Permanent establishment (PE) risk can build long before a company opens an office. Learn how remote work, local authority and commercial activity can create hidden exposure across distributed teams.
Key takeaways
- New OECD guidance provides greater clarity on when cross-border remote work may create a fixed-place PE.
- Working from a foreign home for less than 50% of total working time over the relevant 12-month measurement period generally does not, on its own, create a ‘place of business’ under the updated OECD commentary.
- Reaching the 50% benchmark does not automatically create a PE. The facts and circumstances, including the commercial reason for working there, also matter.
- Fixed-place PE is only part of the picture. Employees with local commercial authority can create separate dependent-agent PE risk.
- PE exposure often builds through combinations of workforce location, local authority and commercial activity.
- CFOs need visibility across HR, payroll, tax and legal data to identify higher-risk markets before exposure grows.
- Going into 2027, companies need a governance model that can account for different treaty positions and local requirements across markets.
Is your distributed team creating a tax presence you cannot see?
A company does not need to open an office to start building a presence in another country.
An employee begins working remotely from abroad. A sales leader starts developing local customers. Headcount grows. Someone gains authority to negotiate commercial terms. Payroll or employment requirements begin to emerge.
Individually, those decisions can look operational. Together, they can change the company’s tax position.
Permanent establishment generally refers to a sufficient business presence in another jurisdiction that can give that jurisdiction taxing rights over certain business profits. An unintended PE can also bring registration, filing and other compliance requirements.
For distributed teams, that exposure can develop without a deliberate market-entry decision.
The issue is no longer limited to whether the company has leased an office or incorporated an entity. Finance teams need to understand where people are working, what they are doing there and how those activities connect to the company’s commercial operations.
By the time a tax authority, auditor or adviser identifies the problem, the underlying activity may have been taking place for months or years. This is why PE risk is now an operating-model issue, not simply a tax question.
What changed for remote-work PE risk in 2026?
Cross-border remote work has challenged traditional assumptions about what constitutes a company’s business presence.
The OECD provided greater clarity in November 2025 when it updated the Commentary on Article 5 of its Model Tax Convention. The changes specifically address when an individual’s home or another location used for cross-border remote work can constitute a place of business for their employer.
The guidance matters in 2026 because it gives companies a more structured way to assess remote-work arrangements.
But the updated Commentary does not itself amend existing tax treaties or domestic law.
It can inform the interpretation of treaty provisions based on the OECD Model. However, companies still need to consider the applicable treaty, domestic rules, local interpretation and the facts of each arrangement.
For CFOs, the update provides a better starting point for asking whether a remote employee’s location is becoming part of the company’s operating footprint.
The 50% working-time threshold provides an important benchmark
Time spent working from another country now has a clearer role in the OECD’s fixed-place analysis.
As a general rule under the updated commentary, a home or similar location would generally not constitute a place of business of the enterprise where an individual works there for less than 50% of their total working time for that enterprise over any 12-month period commencing or ending in the fiscal year concerned.
That gives companies a useful benchmark. It is not, however, a universal 50% safe harbor against PE risk.
The guidance relates specifically to whether a home or similar location can constitute a place of business under the fixed-place PE analysis. Other PE rules and local requirements may still apply.
The calculation should reflect the employee’s actual conduct during the relevant period rather than relying only on contracts or remote-work policies.
For distributed teams, that makes workforce location data increasingly important.
A company cannot assess cross-border working risk accurately if it does not know where its employees are actually working.
Crossing 50% does not automatically create a PE
An employee spending at least half of their working time from a home or similar location abroad does not automatically turn that location into a permanent establishment.
The analysis then considers whether there is a commercial reason for the employee’s activities to be carried out from that country.
Two employees can spend the same amount of time working from the same foreign market and create very different risk profiles.
One works there because of a personal preference that the employer accommodates.
The other works there to develop customers, support a local operation or perform activities connected to the company’s business in that market.
The working-time pattern may look similar. The commercial context does not.
The updated framework therefore puts greater emphasis on what is actually happening in the market, rather than relying on the remote-work arrangement alone.
A practical way to think about the updated framework
| Question | What to assess |
| How much time is spent working from the foreign location? | Whether the employee works there for less than or at least 50% of total working time over the relevant 12-month period |
| Why is the employee working there? | Whether the location primarily reflects personal preference or serves a commercial purpose for the business |
| What activities take place there? | The employee’s actual role, responsibilities and connection to business activity in the market |
| What other PE rules may apply? | Whether commercial authority or other activities create separate PE considerations |
The framework creates greater clarity around remote work. It does not eliminate the need for country-specific analysis.
Fixed-place PE is only one part of the risk
The OECD’s updated remote-work guidance focuses on when a home or other location may constitute a fixed place of business.
But location is only one part of the PE analysis.
Distributed teams can also create dependent-agent PE risk through the commercial activities employees perform in a market, even when the company has no traditional office there.
That makes authority particularly important.
CFOs should understand whether employees negotiate commercial terms, play a central role in securing contracts, develop local customers or otherwise represent the business in the market.
Tracking remote-work days alone will not reveal that exposure.
The more closely an employee’s activities connect the company to the local market, the more important a formal PE assessment becomes.
Where someone works matters. What they do there can matter even more.
PE risk often sits in the combination, not the individual trigger
No single data point tells the whole story.
An employee’s location may appear low risk on its own. So might a payroll registration, a small amount of local revenue or limited commercial authority.
When several of those conditions begin appearing in the same market, the company’s exposure can change.
A practical assessment should therefore look across four dimensions.
Four signals CFOs should monitor
| Signal | What to monitor | Why it matters |
| Location | Where employees actually work and how frequently | Reveals recurring or concentrated presence |
| Authority | Contract negotiation, commercial decision-making and role in securing business | Can indicate dependent-agent PE exposure |
| Payroll and employment | Registrations, employer obligations and local workforce growth | Shows increasing operational connection to the market |
| Commercial activity | Customers, revenue and business development connected to the country | Helps determine how closely employee activity serves the local market |
Those signals often sit across different functions. HR sees employee location, payroll sees registrations, finance sees revenue and legal may see commercial authority. CFOs need enough cross-functional visibility to recognize when those facts converge and formal tax or legal review is warranted.
A market with one remote employee and no commercial activity may require monitoring. A market with growing headcount, payroll obligations, local customers and employees exercising commercial authority deserves a much closer look.
The more signals that converge in one country, the harder it becomes to treat them as isolated events.
Set escalation points before a market becomes high risk
Monitoring only helps if someone knows when to act.
Companies should establish clear triggers for escalating a market to tax, legal or other appropriate advisers.
Those triggers can include:
- A material increase in remote headcount or plans to hire additional employees
- Employees approaching or exceeding relevant working-time thresholds
- New authority to negotiate or influence commercial arrangements
- Growing local customer or revenue activity
- New payroll or employer registrations
- Temporary remote-work arrangements becoming recurring or permanent
Not every trigger means a PE exists. It means the facts deserve another look.
If the company waits until a market has substantial headcount, revenue and local commercial activity, the question may no longer be whether the operating model needs attention.
The question may be how quickly the business can bring that model under control.
When PE risk rises, the operating structure may need to change
Identifying elevated PE risk does not automatically mean the company needs to establish an entity.
It does mean the current structure should be reassessed.
Depending on the market, workforce and business activity, the company may need to reconsider how employees are engaged, how commercial authority is structured or whether a more formal local presence is appropriate. Options may include adjusting workforce arrangements, using an Employer of Record (EOR) or establishing a local entity.
The right response depends on what is driving the risk.
If the issue is an isolated remote-work arrangement, tighter policies or a change in working pattern may be enough.
If the company is intentionally building a workforce and customer base in the market, the risk may be telling leadership something more fundamental.
The operating structure may no longer match the business the company has built.
What should CFOs watch heading into 2027?
The OECD’s updated commentary provides greater clarity, but it does not create one global standard for remote-work PE risk.
Countries may interpret treaty provisions differently, domestic tax rules still matter and existing treaties may not reflect the latest OECD commentary in the same way or at the same time.
That makes 2027 less about applying one new global rule and more about managing differences across markets.
CFOs need a consistent internal framework for tracking workforce location, reviewing commercial activity and escalating higher-risk arrangements. Country-specific tax and legal analysis can then determine how those principles apply locally.
Turn PE monitoring into an operating process
PE risk cannot be managed effectively through an annual tax review alone.
Distributed teams change too quickly. Employees relocate. Roles evolve. Markets expand. Commercial activity develops.
Companies need a repeatable process that connects those changes to tax and legal review when appropriate. That requires coordination across finance, HR, payroll and legal rather than treating PE as an isolated tax exercise.
A practical governance model can include:
| Control | What it should accomplish |
| Cross-border work approval | Identify international working arrangements before they begin |
| Location tracking | Maintain visibility into where employees actually work |
| Role review | Identify changes in commercial authority or responsibilities |
| Market-level monitoring | Connect headcount, payroll, customer and revenue activity |
| Escalation criteria | Define when tax or legal review is required |
| Periodic reassessment | Revisit arrangements as the underlying facts change |
The process does not need to treat every remote-work request as a tax emergency. It needs to identify the arrangements that warrant a closer look.
The earlier those signals become visible, the more options the business has to respond.
Frequently asked questions about PE risk
What is PE risk?
Permanent establishment arises when a company’s activities in another jurisdiction create a sufficient taxable business presence under the applicable rules.
Depending on the circumstances, that can result in corporate tax, registration, filing and other compliance obligations.
Can a remote employee create a permanent establishment?
Potentially.
Under the OECD’s updated commentary, cross-border home working can be relevant to fixed-place PE analysis depending on the employee’s working pattern and the commercial reasons for performing activities from that location. Other forms of PE, including dependent-agent PE, may also need to be considered.
Does working abroad for 50% of the time automatically create a PE?
No.
The 50% benchmark is relevant to the OECD commentary’s analysis of whether a home or similar location may constitute a place of business. It is measured based on total working time for the enterprise over the relevant 12-month period.
Reaching that level does not automatically establish a PE. The broader facts and circumstances, including whether there is a commercial reason for the employee’s presence in the country, also need to be considered.
Can PE risk exist without an office or entity?
Yes.
Distributed teams can create PE considerations without a traditional office or incorporated entity.
Employee location, commercial activity, authority and the broader relationship between the company and the market can all be relevant to the analysis.
Does using an EOR eliminate PE risk?
An EOR can help address employment-related requirements and allow a company to employ workers without immediately establishing its own local entity. It does not, however, eliminate PE or other corporate compliance considerations.
Companies may still need to assess corporate tax, transfer pricing, VAT and other registration or filing requirements based on their activities in the market. Employee responsibilities, commercial authority and local business activity can all remain relevant.
An EOR can therefore be one part of the operating structure, but it is not a blanket solution to PE, tax or wider corporate compliance exposure.
A distributed workforce needs distributed-risk visibility
Remote work has made international hiring easier. It has also made corporate presence harder to see.
A company can build meaningful activity in a market before anyone makes a formal decision to enter it. Employees relocate. Responsibilities expand. Customers appear. Temporary arrangements become permanent.
None of those developments should be viewed in isolation.
For CFOs, the opportunity is to connect the signals early enough to keep the business in control of what happens next.
That means knowing where employees work, understanding what they do there and recognizing when workforce activity starts to become business activity.
The biggest PE risk may not be the market you deliberately entered. It may be the one your business entered without realizing it.
Building distributed teams across multiple markets? Talk to us about creating an international operating model that gives your business greater visibility and control as it expands.
