How to manage permanent establishment risk when hiring people overseas

• Most companies hiring overseas are not thinking about permanent establishment risk until a foreign tax authority contacts them. By then, the assessment is already calculated and the options are limited.
• Under the OECD’s 2025 Model Tax Convention update, a remote employee working from another country for more than 50% of their time over 12 months can trigger PE exposure for the company they work for.
• The structure of the overseas engagement matters as much as the tax code of the country involved. Employees with decision-making authority, revenue-generating responsibilities, or fixed working locations create PE risk regardless of what their contracts say.
• Smart Outsourcing Solution provides EOR services at $190/month per employee, with 3-business-day onboarding and GDPR-compliant operations across UK, Australian, and US market clients for 250+ companies.

Permanent establishment is the point at which a foreign company becomes liable for corporate tax in a country where it has no registered legal entity.

The trigger isn’t always obvious. A company can create PE exposure without intending to, without realizing it has happened, and without any physical office in the country involved.

An employee signing contracts on the company’s behalf, regularly working from a fixed location, or generating revenue for the company from that country can individually create a PE threshold depending on local tax law and treaty interpretation.

Permanent establishment in outsourcing has a specific legal meaning: the point where offshore activity becomes taxable corporate presence in a country. The legal structure of the engagement (who employs the worker, what authority they hold, and where they regularly work from) determines whether that line is crossed.

How permanent establishment risk is triggered

The OECD’s 2025 Model Tax Convention update established a 50% working-time benchmark as the primary PE trigger for remote and cross-border workers.

Thomson Reuters’ 2026 guide to PE risk for remote workers confirmed that under the updated OECD framework, where an employee works from a home in another country for at least 50% of their total working time over a 12-month period, additional analysis of PE exposure is triggered, including whether the company has a commercial reason for the person’s presence in that country.

This working-time threshold is not the only trigger. The following activities create independent PE exposure regardless of hours worked:

• Contract authority: an employee authorized to sign contracts on the company’s behalf creates a dependent agent PE in most jurisdictions
• Revenue generation: sales activities, customer-facing service delivery, or business development conducted in a country triggers PE even without a physical office
• Fixed place of business: a home office used exclusively and regularly for business constitutes a fixed place under many treaties, particularly when the company provides equipment or subsidizes the space
• Executive decision-making: directors or executives based in a country making binding decisions that affect the business can trigger PE through management and control tests

Pro Tip: Before hiring in a new country, map each role against these four triggers: contract authority, revenue generation, fixed location, and executive decision-making. Roles that score zero on all four are typically low PE risk. Roles that score on even one trigger require either structural mitigation (EOR, restructured scope) or a legal opinion from a local tax advisor in that country.

The organizational blind spot that drives most PE exposure

The structural problem is that most companies discover PE risk after it exists, not before.

The OECD’s 2025 update to its Model Tax Convention, adopted in November 2025, sets out the test. A home office is generally not a place of business if the individual works there less than 50% of their total working time over a twelve-month period.

Above that threshold, a PE can arise if there is a commercial reason for the work being done there, such as dealing directly with local customers or suppliers.

This threshold is how PE exposure builds up unnoticed. Remote employees quietly shift their working location across borders, sometimes temporarily and sometimes permanently, without telling HR or legal. By the time the company finds out, the employee may have spent months working from a PE-triggering jurisdiction.

According to EY’s 2024 Mobility Reimagined Survey, 98% of employers now track domestic and international employee movements, compared to 49% in 2023.

The sharp increase reflects companies learning from PE enforcement actions after the post-pandemic shift to distributed work normalized cross-border working patterns.

Pro Tip: If you are using an EOR in a country where you have more than 15 to 20 employees, it’s worth assessing whether a local entity might reduce cost and complexity. The EOR model works well for early-stage international presence; at scale, the per-employee cost and PE exposure analysis may favor a local entity instead. This is not a reason to avoid EOR. It is a milestone worth planning for.

How EOR structures reduce PE risk

An employer of record helps address the most common PE triggers by taking over the employment relationship in the relevant country.

When an EOR employs staff, the EOR is the registered employer in that country. Payroll, benefits, statutory obligations, and employment contracts run through the EOR’s local legal entity.

The client company gives work direction, but the employment relationship, the fixed-place presence, and the local statutory registration belong to the EOR. This structure eliminates the dependent agent PE risk for many standard offshore roles, unless a worker’s specific activities trigger applicable treaties or local tests.

An employer of record absorbs the employment liability in the relevant country, but the client retains PE exposure for revenue-generating or contract-authorizing activities based in that country.

EOR is therefore not a blanket PE shield. It is a structural tool that eliminates specific triggers while leaving others in place.

How Smart Outsourcing Solution structures EOR for PE risk management

Smart Outsourcing Solution (SOS) provides employer of record services and offshore staffing for UK, Australian, and US-based companies, with EOR available at a fixed $190/month per employee and a 5-business-day onboarding timeline.

With GDPR-compliant operations and 250+ clients across service verticals, Smart Outsourcing Solution can structure EOR engagements specifically for companies managing compliance exposure in cross-border hiring.

• Employer of record at $190/month: full employment coverage for international clients looking to hire in the Philippines, including contracts, payroll, statutory benefits, and termination compliance, priced transparently per employee per month
• 5-business-day onboarding: from signed engagement to active employment status in 5 business days, reducing the window between hiring decision and compliant employment structure
• Offshore staffing in the Philippines: dedicated offshore professionals for back-office, customer service, and administrative roles structured as EOR employment rather than contractor arrangements
• PE risk structuring: engagement models designed to minimize the permanent establishment triggers most commonly associated with cross-border offshore hiring
• GDPR-compliant operations: employment data handling and cross-border data transfer processes aligned to GDPR requirements for UK and European market clients
• UK, AU, and US expertise: deep familiarity with the regulatory environments and employment law requirements in several primary markets where Smart Outsourcing Solution’s clients operate

Companies managing overseas hiring compliance can connect with Smart Outsourcing Solution to discuss EOR structuring, PE risk exposure, and onboarding timelines.