Does Using an EOR Create Permanent Establishment Risk?

The PE Question That Keeps CFOs Up at Night

“If I hire five engineers in Germany through an EOR, does that create a permanent establishment for my US company?” This is the single most common compliance question I get from finance leaders considering international hiring — and the answer is more nuanced than most EOR providers want to admit.

To convert this analysis into execution, map choices on comparison pages, use how to choose an EOR as your buying checklist, and prioritize markets via remote jobs by country.

The short answer: a well-structured EOR arrangement, used properly, should not create PE risk. The EOR is the legal employer. Your company has no registered office, no fixed place of business, and no authority to conclude contracts in the foreign jurisdiction. But “should not” is doing heavy lifting in that sentence, and the way you operate day-to-day matters more than what your contract says.

What Permanent Establishment Actually Means

Under the OECD Model Tax Convention (Article 5), a PE exists when a foreign company has a “fixed place of business through which the business of an enterprise is wholly or partly carried on.” This triggers corporate tax obligations in the host country — meaning your US company would owe corporate income tax to Germany on profits attributable to activities performed there.

PE can be triggered through:

A fixed place of business — an office, branch, factory, or workspace that your company controls
A dependent agent — someone who habitually exercises authority to conclude contracts on your behalf
A service PE — in some treaties, employees performing services in a country for more than 183 days in a 12-month period

The threshold varies by bilateral tax treaty. The US-Germany treaty follows OECD conventions closely. US-India has some differences. US-UK has its own quirks. You need to check the specific treaty, not rely on general principles.

When EOR Does NOT Create PE Risk

In a standard EOR arrangement:

The EOR is the employer, not your agent. The worker’s employment contract is with the EOR entity. The EOR pays salary, withholds taxes, provides statutory benefits, and handles termination. Your company has a services agreement with the EOR provider, not an employment relationship with the worker.

Your company has no fixed place of business. The worker may work from their home or a coworking space, but neither is a premises “at the disposal of” your company in the OECD sense. The EOR’s office (if they have one locally) belongs to the EOR, not to you.

The worker cannot bind your company to contracts. EOR employees perform work under your direction, but they don’t sign deals, commit to customer agreements, or exercise legal authority on your behalf. This is the dependent agent test, and it’s critical.

Under these conditions — and they’re the conditions that exist in a properly structured EOR arrangement — PE risk is minimal. The OECD’s commentary on Article 5 specifically notes that activities carried out by an independent entity (the EOR) are generally not attributable to the foreign enterprise (you).

When EOR Might Create PE Risk

Here’s where it gets complicated. PE analysis looks at substance over form. Even if your EOR contract is airtight, certain operational patterns can trigger PE risk.

Your EOR employee negotiates and closes deals

If the person you’ve hired through an EOR routinely negotiates contracts with your customers and has the practical authority to commit your company — even without formal signing authority — tax authorities may argue a dependent agent PE exists. The OECD’s 2017 updates (BEPS Action 7) specifically broadened the dependent agent definition to catch arrangements where someone “habitually plays the principal role leading to the conclusion of contracts.”

A software engineer writing code? No PE risk. A sales representative who sends proposals, negotiates terms, and closes deals — with the contract being signed by someone back at headquarters as a formality? That’s the gray zone tax authorities are looking at.

You control a physical workspace

If your company leases a coworking space, provides office equipment at a specific location, or requires the EOR employee to work from a designated premises that you’ve arranged, you may have created a fixed place of business. The EOR’s involvement doesn’t insulate you if the physical presence is attributable to your company rather than the EOR.

You have multiple EOR employees concentrated in one country

One EOR employee performing technical work rarely triggers scrutiny. But 20 EOR employees in the same country, working as a cohesive team, performing core business functions? Tax authorities may argue that this constitutes a de facto business establishment — especially if the team generates revenue, interacts with local customers, or operates with significant autonomy.

There’s no magic number, but the risk increases with headcount and with how integral the team’s work is to your revenue generation.

Service PE in specific treaties

Some tax treaties (notably India’s treaties with several countries) include a “service PE” provision: if employees or contractors perform services in the country for more than a specified period (often 90 or 183 days), a PE may be deemed to exist regardless of whether there’s a fixed place of business. The question then becomes whether EOR employees count as “your” employees for treaty purposes. Most interpretations say no — they’re the EOR’s employees — but some tax authorities have taken aggressive positions.

How to Structure Your EOR Arrangement to Minimize PE Risk

1. Keep sales and contract authority at headquarters

Your EOR employees should not negotiate or close deals on your behalf. If you need salespeople in a foreign market, either set up an entity or use a commission-agent structure with proper PE analysis. This is the highest-risk activity and the easiest to control.

2. Don’t provide or control physical workspace

Let employees work from home or choose their own coworking space. If you’re paying for workspace, route it through the EOR as a benefit, not through your company directly. The workspace should be attributable to the EOR or the individual, not to your company.

3. Document the EOR’s independence

Your services agreement with the EOR should clearly establish that the EOR exercises independent judgment in employment matters — hiring, firing, compensation structure, benefits, and HR policies. If your company dictates every term and the EOR is merely processing paperwork, the “independent entity” argument weakens.

4. Get transfer pricing right

If your EOR employees are performing services that generate significant value for your company, you need a transfer pricing arrangement that allocates appropriate profit to the jurisdiction where the work is performed. This doesn’t mean you have a PE — it means you’re demonstrating that the economic substance of the arrangement reflects arm’s-length pricing. This actually reduces PE risk by showing tax authorities you’re not trying to avoid attributing profits to the jurisdiction.

5. Monitor headcount thresholds

There’s no universal safe harbor, but once you exceed 10–15 EOR employees in a single country performing core business functions, it’s worth getting a formal PE risk assessment from a tax advisor familiar with the specific bilateral treaty. Our EOR vs. entity guide covers the decision point where setting up your own entity becomes both cheaper and safer.

What EOR Providers Tell You vs. What’s True

Most EOR providers market their service as eliminating PE risk. “Hire without establishing a local entity — no PE exposure.” This is largely accurate for the core use case (hiring a small team for support, engineering, or back-office work), but it overstates the protection for edge cases.

No EOR provider can guarantee you won’t have PE exposure if your workers are closing deals, you’re controlling local premises, or you’re building a 50-person team that functions as a local branch in everything but name. The EOR structure reduces PE risk significantly compared to direct hiring without an entity — but it’s not a blanket exemption.

The best providers — Remote, Deel, and G-P — have published guidance on PE risk and will discuss structuring during onboarding. Smaller providers may not raise it at all. If your provider hasn’t discussed PE risk with you, that’s a red flag about their compliance depth.

When to Get Professional Advice

Get a formal PE risk assessment if any of the following apply:

You have more than 10 EOR employees in a single jurisdiction
Any EOR employee has customer-facing, sales, or business development responsibilities
You’re providing or paying for local workspace
You’re operating in jurisdictions with aggressive service PE provisions (India, China, Israel)
Your EOR employees are performing activities directly tied to your company’s core revenue generation

For a broader understanding of EOR compliance risks beyond PE, see our EOR compliance risks guide. The EOR for enterprise guide covers PE considerations specific to larger-scale deployments.

The rule of thumb: use an EOR for what it’s designed for — hiring talent in markets where you don’t have an entity and aren’t ready to build one. Don’t use it as a permanent substitute for entity setup in countries where you’re building a significant, long-term presence. The PE risk is lowest when the EOR is a bridge, not a destination.

To move from strategy to execution, use remote jobs by country and benchmark provider options in EOR comparisons.