If you are looking for how to avoid Permanent Establishment Risk and don’t know how a Single Remote Hire Can Create an Unplanned Tax Bill, compliance risk, then this PE risk guide is for you.
Most companies think about global hiring compliance in terms of payroll and labor law. Fewer think about permanent establishment risk — and that’s exactly why it’s become one of the most expensive blind spots in international expansion.
A single remote employee, hired with good intentions and zero local office, can create a taxable corporate presence in a country your finance team never planned to file taxes in.
This isn’t a hypothetical.
In February 2026, an Indian tax tribunal set aside a ₹3,960 crore (roughly US$475 million) tax demand against Booking.com that hinged entirely on whether the company had created a permanent establishment in India. The demand was ultimately overturned — but the exposure was real, and the case shows exactly how much is at stake when this goes wrong.
This guide breaks down what PE risk actually is, the legal tests regulators use, real 2025–2026 enforcement activity, a practical framework for reducing your exposure, and how an Employer of Record like Deel fits in — including where EOR protection has limits that most vendor content glosses over.
Let’s get into details.
Disclosure: This post contains affiliate links. We may earn a commission at no extra cost to you.
What Permanent Establishment Risk Actually Means
Permanent establishment (PE) is a tax concept, not an employment one.
Under nearly every bilateral tax treaty in the world — most based on the OECD Model Tax Convention — a foreign company only becomes liable for corporate income tax in a country if it has established a “permanent establishment” there.
No PE means the country generally cannot tax your global profits; a PE means a portion of your income becomes taxable there, often with penalties and interest layered on top.
The problem is that PE isn’t triggered by intent — it’s triggered by conduct.
You don’t need an office, a subsidiary, or a formal decision to expand. A single remote hire can trigger permanent establishment exposure well before your finance team even identifies the corporate tax issue, with payroll teams increasingly functioning as the early-warning system for this kind of risk.
Three PE Tests Under the OECD Model (Article 5)
Article 5 of the OECD Model Tax Convention sets out three core tests for determining whether a foreign company has created a taxable business presence, a Permanent Establishment (PE), in another country
Three-Part Test for Fixed Place PE
Not every physical location abroad creates a PE. Under Article 5(1), a location only qualifies once it passes three distinct conditions, as outlined in expert analysis from Taxmann and Mauve Group:
Note: All three conditions have to be met simultaneously.
A recurring physical presence that fails any one of them — say, a location the company doesn’t actually control, or one used only for storage — generally falls short of fixed-place PE.
Three Categories of PE Under Article 5 Are
Separately, Article 5 also defines three broad routes through which a PE can form, as Global Wealth Protection’s breakdown of the OECD Model lays out:
This is the layer most relevant to distributed teams: a company can fail the fixed-place test entirely — no office, no warehouse, nothing physical — and still create a PE purely through what a remote employee is authorised and habitually able to do.
Exceptions Regulators Actually Recognise
Not every foreign activity creates a PE. Most tax treaties exclude genuinely preparatory or auxiliary activities — using a facility solely to purchase goods, store inventory, or gather information — since none of these directly generate revenue.
The catch: the burden of proof sits with the company. If challenged, you need to show the activity was truly auxiliary, not a disguised revenue function — which is why documenting what a role actually does, not just its title, matters.
A newer, less settled concept is virtual permanent establishment: the idea that a company can create a taxable digital presence in a country with no physical footprint at all, purely through the scale of its remote activity there. It’s still evolving and not uniformly codified — but worth watching if you serve customers or run revenue-generating remote staff in a market where you have no physical presence.
Real 2025–2026 Enforcement: The Line Is Moving Fast
PE enforcement isn’t static, and recent case law shows regulators actively tightening the standard rather than relaxing it.
Between mid-2025 and early 2026, a cluster of Indian tribunal and Supreme Court rulings reshaped how dependent-agent and fixed-place PE are assessed:
The throughline: tax authorities are increasingly rewarding substance and clean organisational structure while punishing arrangements that functionally look like a disguised local presence, regardless of how the paperwork is labelled.
This isn’t confined to India — tax authorities in Germany and Australia have similarly scrutinised EOR arrangements where an employee’s day-to-day activities resemble those of a full company representative.
How to Avoid Permanent Establishment Risk | A Practical Framework
PE risk is manageable, but only with deliberate structure — not by accident. Here’s a working checklist for assessing and reducing exposure before it becomes a tax authority’s problem to define for you.
Before creating a role in a new country, ask explicitly: can this person conclude, negotiate, or bind the company to contracts? If yes, that role carries elevated dependent-agent PE risk, no matter what employment structure sits underneath it. Keep final contract-signing authority with an entity outside the country wherever the role allows it.
Back-office, engineering, design, and internal support functions carry materially lower PE risk than sales, business development, or country-leadership roles that close deals or set local strategy. Write this distinction into job descriptions and internal documentation, because regulators look at what the role actually does, not its title.
If your business involves consulting, implementation, or technical services delivered in-country, monitor days spent on the ground against the specific treaty’s service-PE threshold. Thresholds vary by treaty — there’s no universal day count — so this needs to be checked per country, not assumed.
A recurring home-office setup used for client meetings, a consistent co-working desk, or a semi-permanent mailing address and local bank account can all read as a fixed place of business over time, even without an official office lease.
If a location is being used repeatedly and systematically to conduct business, treat it as a PE risk signal.
Dependent-agent and service-PE language differs meaningfully by treaty, and some include specific exemptions or safe harbours for certain activities or revenue types. Generic PE guidance is a starting point, not a substitute for checking the actual treaty language between your home country and the target market.
Regulators are now explicitly testing for this pattern — splitting a function across multiple legal entities or jurisdictions specifically to avoid crossing a PE threshold is increasingly treated as a red flag rather than a legitimate structuring choice.
Employing workers through an EOR’s local entity, or engaging contractors through an Agent of Record, removes the direct employment relationship that most commonly triggers fixed-place and employee-driven PE exposure.
It is not a complete shield, but it is a legitimate and widely used first line of defence, particularly for early-stage market entry where setting up a full subsidiary isn’t yet justified.
A support hire who gradually takes on client-facing responsibility, or a contractor whose scope quietly expands into ongoing exclusive work, can drift into PE-relevant territory without anyone deciding it should. Build a periodic review — annually at minimum, or whenever a role’s scope changes — rather than treating the initial hiring decision as a one-time compliance check.
Does an EOR Create or Protect Against Permanent Establishment?
This is where most vendor content oversimplifies.
The honest answer: an EOR meaningfully reduces PE risk, but it is not an absolute shield.
The core premise of an EOR arrangement is legal separation — the EOR entity, not your company, is the legal employer in the foreign country, so your company has no direct local employment relationship there.
That removes the most common trigger for fixed-place and employment-based PE exposure, since the worker is not, on paper, your employee at all.
But dependent-agent PE is different because it’s about conduct, not payroll structure. If an EOR-employed worker negotiates contracts, commits your company to obligations, maintains a fixed office under your company’s name, or represents your company at official meetings, the PE protection an EOR provides weakens considerably — the legal structure doesn’t override the substance of the economic activity.
Putting a country manager who closes six-figure deals on an EOR’s payroll does not, by itself, eliminate the tax exposure created by that person habitually signing contracts on your behalf.
This is the nuance Deel’s own compliance guidance reflects. The structure used to employ people in a foreign market is the first line of defence — EOR removes the direct employment relationship that commonly triggers PE, because workers are employed through Deel’s local entities rather than the client’s own.
But the most common source of unexpected PE exposure isn’t a fixed office at all — it’s an employee or agent whose role quietly crosses into contract authority or revenue-generating activity in a foreign market, which is why role design matters as much as the employment vehicle itself.
Worth noting too: even a subsidiary doesn’t automatically resolve the question. A locally incorporated subsidiary is generally its own taxable entity subject to local corporate tax regardless of PE status — but under certain conditions, a parent company can still be deemed to have its own separate PE through a subsidiary’s activities if the subsidiary is effectively acting as its dependent agent.
Structure alone never fully substitutes for how the relationship actually functions in practice.
Where Deel Fits
Deel doesn’t eliminate PE risk with a checkbox — no vendor honestly can — but it materially reduces your exposure and gives you the infrastructure to manage what remains.
By employing your international team through Deel’s own local entities, you avoid the direct employment relationship that most commonly triggers fixed-place and employee-driven PE exposure, without the cost or multi-month timeline of setting up your own subsidiary.
For roles that carry genuine contract-authority or revenue-closing responsibility — the roles regulators scrutinise most — Deel’s in-house legal, tax, and compliance network can help you structure the engagement, map decision-making authority correctly, and flag when a market has crossed the threshold where a local entity, not an EOR, becomes the right call.
Don’t know more about Deel? Read my below detail Deel Overview
See how Deel helps structure international hires to manage permanent establishment exposure → [Book a Demo with Deel team]
