Introduction
Remote hiring in regulated sectors is heading towards tighter borders, not looser ones. Employers in finance, healthcare, life sciences and defence will keep using employer of record (EOR) models, but mostly for pilots, small teams and fast market entry, inside a short list of approved countries, with tracked locations and locked-down data access. The “work from anywhere” promise doesn’t survive contact with tax authorities, tribunals and supervisors.
That’s the short answer.
Here’s the longer one, and it’s less comfortable. Many leadership teams spent the pandemic years treating remote work as a perk to be handed out, then spent the years after wondering why legal, tax and security kept saying no. They weren’t being awkward. The rules had simply caught up with the practice.
An EOR (the legal employer on paper, while you direct the day-to-day work) is not a payroll tool, and it isn’t a cloak of invisibility either. In this guide I’ll walk through what is changing, where the real compliance traps sit, and when an EOR is worth paying for versus setting up your own entity. I’m writing from Los Angeles, but the lens is global, with a fair amount of UK and EU detail because that’s where the regulation is moving fastest.
What Is Changing in Remote Hiring for Regulated Sectors?
Plenty, and mostly in one direction. Remote and hybrid working has moved from a policy preference to a regulated activity, and the organisations that hire across borders are being asked to prove where people sit, what they touch and who is legally responsible for them.
Regulated Reality Replaces Policy Preference
Commentators have started describing remote working law as shifting from preference to regulated reality, and I think that’s about right. A few years ago a manager could say yes to someone working from Lisbon for the winter. Now that yes comes with a tax question, a social security question, an immigration question and, in a bank, a supervisory question.
Pay rules are tightening too. The EU Pay Transparency Directive set 7 June 2026 as the transposition deadline for member states, which means banning historical pay inquiries and giving workers access to average pay data broken down by sex. A European Commission briefing adds mandatory salary range disclosure before hiring, plus action on unjustified gender pay gaps above 5% for organisations with more than 100 employees. If your EOR hires into the EU on your behalf, you still need to understand this, because the pay data is about your roles.
Tribunals Penalise Misuse of Labour Models
PwC UK’s view of EORs is that they streamline market entry but leave organisations exposed to tax penalties and investigations when an arrangement breaches local labour or co-employment rules. Tribunals look at substance. If you hire, direct, discipline and promote someone, calling a third party “the employer” won’t carry much weight.
Worker status is the other front. The EU Platform Work Directive, Directive (EU) 2024/2831, has a transposition deadline of 2 December 2026 and introduces a rebuttable presumption of employment alongside rules on algorithmic management. CXC Global’s tracker shows how that touches distributed workforce contracts and digital oversight. Contractors engaged through clever structures are the obvious casualties.
Market Growth and Automation
Demand isn’t slowing. One market report puts the global EOR market at $7.45 billion with healthcare showing the fastest vertical growth, a 10.5% CAGR, while IT holds roughly 31% of adoption. Other analysts project it to reach $10.45 billion by 2035.
Automation is eating the admin: screening, document checks, payroll runs. Fine. But the human compliance layer isn’t going anywhere in regulated roles, and I’d be suspicious of any provider that tells you otherwise.
Why Is Work From Anywhere Ending in Regulated Industries?
Because the cost of ignoring location is now higher than the cost of restricting it. Tax rules care where you sit. Supervisors care where the data sits. Neither cares how pleasant the policy looked in the staff handbook.
Location Tracking Is Now Standard
Most mature employers already log where people work. Not out of nosiness, but because payroll, withholding and social security all hang on location. In finance, healthcare and defence there’s even less room to shrug.
Tracking has its own limits, mind. Under GDPR, consent for monitoring software is legally shaky given the power imbalance between employer and employee, so you need a documented Legitimate Interest Assessment instead. Collect location data for a stated compliance purpose, keep it proportionate, and don’t quietly turn it into a productivity scoreboard.
Permanent Establishment Triggers
One person in the wrong country can create a taxable presence for the whole business. TeamEd Global warns that cross-border remote work in financial services or defence can trigger permanent establishment exposure almost immediately. The OECD offers some comfort: its latest analysis suggests that working from a home office abroad for under 50% of working time generally won’t create a permanent establishment. Generally. That word is doing a lot of lifting, and national tax authorities don’t have to agree with each other, or with you.
The 10–20 Day Rule
Many advisers suggest capping work-abroad allowances at 10 to 20 days per year unless a multi-jurisdictional review has been done. I’d go further and say that’s already generous. Anything beyond it should be an approved exception, with a country on the list and a checked address.
Selling unlimited global flexibility to compliance-heavy employers is fantasy. Expensive fantasy.
Which Compliance, Tax and Payroll Rules Apply Across Borders?
Three buckets, and all of them bite: local employment law, payroll and social contributions, and professional credentials. An EOR can carry the first two for you, to a point. The third one stays stubbornly close to home.
Local Employment Law
Notice periods, working time limits, mandatory benefits, probation rules and termination protections all follow the worker’s country, not your head office. In parts of Europe, dismissal procedures alone can swallow months. Hybrid working arrangements add another wrinkle, since a “remote” contract that quietly requires monthly office attendance in a second country creates two sets of obligations.
Payroll and Social Contributions
Payroll across borders means income tax withholding, employer and employee social security, statutory pensions, holiday pay and, sometimes, local benefits in kind. Get the registrations wrong and you’re paying penalties plus back contributions. A good EOR handles registrations and filings under its own entity, and that’s the real value of EOR services: someone else holds the administrative burden of local filings.
If you’re looking for UK-specific EOR services, the same logic applies. The provider employs, runs PAYE and national insurance, and issues compliant contracts, while you manage the work.
Credential and Licence Checks
This is where generic providers fall over. In finance and accounting, an EOR can’t just run payroll. It has to verify and validate local professional certifications so regulators stay satisfied. For clinicians, the question is whether the licence is valid where the patient or the data sits.
Identity matters too. For non-face-to-face onboarding, the FATF guidance on digital identity sets out how identity proofing should work with trusted digital credentials. It’s written for customer onboarding, but the principles transfer neatly to remote staff vetting, and our piece on rigorous remote talent vetting goes deeper on method.
When Does an EOR Make Sense for Regulated Employers?
When speed and uncertainty matter more than control. That’s the honest test.
Pilot Teams and Market Testing
Say you want three engineers in Poland to test whether a market is worth entering. Setting up a local entity for that is overkill. An EOR gives you variable costs, an easy exit if the pilot flops, and no registered office to wind up afterwards.
Speed of Onboarding
Onboarding in days beats setting up an entity in months. Compare it to the usual route and the gap is stark, which is why founders obsessed with velocity lean on EORs. If you’re comparing providers, this overview of Deel versus Remote is a reasonable place to start, though it was written with startups in mind rather than banks.
Limits of Liability Transfer
Here’s what sales decks gloss over. An EOR takes on employment liabilities as the legal employer, but it doesn’t take on your regulatory duties. The FCA, the HHS, the FDA and your own auditors will still look at you. Misclassification, co-employment findings and tax nexus questions can still land on your desk.
So an EOR is a tool for managing exposure. Not a shield.
Which Is Better for Regulated Firms: EOR or Own Entity?
Short answer: EOR for testing, own entity for staying. If you’re building a permanent regional team, I’d rather pay for the entity and keep control.
Factor | Own entity | EOR |
|---|---|---|
Speed to hire | Slow, formal registration | Days |
Cost profile | High fixed costs | Variable, scalable down |
Regulatory liability | Held directly by you | Employment liability shifts, regulatory duties stay |
Data and IP control | Internal firewalls and policy | Relies on provider encryption and access paths |
Best for | Permanent hubs | Pilots, small teams |
Past roughly a dozen heads in one country, the EOR margin starts to look like rent on a house you’ll never own. Run the numbers at eight, twelve and twenty people before you commit. For a structured way to compare providers, see this comparison framework for regulated hiring.
How Can Employers Secure Data in Distributed Teams?
Start from the assumption that home networks are hostile. A literature review by Chapman compares remote setups to unmanaged bring-your-own-device risk, and Cybsafe’s figures there suggest roughly a third of breaches stem from staff working beyond traditional network boundaries. Dated, yes, but the pattern hasn’t improved.
For healthcare, the HHS remote use guidance asks for multi-factor authentication, role-based access and clearance checks, and the wider HIPAA Security Rule material covers risk analysis across decentralised environments. For banks, the European Central Bank’s cloud outsourcing supervisory guide sets expectations for third-party operational dependence, and an EOR is, in effect, one more third party.
Practical controls look like this:
Managed devices only, with disk encryption and remote wipe
Geo-fenced access that blocks logins from unapproved countries
Least-privilege roles, reviewed quarterly
Session logging with a documented lawful basis
Regulators have also grown comfortable with remote oversight themselves. The FDA now runs voluntary, risk-based remote interactive evaluations of manufacturing sites by livestream, with an operational protocol that includes 15-day facility response windows. If an inspector can inspect remotely, you can expect them to ask hard questions about your remote controls.
What Will This Mean for Workers, Employers and Markets?
Workers get mixed results. Available evidence suggests that employees perceive both benefits and disadvantages: flexibility and wellbeing gains on one side, isolation and blurred boundaries on the other. The ILO’s work on telework and home-based employment is a useful reference for definitions and social protection boundaries, and its statistical methodology resources show why counting cross-border remote workers is still messy.
Employers face a squeeze. Flexibility remains a retention lever, particularly for scarce skills, but compliance costs eat into the savings. Talent markets will likely split: approved-country hubs such as the UK, Ireland, Poland and Portugal get busier, while informal arrangements elsewhere shrink. Emerging talent hubs aren’t shut out, but they’ll need providers who can prove compliance, as discussed in our look at remote worker retention in Africa.
Build a Compliant Global Employment Strategy
Pick your countries first. A short, approved list beats a sprawling map every time. Then decide the model per country: EOR where you’re testing, entity where you’re staying, and contractors only where the work is genuinely independent.
Write the policy around location, not just job titles. Name the countries, the day limits, the approval route and the data controls. Review quarterly, because transposition deadlines keep landing and the rules keep shifting. If you want a wider view of tools, our guide to the best remote hiring platforms for regulated industries is worth a skim, and so is IMÒ’s take on the future of remote employment.
FAQ
Will EORs still matter in regulated sectors?
Yes, for pilots and fast entry. They’re less attractive for permanent teams where control and cost favour your own entity.
Does an EOR remove my compliance obligations?
No. It shifts employment liabilities, but sector regulators still hold you responsible for conduct, data and licensing.
Does remote work abroad always create a permanent establishment?
No. The OECD indicates that under 50% of working time from a home office abroad generally avoids it, though national tax authorities decide.
How many days abroad should I allow?
Ten to twenty a year, in approved countries, with location checks. More needs an audit first.
Conclusion
Regulated remote hiring is growing up. The winners will treat location, credentials and data access as first-class concerns, use EORs where speed and uncertainty justify them, and build entities where permanence does. Skip the fantasy of borderless work. Hire remotely, hire carefully, and keep your paperwork tidier than your competitors’.
