Remote Work Compliance: Where Is Your Employer Paying Tax?

Theme: Bureaucracy Without Pain
Author: Clara Hoffmann, Employment Lawyer & BorderPilot Contributor

“We hired talent everywhere—what could possibly go wrong?”
—Every startup, one Zoom call before the tax auditor knocked

The past five years have turned kitchen tables into boardrooms and beaches into breakout rooms. For companies, the upside is obvious: access to global talent and happier employees. The downside? A maze of tax, social-security and labour-law obligations that do not disappear when your marketing lead logs in from Lisbon.

As counsel to dozens of distributed teams—and now part of BorderPilot’s data research crew—I spend a disproportionate amount of my life answering one deceptively simple question: “Where exactly are we paying taxes for this remote employee?”

Today, I am putting the answer in writing, minus legalese, so you can concentrate on building product instead of filing 27-B/6 forms. We will cover:

1. Permanent Establishment (PE) risk—simplified, I promise.
2. Payroll registrations, the hidden time-bomb.
3. Why a remote-work policy is your first line of defence.
4. When it makes sense to use an Employer of Record (EOR).
5. Practical checklists and war stories from the compliance frontline.

Let’s untangle the bureaucracy—without the pain.

1. Permanent Establishment Risk, Simplified

1.1 What Is PE and Why Should You Care?

In the eyes of most tax authorities, a foreign company becomes taxable in their territory if it has a Permanent Establishment—a “fixed place of business through which the business of the enterprise is wholly or partly carried on.” That definition comes straight from the OECD Model Tax Convention, but here’s the translation:

If your employee in Spain is effectively carrying on your business from their spare bedroom, the Spanish tax office may treat that bedroom as a mini-branch—and present you with a corporate-tax bill.

1.2 Three Common PE Triggers

1. Fixed Place of Business
   • Employee works from the same country for a sustained period (often 6–12 months).
   • They have authority to sign contracts or make sales decisions.
   • They are not merely “support staff” but core to revenue generation.

2. Dependent Agent
   • Even without a physical office, a salaried individual habitually concludes contracts on behalf of the company.
   • Think: a sales director in São Paulo closing deals under your logo.

3. Service PE
   • Some treaties trigger PE when services exceed a time threshold (e.g., 183 days in any 12-month period).
   • Common in engineering or consulting projects.

1.3 Real-World Example

A Berlin fintech hires Maya, a senior BD manager, who relocates to Bogotá for family reasons. She keeps negotiating and signing loan agreements with LATAM clients. After 10 months, Colombia’s tax authority investigates the company’s presence. Result: back-dated corporate tax, VAT registration, penalties, and Maya’s living room being classified—rather unromantically—as a “branch premises.”

1.4 “But We’re Just Two Founders, Surely PE Doesn’t Apply?”

Start-ups often assume they fly under the radar. They do—until that first Series A due-diligence questionnaire. Investors do not like phrases such as “unquantified PE exposure.” Clean up before the term sheet.

2. Payroll Registration: The Hidden Time-Bomb

PE usually steals the headlines, yet payroll is the more frequent compliance trip-wire. Why?

1. Withholding at Source
   Most jurisdictions demand that the employer withhold income tax and social security once an employee is resident there, even if no PE exists.

2. “Shadow Payroll” Isn’t a Cape
   Running a “shadow payroll” in Excel while paying people as contractors can backfire. Tax authorities label that arrangement as disguised employment—and want retroactive withholdings plus fines.

3. Social-Security Treaties Are Patchy
   EU regulations (883/04) make intra-EU postings relatively smooth. Outside the bloc, bilateral agreements vary wildly. An American employee spending 18 months in France? Prepare for dual contributions unless an A1/Certificate of Coverage applies.

2.1 Registration Checklist

• Determine employee’s tax residence (usually >183 days).
• Check whether the company must register as a foreign employer.
• Verify labour-law protections (minimum wage, working time, termination).
• Assess social-security treaty coverage or exemptions.
• Confirm benefit obligations (mandatory pensions, health insurance).

I maintain a 50-line spreadsheet for each hire. BorderPilot automates 80 % of that detective work—worth the subscription fee and my sanity.

3. Design a Bulletproof Remote-Worker Policy

3.1 Why Policy Beats Ad-Hoc Exceptions

An inbox full of “Hey, can I work from Bali for three months?” requests is not a policy. You need a framework that balances employee flexibility with corporate compliance.

3.2 Core Clauses to Include

1. Approval Process
   • Define who signs off (HR, Finance, Legal).
   • Obligatory lead time (e.g., 30 days before relocation).

2. Permitted Countries and Time Limits
   • Red–amber–green list based on PE and payroll risk.
   • 90-day tourist stints vs. indefinite moves.

3. Employee Declarations
   • Self-reporting of days, address changes, tax notices received.

4. Cost Allocation
   • Who pays for visa, tax advice, additional insurance?
   • Clarity prevents resentment later.

5. Data Security & IP Protection
   • VPN usage, restricted jurisdictions, export-control compliance.

3.3 Example Clause (Feel Free to Steal)

Employees may perform remote work from a “Green List” country for up to 90 consecutive days in any 12-month period, provided: 1. The employee retains tax residence in their home jurisdiction. 2. No client-facing activities requiring contract signature are undertaken. 3. The arrangement is approved by HR and Legal via the Remote Work Request Form.

3.4 Communication Tip

Frame the policy as risk management, not control. Employees generally accept boundaries when you explain that a wrong postal code can cost the company 30 % of revenue.

4. Solutions: When an Employer of Record Saves the Day

4.1 What Is an EOR?

An Employer of Record is a third-party entity that legally employs your worker in the host country, handles payroll, tax withholdings, statutory benefits and sometimes even equipment logistics. Your company signs a service agreement, while the EOR signs a local employment contract with the worker.

4.2 Benefits

• PE Mitigation: Because the EOR is the legal employer, your company’s risk of creating a taxable presence drops significantly (not to zero; see below).
• Speed: Hire in days vs. months needed for entity setup.
• Local Expertise: Compliance, terminations, severance—outsourced.
• Cost Predictability: Flat fee per employee beats the unknown cost of future audits.

4.3 Limitations

1. Residual PE Risk
   Authorities may still examine whether the worker is acting as a dependent agent of your business. If they’re the VP Sales signing million-dollar deals, EOR or not, you can’t hide.

2. Control & Culture
   Employees on an EOR’s paper but in your Slack can feel like second-class citizens. Treat them equally regarding bonuses, equity and career paths.

3. Price Tag
   Expect 10–15 % of payroll as fees. Cheaper than opening a Brazilian Ltda, but not negligible at scale.

4. Data-Protection Chain
   Add the EOR to your GDPR vendor list. Additional paperwork, always.

4.4 A Quick Decision Matrix

1–2 Employees, Exploratory Market → EOR
10+ Employees, Long-Term Strategy → Local Entity
Key Executives Signing Contracts → Local Entity + Tax Ruling

4.5 Case Study: Smooth Landing in Mexico

When two remote-working designers relocated from Canada to Mérida, their SaaS employer faced Mexico’s notoriously paperwork-heavy IMSS (social security) system. By partnering with an EOR and using BorderPilot’s local-cost projections, onboarding finished in under three weeks. The couple, incidentally, documented their journey in “Remote Working Couples: Finding Your Place in Mexico”—worth a read if tacos and turquoise water are your jam.

5. War Stories & Practical Tips

5.1 The 183-Day Surprise in Thailand

A California wellness start-up let its CTO work from Phuket “for six months, maybe longer.” Nobody noticed she passed the 183-day threshold. Thailand levied personal income tax on her global income, and the start-up had to retro-register for Social Security Office contributions. The fix: BorderPilot calendar reminders and bi-weekly location check-ins.

5.2 The CFC Angle You Didn’t Expect

If your remote employees are also shareholders (common in tech), moving them abroad can shift your cap-table’s controlled foreign corporation status. Read our primer “Understanding CFC Rules for Digital Nomads – 2023” to avoid dividend-tax whiplash.

5.3 The Swiss Social-Security Double Dip

Switzerland isn’t in the EU Social Security Regulation. A French engineer commuting three days a week to Geneva triggered compulsory AVS contributions and kept paying French URSSAF. Double the deductions, zero happy employees. Solution: Apply for a detached-worker certificate before day one, not after day 60.

5.4 The “Contractor” Re-Classification Raid

An influencer-marketing agency paid all non-US staff as 1099 contractors through PayPal. Spain’s labour inspectorate reclassified 14 creatives as employees, assessed €1.2 million in back payroll tax, and blocked the PayPal account pending settlement. Moral: If workers follow your schedule, use your tools, and represent you publicly, they’re employees in EU eyes.

6. Action Plan: Your 30-Day Compliance Sprint

1. Audit existing remote staff: where are they, how long, what roles?
2. Map each location’s payroll registration requirement (BorderPilot does this in minutes).
3. Assess PE risk per country—look for contract-signing power and revenue contribution.
4. Decide EOR vs. Entity vs. Strict Travel Limit.
5. Draft/Update Remote Work Policy; circulate for employee feedback.
6. Implement a location-tracking mechanism (HRIS, VPN logins, or self-reporting).
7. Train managers to spot compliance red flags: term sheet signatures, large local clients.
8. Schedule quarterly reviews; tax law changes quicker than fashion trends.

7. Frequently Asked (Late-Night Slack) Questions

Q: Our designer is in Bali on a tourist visa. Is that okay?
A: Visa ≠ work authorization. Indonesia technically prohibits working on a tourist visa, even if the “work” is for a foreign entity. Zero immigration compliance, zero payroll compliance—high PE risk. Get a KITAS or relocate.

Q: Can we just pay everyone as contractors?
A: That strategy aged like milk. Many jurisdictions apply the substance over form test. If it quacks like an employee, taxes like an employee.

Q: Does using cryptocurrency payroll bypass withholding?
A: Creative, but tax authorities focus on economic reality, not medium of exchange. Crypto wages are still wages—plus additional reporting obligations.

8. Bureaucracy Without Pain—Final Thoughts

Compliance is often portrayed as the enemy of flexibility. In reality, knowledge buys freedom. When you understand where your employer is paying tax—and where it should—you can travel, hire and grow without the 3 a.m. auditor-nightmare.

At BorderPilot, we combine live tax data, treaty analytics and human expertise (yours truly included) to turn this labyrinth into a straight line. If you’re mapping out your next hire—or your next beach office—start a free relocation plan today. Your future self (and your finance team) will thank you.

See you on the right side of the tax code.