Cyprus Permanent Establishment Risk (2026): When Your Remote Work Triggers Taxes for Your Employer

You moved to Cyprus for the weather and the 60-day rule. You kept your job with a London, Berlin or Zurich employer and plugged the laptop in. What very few remote workers realise is that this quiet arrangement can create a permanent establishment (PE) in Cyprus for the foreign employer — dragging the employer into the Cyprus tax net, triggering retroactive corporate tax on attributable profit, and causing the employer to either fix the situation or end the employment.

This article walks through the PE tests under OECD Article 5, applies them to remote-employment patterns, and sets out the three fixes actually available.

What is a permanent establishment

Under Article 5 of the OECD Model Tax Convention (adopted in Cyprus’ treaties and the Income Tax Law), a PE is:

• A fixed place of business through which the business of an enterprise is wholly or partly carried on (Art. 5(1)).
• A dependent agent who habitually concludes contracts on the enterprise’s behalf (Art. 5(5)).
• A building site, construction or installation project lasting more than 12 months (Art. 5(3)).
• For services, a service PE threshold (varies by treaty, often 6–9 months of presence in a 12-month period).

When remote work triggers a PE in Cyprus

Core factors that push towards fixed-place PE:

• A specific physical location (home, co-working space) used routinely.
• At the employer’s disposal (paid for by the employer, required by the employer, used exclusively for work).
• For non-preparatory / non-auxiliary activities — i.e. core business.
• Continuous (weeks or months, not a few days).

Factors that push towards dependent-agent PE:

• Employee acts on behalf of the employer.
• Habitually concludes contracts — or plays the principal role leading to conclusion.
• Contracts are in the name of the employer or grant the right to use or sell the employer’s property.

The home-office exception (and its limits)

The OECD Commentary (Art. 5 para. 18) allows for a narrow home-office exception where:

• Use is purely preparatory or auxiliary (record-keeping, communications, administration).
• Not required by the employer; the employee could work from the employer’s office if available.
• Intermittent or incidental.

The exception does not cover: a senior executive performing core functions from home; an engineer writing the product; a salesperson negotiating deals; a consultant delivering to clients. For those roles, a continuous Cyprus home office creates PE risk.

Dependent-agent PE

The 2017 OECD update (BEPS Action 7) expanded dependent-agent PE to cover situations where the agent plays the "principal role leading to the conclusion of contracts that are routinely concluded without material modification by the enterprise." This caught commissionaire arrangements and the modern remote-sales pattern.

For Cyprus treaty purposes, whether the BEPS Action 7 language applies depends on whether the relevant Cyprus treaty has been amended via the OECD Multilateral Instrument. Several Cyprus treaties have adopted the expanded language; others remain on the pre-2017 formulation.

Service PE and construction PE

• Construction PE: applies to building, construction and installation activities lasting more than 12 months (OECD Model). Most Cyprus treaties follow this. Cyprus law itself uses a 3-month (some treaties 6) threshold for limited construction activities.
• Service PE: available in some Cyprus treaties (e.g. India DTT) where services are provided in Cyprus for a prescribed period (often 6 months in a 12-month period).

Consequences of an unintended PE

• Cyprus has primary taxing right over profit attributable to the PE.
• Attributable profit is determined by functional analysis — what functions are performed, what risks are borne, what assets are used in Cyprus.
• Employer must register the Cyprus PE for tax, file TD4 corporate returns, register for VAT if thresholds met.
• Home country gives credit for Cyprus tax or exempts the attributable profit — often after a delay or a domestic dispute.
• Penalties for non-registration can equal or exceed the tax itself.

OECD and Cyprus practice post-COVID

The OECD’s April 2020 guidance (reissued 2021) softened PE enforcement during genuine COVID-forced dislocation: an employee working from a home country they couldn’t leave was not treated as creating PE. Post-2022 this guidance is treated as historical; in 2025 OECD issued a further update stressing that voluntary, permanent remote work arrangements are not protected. Cyprus Tax Department practice (CIRC 2023/05 analogues) tracks this.

Three realistic fixes

1. Cyprus subsidiary of the employer. Employer incorporates a Cyprus company, employs the worker locally, charges an arm’s-length management fee or cost-plus margin back to the parent. Cleanest legal answer; most substantive cost. See our company registration services.
2. Employer of Record (EOR). Employer uses a Cyprus-registered EOR to payroll and manage the worker locally. Fast to implement (days), ongoing monthly cost, no need to create a subsidiary. Good bridge for small numbers or uncertain durations.
3. Restructure the role. Rewrite the employee’s scope so the activities in Cyprus are demonstrably preparatory / auxiliary — no core business, no contract signing, limited decision-making. Rarely workable for senior or client-facing roles. Requires evidenced changes, not just contract language.

Worked scenarios

Scenario 1: UK SaaS engineer, UK employer

Fully remote engineer writing product code from Cyprus. Core business activity. Continuous use of home office for 2+ years. Strong PE risk for the UK employer. Typical fix: the UK employer sets up a Cyprus subsidiary (IP Box-eligible) and migrates the employment; or engages an EOR.

Scenario 2: German consultant with multiple clients

Independent consultant, German residency, working from Cyprus occasionally, serving multiple clients. No PE for clients (independent status). But the consultant may need to register as a Cyprus self-employed person or incorporate a Cyprus company to anchor the Cyprus-side tax treatment.

Scenario 3: Israeli salesperson of a US SaaS

Relocated from Tel Aviv to Limassol, continues as EMEA sales lead negotiating contracts with European enterprises on behalf of the US SaaS. Dependent-agent PE risk is high. Fix: US employer incorporates a Cyprus subsidiary; salesperson becomes its employee; Cyprus sub bills cost-plus to US parent.

Self-assessment checklist

Score one for each Yes:

• I work from Cyprus more than half my working time.
• I use the same home office / co-working desk continuously for more than 3 months.
• My role involves core business activity, not just preparatory / auxiliary tasks.
• I have authority to conclude contracts or play the principal role in doing so.
• My employer knows and permits the Cyprus location.
• I have not been temporarily dislocated — Cyprus is my deliberate home.
• My employer has no Cyprus entity through which to employ me.

Score 3+: material PE risk. Discuss with the employer and initiate a fix. Score 5+:advanced PE risk; the employer is exposed to back taxes if audited.