United Kingdom
Make employment in the United Kingdom easy. Let us handle payroll, benefits, taxes and compliance. Benefit from a personalised service, and direct contact with our expert team.
EOR Risks explained
Risks of Using an Employer of Record: What You Need to Know
Using an Employer of Record in the UK is one of the safest ways to hire internationally. But "safest" does not mean "risk-free." Like any business relationship, there are things that can go wrong, and it is worth understanding them before you commit.
The good news is that most EOR risks are manageable. They are not reasons to avoid using an EOR. They are reasons to choose your provider carefully and to set up the relationship properly from the start.
This guide covers the main risks of using an EOR, what they mean for your business, and how to mitigate each one.
What are the risks of using an Employer of Record?
The main risks of using an EOR are loss of direct control over the employment relationship, dependency on a third party for compliance, hidden fees, data security concerns, permanent establishment risk, and a potentially less personal employee experience. Each of these risks is real, but each one can be mitigated with the right provider and the right approach.
Loss of direct control
When you use an EOR, the EOR is the legal employer. This means the employment contract is between the employee and the EOR, not between the employee and your company. Any changes to the contract, such as a pay rise, a change in hours, or a new job title, must go through the EOR.
This can feel restrictive, especially if you are used to managing employment directly. If you want to give someone a pay rise, you cannot just update their contract yourself. You need to contact the EOR, request the change, and wait for them to process it.
How to mitigate this risk
Choose an EOR with a dedicated account manager who knows your business. A good account manager will process changes quickly and efficiently, often within the same day. Some EOR providers also offer self-service platforms that let you request contract changes directly, reducing the back-and-forth.
It is also worth setting expectations with your employees from the start. Explain that the EOR is the legal employer and that certain administrative changes will go through them. Most employees understand this, particularly if the process is smooth and transparent.
Dependency on third-party compliance
Your employees' payroll, tax, pension, and compliance are in the hands of the EOR. If the EOR makes a mistake, it can affect your employees and your business. A payroll error, a missed pension contribution, or a failure to comply with UK employment law can have serious consequences.
This risk is not theoretical. HMRC can impose penalties for late or incorrect PAYE returns. The Pensions Regulator can fine employers who fail to meet their auto-enrolment obligations. And employees can bring employment tribunal claims if their statutory rights are not respected.
How to mitigate this risk
Choose an EOR with a strong track record and deep UK expertise. Look for providers that own their own UK entity (rather than partnering with a third party), employ CIPD-qualified staff, and have a clear process for handling compliance issues.
Ask potential providers about their compliance track record. Have they ever had a HMRC penalty? Have they ever had a Pensions Regulator enforcement action? A reputable provider will be transparent about this.
It is also worth reviewing your EOR's compliance processes periodically. Ask for evidence of RTI submissions, pension contribution records, and right-to-work check documentation. A good EOR will provide this without hesitation.
Hidden fees
Some EOR providers advertise low base fees but charge extra for services that you might expect to be included. Common hidden fees include:
- Benefits administration (private health insurance, life insurance)
- Payroll changes (salary adjustments, bonus payments)
- Compliance updates (changes to employment law)
- Offboarding (managing notice periods, redundancy)
- Reporting (custom reports, data exports)
- Account management (dedicated support vs shared support)
The total cost can end up being significantly higher than the headline fee, particularly if you have a lot of changes or a complex employment structure.
How to mitigate this risk
Ask for a complete fee schedule before you sign anything. Make sure you understand what is included in the base fee and what costs extra. Ask about minimum commitments, early termination fees, and any other charges that might apply.
A good EOR provider will be transparent about its pricing. If a provider is vague about fees or reluctant to provide a written fee schedule, treat that as a red flag.
For a detailed comparison of EOR pricing, see our guide to the best Employer of Record providers in the UK.
Data security concerns
The EOR will have access to sensitive employee data, including salary information, bank details, national insurance numbers, and personal identifiers. This data is valuable to cybercriminals, and a data breach at your EOR provider could expose your employees' personal information.
Under the UK GDPR and the Data Protection Act 2018, both you and the EOR have obligations to protect personal data. If there is a breach, the Information Commissioner's Office (ICO) can impose fines of up to £17.5 million or 4% of global annual turnover, whichever is higher.
How to mitigate this risk
Ask potential EOR providers about their data security practices. Do they hold ISO 27001 certification? Do they conduct regular penetration testing? How is employee data stored and encrypted? What is their incident response plan?
It is also worth reviewing the data processing agreement (DPA) that forms part of your EOR contract. The DPA should clearly set out the EOR's obligations under UK GDPR, including data retention periods, breach notification procedures, and the technical and organisational measures in place to protect personal data.
Permanent establishment risk
Permanent establishment (PE) is a tax concept that determines whether your business has a taxable presence in a country. If your UK activities are deemed to create a PE, your company could be liable for UK corporation tax on profits attributable to that PE.
Using an EOR can help manage PE risk because the EOR is the employer, not your company. However, it does not eliminate the risk entirely. If your UK employees are acting on behalf of your company in a way that creates a fixed place of business or concludes contracts in the UK, HMRC could still argue that you have a PE.
How to mitigate this risk
Understand the PE rules before you start hiring in the UK. The UK's double tax treaties set out the conditions under which a PE can be created, and the specific rules vary by treaty.
Choose an EOR provider that understands PE risk and can advise you on how to structure your UK activities to minimise the risk. A good EOR will not just employ your workers; it will help you understand the broader tax implications of your UK operations.
If you are concerned about PE risk, it is worth taking professional tax advice in addition to using an EOR. The EOR can manage the employment side, but a tax adviser can help you understand the corporate tax implications.
Employee experience
When you use an EOR, your employees may feel disconnected from your company. Their payslip comes from the EOR, their contract is with the EOR, and their pension is managed by the EOR. They work for you in practice, but their legal employer is a company they may never have heard of.
This can affect employee engagement, particularly if the EOR's processes are impersonal or slow. An employee who has a payroll query wants it resolved quickly, by someone who understands their situation. If they have to call a shared support line and explain their issue to a different person every time, it creates frustration.
How to mitigate this risk
Choose an EOR with a dedicated account manager model. A dedicated manager knows your employees, understands their situations, and can resolve issues quickly. This makes the EOR feel less like a faceless third party and more like an extension of your HR team.
It is also worth investing in your own internal communication. Make sure your employees understand why you are using an EOR, what it means for their employment, and how the EOR relationship works. Transparency builds trust.
What to do if things go wrong
If something does go wrong with your EOR, the steps you take depend on the nature of the problem.
Contact your EOR immediately and request a correction. If the error results in an incorrect PAYE submission, the EOR should file an adjustment with HMRC. If the error affects your employee's pay, it should be corrected in the next pay cycle.
If the EOR fails to meet a compliance obligation (for example, a missed pension contribution or a late RTI submission), raise it with your account manager immediately. The EOR should take corrective action and, if a penalty has been imposed, take responsibility for it.
If you become aware of a data breach at your EOR, follow your own incident response plan and notify the ICO if required under UK GDPR. The EOR should also have its own incident response plan and should notify you of the breach without undue delay.
If you have a contractual dispute with your EOR, refer to your service agreement. Most EOR contracts include dispute resolution provisions, typically starting with informal resolution and escalating to mediation or arbitration if necessary.
The best way to deal with problems is to prevent them from happening in the first place. Choose a reputable provider, set clear expectations, and maintain open communication.
How to choose a low-risk EOR provider
The risks described above are manageable, but only if you choose the right provider. Here is what to look for:
A provider that owns its own UK entity has more control over the employment relationship and can respond more quickly to issues. Providers that use third-party partners add a layer of complexity.
UK employment law is complex and changes frequently. CIPD-qualified staff have demonstrated a thorough understanding of UK employment practices.
A provider that is upfront about its pricing is less likely to surprise you with hidden fees.
A dedicated manager who knows your business can resolve issues faster and more effectively than a shared support team.
Look for ISO 27001 certification or equivalent. This demonstrates that the provider takes data security seriously.
The service agreement should clearly set out the responsibilities of both parties, the fees, the service levels, and the dispute resolution process.
Ask for references from existing clients. A provider with a strong track record is more likely to deliver a reliable service.
If you are comparing EOR providers, see our guide to the best Employer of Record providers in the UK for a detailed comparison.
Agility EOR is far more than just a service provider. We’re flexible, innovative and focused on outstanding client service. Supporting you every step of the way – and valuing your people as the cornerstone of success.
Frequently asked questions
The main risks are loss of direct control over the employment relationship, dependency on a third party for compliance, hidden fees, data security concerns, permanent establishment risk, and a potentially less personal employee experience. Each of these risks can be mitigated with the right provider.
Yes, using an EOR is generally safe, provided you choose a reputable provider. The EOR model is well established and used by thousands of businesses worldwide. The key is to choose a provider with a strong track record, transparent pricing, and deep compliance expertise.
Contact your EOR immediately and request a correction. If the error results in an incorrect PAYE submission, the EOR should file an adjustment with HMRC. A good EOR will take responsibility for errors and correct them promptly.
The EOR will have access to employee data, including salary information, bank details, and personal identifiers. This is necessary for the EOR to fulfil its role as the legal employer. However, the EOR should have robust data security measures in place to protect this data.
If you decide to stop using your EOR, you will need to transfer your employees to your own entity or to another EOR. In the UK, this process is governed by TUPE (Transfer of Undertakings Protection of Employment) regulations, which protect the employees' terms and conditions during the transfer. Your EOR should support you through this process.
Ask your EOR for evidence of compliance, including RTI submission records, pension contribution records, and right-to-work check documentation. A good EOR will provide this without hesitation. You can also check with HMRC and the Pensions Regulator if you have concerns.
Speak to an expert
If you are considering using an Employer of Record in the UK, Agility EOR can help. Our team of CIPD-qualified specialists handles contracts, payroll, tax, and compliance, with a dedicated account manager for every client. Get in touch to find out how we can support your UK hiring.