Employer of Record Tax Risk: What the Contract Doesn’t Cover

By Finance Fundamentals Staff. Reviewed for accuracy by a member of our editorial team with a background in international employment tax and cross-border payroll compliance.

This article covers general international employment and tax concepts. Employer of Record rules vary by country and change frequently. Confirm current requirements in each jurisdiction where you employ people before making a structural decision.

What an Employer of Record Actually Does

An Employer of Record is a third-party company that becomes the legal employer of a worker on paper, while a separate client company directs the worker’s day-to-day tasks. The EOR runs payroll, withholds local income tax, remits social contributions, issues the local employment contract, and carries the statutory obligations that come with being the registered employer in that country. The client company decides what the person works on, sets goals, and often manages performance reviews directly.

This split exists because most countries require a locally registered legal entity, or an equivalent, before anyone can put a worker on payroll there. Building that entity takes months and real capital. An EOR already has the registration, the local bank accounts, and the compliance infrastructure, so a company can hire someone in, say, Portugal or the Philippines within days rather than quarters.

That speed is the entire value proposition. Deel, Remote, Globalization Partners (also known as G-P), and Rippling are among the larger providers now operating this model at scale across dozens of countries, alongside a long tail of regional and single-country specialists. None of them make the underlying legal relationship simple. They make it fast.

EOR vs. PEO: Not the Same Structure

A related structure, the Professional Employer Organization, works differently. A PEO typically operates under a co-employment model within a single country, often the United States, where both the PEO and the client share defined employer responsibilities under a written agreement. An EOR, by contrast, is usually the sole legal employer, which is precisely why companies use it to expand into countries where they have no registered entity at all. Confusing the two structures during a compliance review is a common and avoidable mistake.

Misclassification and Co-Employment Risk

The first risk category sits inside the EOR relationship itself. Say the client company controls the worker too tightly: rigid hours, company equipment, discipline handled directly, none of it routed through the EOR. Regulators in several countries can argue that the client, not the EOR, is the real employer. That argument, if it succeeds, can unwind the entire arrangement.

Worker misclassification is not a rare footnote. An oft-cited Economic Policy Institute analysis, referenced repeatedly in industry compliance guidance, found that roughly 30 percent of U.S. employers had misclassified at least one worker.

Penalties vary sharply by state and country. California’s civil penalties for willful misclassification run from $5,000 to $25,000 per violation. Virginia scales penalties by audit history, from $1,000 per worker on a first offense up to $5,000 on later ones. Australia’s Fair Work Act allows civil penalties as high as AUD 82,500 per misclassified worker.

The Lyft Precedent and What It Actually Teaches

The Lyft case is the example most compliance teams still cite. The company settled a California driver-classification dispute for $27 million in 2019 and agreed to modify its service terms. That case involved contractors, not an EOR arrangement, but the underlying legal test, how much control one party exercises over the work, is the same test regulators apply when they scrutinize EOR co-employment claims.

Two things follow from that. Contract language between client and EOR matters less than actual day-to-day behavior. A well-drafted agreement stating the EOR is the sole employer will not survive scrutiny if the client’s managers are running performance reviews, setting mandatory hours, and issuing formal warnings without the EOR’s involvement.

A common EOR sales pitch, that the structure “eliminates” employment risk, overstates what it actually does. It relocates the legal employer of record. It does not relocate the practical control that regulators examine.

Permanent Establishment Risk the EOR Doesn’t Fully Absorb

Permanent establishment, or PE, is a corporate tax concept, not an employment one, and this is where the confusion tends to start. A company can have zero payroll compliance issues and still trigger a taxable presence in a country because of what a remote employee does there, not how they are paid.

Where the OECD Draws the Line

The OECD’s 2025 update to its Model Tax Convention guidance flags several PE triggers relevant to distributed teams.

• An employee spending more than half their working time in another country over a rolling twelve-month period.
• Someone regularly negotiating or concluding contracts on the company’s behalf from abroad.
• A senior executive making binding business decisions remotely.
• A home office used consistently enough to look like a genuine place of business rather than a convenience.

An EOR handles none of that. It manages payroll and the local employment contract. It has no visibility into whether the person it pays is closing enterprise sales deals from a hotel room in Singapore or approving budgets from a kitchen table in Lisbon.

That gap is the single most misunderstood limitation of the EOR model. It deserves a direct opinion rather than a hedge: marketing copy that frames an EOR as a way to “expand risk-free” is misleading. It is a way to run payroll compliantly. It is not a corporate tax shield.

The Headcount Tipping Point

Practitioners quoted in Thomson Reuters’ 2026 payroll compliance commentary point to a rough headcount threshold. Somewhere around 15 to 20 employees in a single country, companies typically stop leaning on an EOR and start weighing a local entity instead. Below that number, an EOR is usually cheaper and faster. Above it, the tax exposure and the cost of the EOR’s markup both tend to justify building local infrastructure.

IP Assignment Gaps: Who Actually Owns the Work

Every company assumes it owns what its people build. That assumption rests on IP assignment clauses that, in most countries, need to be explicit, properly executed, and consistent with local statute. An EOR arrangement adds a structural wrinkle: the worker’s formal employment contract is with the EOR, not with the client company that actually benefits from the invention, code, or creative work.

In the United Kingdom, the default rule under the Copyright, Designs and Patents Act gives the employer ownership of works created in the course of employment. The word “employer” in that statute points to whoever the legal employer is, which may not be the company that wants the rights.

Germany’s Stricter Invention-Compensation Rule

Germany goes further with its Employee Invention Act, which requires employers to formally claim inventions within a set window and, in many cases, pay separate statutory compensation to the inventor beyond ordinary salary. If the EOR is the named employer, these obligations technically attach to the EOR first.

How Providers Try to Close the Gap

Most reputable EOR providers solve this contractually, layering a tripartite agreement or an assignment-back clause that routes IP from the worker to the EOR and then immediately to the client. That solution depends entirely on the paperwork being done correctly in every country, for every hire, every time. It is a process risk more than a structural one, but process risk compounds across a distributed workforce of dozens of contracts drafted under different countries’ laws.

A gap here rarely surfaces during normal operations. It surfaces during due diligence for a fundraising round or an acquisition, when a buyer’s counsel asks for clean IP assignment chains covering every engineer who touched the codebase. That is an uncomfortable moment to discover a signature was missing three years earlier.

Benefits and Termination Law Exposure by Country

American hiring managers tend to assume termination works the way it does at home: notice is a courtesy, severance is negotiable, and at-will employment means either side can walk away with minimal formality. Almost nowhere else works that way, and the gap catches companies off guard even when an EOR is technically absorbing the administrative burden.

Notice, Severance, and Protected Categories

Germany’s statutory notice periods start at four weeks and stretch to seven months for employees with 20 or more years of tenure, during which the employer generally keeps paying wages. Belgium’s notice requirements for long-tenured staff can run past a full year. Mexico requires three months’ salary plus 20 days’ pay for every year of service on dismissal without cause.

Spain caps unfair-dismissal compensation at 33 days’ salary per year of service, up to 24 months. Italy accrues a separate severance fund, the TFR, throughout employment and pays it out on termination regardless of the reason. Protected categories add another layer: in Germany, pregnant employees carry dismissal protection from the start of pregnancy through four months after childbirth. None of these obligations disappear because a company routed the hire through an EOR; the EOR simply becomes the party responsible for calculating and paying them correctly.

Putting the Numbers Side by Side

The chart below translates a few of those formulas into a single illustrative comparison: statutory severance-style exposure owed to a hypothetical employee with 20 years of service, expressed in weeks of pay. The numbers are simplified and rounded for comparison purposes.

Actual entitlements depend on cause, contract terms, and local negotiation. This is not a substitute for a country-specific calculation from qualified counsel.

Risk Severity at a Glance

None of these four risk categories behaves the same way. Some are common but cheap to fix. Others are rare but expensive when they hit. The table below reflects practitioner judgment built from the sources cited throughout this article, not a formal actuarial model, and it is worth reading that way: a rough map, not a precise probability table.

A Worked Scenario: When Permanent Establishment Risk Materializes

The following is a hypothetical composite drawn from patterns described in the industry sources cited above, not a real company.

A 40-person U.S. software company hires a senior sales director through an EOR in France to build a European book of business. The arrangement looks clean on paper: French payroll, French benefits, a compliant local contract.

Eighteen months in, the director is closing six-figure enterprise deals directly and signing order forms with delegated authority. She now spends more than half the year working from a Paris apartment that has effectively become the regional sales office.

None of that shows up in a payroll audit. The EOR keeps running payroll correctly, withholding the right amounts, filing the right local forms. The exposure sits one level up, in French corporate tax. The tax authority can argue the company now has a fixed place of business and a dependent agent concluding contracts on its behalf, both classic PE triggers under the OECD framework referenced earlier.

If that argument succeeds, the company owes French corporate tax on the profit attributable to that activity, retroactively, plus interest and potentially penalties. The EOR is not on the hook for any of it. Its contract covers payroll compliance, not corporate tax structuring, and every reputable provider’s terms of service say so explicitly. The client company, and its finance leadership, own that outcome.

Common Mistakes Companies Make with EOR Arrangements

Most problems trace back to a handful of repeated errors rather than exotic edge cases.

• Treating the EOR as a full risk transfer. The EOR absorbs payroll and statutory-employer liability. It does not absorb corporate tax nexus risk, and most contracts say so in the fine print few people read.
• Letting managers run the relationship like a normal employee. Direct control over hours, discipline, and performance management, exercised without going through the EOR’s systems, is exactly what regulators look for when testing co-employment claims.
• Skipping a headcount review as the country grows. A single EOR hire in a country is low risk. Fifteen or twenty is a different conversation, and few companies schedule a review to have it.
• Assuming IP assignment “just happens.” It happens because someone drafted, executed, and filed the right clause. Confirm the paperwork exists rather than assuming the provider’s standard template covers it.

That is a four-item list on purpose. Compliance failures in this space rarely come in tidy threes, and forcing them into a rule-of-three summary tends to flatten exactly the nuance that matters.

Due-Diligence Checklist Before Signing an EOR Contract

Before signing with any provider, a finance or people-ops team should be able to answer each of the following with specifics, not marketing language.

1. Does the provider have its own registered legal entity in the target country, or does it subcontract through a local partner? Subcontracted arrangements add a layer of counterparty risk.
2. What does the contract say about corporate tax and permanent establishment liability, explicitly? If the answer is silence, treat that as the answer.
3. How does the provider document IP assignment, and can they produce a sample tripartite agreement for review before signing?
4. What is the provider’s process for flagging when an employee’s role or travel pattern starts to look like a PE trigger?
5. What happens to payroll continuity if the provider itself faces financial distress or loses its local registration?
6. Can the provider show references from other clients operating in the same specific country, not just a general client list?

A short due-diligence conversation on these six points, run before a contract is signed, is cheaper than any of the outcomes described earlier in this article.

Key Takeaways

Companies that already navigated a related headache, registering for payroll tax in multiple states or countries without local entities, often reach for an EOR specifically to sidestep that registration burden. Our related guide on payroll tax for distributed teams walks through why that registration problem exists in the first place and where an EOR fits as one of several possible fixes.

Frequently Asked Questions

Does an Employer of Record eliminate permanent establishment risk?

No. An EOR manages payroll and the local employment contract. Permanent establishment is a corporate tax determination based on what an employee actually does and where, which sits outside what any EOR contract typically covers.

Is an Employer of Record the same thing as a Professional Employer Organization?

They are related but distinct. A PEO usually operates a co-employment model within one country, most often the United States. An EOR is typically the sole legal employer and is the more common structure for entering a country where a company has no registered entity at all.

Who owns intellectual property created by an employee hired through an EOR?

Ownership should flow from the worker to the EOR and then to the client company through a properly executed assignment chain. Whether that chain actually exists in every contract, for every hire, is worth confirming directly rather than assuming.

At what headcount should a company stop using an EOR and set up a local entity?

Practitioners commonly point to roughly 15 to 20 employees in a single country as the point where the math and the risk profile typically favor a local entity. The right number still depends on revenue in that country and on risk tolerance.

Can an EOR provider be held liable if permanent establishment risk materializes?

Generally, no. Most EOR contracts explicitly limit the provider’s obligations to payroll and employment compliance, not corporate tax structuring. The client company typically bears the corporate tax consequence.

How large is the global EOR market right now?

One January 2026 industry research report values the global EOR market at roughly $6.82 billion in 2025, rising to about $7.45 billion in 2026. It projects a climb to $15.89 billion by 2035 at an estimated 9.24 percent annual growth rate. Treat market-sizing figures like this as directional, since methodologies vary between research firms.

References

• Custom Market Insights, “Global Employer of Record (EOR) Market” report, as reported by Yahoo Finance, January 2026.
• Thomson Reuters, “Payroll Pulse: Navigating Permanent Establishment Risk with Remote Workers in 2026,” Thomson Reuters Tax & Accounting blog.
• Gloroots, “Employee Misclassification Penalties: Know the Risks,” 2026.
• Boundless HQ, “Termination of Employment: Global Rules,” 2026.
• RemotePeople, “Severance Pay by Country: 2026 Global Guide.”
• EY, “Mobility Reimagined Survey,” 2026, as cited in Thomson Reuters payroll compliance commentary.