What is Permanent Establishment Risk & How to Avoid It?

Last updated July 2026. This is general information, not tax or legal advice — permanent establishment rules turn on specific facts and the treaty between the two countries involved, so get advice for your situation before you act.

Expanding into another country is exciting — right up until you accidentally trigger permanent establishment risk and find yourself with a tax bill you never budgeted for.

Permanent establishment (PE) risk is the possibility that your company's activities in a foreign country create a taxable presence there — making you liable for corporate income tax, filing obligations, and penalties in that country, even if you never set up an entity. One long-running project, a remote hire with the wrong responsibilities, or someone closing deals on your behalf can be enough.

PE is not about intent. It's about how local tax authorities and tax treaties read your activities. This guide covers what PE means, the specific triggers, what it costs when you cross the line, how the OECD's 2025 rules changed the game for remote work, and how to avoid PE risk while you keep growing your global team.

Hiring specifically in India? We go far deeper — case law, the exact tax math, and a mitigation playbook — in our companion guide: Permanent establishment risk in India.

What is permanent establishment risk?

Permanent establishment risk is the chance that your business activities in a foreign country cross a threshold — “permanent establishment” — that gives that country the right to tax the profits tied to those activities. Once you cross it, you owe corporate income tax there, you have to comply with local filing rules, and if you weren't paying, the assessment can reach back years.

Say your company is based in the US, but you have an employee working from home in India, or a sales rep closing deals in Germany. Those countries' tax authorities may decide you've created a PE. From that point you owe tax on the income generated through that presence — and penalties can be retroactive.

The concept is primarily governed by Article 5 of the OECD Model Tax Convention, the framework behind most bilateral tax treaties. Every country also has its own domestic definition of taxable presence, and those can be stricter than the treaty — India is a prominent example (more below).

Why PE risk matters more in 2026

Three shifts have made this a bigger issue than it was even a few years ago:

• BEPS Action 7 tightened the definitions. The OECD widened the dependent-agent PE definition, narrowed the “preparatory and auxiliary” exemptions, and added an anti-fragmentation rule. Activities that once sat safely below the PE line may now trip it.
• Remote work rewrote the rules — in November 2025. The OECD's 2025 Update (published 19 November 2025) introduced a 50% working-time benchmark and a commercial-reason test for home-office PE — the first comprehensive revision to Article 5 since 2017. Tax authorities are now actively watching cross-border remote arrangements.
• Enforcement is intensifying. High-enforcement jurisdictions — India especially — apply stricter interpretations than the OECD model, and companies are being audited for PEs they didn't know they'd created.

PE is the tax question sitting underneath every cross-border hire, which is why it usually decides the bigger structural call: employing through an EOR versus opening your own entity. If the model itself is new to you, start with what an Employer of Record actually is.

What are the three main types of permanent establishment?

There are three primary types of PE under international tax law, plus two emerging categories. Each creates a corporate-tax obligation in a foreign country through a different mechanism.

1. Fixed place of business PE

The most straightforward type. Under the OECD Model, a fixed-place PE needs three things: a link to a specific location, a degree of permanence, and actual business being carried on through that place.

Classic examples: offices, branches, factories, warehouses, mines. It also reaches home offices where the space is “at the disposal” of the company (not just the employee's convenience) and fixed-desk arrangements in coworking spaces. Construction or installation sites can qualify too, typically past 12 months under the OECD Model.

“Permanence” can be shorter than you think. In a landmark Indian case, the Supreme Court held that a UK company had a fixed-place PE at a race circuit it controlled for only a few days a year — because during the event the venue was entirely “at its disposal.” Duration wasn't the deciding factor; control was. We break down that ruling, and the tax consequences, in our India PE guide.

2. Dependent agent PE (DAPE)

This one is triggered by people, not places. A dependent-agent PE arises when someone habitually negotiates or concludes contracts in a foreign country on your behalf. After BEPS Action 7, this was widened to include agents who play the leading role in negotiations even if they don't formally sign.

The agent has to be dependent on your company (not an independent agent acting in their own ordinary course of business) and has to habitually exercise authority to conclude contracts. “Habitually” implies frequency — but in principle even a short stay can create a DAPE if contracts are actually being closed.

Example: your UK-based sales rep regularly closes deals with French clients for the parent company. That can be a dependent-agent PE in France.

3. Service PE

Recognized under the UN Model Tax Convention and adopted by many countries. A service PE can arise from the duration and nature of services performed in the host country, even with no fixed location.

The threshold varies by country and treaty — commonly 90 to 183 days within a 12-month period. Critically, cumulative time across multiple employees can count toward it.

Example: a Canadian consulting firm rotates teams through a client project in Singapore. No one person exceeds 90 days, but collectively the firm has people on the ground for eight months. That can trigger a service PE.

Emerging categories to watch

• Construction PE: a subset of fixed-place PE with its own duration thresholds — 12 months under the OECD Model, but as low as 6 months in some bilateral treaties. Linked projects are often aggregated, so splitting contracts rarely helps.
• Digital / virtual PE: the UN Model's Article 12B lets source countries tax income from automated digital services based on “significant economic presence,” even with no physical footprint. Several countries have moved this way. India, for instance, has a domestic Significant Economic Presence rule that can pull in foreign SaaS, e-commerce, and platform businesses on revenue or user thresholds — see the India guide.

Fixed-place PE is the one most people picture, and it is the reason registering an entity abroad is a heavier decision than it first appears. Agency PE turns on authority rather than job title, which is worth reading alongside how a distributed workforce is actually structured.

What triggers permanent establishment risk?

PE rarely happens on purpose — but it absolutely happens without companies noticing. The triggers fall into five buckets.

• 1. Physical presence. Leasing or owning space abroad — even a small office, warehouse, or distribution center. Home offices used regularly for business can count if the space is at the company's disposal, not just the employee's choice. Fixed-desk coworking arrangements (not the occasional hot desk) can too.
• 2. Employee and agent activity. Contract-signing authority is the biggest red flag. If a senior executive flies in and signs a major agreement, a dependent-agent PE can exist regardless of how brief the trip was — the act, not the duration, is what matters. Sales and deal negotiation, C-suite decision-making from a foreign location, and revenue-generating roles all carry far higher risk than purely administrative support.
• 3. Duration and continuity. Six months is a common fixed-place benchmark. 183 days (sometimes as low as 90) is typical for service PE. Construction PE usually runs to 12 months (6 in some treaties). And cumulative time counts — recurring short visits by several employees can aggregate past a threshold even if no one person does.
• 4. Authority and decision-making. People who habitually conclude contracts, or local staff making real business decisions (pricing, strategy, hiring) rather than executing HQ's decisions. Negotiating contracts is higher-risk than merely relaying terms decided at home.
• 5. Revenue-generating vs. auxiliary activities. Under Article 5(4) of the OECD Model, genuinely “preparatory or auxiliary” activities are generally exempt. But BEPS Action 7 raised the bar for what counts as truly auxiliary. Higher risk: sales, client management, deal closing, product development. Lower risk: storage, display, purchasing, information-gathering — as long as they're genuinely supportive, not core work dressed up as support.

From our experience helping 300+ global companies build teams abroad, the trigger that catches companies off-guard is almost never the obvious one. It's rarely the office lease — it's the one senior hire who, on paper, “supports sales,” but in practice is the person the customer negotiates with and the deal closes around. Tax authorities look at what people actually do, not their job titles.

Contract wording is the first thing an auditor reads, so start with the clauses that belong in an employment contract. A contractor who behaves like an employee is a PE trigger and a classification problem at the same time, so compare the contractor and employee tests side by side and see how classification is established and held through an EOR.

How does remote work create permanent establishment risk?

This is where PE risk has changed the most. Before 2020, PE was mostly about offices and factories. Now a single remote employee working from an apartment abroad can potentially create a taxable presence for your company — and in November 2025 the OECD published new rules for exactly this situation.

The OECD's 2025 two-part framework

The OECD's 2025 Update (published 19 November 2025) set out a two-part test for whether a home office is a place of business:

Step 1 — the time test. If an employee works from a foreign location for less than 50% of their working time over a rolling 12-month period, that location is generally not treated as a place of business. It's based on actual time worked, not what the contract says. Below 50%, you're typically safe.

Step 2 — the commercial-reason test. If they cross 50%, the question becomes whether there's a genuine commercial reason for them to be in that country — serving local clients, accessing a regional market, supporting on-site operations. Crucially, remote work allowed purely to retain an employee or cut costs does not count as a commercial reason.

When remote workers are higher-risk: anyone with contract-signing authority or who habitually negotiates deals from abroad; revenue-generating roles (sales, business development, client management) based in the host country; and founders or key executives running essential functions from a home office abroad. The OECD is explicit that if one person essentially is the business and operates from a foreign country, that home office will very likely be treated as a place of business.

When they're lower-risk: support, admin, and genuinely auxiliary roles; people working remotely for personal reasons (family, lifestyle) with no business-driven reason to be there; and occasional client visits like quarterly meetings.

The catch: not every country accepts the OECD's safe harbor — India rejected it outright

The 50% safe harbor is only as good as the country that honors it, and India formally reserved against it. In its position on the 2025 Update, India recorded a reservation against both the 50% quantitative test and the commercial-reason test. Instead, India can treat an employee's home as being “at the disposal” of the foreign enterprise — and therefore a place of business — under its own stricter tests (stability, productivity, dependence).

The practical takeaway: if your remote worker is in India, don't rely on the OECD 50% threshold — it doesn't apply. For what India actually applies, and how to structure around it, see our India PE guide. Other non-OECD and high-enforcement jurisdictions may deviate too — always check the specific treaty and local law for every country where your remote workers sit.

One senior hire working from a country you have no entity in can be enough on its own. Our guide to managing a remote team covers the operating side, and the remote workforce models companies use covers the structural options. Right-to-work sits next to this: here is why work authorisation matters before day one.

What are the consequences of triggering permanent establishment?

Crossing the PE line does far more than add one tax bill. The obligations cascade.

• Corporate income tax on attributable profits. A PE is generally taxed on the profits attributable to it, at the host country's corporate income tax rate — which varies widely by country. Only the profits attributable to the PE are taxed, not your global income.
• Retroactive assessments, penalties, and interest. Assessments can reach back years — you owe from when the PE was created, not from when it was discovered, plus interest and penalties.
• Cascading compliance. A PE typically triggers local registration, compliant accounting records, VAT/GST obligations, payroll-tax registration, withholding, and social-security contributions. One unplanned PE can snowball into a full local compliance operation.
• Double taxation. If both countries tax the same income, you can pay twice. Treaties give relief — but only if you knew about the PE and kept proper records, which unintentional PEs rarely do.
• Reputational damage and scrutiny. Once flagged in one country, expect closer attention to your operations everywhere else.

Illustrative scenario: a US software company lets a senior sales executive relocate to Germany and keep her role — regularly meeting clients and finalizing agreements. Eighteen months in, a German audit identifies a PE: corporate tax on German sales, retroactive VAT, penalties, and a requirement to register a branch.

Back taxes are rarely the only bill. Read how compliance is managed across markets with an EOR and our HR legal compliance checklist, because exposure is always cheaper to fix before it is discovered than after. If you suspect it already exists, an EOR compliance audit is how you size it, and workplace compliance for employers covers the day-to-day discipline that stops it recurring.

How do you avoid permanent establishment risk?

There's no single fix. The right approach depends on your objectives, risk tolerance, and how deep your operations run in the country. Most companies need a combination of the following.

1. Use an Employer of Record (EOR) for foreign hires. The most common practical route to hire in a country without creating a direct taxable presence. The EOR is the legal employer — it handles payroll, tax withholding, social security, and local employment compliance — while you direct the day-to-day work.

The honest caveat competitors skip: an EOR reduces PE risk; it does not eliminate it. It cleanly removes the employment footprint. It does not neutralize a foreign employee who closes deals (dependent-agent PE), an office you lease in your own name (fixed-place PE), or control-heavy supervision of local operations. If your operation looks like a branch in everything but name, tax authorities can look straight past the EOR. EOR is best for small teams, market testing, and hires that are genuinely delivery-focused.

2. Limit contract-signing authority abroad. The direct fix for dependent-agent PE. Keep contract approvals, pricing, and deal sign-offs centralized at home. If you have sales staff abroad, structure roles so they negotiate but don't conclude — and document it in contracts and policy.

3. Structure roles as genuinely auxiliary, not core. Revenue-generating roles carry far more risk than support roles. Where you can, make foreign roles genuinely preparatory or auxiliary — and remember that after BEPS Action 7, authorities look at what people do, not their titles.

4. Monitor duration. Set policies capping how long employees work in a foreign country, require pre-approval for relocations (even temporary), and track cumulative days per person per country. Rotate people before thresholds (90/183 days, or whatever the treaty says) on project-based work.

5. Use independent contractors carefully. A genuinely independent contractor — multiple clients, control over their own work, no authority to bind you — generally doesn't create PE. But misclassification makes things worse, not better, and many tax authorities (India among the most aggressive) reclassify dependent contractors as employees.

6. Establish a local subsidiary for substantial operations. For deep, long-term operations, a subsidiary can be the cleanest path — its own filings, its own compliance. Caveat: a subsidiary does not automatically shield the parent. If subsidiary staff act as the parent's dependent agents, or parent staff use subsidiary premises as a fixed base, the parent can still pick up a PE independently.

7. Document everything. Written contracts defining scope, authority limits, and location of services; time logs of presence per country; board resolutions showing where decisions are actually made. If your PE status is ever challenged, documentation is your defense.

The cleanest structural answer is employing through a local employer of record, and here is how that works mechanically. Our guide to hiring international employees sets out the full sequence. Payment routing matters just as much: how to pay international employees without creating a taxable presence, and what global payroll services do and do not cover. A PEO does not solve PE the way an EOR does, so the difference is worth understanding before you pick. For the wider view, see EOR risk management across legal, financial and operational exposure, then run the permanent establishment risk quiz against your current setup.

How Wisemonk helps you hire in India without PE exposure

If you're hiring in India specifically, Wisemonk handles this exact problem. Your employees work under our India entity, not yours: we become the Employer of Record, running payroll, statutory contributions, and local compliance, so your parent company stays off the Indian tax registration map.

If you are shortlisting providers, our checklist on how to choose an Employer of Record covers what to ask and what to verify. Costs are laid out in our EOR pricing and cost breakdown, and what EOR implementation looks like takes you from signature to first payroll.

We've helped 300+ companies from the US, UK, France, Canada, and beyond build teams in India, and we manage $20M+ in payroll for 2,000+ employees — with 24–48 hour onboarding and flat-fee pricing.

One honest note, the same one we make above: an EOR handles the employment and payroll footprint, not every PE trigger. Sales-closing roles, leases in your own name, and control-heavy supervision still need structuring on your side. For the full India picture — case law, the tax math, and the mitigation playbook — read our India permanent establishment guide.