Hiring Remote Employees Across Borders: Tax Obligations, PE Risk, and Penalties in 2026
A single remote employee working from home in another country can force your company to register with foreign tax authorities, withhold local payroll taxes, and pay corporate income tax on attributed profits — all without setting up a single office. The OECD updated the rules in November 2025. Here's what changed, what still triggers risk, and how to structure your global hiring to stay compliant.
Want to pay less tax?
Upload your documents, track income across currencies, and get an AI report with specific savings strategies.
Get started freeWhat Is Permanent Establishment and Why Does It Matter for Remote Teams?
The Basic Concept
Permanent establishment is a legal concept in international tax law. When your company has a PE in a foreign country, that country has the right to tax the profits attributable to your activities there. Historically, PE required a physical office, branch, factory, or subsidiary. Today, a single remote employee working full-time from their home can be enough — if they meet specific thresholds. There are two main PE types relevant to remote hiring. A fixed place of business PE arises when an employee regularly uses a location (such as their home) as a fixed place through which your company carries out its business. A dependent agent PE arises when an employee habitually concludes contracts on your company's behalf in the foreign country — for example, a remote sales rep who negotiates and closes deals. Either type can trigger corporate income tax registration, profit attribution, local payroll and withholding obligations, and penalties for periods of non-compliance.
A PE doesn't require a lease, office, or registered subsidiary — a home office can qualify
Fixed-place PE: triggered by regular, sustained use of a foreign location for business activities
Dependent agent PE: triggered when an employee habitually concludes or negotiates contracts abroad
PE consequences: corporate tax registration, profit attribution to that country, local payroll tax obligations
60% of global mobility compliance failures in 2026 stem from evolving tax and immigration enforcement errors
The OECD November 2025 Update: What Actually Changed
The New Two-Part Framework
On November 19, 2025, the OECD released its first major update to the Model Tax Convention since 2017, with significant new guidance on when remote work creates a PE. The update does not change the treaty text itself — it updates the Commentary, which countries use to interpret their bilateral tax treaties. The framework has two tests. The temporal test: if an employee spends less than 50% of their total working time at a foreign remote location over any 12-month period, that location is generally not a 'fixed place of business' and no PE arises. This safe harbor was absent before November 2025. The commercial reason test: if the employee exceeds 50% of working time abroad, the analysis shifts to whether the foreign presence serves a genuine commercial purpose — for example, serving local clients, accessing regional markets, or supporting on-site operations. Employee convenience, talent retention, or cost savings on office space are explicitly stated as not constituting valid commercial reasons. The update gives multinationals clearer guidance and a defensible safe harbor. But it also gives tax authorities clearer criteria to challenge arrangements above the 50% threshold.
What the Update Does Not Fix
The OECD's update applies to treaty interpretation. Countries must still adopt it into their own bilateral treaties and domestic guidance, which happens unevenly. Several jurisdictions have already reserved their positions. India does not accept the new OECD tests and applies its own criteria — India remains one of the highest-risk jurisdictions for PE. Israel has specific criteria for measuring the 50% threshold. Nigeria and Malaysia have also indicated differing interpretations. The dependent agent PE analysis is entirely unchanged by the November 2025 update. Any remote employee who habitually negotiates or concludes contracts on your company's behalf abroad remains a high-risk PE trigger regardless of how many days they work from home. For non-OECD countries — including many in Latin America, Africa, and Southeast Asia — the new guidance may have limited effect because their treaties predate the Commentary update or their domestic rules deviate significantly from the OECD model.
The update applies to treaty commentary, not treaty text — bilateral adoption is required and uneven
India: does not accept the new tests; PE risk remains high and enforcement is active
Dependent agent PE (sales roles, contract negotiation) is not covered by the new framework — still full risk
Non-OECD countries: new guidance may not apply; always verify local rules before hiring
Where no tax treaty exists, local tax liability starts on day one of the employee's presence
PE and Payroll Risk by Jurisdiction — Key Markers for Remote Hiring
| Country | PE Risk Level | Payroll Withholding Without PE | Key Trigger | Social Security Risk |
|---|---|---|---|---|
| Germany | High | Yes — even without a PE, withholding required if employer has a representative in Germany | Sustained home office use; client meetings at home increase risk | Dual contribution risk if no social security agreement in place |
| UK | Medium-High | Yes — HMRC requires withholding once employee works from UK | IR35 (disguised employment) applies to contractors; PAYE registration required | NI contributions required from employer |
| France | Medium | Only if PE exists | Sales roles with contract authority; regular sustained presence | Mandatory employer social contributions ~40-45% of gross salary |
| Canada | Medium (rising) | Generally triggered by 183+ days or salary borne by Canadian PE | OECD 2025 update now under review; home office PE risk rising for sustained arrangements | No dual CPP contributions if SSTA in place with employer's country |
| India | Very High | Yes — withholding required; India does not conform to OECD 2025 tests | Physical presence; Indian authorities actively audit foreign company arrangements | Provident Fund contributions mandatory if in scope |
| Brazil | Very High | Yes — tax and social contributions (INSS 20%, FGTS 8%) from day one | Any sustained employment relationship triggers full local compliance | Total employer cost often exceeds 80% of base salary including mandatory contributions |
| USA (state level) | Variable | Withholding required per state where employee is located | Each state has independent nexus rules — California is especially aggressive | FICA applies; state unemployment varies by state |
Risk ratings reflect general patterns in 2026 enforcement. Each situation depends on the specific employee role, activities, tax treaty coverage, and bilateral social security agreements in place. Always verify with local counsel before hiring.
The Payroll Problem: Tax Withholding Obligations Exist Even Without a PE
Two Separate Obligations
PE risk and payroll tax obligations are not the same thing. A company can have payroll withholding obligations in a foreign country without ever crossing the PE threshold. The employee's income tax must be withheld and remitted to their country of residence once they establish tax residency there — typically after 183 days in most jurisdictions, though some countries trigger this sooner. Germany is a notable example: wage tax withholding applies to foreign employers even in the absence of a PE, as long as the employer has any representative in Germany, including the remote employee themselves. Austria and Austria have similarly lower thresholds. For social security, the situation is separate again. Without a bilateral Social Security Totalization Agreement between the employer's country and the employee's country, both countries may claim contributions simultaneously. The US has totalization agreements with 28 countries. Within the EU, Regulation 883/2004 prevents dual contributions as long as the required certificates of coverage are filed — which many companies forget to do. Missing the certificate means both countries collect.
Tax residency (and payroll obligations) often triggers at 183 days — some countries act sooner
Germany: withholding required even without PE if employer has any representative there
EU social security: Regulation 883/2004 prevents dual contributions — but only if coverage certificates are filed
US has totalization agreements with 28 countries — check before assuming dual contributions don't apply
Brazil total employer cost frequently exceeds 80% of base salary when all mandatory contributions are included
Worker Classification: The Second Major Risk
Contractor vs. Employee Across Borders
Many companies avoid the payroll and PE complexity by classifying international hires as independent contractors. The logic is straightforward: contractors handle their own taxes, no withholding required, no payroll registration. The risk is also straightforward: if the worker actually functions as an employee — fixed hours, integrated into your processes, single client, using your equipment, following your management — tax authorities will reclassify them regardless of what the contract says. Misclassification penalties in 2026 are substantial. In the US, a three-year misclassification of five employees at $80,000 each creates a liability of approximately $205,000 in back taxes, penalties, and interest — before state obligations. In EU countries, fines for misclassified workers can exceed €50,000 per person. Brazil, Spain, India, and the Netherlands are all actively enforcing. The IRS three-factor test looks at behavioral control, financial control, and the type of relationship. The Department of Labor applies a separate economic reality test. A contract does not override the actual facts of the relationship.
A contractor label doesn't override actual practice — control, integration, and exclusivity determine classification
US misclassification: ~$205,000 liability for 5 workers over 3 years (back taxes + penalties + interest), before state exposure
EU penalties: fines exceeding €50,000 per misclassified worker in multiple member states
Brazil, Spain, India, Netherlands: active enforcement with criminal liability possible in severe cases
US voluntary remedy: VCSP program lets companies reclassify and pay 10% of one year's employment tax liability
The EOR Reduces — But Does Not Eliminate — PE Risk
Typical EOR fee per employee per month — and what it doesn't cover
What Actually Protects You: A Practical Compliance Framework
Six Controls That Reduce Exposure
There is no zero-risk structure for international remote hiring. But the risk is manageable with the right controls in place before the hire, not after.
Track time by jurisdiction, continuously. The OECD 50% temporal test requires tracking actual working hours by country over rolling 12-month periods. Manual spreadsheets are a liability — purpose-built global mobility software generates the audit trail that authorities actually accept.
Require pre-approval for any cross-border remote arrangement. A 30-day review window before work begins gives tax and legal teams time to assess jurisdiction-specific risk. After the fact is always harder.
Limit contract authority for remote employees. Dependent agent PE is triggered by the habitual conclusion or negotiation of contracts. Keep contract-signing authority with employees located in your home jurisdiction. Remote employees should hand off to US or HQ-based colleagues for final deal close.
Use an EOR for full-time international hires. EORs eliminate misclassification risk, handle payroll compliance, and provide the legal infrastructure for employment in 85–100+ countries. The $400–700/month fee is typically cheaper than PE exposure or misclassification penalties.
File for social security coverage certificates before employees cross borders. EU Regulation 883/2004 certificates of coverage, US Certificate of Coverage (for totalization agreement countries), and equivalent bilateral instruments prevent dual contributions. These must be filed before — not after — the employee starts working abroad.
Get local legal advice annually for high-risk jurisdictions. Germany, India, Brazil, and Spain have enforcement environments that shift faster than most internal policy cycles. A single jurisdiction review by local counsel costs far less than a retroactive assessment.
The Highest-Risk Scenarios in Practice
Where Companies Get Caught
The misclassification and PE failures that generate the largest liabilities share a common pattern: the hiring decision was made by HR or a business unit, the finance and legal team found out months later, and by then multiple tax periods had already passed. The costliest scenarios in 2026 are a remote sales employee with contract authority in a high-enforcement market like Germany, India, or Brazil; a long-term contractor engagement (12+ months, integrated workflow, single client) in any EU country with strict labor law; a senior executive traveling and working across multiple jurisdictions for extended periods, creating DE agent exposure in each; and a company that used an EOR correctly for payroll but allowed the employee to conduct commercial activities that created a separate PE exposure.
Sales employees with contract authority abroad: highest dependent agent PE risk, no OECD safe harbor applies
Contractors working exclusively for one company for 12+ months: misclassification risk in EU, India, Brazil, and increasingly the US
Traveling executives: PE exposure can accumulate across multiple countries simultaneously
EOR + commercial PE: payroll handled, but corporate tax exposure still present if employee conducts core business activities
India: the December 2025 Delhi High Court ruling (CIT v. Clifford Chance) confirmed physical presence is required for Service PE under the India-Singapore treaty — but fixed-place PE via home offices remains high risk
Track Global Payroll and Tax Obligations in One Place
TaxRavens PRO helps HR directors and CFOs track cross-border employee obligations, payroll tax exposure by jurisdiction, and compliance deadlines across multiple countries. Know where your team is working. Know what you owe. Stop discovering global tax exposure in due diligence.