is not tax or legal advice. It’s a starting checklist for knowing when to escalate before, rather than after, the hire is made. Our HR compliance services team can also flag country-specific red flags as part of onboarding a new remote hire.

Frequently Asked Questions

Can one remote employee really create a permanent establishment?

Yes. Unlike immigration status, which is generally assessed per-person, tax authorities do not require a minimum headcount before PE rules apply. A single senior, client-facing remote employee working consistently from a home office is a recognized PE trigger in a number of jurisdictions, particularly under dependent-agent and service-PE tests.

Does using an EOR completely eliminate permanent establishment risk?

A properly structured EOR arrangement, where the EOR’s local entity is the genuine legal employer, is the standard way to avoid PE risk from remote headcount, and it’s the primary reason companies use EORs for early-stage international hiring rather than opening an entity. It is not an absolute guarantee against every possible tax authority interpretation, but it removes the core condition — your company itself conducting business through a fixed place or dependent agent — that most PE tests are built around.

Is home-office PE risk the same as needing a local entity to hire someone?

No — they’re related but separate questions. You can hire compliantly in many countries without a local entity by using an EOR. The PE question is about whether your own company’s activity in that country (rather than the EOR’s) rises to the level of a taxable presence. Using an EOR is precisely how companies hire compliantly without needing to answer “yes” to that question.

Does a remote contractor carry the same PE risk as a remote employee?

Contractor arrangements can still create PE exposure, particularly under the dependent-agent test, if the contractor is functionally integrated into the company and has authority to conclude contracts on its behalf. Misclassifying what is really an employment relationship as a contractor arrangement adds a second layer of risk (labor-law misclassification) on top of any tax exposure, so it doesn’t avoid the underlying problem.

How quickly can a company become PE-compliant after realizing there’s exposure?

Timelines vary by country and by how the exposure arose, but moving an existing remote employee’s legal employment to a compliant EOR structure is typically the fastest corrective path, since it doesn’t require the company to first establish its own local entity. Our team can walk through options for a specific country and role.

The Bottom Line

Permanent establishment risk from remote work is easy to miss because it doesn’t look like international expansion from inside the company — it looks like a normal hiring decision. But tax authorities increasingly treat a long-term, functionally significant remote employee the same way they’d treat a small foreign branch office, and the financial consequences of getting it wrong are retroactive, not prospective. The most reliable way to hire internationally without creating that exposure is to make sure the legal employer of record in that country is an entity that already has compliant local tax nexus — which is the specific problem an EOR is built to solve.