One employee working from home in Spain can create a taxable presence for your entire foreign company. OECD BEPS post-COVID guidance, Spanish IS law, the dependent agent PE test, and what every US, UK and German business must do to manage the risk.
The rise of remote work since 2020 has created a permanent establishment (PE) exposure that most foreign businesses have still not adequately assessed. The problem is straightforward: your company is based in the United States, the United Kingdom, or Germany. You have one, three, or a dozen employees who have moved to Spain and work from home. Your company has no Spanish office, no Spanish registration, no Spanish bank account. You may believe Spain is simply where your employees happen to live — irrelevant from a corporate tax perspective. That belief is wrong, and the consequences of getting it wrong are severe.
A permanent establishment is a taxable presence: a connection between a foreign entity and a host country that is sufficient to require that entity to pay corporate income tax (Impuesto sobre Sociedades, IS) in that country on the profits attributable to the PE. Once a PE is found to exist, the host country (here, Spain) is entitled to tax the income attributable to it as if it were an independent enterprise.
The PE concept originates in bilateral double tax treaties and the OECD Model Tax Convention. Spain has treaties with over 90 countries, including the United States (1990 treaty), the United Kingdom (1975 treaty with protocols), and Germany (2011 treaty). Each treaty defines PE slightly differently, but the core tests are consistent with the OECD model: the fixed place of business PE, the construction project PE, and the dependent agent PE.
Absent a treaty (which is rarely the case for major trading partners), Spain's domestic Impuesto sobre Sociedades law (Ley 27/2014) defines PE under Article 13, broadly following the OECD model. The personal income tax framework for individuals is governed by the Ley del IRPF (see official BOE text of Ley 35/2006).
The first and most immediate risk for remote workers is the fixed place of business PE. Under Article 5(1) of the OECD Model Convention (and the corresponding provision in Spain's treaties), a PE exists where a foreign enterprise has a "fixed place of business through which the business of the enterprise is wholly or partly carried on."
The three elements are: (i) a place of business (the home office), (ii) fixedness (it has to be sufficiently permanent and stable — not merely transient or occasional), and (iii) the business of the enterprise must be carried on through that place.
In the remote work context:
On its face, this analysis leads inexorably to a PE finding. However, the key mitigating factor is the OECD Model's commentary on the home office scenario: for a fixed place of business PE to be established at the employee's home, the enterprise must have required the employee to use that home as a place of business, or it must have been clear from circumstances that the enterprise was using it as part of its operations. A genuinely informal arrangement where the employee works from home out of personal choice, without the employer directing them to use that location or holding it out to clients, has a stronger argument against PE status.
In practice, the more integrated the home office is into the company's business infrastructure — company laptop, company VPN, company phone, company email domain, regular video calls with clients from the home address — the harder it is to argue there is no PE.
Even if the fixed place of business test is avoided, the dependent agent PE is the primary risk for companies with sales or business development staff in Spain. Under Article 5(5) of the OECD Model (as updated by the 2017 BEPS-influenced revision), a PE exists where a person (the "agent") acting on behalf of the foreign enterprise habitually concludes contracts, or habitually plays the principal role leading to the conclusion of contracts, in Spain — and those contracts are for activities forming a normal part of the enterprise's business, unless the agent is of independent status acting in the ordinary course of their own business.
Key elements:
Article 5(4) of the OECD Model exempts certain activities from PE status on the basis that they are merely preparatory or auxiliary to the enterprise's main business. Under Spain's treaties, these typically include: storage of goods, purchase of goods for the enterprise, collection of information, and similar support activities.
For remote workers, the key question is whether the employee's activities qualify as merely "preparatory or auxiliary." The BEPS revision has made this harder to argue: activities that are "core" to the enterprise's business do not qualify, even if carried out by a single person. A software engineer writing production code is not performing "preparatory or auxiliary" activities — they are performing core business functions. By contrast, a market research analyst gathering information about Spanish market conditions, without any client contact or sales authority, might more plausibly fall within the exception.
If the AEAT determines that a foreign company has a PE in Spain, the consequences include:
Employer of Record (EOR) arrangements: Many foreign companies use an EOR — a local Spanish entity that formally employs the worker and handles Spanish payroll, social security, and labour law compliance. The employment relationship runs through the EOR, not the foreign company. This removes the direct employment link but does not automatically eliminate PE risk if the foreign company's employees are still habitually concluding or facilitating contracts in Spain.
Clear role definitions: Restructuring the employee's role to ensure it genuinely falls within the preparatory or auxiliary exemption — no client contact, no sales authority, purely internal functions — can reduce PE risk but requires consistent implementation and documentation.
Registration of a branch or subsidiary: For companies with significant Spanish operations, the pragmatic solution is to accept the PE and structure it correctly — either through a Spanish branch (sucursal) or a Spanish subsidiary (sociedad de responsabilidad limitada). This provides legal certainty, allows proper IS planning, and avoids the retrospective exposure of an unregistered PE.
Transfer pricing analysis: Documenting the arm's length nature of compensation paid to the Spanish PE for its functions, assets, and risks reduces the exposed profit base and provides a defensible position in AEAT inquiries.
Jacob Salama provides PE risk assessments for foreign companies with Spanish remote workers, advises on structuring options, and represents businesses in AEAT PE investigations. Book a free call to understand your exposure.