Employer of record in Spain: permanent establishment risks to check first

An employer of record in Spain can be a sensible way to put a Spanish employment contract, payroll withholding and Social Security contributions in place without incorporating on day one. It is not, however, a tax shield. Permanent establishment risk is not decided by the label on the employment contract. It is decided by what the person in Spain actually does for the foreign company, who directs that work, what authority they exercise, and whether Spain has become a real place from which the business is carried on.

This distinction matters most for companies hiring their first based in Spain sales lead, country manager, senior engineer, founder or executive. The EOR may solve the labour administration layer while leaving the foreign company exposed to establecimiento permanente, effective-management, labour-assignment or Social Security questions. In some files, the cleaner answer is a narrow EOR arrangement. In others, it is a Spanish branch, a subsidiary, or a properly designed company formation in Spain with tax and payroll compliance aligned from the beginning.

The working question is not “Can we hire through an EOR?” It is “Can we defend that the Spanish person is not creating a taxable business presence for the foreign company?” That is a different file, and it has to be built before the first contract, job description and sales mandate are signed.

What an employer of record actually solves in Spain

An employer of record is useful because Spain is not a jurisdiction where payroll can be treated casually. A Spanish employment relationship normally requires a proper contract, payroll withholding, Social Security registration and contribution management, working-time compliance, vacation and termination handling, and the application of the relevant collective bargaining framework where one applies.

The Social Security layer is particularly formal. The Tesoreria General de la Seguridad Social assigns an employer registration number and main contribution account code to identify the employer in the relevant Social Security regime, and the employer who hires workers for the first time must request registration before the activity starts, according to the official TGSS employer registration guidance. The obligation to contribute also begins when the labour activity starts, as reflected in the Social Security guidance on the obligation to pay contributions.

A properly run EOR can take that administrative load away from the foreign client. That is the legitimate attraction of the model. The mistake is assuming that payroll compliance answers the tax question. It does not.

The EOR is evidence of how the worker is paid and employed. It is not proof that the foreign company has no Spanish business presence.

The tax question Spain asks instead

Spanish tax law does not ask whether the employee is on an EOR platform. It asks whether the non-resident company is operating in Spain through a permanent establishment. Article 13 of the Non-Resident Income Tax Law, reflected in AEAT’s official guidance on permanent establishments of non-resident entities, points to two broad routes: a continuous or habitual place of business in Spain where all or part of the activity is carried out, or an agent in Spain authorised to contract in the name and on behalf of the non-resident who habitually exercises those powers.

AEAT’s non-resident taxation manual repeats the same logic and lists examples such as places of management, branches, offices, factories, workshops, warehouses, shops and construction or installation projects exceeding six months. It also warns that where a double-tax treaty applies, the treaty definition needs to be checked and may be more restrictive than Spanish internal law. That is why a serious EOR review is not only Spanish payroll review. It is Spanish domestic law plus the applicable tax treaty, mapped against the real job.

The wrong way to read the EOR contract

Many foreign companies read the EOR contract as if it creates a legal wall between Spain and the foreign business. In practice, the EOR contract is only one document in a wider evidentiary file. Tax authorities and labour inspectors can look at the job description, reporting line, customer emails, CRM permissions, signature authority, pricing discretion, travel pattern, workstation, corporate email, management minutes and internal decision process.

If those facts show that Spain has become a commercial base for the foreign company, the payroll wrapper will not cure the problem. It may simply make the first months easier while the underlying exposure grows.

Three EOR profiles and their PE risk

The same EOR provider can be low risk in one file and inappropriate in another. The decisive point is the function performed in Spain.

This is why the safest EOR structures are usually narrow. The employee has a clear non-contracting role, no authority to bind the foreign company, no Spanish office presented as the company’s office, no Spanish market-launch mandate, and no practical control over the foreign company’s core commercial decisions.

The dependent-agent problem: signing is not the only risk

The clearest danger is the based in Spain worker who habitually concludes contracts in the foreign company’s name. Spanish internal law refers to an agent authorised to contract, acting in Spain in the name and on behalf of the non-resident, who habitually exercises those powers. Many companies understand that formal signing authority is dangerous, and they remove it from the job description.

That is only the first step. The harder cases involve commercial authority that is not called signing authority: negotiating price, approving discounts, committing delivery terms, telling customers that legal approval is a formality, or managing the Spanish pipeline so that the foreign headquarters merely rubber-stamps what has already been agreed. In a real review, the substance of the sales process matters more than the title of the role.

This broader principal-role analysis depends on the applicable double-tax treaty and any MLI or OECD-style wording that modifies it. It should not be treated as a universal Spanish domestic rule; the domestic test, treaty text and real sales process must be read together.

Controls that help, but do not guarantee the answer

• No contracting authority. The based in Spain person should not sign, orally bind, or habitually conclude contracts for the foreign company.
• Real approval outside Spain. Pricing, terms, acceptance and legal commitment should be decided by people outside Spain, with records that show real review.
• Clear customer communications. Spanish customers should not be left with the impression that the based in Spain person is the local contracting authority.
• CRM and email discipline. The internal record should not contradict the formal structure by showing local closure of deals in Spain.

These controls reduce risk only if they match the way the business actually operates. A policy that says “no authority” is not useful if the salesperson’s bonus plan, sales process and internal communications reward the opposite behaviour.

Home office and fixed-place risk

A Spanish home office is not automatically a permanent establishment. But it also cannot be ignored. The Spanish internal test asks whether the non-resident has, by any title, facilities or places of work in Spain on a continuous or habitual basis where all or part of its activity is performed. That is a fact-sensitive question.

Risk increases when the foreign company requires the employee to work from Spain for business reasons, pays for or equips the Spanish workspace, lists the Spanish address in commercial materials, uses the home as a customer-facing base, or has no meaningful workplace outside Spain for that function. Risk is lower where the employee is in Spain for personal reasons, the company has not organised a Spanish workplace, and the function is not a local market or contracting function. Those are not magic safe harbours. They are evidence points.

For PE analysis, the question is not whether the laptop is in Spain. The question is whether the foreign business is being carried on from Spain in a legally meaningful way.

Effective management Is a separate risk

Permanent establishment is not the only tax issue. If directors, founders or senior executives relocate to Spain and begin running the foreign company from Spain, the question can move beyond PE into corporate tax residence. Article 8 of Spain’s Corporate Income Tax Law treats entities as Spanish tax resident if, among other criteria, they have their effective place of management in Spain. The law explains this as the place where the direction and control of the whole of the entity’s activities is located, as set out in Article 8 of Ley 27/2014.

This matters for founder-led companies. A non-Spanish company can use an EOR for one employee and still face a much larger problem if the founder is physically in Spain making board-level decisions, controlling treasury, approving hires, signing strategic contracts and managing the group from a Spanish residence. EOR paperwork does not answer that question because it is not an employment question. It is a corporate governance and tax residence question.

The founder relocation trap

The risk often appears in relocation files where the founder is focused on personal residence, the Beckham regime, or family immigration. The company structure is treated as background. That is dangerous. If the founder’s Spanish presence changes where the business is directed and controlled, the personal relocation file and the corporate tax file have to be designed together.

For that reason, an EOR analysis for executives should be coordinated with tax residence, board governance and accounting review. Where the business genuinely needs a Spanish operational base, it may be more coherent to form a Spanish company and support it with proper monthly accounting and tax compliance in Spain than to stretch an EOR model beyond its defensible limits.

Labour law: the EOR must be more than a payroll shell

Spanish labour law also has to be respected on its own terms. The Estatuto de los Trabajadores defines the employment relationship around paid services performed voluntarily, on another’s account, within the organisation and direction of an employer. It also provides that only duly authorised temporary work agencies may temporarily assign workers to user companies. Article 43 treats illegal assignment seriously where the service contract is limited to making workers available, where the supplying company lacks its own stable organisation or necessary means, or where it does not exercise the functions inherent to an employer. The article also provides for joint liability for obligations owed to workers and Social Security in illegal assignment cases, as reflected in the official BOE text of the Estatuto de los Trabajadores.

This does not mean every EOR arrangement is illegal. It means the EOR must be a real employer in the labour-law sense, not merely a payroll invoice. If the foreign company controls every employment function, disciplines the employee directly, sets working conditions without the EOR, treats the EOR as invisible, and the EOR has no practical employer role, the structure deserves careful review.

What a defensible EOR labour file usually shows

• Real employer functions. The EOR executes and manages the Spanish employment contract, payroll, Social Security, leave, termination process and mandatory employment records.
• Documented division of authority. The foreign client can direct commercial outcomes, but employment powers should be allocated and recorded correctly.
• Spanish working conditions. Salary, working time, vacation, health and safety, data handling and applicable collective rules are not left to foreign templates.
• No false autonomy. If the worker is truly an employee, the file should not be dressed as freelance work to avoid payroll.

What happens if a permanent establishment exists

If the facts create a Spanish permanent establishment, the consequences are not cosmetic. AEAT’s non-resident taxation manual states that non-residents obtaining income through a PE in Spain are taxed on the total income attributable to that PE, wherever obtained. It also states that PE taxable income is determined under the general Corporate Income Tax rules, with specific rules for internal dealings with the head office and related parties. The same AEAT manual notes accounting, registry and formal obligations comparable to those of resident entities, and AEAT’s dedicated page on withholding and instalment payments for permanent establishments confirms that PEs are subject to withholding obligations and instalment payments, including Modelo 202, in the same terms as Spanish resident entities.

In practice, the discussion can move from “we used an EOR” to “we need to regularise a Spanish tax presence, attribute profit, review transfer pricing, file correctly, and explain why the structure was not documented earlier.” That is why the PE memo should be prepared before the role becomes operational, not after the first AEAT or labour-inspection question arrives.

How to build a defensible Spanish hiring structure

The right structure starts with the real commercial purpose. If the Spanish hire is a support role, the EOR may be appropriate. If the Spanish hire is intended to open the Spanish market, manage customers, negotiate revenue or run a team, the EOR should be treated as one possible step in a broader market-entry plan, not as the whole solution.

The documents that should exist before the hire starts

• Role-risk memo. Identify whether the person performs support, sales, management, contracting, product delivery or executive functions in Spain.
• Authority matrix. State who can negotiate, approve, sign, discount, hire, terminate, commit delivery and bind the foreign company.
• Workplace record. Record whether Spain is a personal remote-work location, a required company location, a customer-facing office, or something in between.
• EOR contract review. Confirm the EOR is not merely providing a worker on paper and that employer functions are allocated coherently.
• Treaty and tax analysis. Review the applicable double-tax treaty, domestic Spanish PE rules, transfer-pricing implications and corporate tax residence risk.
• Migration plan. Decide in advance what fact pattern will trigger a branch, SL, payroll transfer or full Spanish compliance setup.

When a Spanish entity is cleaner

A Spanish SL or branch is not always necessary, and premature incorporation creates cost and compliance. But where Spain is a revenue market, the employee has real commercial authority, local operations are being built, or founders are relocating to Spain, a local entity may reduce uncertainty rather than increase it. It gives the structure a clear taxpayer, employer, accounting perimeter and contractual counterparty. That can be more efficient than defending an EOR structure that no longer matches the business.

For foreign groups, the choice is usually between three imperfect options: keep a narrow EOR structure, register a Spanish permanent establishment or branch, or incorporate a Spanish subsidiary. The correct answer depends on function, scale, treaty position, client contracts, industry regulation and the founder’s personal relocation plan.

Frequently asked questions

Does an employer of record eliminate permanent establishment risk in Spain?

No. An EOR can manage the Spanish employment and payroll layer, but PE risk depends on the foreign company’s business presence in Spain. The key questions are whether there is a continuous or habitual place of business in Spain, whether the based in Spain person habitually contracts for the foreign company, and how the applicable tax treaty modifies the domestic Spanish position.

Can an EOR employee in Spain negotiate with Spanish customers?

Possibly, but this is where risk often begins. Pure lead generation is different from negotiating material terms, approving pricing or effectively concluding the commercial deal. If the person in Spain becomes the practical contracting channel for Spanish customers, the structure should be reviewed before the role goes live.

Is a Spanish home office a permanent establishment?

Not automatically. The risk depends on the facts: whether the company has a place of work in Spain by any title, whether activity is continuous or habitual, whether the home office is at the company’s disposal in practice, and whether the work performed there forms part of the foreign company’s core business. A personal remote-work choice is not the same as a company-required Spanish operating base.

Does an EOR avoid Spanish social security?

No. The point of a Spanish EOR is usually to place the worker within Spanish payroll and Social Security compliance through the EOR. That may be correct for employment administration, but it does not prove that the foreign client has no separate tax or labour exposure. If the foreign client is the real employer in substance, or if the arrangement is an illegal assignment of workers, the analysis changes.

When should a foreign company form a Spanish company instead of using an EOR?

Usually when Spain is not just a hiring location but a business location. Indicators include Spanish customers, local contracting, a based in Spain country manager, local revenue targets, regulated activity, a team build-out, founder relocation, or a need for Spanish invoices and banking. In those cases, the legal cost of a proper SL or branch may be lower than the risk of defending an overstretched EOR arrangement. Legal Fournier can review the structure through its company formation service and coordinate the tax, labour and accounting perimeter.

Can a PE issue create Spanish corporate tax filings?

Yes. If a permanent establishment exists, AEAT treats the income attributable to that PE under the non-resident income tax rules for permanent establishments, with corporate-tax-style computation and formal obligations. Instalment payments, withholding duties, accounting, tax returns and profit attribution can all become part of the file.

Talk to a Spanish lawyer