A remote team can look clean on paper and still create tax problems.
One engineer works from Berlin, a sales lead takes calls in London, and a finance executive settles in Lisbon for half the year, then nobody notices until a tax authority asks where the business is really being carried on.
That's permanent establishment risk, and distributed work has made it harder to ignore. The old tax framework was built around branches, offices, and factories, not a company whose real footprint is spread across home offices, co-working desks, and customer sites.
A 40-person SaaS company can believe it has no foreign footprint, then discover that two tax authorities see it differently.
The company has no office, no subsidiary, and no local hires, but one senior person is closing deals from abroad while another is managing work from a fixed home base. That is enough to put the question on the table.
Permanent establishment, or PE, is the risk that a foreign tax authority treats the business as having a taxable presence in its jurisdiction even without a legal entity.
The OECD's framework still centres on a “fixed place of business through which the business of an enterprise is wholly or partly carried on” and lists examples such as a place of management, branch, office, factory, workshop, mine, quarry, or extraction site, with construction projects bringing their own duration test in the legal instruments (OECD legal instruments).
Practical rule: if the company can point to a location abroad where work is done with some regularity, tax authorities will ask whether that location is doing more than supporting the business.
Distributed teams raise the stakes because the legal definition was built for tangible places and clear lines of control. Remote work blurs both.
A sales manager sending contracts from a hotel in Madrid, a product lead running weekly decision meetings from a kitchen table in Paris, and a founder spending months operating from Lisbon can all create the kind of pattern authorities scrutinize.
The two core triggers are the ones that matter most in practice, fixed place of business and dependent agent.
Everything else in this topic is a variation on those two ideas, or a treaty-specific rule that taxes activity because it lasts too long or is too embedded in the country.
For teams already hiring across borders, our compliance guide is a useful starting point for checking where work patterns, authority, and local presence start to create exposure.
A remote worker at a dining table does not automatically create a fixed place PE.
The test is whether the business has a fixed, physical location at its disposal and uses it to carry on the business in a non-transient way.
Distributed teams get this wrong because the line between personal space and business space blurs fast.
A home office can stay personal, or it can become part of the company's operational footprint if the arrangement looks like the company is using it as a base.
Remote work changes the analysis when the location starts to look like a real business presence.
The OECD commentary update points to a practical benchmark for home-working patterns.
A home or similar location is generally not treated as a fixed place PE if the employee spends less than 50% of total working time there over any twelve-month period, and once that level is crossed the question becomes whether the foreign-country presence serves a real commercial purpose rather than personal convenience (Grant Thornton summary of the OECD update, Rise Works summary of the OECD update).
That does not give you a clean safe harbour however.
Treaty wording still controls, and the same hybrid arrangement can be acceptable in one country and exposed in another.
Tax authorities look at whether the company is using the location as part of the business, not just accepting where the employee chose to work.
A rented co-working desk, a foreign server room used as a working base, or inventory held through a fulfilment partner is much easier for a tax authority to treat as a place of business than an employee's private dining table.
The operational question is blunt.
If the company controls the place, relies on it, or keeps using it for core work, exposure rises. If the setup exists only because the employee prefers to work there, the PE argument is weaker.
Duration still matters outside pure remote work though.
A building site or assembly project can become a PE if it lasts beyond 12 months under the OECD model, though some treaties cut that period to 6 months. That is why location and time have to be tracked together, not reviewed in isolation.
A cross-border operating model such as employer of record arrangements can help separate where people sit from where the company is legally based, but only if the paperwork matches the working pattern.
The fixed place test catches many remote and hybrid teams, but it is not the only route to PE. A company can create taxable presence through the person acting on its behalf, even with no office at all. Sales-led and project-led businesses get caught because everyday work patterns show authority and continuity.
Dependent-agent PE arises when someone in the source country is not an independent agent and habitually concludes contracts, or plays the principal role leading to contract conclusion, for the foreign enterprise.
HMRC's guidance makes clear that UK contracts can be in the enterprise's name, for the transfer or licensing of property, or for services, which goes well beyond a narrow “who signs the paper” test (HMRC INTM264510).
A senior sales representative in Singapore who regularly negotiates final terms for a US company is a real exposure point, even without a local office.
If deals are routinely finished through that person's calls and messages, tax authorities will look at the substance, not the lack of a branch.
The duration thresholds covered in the fixed-place section apply to projects as well.
Construction-site PE is often missed because the work looks temporary. It is not.
The key question is whether the project activity creates a taxable presence through time and control. For teams using contractor structures, our contractor of record guidance is useful for understanding how the contractual chain affects total compliance & PE risk.
A remote-first company can still create exposure through a project manager overseeing work abroad, or a contractor installing equipment on a long deployment.
A long-running delivery team, a repeated site presence, or a person who keeps the business operational in-country can all support a PE argument.
The mistake is treating PE as a bricks-and-mortar issue. Project businesses and sales-led businesses face sharp exposure because contracts, delivery, and local decision-making create presence without anyone signing a lease. That is what operations leaders need to control.
PE risk rarely starts with a dramatic event. It builds through habits that look harmless inside the company and look structural from the outside. A local tax inspector does not need a formal office lease if the day-to-day pattern already shows authority, continuity, and local commercial activity.
Local contracting behaviour: employees negotiating or signing contracts from their home country, especially when the final commercial terms are already settled there.
Repeated customer-facing travel: the same person returning to a market for demos, renewals, or closing calls rather than occasional support.
Assets sitting abroad: servers, inventory, or equipment stored in a jurisdiction where the business relies on them for delivery.
Senior staff habitually abroad: executives or country leads working repeatedly from a second location, which can move the analysis towards permanence and away from personal convenience.
Local market signals: a dedicated phone number, country-specific marketing, or a bank signatory based abroad, all of which make the business look locally embedded.
The core point is cumulative effect. One incident rarely decides the case. A pattern of habitual activity, local authority, and repeated use of a place or person does.
That pattern is why a clean org chart can still hide PE risk. A business may have centralised management on paper, but if the country lead is acting like the local commercial engine, tax authorities will notice.
Practical rule: if a remote employee can regularly influence revenue, close terms, or make the business appear locally established, the company should treat that as a PE warning sign, not a comfort story.
For contractor workflows, this article explains how to pay a contractor compliantly, including PE analysis, because payment process and local presence often travel together.
Mitigation is not a single clause in an employment contract. It is operational discipline, applied every week.
If the company wants to keep remote work flexible and keep tax exposure under control, the rules have to be visible to managers, sales leaders, and finance.
The fastest fix is to stop local staff from binding the company. Signature authority should sit in one controlled workflow, closing calls should be centralised, and people in-country should be told plainly that they cannot finalise terms or negotiate the last commercial mile.
That matters because dependent-agent PE is driven by real authority, not company intention.
Employer of Record structures can help separate local employment from local contracting authority, but only when the company does not keep behaving as if the local employee is still the commercial decision-maker. The legal wrapper is useful. The business habit is what protects it.
Travel logs, home-office attestations, device-location policies, and records separating personal time from business work all help show that a foreign location is not being used as the company's place of business.
If a market is sensitive, board meetings should not drift there casually, and warehouse or server siting decisions should be reviewed before they are locked in.
When uncertainty is high, local advisers can sometimes seek a ruling or comfort letter from the relevant tax authority. That is slower than improvising, but faster than dealing with an assessment after the fact.
LegesGPT for business owners can also help teams organise the legal questions before they reach outside counsel.
If the company cannot explain why a person, room, or project sits in a country, it should assume the tax authority will ask.
Mitigation is procedural. The company needs a clear line between personal convenience and business presence, and it has to maintain that line in contracts, calendars, systems, and approvals.
The right operating model depends on how much presence the company needs in the market. Some teams try to dodge PE risk with contractors alone, others open entities too early, and both choices can be wrong. The better answer is to match the structure to the commercial plan.
| Dimension | EOR | Local Entity | Independent Contractor |
|---|---|---|---|
| Setup speed | Fast | Slowest | Fast |
| Employment liability | Lower in the host country when used properly | Fully localised | Lower on paper, higher if misclassified |
| Contract authority | Can be centralised away from the host country | Can be centralised, but the local entity may still create presence | Often informal unless tightly controlled |
| Fixed-place PE risk | Lower if the employee is not using a company-controlled place | Higher if the entity creates an actual local base | Mixed, depends on where the work is done and how controlled it is |
| Dependent-agent PE risk | Lower when local staff cannot bind the business | Manageable, but the local team can still create presence | Highest when the contractor acts like a local sales arm |
EOR works best for early market entry and small headcount, because it gives the company a clean hiring wrapper while it tests the market.
A local entity makes more sense once revenue, IP, and operational concentration justify the overhead. Contractor models are the weakest on PE control because authority often ends up being informal, then the business acts surprised when the contractor behaves like a country lead.
FastCorp's cross-border tax planning advice is useful context for leaders deciding where to place staff, contracts, and assets before the market footprint hardens.
A hybrid model is often the most practical answer.
A sales engineer can sit under EOR while a country lead works through a local entity, or the reverse, if the commercial design supports that split.
The key is that the company should not let contractors substitute for employees in roles that shape contracts, pricing, or customer commitments.
Misclassification makes the PE picture worse, not better. If a contractor is really operating as an embedded employee, the tax, payroll, and employment risk all start to stack.
Our contracting versus consulting guidance is relevant here because the label on the engagement does not control the actual risk.
A remote team can create PE pressure even without a leased office. Once people work across borders, sell from home, or close deals through cloud systems, tax authorities start asking whether the business has a taxable presence anyway.
OECD-linked and EU-related materials have repeatedly explored significant digital presence and virtual nexus ideas tied to revenue, users, and online contracts, which shows how far the debate has moved beyond bricks and mortar (LUISS thesis on digital PE concepts). The policy direction is clear even if treaty text is still uneven.
The harder question is how far current law already stretches before formal treaty change. The IMF view noted in the same research material is that user-data collection alone generally does not create PE under current definitions, even though pressure keeps building toward broader virtual nexus tests.
A developer working from Lisbon for months, a sales engineer closing deals from a co-working space, or cloud infrastructure processing data in a jurisdiction can all trigger questions older guidance never handled cleanly.
The company may have no branch, no signboard, and no local entity, yet the work pattern still looks like business presence to a tax auditor.
The wider tax response reflects that tension. Policymakers have kept exploring revenue-based solutions such as Pillar One Amount A.
Domestic tools like the UK's diverted profits tax and digital services taxes in parts of Europe show that countries will act when multilateral reform moves slowly, a point also reflected in OECD Pillar One materials and HMRC guidance on diverted profits tax.
The practical response is discipline. Track where people work, document why they are there, and bring in counsel before the company scales into a market where the rulebook is still shifting.
If a distributed team already crosses borders, map every role with customer authority, location habits, and asset use, then test that map against the treaty rules in each country before the exposure gets expensive.
