Labour law · 12 August 2026 · 16 min read

Employer of Record Risks: What U.S. Companies Must Know

Hands sorting compliance documents at office table

An Employer of Record (EOR) transfers significant administrative obligations — payroll, statutory filings, local employment contracts — but it does not transfer all legal, tax, or operational exposure to your company. Several categories of risk remain firmly with you, the hiring company, regardless of what the EOR contract says.

Before you enter any commercial negotiation with an EOR provider, three actions reduce your exposure immediately:

  • Validate entity ownership. Confirm the provider owns or directly controls a licensed legal entity in the target country. Aggregator models that rely on undisclosed third-party partners multiply your compliance and data risk.
  • Request audited compliance evidence. Ask for audited payroll tax filings, statutory remittance records, and any available SOC 2 or ISO 27001 certification. Absence of these is a disqualifying signal, not a negotiating point.
  • Commission a scoped tax and employment law opinion. Before signing, ask your tax counsel to assess permanent establishment exposure and your employment counsel to review termination and IP assignment mechanics for the target jurisdiction.

Risks that typically remain with the hiring company even under a well-drafted EOR arrangement include co-employment and joint-employer exposure, permanent establishment (PE) risk, intellectual property ownership gaps, data privacy liability, and payroll error penalties that tax authorities may pursue against you directly.

Key Takeaways

EOR arrangements reduce administrative burden but leave co-employment, PE, IP, data, and payroll-penalty exposure with the hiring company unless each risk is contractually allocated before signing.

Point Details
Verify entity ownership first Confirm the EOR owns a licensed local entity; aggregator models multiply compliance and data risk.
Demand IP assignment in both contracts Both the EOR service agreement and the employment contract must assign work product to your company.
Require indemnities and insurance Indemnity scope should cover statutory underpayments, tax penalties, and joint-employer claims, backed by EPL and professional liability certificates.
Scope transition support before signing Define employee transfer terms, data handover timelines, and escrowed payroll funds in the contract, not after a dispute arises.
Commission a scoped tax and employment law opinion Ask counsel to assess PE exposure, shadow-payroll obligations, and the earliest date a PE could be deemed to have arisen in the target jurisdiction.
Expandtosouthafrica for South Africa hires A licensed single-country EOR with BCEA-compliant contracts, flat-fee pricing, and CCMA-aware termination support reduces the most common EOR risks for South Africa hiring.

Table of Contents

The core employer of record risks you need to manage

Workday’s analysis of cross-border EOR arrangements finds that regulatory uncertainty affects a significant portion of markets, and that 31% of providers cite data privacy as a leading operational concern. Those numbers reflect a structural reality: risk does not fully transfer to the EOR. Exposure is frequently shared, and the hiring company often retains reputational and residual legal liability that must be contractually allocated before day one.

The table below maps each major risk category to its typical impact and the two contract-level mitigations that matter most.

Risk category Typical impact Top 2 contractual mitigations
Co-employment / joint-employer Back pay, benefits claims, wrongful-termination liability Behavioral control limits in MSA; indemnity clause covering joint-employer claims
Aggregator / partner model Inconsistent compliance, data leakage, unknown sub-processors Require proof of direct entity ownership; sub-processor disclosure and consent
Permanent establishment Corporate tax filing obligations in the employee’s country PE risk allocation clause; shadow-payroll trigger threshold
Tax & payroll liability IRS or foreign tax assessments, penalties, interest Audit rights over filings; tax indemnity covering client-side penalties
IP ownership gaps Loss of work-product rights to EOR or employee Dual assignment: EOR service agreement + employment contract
Statutory entitlements Underpaid severance, missed benefits, tribunal claims Local-law compliance warranty; indemnity for statutory underpayments
Data privacy & security Regulatory fines, data breach liability DPA with data residency terms; SOC 2 / ISO 27001 certification requirement
Service quality / SLA Payroll delays, misfiled taxes, employee dissatisfaction SLA with financial remedies; payroll error cure period and escalation path
Insurance gaps Uninsured workers’ comp or EPL claims Certificate of insurance for workers’ comp, EPL, and professional liability
Immigration / work authorization Unauthorized work, visa violations, deportation risk Sponsorship capability confirmation; immigration compliance warranty
Employee experience Attrition, employer brand damage Named HR contact; benefit parity commitment
EOR financial solvency Payroll interruption, employee claims against client Escrowed payroll funds; transition assistance clause

Pro Tip: The due-diligence metric most buyers miss is the provider’s statutory remittance lag. Ask for evidence that PAYE, social contributions, and other employer taxes are remitted on the statutory due date, not on the day the provider receives your invoice. A provider who remits late is creating penalty exposure in your name.

Co-employment and joint-employer risk

U.S. courts and regulators examine the substance of the employment relationship, not just its contractual label. Established control-test precedent means that if your company directs the day-to-day work of an EOR-employed worker — setting hours, assigning tasks, managing performance — regulators may treat you as a joint employer. The consequences include exposure to wage-and-hour claims, benefits obligations, and wrongful-termination suits filed directly against your company.

Aggregator and partner model risk

Many global EOR platforms do not own local entities in every country they serve. They contract with local partners, which introduces a layer of compliance and data risk you cannot directly audit. Charles Russell Speechlys warns that EOR regulatory treatment varies widely by jurisdiction, and that in some markets, labor-leasing arrangements can be unlawful or tightly restricted. If your provider’s local partner is non-compliant, the exposure lands on you.

Permanent establishment and shadow payroll

An employee working in a foreign country can create a taxable presence for your company in that country, even when the EOR is the legal employer. Workday’s cross-border analysis notes that PE concerns arise in a material share of markets for EOR arrangements. Shadow payroll — a parallel payroll calculation run in the employee’s home country to satisfy local tax reporting — may be required even when the EOR handles the actual payment.

IP and invention-assignment risk

Because the EOR is the formal legal employer, it may hold default ownership of employee-created intellectual property under local law unless the service agreement and the employment contract both contain explicit assignment language. Charles Russell Speechlys advises that IP assignment enforceability varies by jurisdiction and that direct assignment agreements or consultancy agreements may be needed alongside the EOR employment contract.

Data privacy and security

Your employees’ personal data flows through the EOR’s systems, which means your company shares accountability for how that data is stored, processed, and transferred. Require a data processing addendum (DPA) that specifies data residency, sub-processor disclosure, breach notification timelines, and the provider’s certification status. Consent management controls for professional services contexts, such as those offered by ConsentStack, can help you document and enforce data processing boundaries.

Employment law, statutory entitlements, and termination

PwC’s analysis emphasizes that termination, local labor-leasing restrictions, and IP protections require careful legal drafting and local advice. Statutory notice periods, severance calculations, and mandatory benefits differ significantly across jurisdictions. An EOR that miscalculates severance or misses a mandatory consultation step can expose your company to tribunal claims, even if the EOR indemnifies you in theory.

Insurance coverage gaps

Standard EOR agreements do not automatically include workers’ compensation coverage, employer’s practices liability (EPL) insurance, or professional liability insurance at levels adequate for your risk profile. Request certificates of insurance before signing and confirm that coverage extends to claims brought by the EOR-employed worker against your company.

Hands holding insurance certificate over desk

Financial solvency of the EOR

If your EOR provider becomes insolvent, payroll stops. Employees may pursue claims against your company as the economic beneficiary of their work. Require escrowed payroll funds covering at least one pay cycle and a contractual transition assistance obligation that survives termination of the agreement.

The IRS, the Department of Labor (DOL), and state-level unemployment and workers’ compensation regulators each have independent enforcement pathways that can reach your company even when an EOR is the legal employer of record.

The IRS does not automatically accept the EOR structure as a complete transfer of payroll tax responsibility. If the EOR misfiled or failed to remit withholding taxes, the IRS can assess failure-to-pay penalties and interest against the party it determines had control over the funds. Payroll errors compound over time; back-tax assessments can cover multiple years and include both the unpaid tax and accrued penalties.

The DOL enforces the Fair Labor Standards Act (FLSA) using an economic reality test that looks at behavioral control, investment, and profit-and-loss exposure. A U.S. company that directs an EOR worker’s daily tasks may be found to be a joint employer under FLSA, making it liable for minimum wage, overtime, and record-keeping violations regardless of the EOR contract.

State unemployment agencies can issue chargebacks against your company’s unemployment insurance account if a former EOR worker files a successful claim and the state determines you were the functional employer. State workers’ compensation regulators apply similar logic: if your company directed the work and the EOR’s coverage lapses, your company may be the responsible party.

On the outbound side, U.S. companies hiring internationally through an EOR must assess whether the employee’s activities create a PE in the employee’s country. A PE can trigger corporate income tax filing obligations, transfer pricing requirements, and in some cases retroactive tax assessments covering the period since the employee started work. Shadow payroll mechanics — running a parallel payroll calculation in the employee’s country to satisfy local income tax reporting — may be required even when no actual payment flows through that country.

Pro Tip: Commission a scoped tax opinion before the first hire in any new country. The opinion should answer three narrow questions: (1) Does this role and its activities create PE risk for our company? (2) What shadow-payroll or withholding obligations apply to us directly? (3) What is the earliest date a PE could be deemed to have arisen? A broad “EOR eliminates PE risk” statement from a vendor is not a substitute for a jurisdiction-specific legal opinion.

What to insist on before you sign with any EOR

A structured due-diligence process protects you at the procurement stage. Work through these items in priority order before any contract is executed.

  1. Entity ownership and licensing. Request the certificate of incorporation and operating license for the local entity that will employ your workers. If the provider uses a partner, require the partner agreement and confirm the partner’s compliance track record.
  2. Audited payroll and tax filings. Ask for at least two years of audited statutory remittance records for the target jurisdiction. Gaps or delays in remittance are a direct indicator of future penalty exposure.
  3. SOC 2 Type II or ISO 27001 certification. Request the current certification report, not a self-attestation. Confirm the scope covers the systems that will process your employees’ data.
  4. Insurance certificates. Require certificates for workers’ compensation, EPL, and professional liability. Confirm coverage limits and that your company is named as an additional insured where applicable.
  5. Indemnity scope and cap. The indemnity should cover statutory underpayments, tax penalties, data breaches, and joint-employer claims. Negotiate a cap that reflects your realistic worst-case exposure, and push for carve-outs that remove the cap for fraud or willful misconduct.
  6. IP assignment language. Confirm that both the EOR service agreement and the employment contract contain explicit, irrevocable assignment of all work product to your company. Review local-law enforceability with counsel.
  7. Data processing addendum. The DPA must specify data residency, sub-processor names, breach notification timelines (72 hours is the GDPR standard and a reasonable benchmark), and your right to audit data handling.
  8. Transition assistance and exit mechanics. Define what happens if you terminate the EOR relationship: employee transfer terms, cost of transfer, data handover timeline, and the provider’s obligation to cooperate with a successor EOR or your own entity.
  9. Audit rights and SLA remedies. Require the right to audit payroll records and tax filings annually. SLA remedies should include financial credits for payroll errors and a defined cure period.
  10. Immigration and sponsorship capabilities. If any role may require a work permit or visa, confirm the provider can sponsor or support the application in the target country. An EOR that cannot sponsor work authorization cannot legally employ the worker.

Pro Tip: *When negotiating, prioritize indemnity scope and insurance coverage over price concessions. A provider that resists a broad indemnity or cannot produce insurance certificates is signaling that it does not expect to be held accountable for errors.

Questions to ask during vendor sales calls that quickly reveal sophistication and entity ownership:

  • “Show me the certificate of incorporation for the entity that will sign the employment contract.”
  • “What is your average statutory remittance lag versus the legal due date in this jurisdiction?”
  • “Walk me through your process when a payroll tax filing is rejected by the local authority.”
  • “Who are your sub-processors for payroll data, and can I see your sub-processor list?”

Ongoing governance to keep EOR risk under control after signing

Signing a well-drafted contract is the start, not the finish. The following quarterly governance practices reduce the chance that an EOR relationship produces surprises.

Payroll and tax reconciliation. Each month, reconcile the EOR’s payroll report against your HRIS and finance systems. Confirm that gross-to-net calculations match the employment contract, that statutory deductions are correct, and that remittance dates align with local legal deadlines. The EOR pricing comparison tool from Expandtosouthafrica illustrates how hidden markups and deposit amortization can inflate total employer cost over time — monthly reconciliation catches these before they compound.

Shadow-payroll and PE monitoring. If any employee’s role has changed scope, confirm quarterly that the PE risk assessment remains valid. A worker who moves from a support function to a business development role may cross the PE threshold without triggering an automatic review.

Data access and RBAC audits. Review role-based access controls for EOR platform users at least quarterly. Terminate access for departed employees and confirm that the EOR’s own staff access is limited to what is necessary for payroll processing.

SLA scorecards. Track payroll accuracy rates, on-time filing rates, and response times against the SLA. Escalate breaches in writing to preserve your contractual remedies.

Contingency planning for vendor failure. Maintain a documented transition plan that includes: the name of a backup EOR provider, the steps to transfer employees, the timeline for data handover, and the source of escrowed payroll funds to cover at least one pay cycle if the provider fails. Review and test this plan annually.

Pro Tip: Reconcile total cost of employment monthly, not just the EOR invoice. Include employer social contributions, any deposit or setup amortization, and currency conversion costs. Providers who bundle these into a single line item are obscuring the true cost of each hire.

Ongoing governance to keep EOR risk under control after signing — overview diagram

When an EOR is the right move — and when to reconsider

EOR arrangements work well in a specific set of circumstances: you need to hire quickly in a new market, your headcount in that country is small (typically fewer than five to ten employees), and the engagement is intended as a market test rather than a permanent operational base. The model’s speed advantage — days to onboarding versus months for entity setup — is real and valuable in those conditions.

The case for reconsidering grows as headcount rises, as employees take on roles that involve signing contracts, holding inventory, or making binding decisions on behalf of your company. Each of those activities increases PE risk. Executive roles, in particular, can create PE exposure that no EOR contract can fully neutralize.

EOR adoption accelerated sharply after COVID-19 as companies built distributed teams, but the model is most effective as a tactical, short-to-medium-term solution. When your per-country headcount reaches a threshold where the monthly EOR fee exceeds the annualized cost of entity setup and local HR, the economics favor a local entity. That threshold varies by country but is commonly reached at a low single-digit headcount in many jurisdictions.

Employer branding is a subtler consideration. Workers employed through an EOR are legally employed by a third party, which can affect their sense of belonging and your ability to offer equity or certain benefits directly. For roles where talent retention is critical, the EOR structure may create friction that a direct employment relationship would not.

For South Africa specifically, the combination of a favorable time zone (±1 hour from CET), a deep pool of skilled professionals, and salary levels that are often substantially below comparable UK or EU roles make it one of the compelling EOR markets for international companies. The complete guide to EOR in South Africa covers the specific BCEA, LRA, and COIDA obligations that apply when you hire there.

Hiring in South Africa? Expandtosouthafrica reduces these risks by design

Expandtosouthafrica is the publisher of this article and a South Africa-only EOR provider. That single-country focus is the core risk mitigation: every compliance control, every statutory filing, and every employment contract is built for South Africa, not adapted from a 150-country template.

Expandtosouthafrica

Specific controls that address the risks covered above: employment is delivered through a licensed local South African entity (not an aggregator partner), with BCEA-compliant contracts, ZAR payroll, and all statutory filings including PAYE (EMP201 with SARS), UIF, SDL, and COIDA. Data is handled under both POPIA and GDPR with EU data residency. Pricing is a flat fee of €350 / $399 / £299 per employee per month with no setup fees or FX loading, which makes monthly cost reconciliation straightforward. CCMA-aware termination support is included, and free transfers from other EOR providers mean exit costs are not a barrier to switching.

To evaluate Expandtosouthafrica during procurement, request: the local entity certificate of incorporation, a sample BCEA-compliant employment contract, the data processing addendum, and the insurance certificate. All are available on request. Visit the EOR services page to request documentation or get a cost estimate for your South Africa headcount.

An editorial perspective on EOR risk: what the standard advice gets wrong

Most EOR risk guides focus on what the provider should do. The more useful question is what you, the hiring company, must do regardless of what the provider promises.

The standard advice — “choose a reputable provider” and “read the contract carefully” — understates the structural problem. An EOR contract is a private agreement between two parties. The IRS, the DOL, and foreign tax authorities are not parties to it. When a regulator assesses a penalty or a court finds joint-employer liability, your indemnity clause is a claim you can pursue against the EOR after the fact. It does not prevent the assessment or the judgment from landing on your balance sheet first.

The implication is that due diligence must be treated as a compliance exercise, not a vendor selection exercise. The questions that matter most — Does this provider own the local entity? Can they produce audited remittance records? What happens to my employees’ data if they are acquired? — are not questions most procurement teams ask because they feel adversarial. They are adversarial. That is the point.

There is also a category of risk that almost no guide addresses: the risk of the EOR relationship working exactly as designed for two years and then creating a PE problem in year three when the employee’s role evolves. Governance does not end at signing. The PE risk assessment, the shadow-payroll check, and the IP assignment review need to be on a recurring calendar, not a one-time checklist.

The EOR model is genuinely useful. For market testing, for speed, for small headcounts in jurisdictions where entity setup is slow or expensive, it is often the right call. The mistake is treating it as a compliance transfer rather than a compliance partnership. Your exposure is reduced, not eliminated. Plan accordingly.

Sources

The following references support procurement, legal review, and tax opinion requests related to EOR arrangements.

This article provides general information about EOR risks and is not a substitute for legal, tax, or employment law advice. Confirm current rules and your specific exposure with qualified counsel before engaging any EOR provider.