Employee Working From Another Country Without Telling You: What to Do

In this guide

Someone in finance notices an expense claim in a currency nobody budgeted for, or IT flags a laptop logging in from the same foreign IP address for 11 weeks. However it surfaces, the discovery is usually accidental, and the first question people ask is whether the employee is in trouble.

The more useful question is what has already accrued, where, and how far back it can be assessed. A liability has been building since the day they landed, and it belongs to the company more often than to the person. We run payroll and employment across 150+ countries and 130+ currencies, and situations like this arrive often enough that the pattern is familiar.

What should you do when an employee has been working from another country without telling you? Establish the exact date they left and where they have been, because every downstream calculation depends on it. Deal with immigration first, since it is the only exposure with a hard clock you cannot wind back. Then quantify the income tax and social security that has accrued in the host country, check whether a voluntary disclosure window is still open, and only then decide whether to regularize the person locally or require a return.

1. Establish the Facts, Without Creating a Second Problem

You need four things: the date they left, the countries they have been in, what work they did there, and their immigration status while doing it. The day count is the hinge, because it decides whether the employee became a tax resident, whether treaty relief is available, and how many months of contributions are outstanding.

How you found out matters too. A self-reported move is the strongest evidence that the non-disclosure was careless rather than deliberate, and that changes both the penalty rate and how far back the authorities can reach. If a tax authority or an auditor asked first, several of the remedies below have already closed: His Majesty's Revenue and Customs (HMRC) states it will be exceptional for a disclosure to count as unprompted once a compliance check is in progress.¹

Be careful how you gather the facts. Mining an employee's location data, device logs, or personal accounts creates its own exposure under data protection law. In Europe, that is the same regime you may already have breached by processing their data in a country you never assessed. Ask directly, and do it in writing.

2. Immigration Time Is Not on Your Side

Tax can be settled late, and contributions can be paid late with interest. A work authorization cannot be backdated, and this is the exposure most employers address last.

Whether the employee needed permission is country-specific. Singapore is the clearest accommodating case, with an important qualifier. The Ministry of Manpower (MOM) states that a foreigner physically in Singapore working for an overseas-based organization does not need a work pass.² That answer is written for someone who already holds lawful long-term status, such as a Dependant's Pass, and it resolves the work-pass question only.

Most countries are not Singapore. Thailand publishes no carve-out for remote work on tourist status, and its answer is the Destination Thailand Visa (DTV). We cover how routes of that kind work in our guide on the digital nomad visa.

In the Schengen area, enforcement tightened during 2026. The Entry/Exit System began operations on October 12, 2025 and became fully operational on April 10, 2026, replacing passport stamping with digitally recorded entries and exits.³ For third-country nationals, the 90-days-in-180 allowance has always been pooled across participating countries, so moving between them creates no fresh allowance. European Union, EEA, and Swiss nationals sit outside it entirely. Where an authorized stay has expired, and there is no exit record, authorities may presume the person no longer meets the conditions of stay.⁴

These consequences land on the individual first, which is why employers deprioritize them and should not. Your employee may be facing a re-entry ban measured in years while you are still modeling payroll. If there is any prospect they have been working without the right to do so, take that to immigration counsel in the destination country first.

3. Where the Income Tax Now Falls

There are three assumptions that cause most of the damage.

First: that 183 days is a universal safe harbor. It is neither universal nor always 183, and the window it is measured over varies as much as the number.

Germany is worth examining more closely. Where a habitual abode arises from a continuous stay, liability attaches from the beginning of that stay rather than from the day the threshold is crossed.

Second: the OECD Model Convention's employment income article contains a 183-day test, but it is one of three conditions, and all three must hold for the home country to keep exclusive taxing rights.⁹ The other factors are that the pay is made by, or on behalf of, an employer not resident in the host country, and that it is not borne by a permanent establishment there. If the host country decides a local entity is the real economic employer, the day count stops mattering.

Sweden illustrates how far the second assumption can break down in practice. Since January 1, 2021, a non-Swedish employer with no permanent establishment in Sweden must deduct preliminary tax from compensation for work carried out in Sweden, regardless of any day count.¹⁰

Third: double tax relief is oversold. It caps the total at the higher of the two liabilities rather than the sum, and does not cover penalties, interest, or your own late-filing exposure.

Where you should have withheld and did not, the liability is yours to settle first, and recovering it afterwards is constrained by law rather than by contract. In the United Kingdom, an employer may not recover National Insurance paid on the employee's behalf other than by deduction from earnings, and only where the under-deduction arose from a good-faith error.¹¹ On a historic underpayment spanning closed years, the employer bears the employee's share.

Not sure which exposure is yours to settle and which falls on the employee? Get in touch with our team and we will tell you what an EOR can resolve from the effective date, what requires a tax advisor.

Have our team scope your exposure

4. Social Security Runs on a Separate Track

Income tax treaties expressly exclude social security, so a tax analysis tells you nothing about contribution liability. Employers who assume social security follows the tax analysis get a second bill.

Contributions are owed where the person physically works, and for European Union cases that default sits in Article 11(3)(a) of Regulation 883/2004.¹² Employers reach for the posting route to displace it, and it usually will not reach this fact pattern. Article 12(1) applies where a worker is posted by the employer to perform work on that employer's behalf, for an anticipated duration not exceeding 24 months.¹² An employer that did not know where its employee was cannot have posted them anywhere, and an open-ended move has no anticipated duration to test against the 24-month limit. Where an absence really is temporary and agreed, the posting route can be available from that point on.

There is a remediation lever, narrower than it looks. An A1 certificate, the document confirming which country's social security legislation applies to a worker, can lawfully be issued after the work abroad has begun, or even after it has ended. The Court of Justice of the European Union held that a retroactively issued certificate binds the host country's institutions even where that country had already ruled the worker subject to its own compulsory insurance.¹³ That is a genuine route back from an assessment already raised, though it depends on the home state agreeing to issue.

The 2023 Framework Agreement on cross-border telework lets an employee stay in the employer's social security system under three conditions: telework in the country of residence is under 50% of total working time, both states are signatories, and both parties have given explicit consent.¹⁴ The United Kingdom has said it will not sign, so the lever does not exist for a UK employer. An employee who relocated entirely is at 100% and falls outside it, and backdating runs to no more than three months before submission.¹⁵

Where no agreement exists between the two countries, contributions can fall due in both places, and the duplicate is usually not recoverable.

Time limits decide how dangerous delay is here. In Germany, contribution claims expire four years after the end of the calendar year in which they fell due, but claims for contributions willfully withheld expire only after 30 years.¹⁶ Once you know and do nothing, the argument that non-payment was not willful becomes very hard to run.

One piece of good news if the destination is Singapore: Central Provident Fund (CPF) contributions are payable only for Citizens and Permanent Residents, so a foreign national who relocated there creates no CPF liability.¹⁷

5. When the Company Itself Becomes Taxable There

A single employee can create a taxable presence for the company. Permanent establishment is the tax concept for a fixed place of business or dependent agent that makes a foreign company liable to corporate tax locally, and the consequences are backdated to the day it arose. Whether one exists turns on what the person was doing, and only partly on where they sat. An engineer writing code alone is a weaker case than a salesperson habitually concluding contracts. We cover the thresholds and the country tests in detail in our guide to permanent establishment risk in Asia.

6. The Exposures That Never Reach the Tax Line

Three costs sit outside the tax analysis and are routinely missed:

• Insurance coverage often lapses. Employer liability and workers' compensation policies are written for a defined territory, and cover for someone working abroad continuously can fall away. An injury claim can also draw an authority's attention to the arrangement.
• Health cover may not transfer. Japan's digital nomad status holders cannot enroll in Japan's public medical insurance, which is why private cover is a condition of the status.¹⁸
• Data and equity create their own problems. If the employee has handled personal data from a country you never assessed, your transfer position has been wrong for as long as they have been there, and share options may be taxed differently in the new country.

7. Bounding It, and Why Disclosure Timing Decides the Cost

The look-back window is not one number. HMRC can assess four years from the end of the relevant tax period as standard, six where the behavior was careless, 12 where the matter is offshore, and 20 where it was deliberate.¹⁹ An employee working from another country is the textbook offshore matter, so the realistic window is 12 years rather than four. That window covers income tax including Pay As You Earn (PAYE), capital gains tax, and inheritance tax; National Insurance runs on its own limits.

Every jurisdiction we reviewed rewards early disclosure, defined as coming forward before the authority does.

Singapore's grace period runs from the statutory deadline, and an extended deadline does not move it, so when the discovery is months old, the window has usually gone and 5% per year is the realistic outcome.

8. Regularizing Forward Does Not Erase What Has Accrued

Putting the employee on a compliant local arrangement stops the exposure growing. It does not settle the months already behind you. These are two separate workstreams, and only one of them has deadlines.

• Regularize where they are, through an Employer of Record. An EOR becomes the legal employer of your worker in their country, taking on the local contract, payroll, withholding, and statutory contributions. At the same time, you keep direction of their work. It is the fastest route to a compliant forward position when you have one person in a country and no entity. Two market exceptions apply:
  • Germany: requires a permit under the Act on Temporary Agency Work (Arbeitnehmerüberlassungsgesetz, or AÜG) and caps assignment to the same client at 18 consecutive months by default.²³
  • Singapore: an EOR is the wrong instrument entirely, because MOM states that an EOR applying for a work pass so someone can be based there while working for an overseas company would be committing an offense.²⁴
• Set up a local entity. Registry fees are rarely the obstacle. Annual filings, local director requirements, and accounting are what make a single-employee entity uneconomic, so it makes sense only when you intend to build a team there.
• Require a return. Months of working in another country can attach that country's non-derogable employment protections regardless of what the contract says.²⁵ Ordering a return can amount to a unilateral variation of terms, and forcing it carries constructive dismissal risk.
• Convert them to a contractor. Almost always wrong. Every authority we reviewed applies substance over form, so relabeling someone who still works under your direction leaves you with a misclassification problem stacked on the original one. We set out the substance tests in our guide to contractor misclassification.
• Ending the employment is a fifth option and sometimes the right one. It does not retire the accrued liability either.

How We Handle an Employee Working From Another Country

We run this as two tracks rather than one.

• The forward track we own outright. Through our Employer of Record service, we become the legal employer in the destination country, issue a compliant local contract, register the person for the statutory schemes that country mandates, and run payroll with correct withholding from the effective date. Where you would rather keep the employment relationship and only fix the payroll mechanics, our Global Payroll service covers registration and filing. We hold our own entities in Singapore, Hong Kong, Taiwan, Malaysia, Vietnam, and mainland China, and work through 600+ local partners and entities elsewhere. Our infrastructure is ISO 27001 certified, covering over 150 countries and 130+ currencies.
• The backward track we scope honestly. We tell you what has accrued and roughly how far back it reaches, and we say where the answer needs a tax advisor or immigration counsel rather than a payroll provider. Settling historic liability with a foreign tax authority is not something an EOR does on your behalf.

To prevent the next one, our Asia remote worker compliance checklist sets out the sequence for getting a cross-border hire right from the start.

Frequently Asked Questions

Q1. Can we just ask the employee to come back and treat the matter as closed?

No. Asking an employee to return resolves the forward position only. The tax that accrued while they were abroad remains assessable, statutory contributions that were not remitted are still owed with interest, and immigration violations cannot be undone by a departure. If the host country has already opened a file, the look-back window and penalty rate are already set. A return is part of the solution, not the whole of it.

Q2. Does the employee owe us the back tax we had to pay?

Often not, and your contract may not help. In the United Kingdom, an employer can only recover under-deducted National Insurance by deduction from earnings, and only where the under-deduction arose from a good-faith error.

Q3. How far back can they look?

Further than most employers assume. In the United Kingdom, it is four years as standard, six for careless behavior, 12 for offshore matters, and 20 for deliberate conduct. German social security claims run four years, or 30 where contributions were willfully withheld.

Q4. Does an Employer of Record fix this?

It fixes the future. From the day it starts, the person is employed compliantly in that country. It does not settle what was accrued before, and in Singapore, it is the wrong instrument for someone working for an overseas company.

Q5. What can Slasify do here, and what can it not?

We can employ the person compliantly in the destination country and run payroll correctly from the effective date. Settling historic liability with a foreign tax authority needs a tax advisor there, and we will say so rather than imply otherwise.

Q6. Can we investigate where the employee has been by checking their device or location data?

Only carefully. Building a case from an employee's location data or personal accounts creates its own legal exposure, particularly in Europe. Ask in writing and rely on records you already hold for a legitimate purpose.

Getting Ahead of It Before the Authority Does

The cost here is set less by the underlying tax than by who finds it first and how long you sit on it. The look-back window, the penalty rate, and whether you are treated as careless or willful all turn on that.

If you have just found out, the order is:

1. Establish the date.
2. Take the immigration question to counsel in the destination.
3. Size what has accrued.
4. Check whether a disclosure window is still open, and only then choose between regularizing locally and bringing the person home.

If you want help with the forward half of that, talk to our team. We will tell you what we can fix, and what needs someone else.

Talk to our team

Statutory figures, penalty ranges, and residency tests reflect published HMRC, IRAS, MOM, CPF Board, Skatteverket, Belastingdienst, SVB, European Commission, and German federal guidance as of September 2026. Thresholds, rates, and time limits change on announced schedules. Confirm current figures with the relevant authority or your advisor before acting.