The 'Permanent Establishment' Risk Mitigation Checklist

Start with the engagement’s operating facts#

Permanent establishment concerns a business’s taxable presence in another country. HMRC’s PE overview describes fixed-place and agent routes. Use those as screening questions; the applicable treaty, including any modifications, and local law determine the actual test for your client.

Keep role boundaries clear, records current, and the legal review tied to actual conduct. A checklist helps you identify changes early; it does not create a PE exemption.

That approach matters because PE problems usually do not appear all at once. They show up as small operating drifts. A client starts routing commercial questions to you because you are responsive. A work location gets described too loosely. Recurring activity becomes normal before anyone checks the rule set. Or a contract says one thing while the day-to-day workflow says another. If you wait until someone asks for a final legal answer, you are usually working backward from a messy fact pattern. If you treat it as a control issue early, you can catch the drift while it is still fixable.

For fixed-place screening, HMRC explains that space can be at an enterprise’s disposal even when shared or not owned by it. Record who can use the location, what client business takes place there, and whether that use continues over time. Correct misleading address labels, but also review the underlying use of the premises.

The practical point is not to become your own tax advisor. It is to make sure your facts are stable, your records are usable, and your workflow does not create avoidable ambiguity. These labels help you sort what needs a quick correction, what needs a documented review, and what needs outside advice before the pattern hardens.

Those are screening questions, not final legal outcomes. A useful control system keeps that distinction clear. It lets you move quickly on the facts you control, while reserving legal conclusions for the point where you have verified the actual rules that apply.

Diagnostic#

Start with what is happening in practice, not what the paperwork says. Use this triage first, then decide whether you can contain the issue internally or need legal review.

Use aligned when behavior, approvals, and documents match; review-needed when scope, location, or activity is changing; and escalate-to-advisor when authority shifts or the applicable rule has not been checked. These are workflow statuses, not tax-risk ratings. Even a consistent arrangement can meet a PE test.

If your legal support is only a title page or a login wall, treat it as insufficient for a final call. A good diagnostic process is simple enough to run quickly and disciplined enough to stand up later.

Start by pulling the materials that show what is happening now, not what happened when the engagement began. In practice, that usually means the current agreement, the active SOW, the approval route the team is actually using, recent meeting notes, recent email chains on scope or price, any travel or service log you already keep, and any public-facing profile or signature that could describe your role or location. You are not trying to build a legal brief at this stage. You are trying to see whether the facts line up.

Ask a short set of operational questions:

• Who handles commercial approvals today?
• Who is expected to answer when a third party asks for price, scope, timing, or terms?
• Who appears in meetings when those topics come up?
• What location is being associated with the work?
• Has the delivery pattern changed since the SOW was signed?
• Are recurring activities being tracked in a way that can be reviewed later?
• If a legal question already came up, do you have the actual source material or only a summary?

You do not need a perfect internal questionnaire. You need enough structure to catch drift before it becomes your normal operating model.

A contract can say no authority while day-to-day conduct shows that you settle commercial points. A clear approval record helps identify that mismatch, but neither good paperwork nor an overseas signature settles the tax result. Review conduct and documents together against the applicable rule.

If counterparties already treat you as the decision-maker, mark the arrangement for review even if the title and SOW describe an external provider. Similarly, recurring activity warrants review when nobody has checked the applicable rule. Treat inconsistent records as a control gap, not as a way to estimate the legal result.

It also helps to assemble a small documentation folder as you go rather than waiting until someone asks for it. It does not need to be elaborate. It just needs to be current and internally consistent. Useful items usually include:

• the signed agreement and current SOW;
• the active approval path or approval map;
• meeting notes showing where decisions were redirected;
• the current version of any process note that explains your role;
• invoices and other materials that reinforce external-provider status;
• the activity log for location-sensitive work;
• screenshots or corrected public materials where role or location wording was fixed;
• any written legal support you actually have in full.

That pack does two jobs. First, it lets you answer client questions without reconstructing history. Second, it makes it easier to spot where one piece of the system has drifted away from the rest.

Treat each row in the table above as a real operating control, not just a warning sign.

When you are asked to discuss or settle price, scope, or terms with third parties, the issue is not necessarily that you joined the conversation. The issue is whether you are becoming the point where commercial uncertainty gets resolved.

Many people slide into that role accidentally because they know the project best, they respond quickly, or the authorized client team is hard to reach. That is where the containment step matters. You do not need to make the interaction awkward. You need to pause when the conversation moves from explanation into commitment and route that decision back to the client's authorized team. If this happens once, document it. If it happens repeatedly, the pattern itself is the signal.

Evidence matters here because memory turns soft very quickly. Keep the email thread, meeting notes, and approval record that show where the decision actually landed. If you verbally redirected the issue during a call, follow up in writing so the record reflects that the commercial decision stayed with the client. Otherwise, everyone may later remember only that you handled the conversation.

When your address or work location is treated like the client's local base, small wording choices can do more damage than people expect. This often starts innocently. Someone lists your location in a profile, directory, pitch deck, or email signature in a way that implies local presence for the client. Or a client starts describing you operationally as their local point in a market when what they really mean is that you happen to work there.

Correct misleading descriptions and retain the updated materials. Then review actual use: does the client have access to the space, direct what business takes place there, or use it repeatedly? Removing “local office” wording does not change those facts.

In-country activity becoming recurring is another area where teams often react too late. The problem is rarely the first activity in isolation. The risk is the pattern that forms when similar activity repeats and no one is logging it carefully enough to review. If the work is starting to look recurring, begin a dated activity log before the pattern expands further. Keep it plain and factual: when the activity happened, where it happened, what the activity was, who requested it, and whether there were approval or decision points involved. You are not drafting legal conclusions in the log. You are preserving facts that can later be checked against the relevant treaty and local law.

Some treaties have a separate services PE clause; others do not. As an example, Article 5(4)(a) of the UK–Algeria convention counts specified services on the same or connected project over more than 183 days in a twelve-month period. That is a treaty-specific example, not a general safe limit. Record personnel, projects, dates, and locations so the applicable test can be applied.

The row about a contract saying no authority while daily conduct says otherwise is often the clearest example of why PE risk is an operating issue. Paper does not cure behavior. If commercial commitments are effectively running through you, fix the workflow first. That means changing who answers, who approves, and how requests are routed in real time. After that, align the SOW and approval materials so the documents catch up to the corrected process. If you reverse that order and update paper first, the team may feel protected while still operating the same way. That is exactly the sort of false comfort that creates later problems.

If the client refuses to align behavior and documents, treat that refusal as its own escalation trigger. At that point the issue is not a minor drafting mismatch. It is a control failure the client is choosing to leave unresolved.

The final row, on login-gated or partial legal sources, seems narrow but matters more than people think. A surprising amount of bad decision-making starts with someone citing a title, a summary, or an inaccessible source as though it settled the issue. If you cannot see the substantive content yourself, or you do not have written advisor support that clearly addresses the point, you do not have a reliable basis for a final call.

The containment action is simple. Do not rely on the source until you obtain the full material or a written advisor memo you can actually review. Keep a record of the access issue as well, so there is a clear reason the matter stayed open.

A workable rule of thumb for diagnostic use is this:

• If facts, approvals, and documents align, record that alignment and retain the applicable tax review; alignment alone does not mean low PE risk.
• If one area is drifting but can still be corrected with process and documentation, treat it as review-needed.
• If authority is moving toward you, the client is presenting you as the decision-maker, or the answer depends on legal material you have not verified, escalate.

That distinction keeps you from overreacting to every stray signal and from underreacting to repeated operating drift.

Contract Firewall#

Authority and contract-related conduct need to be reviewed together. A signature held by the client does not settle the issue if you routinely secure the agreement in practice.

Keep the boundaries explicit: authorized client staff should make the commercial decisions assigned to them, while you support delivery. Also track your role in negotiations. HMRC’s PE definition guidance explains a principal-role test as well as contract conclusion. Where the applicable rules use it, habitual work that leads to contracts routinely accepted without material change can matter even if someone else signs.

The reason authority is the main control point is practical. Many engagements can tolerate some document cleanup, some process refinement, or some location clarification without immediately becoming unstable. They become unstable when the market starts treating you as the person who can commit the client. Once that expectation forms, every rushed call, every casual confirmation, and every undocumented handoff becomes harder to explain.

A useful contract firewall does more than include the right sentence. It connects the contract to the actual path a decision follows from request to approval. If you want the contract to work in practice, build the operating steps around it.

If even one of those pieces is materially out of line, the contract firewall is weaker than it looks.

The cleanest way to make the boundary real is to design for handoff. Do not wait until a negotiation or scope issue appears and hope you remember to step back. Set a simple operating rule in advance for what happens when a conversation moves into price, scope, terms, or commitment. Decide who receives those questions, who answers them, and how you document the transfer. If the client has an authorized team, make sure the route to that team is obvious and consistently used.

This does not require a formal policy memo to be effective. Often a short written process note is enough if people actually follow it. The note can cover who approves commercial matters, where signature authority sits, when you should pause a discussion, and what kind of change requires the SOW or approval route to be updated. The value comes from use, not length.

In live discussions, explain delivery implications and route decisions you do not own to authorized client staff. Keep the record of who resolved material terms and what the client changed before approval. A rubber-stamp handoff should trigger review rather than being treated as protection from agent PE.

The same logic applies to written communication. Drafts, redlines, and summaries can all be part of your support role, but the record should show where commercial authority sits. If you circulate language, make sure it is obvious whether it is a draft for review or an approved position from the client. If the workflow hides that distinction, the document trail will not help much later.

Location control also belongs in the review. Correct misleading descriptions across profiles, invoices, directories, and operating notes, then document the client’s actual access and use of the premises. The tax analysis concerns that use, not only the wording.

When scope, location, or delivery patterns change, update the SOW, approval route, and activity records right away. If you use an EOR, treat it as an added control layer, not a complete shield.

That timing point matters. A lot of teams treat change management as paperwork that can wait until the project settles down. For this issue, that delay is risky because the new pattern becomes normal before the controls are updated. If the work moves location, becomes more recurring, or starts including activities with more client-facing or commercial sensitivity, the agreement materials and approval process should be reviewed while the change is happening. Do not wait until several cycles of the new arrangement have already passed.

A practical update sequence usually looks like this:

• confirm what changed in scope, location, or delivery pattern;
• check whether the current SOW and process note still describe reality;
• correct the approval path if decisions are starting to route differently;
• refresh the activity log so the new pattern is documented from the start;
• escalate for treaty and local-law review when the changed pattern raises a question you cannot verify internally.

That sequence keeps the legal review anchored to real facts instead of a mix of old paperwork and new behavior.

It also helps to watch for common firewall failures that do not look serious at first:

• a temporary exception becomes the normal way commercial questions are handled;
• a client asks you to "just keep things moving" and you start closing points informally;
• a fast-moving chat thread replaces the documented approval path;
• a draft response is sent externally without clear indication that final approval is elsewhere;
• internal convenience language turns you into the client's local representative in practice.

None of these failures needs dramatic language to be dangerous. Their risk comes from repetition. The more often they happen, the more they redefine your role.

If you use an EOR, the same discipline applies. An EOR can improve structure and documentation, but it does not replace authority boundaries or consistent conduct. If the operating facts still show shifting authority, local positioning, or recurring activity that has not been reviewed under the applicable rules, the existence of an EOR does not answer the core issue. Treat it as one layer in the control stack, not the whole stack.

A strong contract firewall is less about legal phrasing in isolation and more about whether the engagement can survive close factual scrutiny. If someone reviewed your agreement, your SOW, your emails, your meeting notes, your profile, and your activity record together, would they all tell the same story about your role? That is the standard worth aiming for.

Client Conversation#

After you reset the contract and approval path, make sure the client can see the same control model. Keep the discussion short and operational.

Explain the structure in simple terms: you are an external provider, authorized client staff handle commitments, and material pattern changes trigger treaty and local-law review. Then show evidence instead of theory: the current agreement, SOW, approval path, and dated activity records. That keeps the conversation on controls the client can actually validate.

This conversation usually goes better when you resist the urge to make it sound like a general tax lecture. Most clients do not need a broad explanation of PE concepts from you. They need to understand how the engagement will be run so that responsibilities are clear and avoidable ambiguity is reduced. Keep the discussion tied to who does what, what changed, and what records support the current structure.

A practical flow is:

• state the operating model in plain terms;
• identify the specific point where drift had appeared or could appear;
• show the control that now handles that issue;
• confirm what kinds of change need review before they scale;
• send a short written recap so the understanding is documented.

That is usually enough. Long theoretical discussions often create more confusion than clarity, especially if the client starts treating your explanation as legal advice rather than operational risk management.

It also helps to bring the client back to observable facts. If the issue was authority drift, show the approval map and the corrected routing. If the issue was location framing, show the corrected materials. If the issue was recurring activity, show the dated log and the point at which review is being requested. When the conversation stays tied to records, it is easier for the client to validate the structure and harder for anyone to fall back on vague assumptions.

You do not need to be defensive in this discussion. The tone can be calm and practical. You are not accusing the client of creating risk. You are making the operating model explicit so the team can keep moving without avoidable confusion. That often makes the conversation easier for everyone involved, because most drift starts from convenience rather than intent.

One useful discipline is to avoid leaving the meeting with only a verbal understanding. If the client agrees that commercial approvals stay with authorized staff, that role framing needs to appear in the actual workflow and supporting documents. A concise follow-up email can do a lot of work here. It can confirm the role split, attach or reference the current approval path, note any corrected materials, and record any open point that still needs treaty or local-law review. That way, the discussion produces a usable record rather than just a good meeting.

If the client pushes the conversation into broad hypotheticals, bring it back to the current facts. The question is not every possible PE scenario in the abstract. The question is how this engagement is being run now, what has changed, and what still needs verification. That focus keeps you within a responsible lane and prevents the conversation from drifting into unsupported conclusions.