How to Avoid Permanent Establishment Risk in Any Country

Permanent establishment risk is the tax exposure you pick up by accident, not by choice. In the cross-border hires we set up, it almost never starts with an office. It starts with where someone sits and what they are allowed to sign.

Permanent establishment (PE) risk is the possibility that your company's activities in a foreign country create a taxable presence there, making you liable for corporate income tax, filing obligations, and penalties in that country, even if you never set up an entity. One long-running project, a remote hire with the wrong responsibilities, or someone closing deals on your behalf can be enough.

PE is not about intent. It is about how local tax authorities and tax treaties read your activities. This guide covers what PE means, the specific triggers, what it costs when you cross the line, what the OECD's 2025 Update said about remote work, and how to avoid PE risk while you keep growing your global team.

This guide is jurisdiction-agnostic: it explains how PE arises anywhere and how to avoid it. If your exposure is specifically Indian, the case law, the effective tax rate and the mitigation playbook sit in our companion guide to permanent establishment risk in India.

What is permanent establishment risk?

Permanent establishment risk is the chance that your activities in a foreign country cross a threshold that gives that country the right to tax the profits tied to them. Cross it and you owe corporate income tax there, you file locally, and assessments reach back years. That is the short definition of permanent establishment risk.

Say your company is based in the US, but you have an employee working from home in Poland, or a sales rep closing deals in Germany. Those countries' tax authorities may decide you have created a PE. From that point you owe tax on the income generated through that presence, and penalties can be retroactive.

The concept is primarily governed by Article 5 of the OECD Model Tax Convention, the framework behind most bilateral tax treaties. Every country also has its own domestic definition of taxable presence, and several countries apply stricter domestic tests than the treaty does. PE rules turn on the specific facts and on the treaty between the two countries involved, so treat this as general information and get advice for your own situation.

Why PE risk matters more than it used to

Three shifts have made this a bigger issue than it was even a few years ago:

• BEPS Action 7 tightened the definitions: the 2015 final report widened the dependent-agent test to also catch a person who habitually plays the principal role leading to the conclusion of contracts that are routinely concluded without material modification, narrowed the Article 5(4) exceptions so each applies only to activities of a preparatory or auxiliary character, and added an anti-fragmentation rule so a business cannot avoid PE status by fragmenting a cohesive operating business into several small operations. Those changes entered the OECD Model through the 2017 Update, so activities that once sat safely below the PE line may now trip it.
• Remote work changed what a place of business can be: the OECD's 2025 Update was approved by the Committee on Fiscal Affairs on October 13, 2025 and adopted by the OECD Council on November 18, 2025. It added new paragraphs 44.1 to 44.21 to the Commentary on Article 5, introducing a working-time benchmark and a commercial-reason test for home offices. It is the first update to the OECD Model since 2017, and the first change to the Article 5 Commentary in that time. Tax authorities are now actively watching cross-border remote arrangements.
• Enforcement is intensifying: high-enforcement jurisdictions apply stricter interpretations than the OECD Model, and companies are being audited for PEs they did not know they had created.

PE is the tax question sitting underneath every cross-border hire, which is why it usually decides the bigger structural call: employing through an EOR versus opening your own entity. If the model itself is new to you, start with what an Employer of Record actually is.

What are the three main types of permanent establishment?

There are three primary types of permanent establishment under international tax law, fixed place of business, dependent agent and service PE, plus two emerging categories. Each creates a corporate tax obligation in a foreign country through a different mechanism, and each has its own threshold, so a company can clear one and still land inside another.

1. Fixed place of business PE

The most straightforward type. Under the OECD Model, a fixed-place PE needs three things: a link to a specific location, a degree of permanence, and actual business being carried on through that place.

Classic examples: offices, branches, factories, warehouses, mines. It also reaches home offices where the space is “at the disposal” of the company (not just the employee's convenience) and fixed-desk arrangements in coworking spaces. Construction or installation sites can qualify too, typically past 12 months under the OECD Model.

2. Dependent agent PE (DAPE)

This one is triggered by people, not places. A dependent-agent PE arises when someone habitually negotiates or concludes contracts in a foreign country on your behalf. After BEPS Action 7, this was widened to include agents who play the leading role in negotiations even if they don't formally sign.

The agent has to be dependent on your company, not an independent agent acting in their own ordinary course of business, and has to habitually exercise authority to conclude contracts. This is also where co-employment gets misread: putting a third party in the employer seat does not change who the person negotiates and closes for. "Habitually" implies frequency, but in principle even a short stay can create a dependent-agent PE if contracts are actually being closed.

Example: your UK-based sales rep regularly closes deals with French clients for the parent company. That can be a dependent-agent PE in France.

3. Service PE

Recognized under the UN Model Tax Convention and adopted by many countries. A service PE can arise from the duration and nature of services performed in the host country, even with no fixed location.

The threshold varies by country and treaty, commonly 90 to 183 days within a 12-month period. Critically, cumulative time across multiple employees can count toward it.

Example: a Canadian consulting firm rotates teams through a client project in Singapore. No one person exceeds 90 days, but collectively the firm has people on the ground for eight months. That can trigger a service PE.

Emerging categories to watch

• Construction PE: a subset of fixed-place PE with its own duration thresholds, 12 months under the OECD Model but as low as 6 months in some bilateral treaties. Linked projects are often aggregated, so splitting contracts rarely helps.
• Digital or virtual PE: the UN Model's Article 12B lets source countries tax income from automated digital services on the basis of significant economic presence, with no physical footprint to point at. A growing number of countries have written revenue or user thresholds into domestic law, so a subscription business with no office, no staff and no agent in a country can still land inside its tax net. This is the category most likely to catch a software company that believes it has no foreign presence at all, and treaty relief is usually thinner here than for the three classic types, because there is no fixed place and no agent for a treaty article to attach to.

Fixed-place PE is the one most people picture, and it is the reason registering an entity abroad is a heavier decision than it first appears. Agency PE turns on authority rather than job title, which is worth reading alongside how a distributed workforce is actually structured.

What triggers permanent establishment risk?

Permanent establishment risk is triggered by five things: physical presence, what your employees and agents actually do, how long they are there, who holds decision-making authority, and whether the work is revenue-generating or genuinely auxiliary. It rarely happens on purpose. It happens because nobody looked at the combination until an auditor did.

• 1. Physical presence: leasing or owning space abroad, even a small office, warehouse, or distribution center. Home offices used regularly for business can count if the space is at the company's disposal, not just the employee's choice. Fixed-desk coworking arrangements, as opposed to the occasional hot desk, can too.
• 2. Employee and agent activity: contract-signing authority is the biggest red flag. If a senior executive flies in and signs a major agreement, a dependent-agent PE can exist regardless of how brief the trip was, because the act rather than the duration is what matters. Sales and deal negotiation, C-suite decision-making from a foreign location, and revenue-generating roles all carry far higher risk than purely administrative support.
• 3. Duration and continuity: fixed place PE has no duration test at all. It turns on disposal, meaning a right to use the place plus control over it, together with continuity of use. Six months is a benchmark you will meet in treaty construction clauses and in continuity arguments, not a fixed-place threshold. Service PE commonly runs at 183 days and sometimes as low as 90, construction PE at 12 months under the OECD Model and 6 in some treaties, and cumulative time counts, so recurring short visits by several employees can aggregate past a threshold even when no single person does.
• 4. Authority and decision-making: people who habitually conclude contracts, or local staff making real business decisions on pricing, strategy and hiring rather than executing decisions taken at home. Negotiating contracts carries more risk than relaying terms someone else has already set.
• 5. Revenue-generating versus auxiliary activities: under Article 5(4) of the OECD Model, genuinely preparatory or auxiliary activities are generally exempt, and BEPS Action 7 raised the bar for what counts as truly auxiliary. Higher risk: sales, client management, deal closing, product development. Lower risk: storage, display, purchasing and information-gathering, as long as they are genuinely supportive rather than core work dressed up as support.

From our experience helping 300+ global companies build teams abroad, the trigger that catches companies off guard is almost never the obvious one. It is rarely the office lease. It is the one senior hire who, on paper, supports sales, but in practice is the person the customer negotiates with and the deal closes around. Tax authorities look at what people actually do, not at their job titles.

Contract wording is the first thing an auditor reads, so start with the clauses that belong in an employment contract. A contractor who behaves like an employee is a PE trigger and a classification problem at the same time, so compare the contractor and employee tests side by side and see how classification is established and held through an EOR.

How does remote work create permanent establishment risk?

This is where PE risk has changed the most. Before 2020, PE was mostly about offices and factories. Now a single remote employee working from an apartment abroad can create a taxable presence for your company, and in late 2025 the OECD wrote guidance for exactly this situation into the Commentary on Article 5.

The OECD's 2025 two-part framework

The 2025 Update to the OECD Model Tax Convention was approved by the Committee on Fiscal Affairs on October 13, 2025 and adopted by the OECD Council on November 18, 2025. It added new paragraphs 44.1 to 44.21 to the Commentary on Article 5 and deleted the old paragraphs 18 and 19. Article 5 itself was not reopened, and the only Article the Update amends is Article 25. Those new paragraphs set out a two-part way of testing whether a home office is a place of business.

Step 1, the working-time test. Where an individual works from a home or other relevant place for less than 50% of their total working time for that enterprise over the course of any twelve-month period commencing or ending in the fiscal year concerned, paragraph 44.8 says that place "would generally not be considered a place of business of the enterprise". It runs on actual time worked, not on what the contract says. At or above 50%, nothing is automatic: paragraph 44.10 says the question "will be determined by the facts and circumstances". It is a benchmark, and only a benchmark.

Step 2, the commercial-reason test. Paragraph 44.11 treats a commercial reason for the individual to be in that country as a "prominent consideration", not a requirement. It fails only where the enterprise allows home working "solely to obtain or retain the services of that individual" (paragraph 44.15) or "solely to reduce costs" (paragraph 44.16), and the word "solely" is doing real work there. Where several reasons exist, paragraph 44.13 says that "if one of those reasons is a commercial reason, then this indicator will be satisfied".

Two limits are worth holding onto. This test only answers whether the home is a place of business, so the preparatory and auxiliary exception and the dependent-agent rules still have to be considered separately. And the Commentary is guidance on the OECD Model, not law in any single country.

When remote workers are higher-risk: anyone with contract-signing authority or who habitually negotiates deals from abroad; revenue-generating roles (sales, business development, client management) based in the host country; and founders or key executives running essential functions from a home office abroad. The OECD is explicit that if one person essentially is the business and operates from a foreign country, that home office will very likely be treated as a place of business.

When they're lower-risk: support, admin, and genuinely auxiliary roles; people working remotely for personal reasons (family, lifestyle) with no business-driven reason to be there; and occasional client visits like quarterly meetings.

Which countries did not accept the 50% benchmark?

The benchmark is only as good as the country applying it. At paragraph 55 of the Positions on Article 5 and its Commentary, India recorded a position stating that it "does not agree with the conditions, including time threshold and commercial reason, detailed in paragraph 44.1 to 44.21 of the Commentary on Article 5 for regarding an individual's home where activities related to the business of an enterprise are carried out, a place of business of the enterprise". India considers that in such a case the individual's home "can be considered as being at the disposal of the enterprise, and it constitutes a place of business of the enterprise for the purpose of application of Article 5". India is not an OECD member, so it records positions on the Model rather than reservations, and the same document shows it using "reserves the right to" for other Articles, which makes the drafting difference deliberate.

Two more countries departed from the new paragraphs. As of September 2026, Nigeria has recorded positions at paragraphs 58 to 60, against paragraphs 44.14 to 44.16 and example D of 44.21, and Malaysia at paragraph 61 reserved the right to agree a different percentage bilaterally. A Commentary position is not law in itself. It signals how a tax authority will read a treaty, and what governs your case is the specific treaty and that country's own domestic rules.

If your remote worker is in India, the 50% benchmark is not the test that will be applied. What India applies instead, and how to structure around it, is in permanent establishment risk in India.

Does the OECD test ask whether a home office is productive?

Paragraph 44.13 says expressly that this analysis does not require asking whether the home has a "productive character". That is worth noticing, because national courts in some jurisdictions do weigh productivity when they decide whether premises are at an enterprise's disposal. The Commentary and those courts pull in different directions, so a home office can sit comfortably inside the OECD reading and still be argued into a place of business under domestic doctrine.

One senior hire working from a country you have no entity in can be enough on its own. Our guide to managing a remote team covers the operating side, and the remote workforce models companies use covers the structural options. Right-to-work sits next to this: here is why work authorization matters before day one.

What are the consequences of triggering permanent establishment?

Triggering a permanent establishment does far more than add one tax bill. You pick up corporate tax on the profits attributable to it, retroactive assessments with interest and penalties, a local registration and accounting obligation, possible double taxation, and closer scrutiny in every other country you operate in. The obligations cascade.

• Corporate income tax on attributable profits: a PE is generally taxed on the profits attributable to it, at the host country's corporate income tax rate, which varies widely by country. Only the profits attributable to the PE are taxed, not your global income.
• Retroactive assessments, penalties, and interest: assessments can reach back years. You owe from when the PE was created, not from when it was discovered, plus interest and penalties on top.
• Cascading compliance: a PE typically triggers local registration, compliant accounting records, VAT or GST obligations, payroll-tax registration, withholding, and social-security contributions. One unplanned PE can turn into a full local compliance operation.
• Double taxation: if both countries tax the same income, you can pay twice. Treaties give relief, but only if you knew about the PE and kept proper records, which unintentional PEs rarely do.
• Reputational damage and scrutiny: once flagged in one country, expect closer attention to your operations everywhere else.

Illustrative scenario: a US software company lets a senior sales executive relocate to Germany and keep her role, regularly meeting clients and finalizing agreements. Eighteen months in, a German audit identifies a PE: corporate tax on German sales, retroactive VAT, penalties, and a requirement to register a branch.

Back taxes are rarely the only bill. Read how compliance is managed across markets with an EOR and our HR legal compliance checklist, because exposure is always less expensive to fix before it is discovered than after. If you suspect it already exists, an EOR compliance audit is how you size it, and workplace compliance for employers covers the day-to-day discipline that stops it recurring.

How do you avoid permanent establishment risk?

You avoid permanent establishment risk by controlling four things: who employs your people abroad, who can sign contracts, what those people do, and how long they stay. Use an Employer of Record for foreign hires, keep signing authority at home, keep foreign roles genuinely auxiliary, cap duration, and document all of it. The right mix depends on your operations.

1. 1. Use an Employer of Record (EOR) for foreign hires: the most common practical route to hire in a country without creating a direct taxable presence. The EOR is the legal employer, handling payroll, tax withholding, social security and local employment compliance, while you direct the day-to-day work.

The honest caveat: an EOR mitigates PE risk, it does not eliminate it. It cleanly removes the employment footprint. It does not touch a foreign employee who closes deals (dependent-agent PE), an office you lease in your own name (fixed-place PE), or control-heavy supervision of local operations. If your operation looks like a branch in everything but name, tax authorities can look straight past the EOR. An EOR is best for small teams, market testing, and hires that are genuinely delivery-focused.

1. 2. Limit contract-signing authority abroad: the direct fix for dependent-agent PE. Keep contract approvals, pricing and deal sign-offs centralized at home. If you have sales staff abroad, structure the roles so they negotiate but do not conclude, and document that in contracts and in policy.
2. 3. Structure roles as genuinely auxiliary, not core: revenue-generating roles carry far more risk than support roles. Where you can, make foreign roles genuinely preparatory or auxiliary, and remember that after BEPS Action 7 authorities look at what people do rather than at what their titles say.
3. 4. Monitor duration: set policies capping how long employees work in a foreign country, require pre-approval for relocations even when they are temporary, and track cumulative days per person per country. On project-based work, rotate people before the treaty threshold, whether that is 90 days, 183 days, or something else entirely.
4. 5. Use independent contractors carefully: a genuinely independent contractor with multiple clients, control over their own work and no authority to bind you generally does not create PE. Misclassification makes the position worse rather than better, and many tax authorities will reclassify a dependent contractor as an employee, which puts the PE question back on the table with a worse set of facts.
5. 6. Establish a local subsidiary for substantial operations: for deep, long-term operations a subsidiary can be the cleanest path, with its own filings and its own compliance. The caveat is that a subsidiary does not automatically shield the parent. If subsidiary staff act as the parent's dependent agents, or parent staff use subsidiary premises as a fixed base, the parent can still pick up a PE of its own.
6. 7. Document everything: written contracts defining scope, authority limits and location of services; time logs of presence per country; board resolutions showing where decisions are actually made. If your PE status is ever challenged, documentation is your defense.

The cleanest structural answer is employing through a local employer of record, so start with how an EOR works mechanically. The full sequence for hiring international employees sets out the order of operations. Payment routing matters just as much: how to pay international employees without creating a taxable presence, and what global payroll services cover. A PEO does not solve PE the way an EOR does, so the difference between a PEO and an EOR is worth understanding before you pick. For the wider view, see EOR risk management across legal, financial and operational exposure.

Where does Wisemonk fit if your exposure is in India?

If you are hiring in India specifically, Wisemonk handles this exact problem. Your employees work under our India entity, not yours: we become the Employer of Record, running payroll, statutory contributions, and local compliance, so your parent company stays off the Indian tax registration map.

If you are shortlisting providers, our checklist on how to choose an Employer of Record covers what to ask and what to verify. Costs are laid out in our EOR pricing and cost breakdown, and what EOR implementation looks like takes you from signature to first payroll.

We have helped 300+ global companies from the United States, the United Kingdom, France, Canada and beyond build teams in India, and we manage $20M+ in payroll for 2,000+ employees on flat-fee pricing.

Two guides, one difference: this page covers how PE arises in any country and how to avoid it. India applies its own stricter tests, so the case law, the tax math and the mitigation checklist live in permanent establishment risk in India.