Permanent establishment risk is among the most consequential – and most underestimated – tax exposures a distributed crypto operation can accumulate. A token issuer incorporated in a low-tax jurisdiction, with founders working from three different countries and validators and servers scattered across five more, may already have created taxable presences in each of those places without a single licence application or a formal office lease. The exposure does not require deliberate planning. It accretes, silently, through the day-to-day decisions of a mobile founder class.
This analysis addresses how permanent establishment doctrine applies to digital-asset businesses operating across borders, where the risk concentrations lie, and how counsel, structuring and operational discipline can manage them. The cross-border angle is not incidental here – it is the entire problem.
What Does Permanent Establishment Risk Mean for a Crypto Business?
A permanent establishment (PE) – a legal concept under most bilateral tax treaties and domestic tax codes by which a foreign enterprise is treated as taxable in a jurisdiction because it has a sufficient business presence there – is the foundational exposure every distributed crypto operation must map before it scales. The classic triggers are a fixed place of business, a dependent agent with authority to conclude contracts, and, in some regimes, a server or digital presence. Digital-asset businesses hit all three categories simultaneously, often without noticing.
Consider the economics. A smart-contract protocol may be "incorporated" in the Cayman Islands or a BVI entity. Its token sale may have been structured through a Swiss foundation. Its core developers work from apartments in Berlin, Lisbon and Singapore. Its on-chain operations run on nodes hosted in data centres across the United States and Asia. Each of those jurisdictions has its own view on what creates a taxable presence. The German tax authority looks at where management decisions are made. Singapore looks at where business is exercised. The United States has layered federal and state exposure. None of them defer to the Cayman register.
In our cross-border practice, the businesses that face the sharpest PE exposure are not, in the main, large exchanges with compliance teams. They are mid-stage token issuers and DeFi infrastructure builders whose founders relocated personally without restructuring the underlying entity – and who assumed the two decisions were the same decision. They are not.
The OECD Model Tax Convention – the template for the vast majority of bilateral income tax treaties in force worldwide – provides the baseline PE analysis. Under its terms, a fixed place of business through which the enterprise wholly or partly carries on its business creates a PE. A dependent agent habitually exercising authority to conclude contracts in the enterprise's name produces the same result. Neither requirement is met by a passive server alone under most treaty interpretations, but active management activity – including on-chain governance participation, business development and client-facing work – performed habitually in a jurisdiction will typically satisfy the fixed-place or agency tests.
The key practical point: where the founders live and work is, in most fact patterns we see, the determinative variable. Not where the entity is registered. Not where the tokens are traded.
The process above describes the standard analytical path. Your facts – the entity's governance structure, where your founders hold authority to bind the business, and where your banking and contract execution actually sit – change the analysis materially.
For a scoped assessment of your group's PE exposure, contact OBOLUS at info@oboluslaw.com. Map your options
How Does the Fixed-Place Trigger Apply to Distributed Teams?
A home office used habitually by a senior employee or founder to manage the business's affairs is, under OECD guidance adopted by most treaty partners, capable of constituting a fixed place of business – and therefore a PE. This is the risk that most distributed crypto teams underestimate. It is not hypothetical. Tax authorities across Western Europe, the United Kingdom and increasingly Southeast Asia have started auditing the working arrangements of mobile digital-asset founders, and the burden of disproving a fixed place falls on the taxpayer.
Three conditions govern whether a home-office arrangement tips into PE territory. First, there must be a degree of permanence or regularity: casual or temporary presence does not suffice, but a developer who consistently codes and deploys from a Berlin apartment three days a week likely meets the threshold. Second, the place must be "at the disposal of" the enterprise: for an employer-employee relationship, this is generally presumed where the employer does not provide an alternative workspace. Third, the enterprise's business must be carried on through that place: routine administrative tasks may not qualify, but executing smart-contract upgrades, negotiating commercial agreements or managing treasury operations almost certainly will.
For crypto operations, the fixed-place analysis intersects with a secondary question: does the deployment of validator nodes or sequencer infrastructure in a jurisdiction constitute a fixed place? Most treaty commentators – and most domestic interpretations of the OECD model – hold that a server alone, passively operated, does not create a PE absent human activity attached to it. However, where technical staff are habitually co-located with infrastructure to manage it, the combined presence may satisfy both the fixed-place and agency tests simultaneously. We have seen tax authority positions that take exactly this approach in major European markets.
The practical implication for operators is that engineering headcount decisions are tax decisions. Hiring an in-country technical lead who also holds commercial authority – a common pattern in early-stage Web3 businesses – compresses two separate PE triggers into one hire.
Does a Local Business Development Contact Create a Permanent Establishment?
A dependent agent habitually concluding contracts – or playing the principal role in the process of concluding contracts – in the name of a foreign enterprise creates a PE under the agency limb of the OECD model, even without a fixed place. This is the trigger most commonly activated by a crypto business that hires a "partnerships lead" or "regional head" in a target market without structuring the role carefully.
The agency PE limb requires two elements: dependency (the agent acts primarily on the instructions of the enterprise, not independently) and habitual exercise of authority to conclude contracts in the enterprise's name. Agency here is an economic and functional concept, not merely a legal one. An employee who negotiates all material terms of exchange listing agreements, institutional custody arrangements or token-distribution partnerships, even if the contract is formally executed by offshore management, will often satisfy both tests.
Two structural responses are available. First, the role can be designed as a genuinely independent agent: a locally licensed intermediary operating for multiple principals, on its own account, for whom the "primarily for one enterprise" dependency test is not met. In a crypto-business context this requires genuine commercial independence and its own client book – not simply a service agreement with a single token issuer. Second, the role can be designed as a preparatory or auxiliary function, which the OECD model explicitly exempts from PE status. Gathering market intelligence, attending conferences and providing information does not typically create an agency PE; negotiating and closing does.
In our practice, the businesses that most frequently crystallize this exposure are those where the founder personally – rather than a formal local entity – acts as the commercial representative in a new market while the operating entity remains offshore. The founder's activity is attributed to the enterprise, and the enterprise's offshore status does not insulate it from PE characterization in the jurisdiction where the founder works.
What Tax Exposure Do Validators, Nodes and Protocol Infrastructure Create?
The tax status of protocol infrastructure – validators, sequencer nodes, RPC endpoints and on-chain governance participation – sits at the frontier of PE doctrine, and the answers vary significantly by jurisdiction. The OECD baseline position treats a server as a PE only where human activity is habitually attached to it in the taxing jurisdiction. Under that reading, a passively operated validator running in a data centre in Frankfurt, with no staff involvement in Germany, does not on its own create a German PE for the protocol entity. That analysis is reasonably settled for conventional server infrastructure.
The complications arise in three directions. First, some jurisdictions maintain domestic PE rules that are broader than the OECD model. They may treat a server as creating a taxable presence based on revenue generated through or by equipment in the jurisdiction, regardless of human attachment. Operators building multi-chain infrastructure should map domestic deviations from the model treaty before selecting node host locations. Second, staking economics create a distinct exposure: if the protocol entity itself receives staking rewards, those receipts may be characterized as business income attributable to the infrastructure activity, not merely passive investment return, in the jurisdiction where the node is active. Third, governance activity – particularly on-chain voting by a foundation or DAO treasury – can be characterized as the exercise of commercial authority in the jurisdiction where the voter is resident.
The Travel Rule (the FATF obligation to pass originator and beneficiary data with virtual asset transfers) and associated AML compliance obligations under frameworks such as MiCA/ESMA and the Singapore Payment Services Act are distinct from PE analysis, but both sets of obligations converge on the same question: where, functionally, does the business operate? Regulators and tax authorities are increasingly sharing the answers to that question.
For token-issuing entities, the most common infrastructure PE risk is a foundation that retains operational control over a live protocol while relying on a legal structure that places all economic activity in an offshore holding entity. Where the foundation's directors or technical committees make decisions – upgrade the protocol, set fee parameters, manage treasury – those decisions create functional presence wherever those individuals sit.
How Should a Cross-Border Holding Structure Be Designed to Manage PE Risk?
A well-constructed holding structure for a digital-asset group separates legal ownership, operational activity and regulatory presence into distinct entities, each with genuine substance in its jurisdiction of residence. PE risk management is a central objective of that separation – not an afterthought added at the point of an audit. The four structural variables that determine PE risk are: where management decisions are made (board and key personnel residency), where contracts are concluded (commercial authority), where banking and treasury are controlled (signatory location and authority), and where technical operations are supervised (engineering management).
A typical multi-jurisdictional stack for a mid-sized digital-asset business might include a holding company in a treaty-efficient jurisdiction, an operating subsidiary in a licensing hub with genuine commercial activity and local substance, a foundation in a jurisdiction sympathetic to protocol governance, and a services entity for the engineering and product team. The PE analysis for each layer turns on whether the activities of that layer "bleed" into another jurisdiction through the activity of personnel based there.
The bleeding is almost always through people, not through registered addresses. A holding company whose sole director is a Swiss resident who physically executes all board decisions in Zurich has Swiss substance. The same holding company, directed by a UK-resident founder who attends board calls from London and signs documents remotely through a DocuSign workflow, may well have a UK PE – regardless of the Cayman address on the memorandum of association.
Decision matrix, by operator profile:
Profile A – Early-stage token issuer, two founders, pre-revenue: The primary PE risk is founder residency. If both founders are tax-resident in high-tax jurisdictions and the operating entity is offshore, the group is almost certainly a PE in both founders' home jurisdictions. The short-term priority is to align founder residency with a genuine substance plan – not merely to relocate, but to restructure commercial authority so that the entity's decisions are made where the founders formally reside. Indicative timeline for a clean restructure: several months, depending on the target jurisdiction's residency programme and treaty network. Key risk: a rushed relocation without renegotiating signatories, banking authority and employment contracts replicates the problem in a different jurisdiction.
Profile B – Exchange with regulatory licence in one EU jurisdiction, expanding commercially into two others: The PE risk here is the agency limb. Local partnerships staff, KYB/KYC officers and commercial managers hired in the expansion markets will each require a careful role-design review. The licensing position under MiCA passporting determines whether the expansion is a regulated activity that requires a branch or only a commercial activity that can be managed through the home-country entity. The two analyses – regulatory and tax – must be run in parallel. Timeline for a compliant expansion structure: varies by the target member state's tax authority posture and the pace of MiCA implementation by the national competent authority.
Profile C – DeFi protocol with a Cayman foundation and global developer community: The primary risks are foundation governance PE (where board meetings and protocol upgrade decisions occur) and staking/node infrastructure PE (where validators are hosted and supervised). The design priority is to ensure that the foundation's directors are genuinely resident and active in a single jurisdiction, that board decisions are made and documented there, and that node operations are either genuinely passive or structured through a separate operating entity with its own substance. Key risk: a foundation whose directors attend meetings "by videoconference from wherever they happen to be" has no fixed management seat and is likely to be treated as resident – and potentially a PE – in the jurisdiction where the most senior director habitually works.
Why Is Relocating Personally Not Enough to Change the Group's Tax Position?
A common assumption in the crypto founder community is that relocating personally to a territorial or zero-tax jurisdiction resolves the group's tax exposure. It does not, and it is perhaps the most persistently misunderstood aspect of digital-asset tax planning. Personal tax residency and corporate PE analysis are parallel but independent inquiries. Resolving one without addressing the other leaves the majority of the group's exposure intact.
When a founder relocates from, say, Germany to Portugal or Dubai, their personal income tax position changes – but the German tax authority's analysis of where the operating company's management is exercised does not. If the founder continues to direct the company's commercial and technical operations from their new location, the management activity simply follows them. The company acquires a PE in Portugal or the UAE instead of – or in addition to – Germany. The relocation relocates the PE. It does not eliminate it.
The structural step that personal relocation must be accompanied by is the transfer of genuine decision-making authority to an entity with substance in the new jurisdiction. That means: a reconstituted board that meets and decides in the target jurisdiction, employment and service agreements that reflect the new reality, banking and treasury authority that sits in the new jurisdiction, and commercial agreements executed by local management. It also means that any remaining activity in the old jurisdiction – a family member managing investor relations from the former home, a co-founder who did not relocate – continues to be assessed independently and may sustain the original PE.
In a recent matter, a token issuer had relocated its two principals to a Gulf Cooperation Council jurisdiction but retained a third co-founder in Western Europe as a technical co-director with authority to execute cloud infrastructure agreements. The technical co-director's activity was sufficient, on the facts, to sustain a PE analysis in the European jurisdiction. The fix required disaggregating the co-founder's authority and restructuring the infrastructure management function through a separately capitalised services entity in the GCC jurisdiction. The restructure added several months to the timeline and generated a significant legal cost that a properly sequenced initial structure would have avoided.
If a prior structure was designed without coordinating founder residency with the holding entity's substance plan, a second read of the group's position can surface the structural gap and the route to a clean outcome. Write to us at info@oboluslaw.com or map your options.
Where Do AML Compliance Obligations and PE Risk Converge?
Regulatory compliance activity and tax PE analysis increasingly share the same factual substrate – and the regulatory disclosures a business makes to one authority are accessible, in many jurisdictions, to another. A business that applies for a CASP authorisation (crypto-asset service provider licence) under MiCA in Lithuania or Malta discloses, in that application, where its management sits, where its key personnel are located, and where its AML function is performed. Those disclosures are the same facts a tax authority uses to assess PE. A business that registers with the FCA under the UK Money Laundering Regulations makes analogous disclosures. The convergence is not coincidental.
FATF Recommendation 15 – the international standard that requires virtual asset service providers to implement AML/CFT controls proportionate to the risks they present – requires VASPs to identify and assess the jurisdictions in which they operate. A VASP that identifies itself as operating in a jurisdiction for AML purposes has simultaneously placed that jurisdiction in play for PE analysis. The practical discipline is to ensure that the regulatory and tax characterization of the business's presence in each jurisdiction are consistent and defensible – not that they minimise disclosure, but that they accurately reflect the substance of where the business operates and are structured accordingly.
The Travel Rule – the FATF obligation requiring virtual asset service providers to transmit originator and beneficiary information with transfers – adds a further layer. Compliance with the Travel Rule requires a VASP to identify its counterparts in each jurisdiction where it sends or receives transfers. That identification process creates a documented record of the jurisdictions in which the VASP is commercially active – again, the same facts relevant to PE assessment. Operators who treat AML compliance as a regulatory silo, separate from their tax and structuring decisions, routinely produce disclosure documents that are internally inconsistent with their corporate structure.
How Are Staking Rewards and Protocol Fees Treated for Tax Purposes Across Jurisdictions?
Staking rewards and protocol fees present one of the more technically contested areas of digital-asset taxation, and the answers vary substantially by jurisdiction and by the characterization of the recipient entity's activity. There is no settled international consensus, and the analysis turns on whether the staking or fee-generating activity is characterized as a business activity, an investment return or a form of income akin to interest or royalties.
For a foundation or protocol entity that directly operates validators, the dominant analysis in most common-law and OECD-aligned jurisdictions is that staking rewards are business income – receipts from an active operation, taxable where that operation has its PE. For a passive token holder receiving staking rewards through a liquid staking protocol, the analysis is more contested: some jurisdictions characterize the reward as income on receipt, others as accretion to the token's cost basis realized only on disposal. Both positions have been adopted by tax authorities in major markets, and neither has been decisively settled by binding domestic authority in most jurisdictions.
Protocol fees – the revenue generated by a live protocol and distributed to its governance token holders or treasury – raise a further question: whether the protocol entity's receipt of those fees constitutes passive royalty income, active business income or a return of capital. The answer determines not only the rate at which the income is taxed but whether it is taxable in the protocol entity's jurisdiction of residence or in the jurisdiction of the users who generate the activity. Where fees are generated by users in a jurisdiction that taxes on a source basis, a PE in that jurisdiction could bring protocol fee receipts within the taxing jurisdiction's reach.
In our structuring practice, we consistently advise that the tax characterization of staking and fee income must be locked down before the protocol launches commercially – not after the first significant revenue quarter, when reclassification or restructuring carries the additional burden of addressing historic periods. A holding structure that is tax-efficient for capital appreciation may be poorly positioned for operating revenue, and the two planning objectives require reconciliation at the outset.
Related at OBOLUS
- Tax and Cross-border Structuring for Digital-Asset Businesses – how OBOLUS builds and reviews multi-jurisdictional holding structures for crypto groups
- Transfer Pricing for Crypto Groups – the legal framework governing intra-group charges across digital-asset holding structures
- VASP Licensing in Germany under BaFin – regulatory requirements for digital-asset businesses seeking authorisation in Germany
A Common Assumption: The Smart-Contract Entity Has No Employees, So There Is No PE
A common assumption among founders structuring protocol entities is that because a deployed smart contract operates autonomously – executing code without human intervention once deployed – the entity that deployed it has no ongoing operational presence in any jurisdiction and therefore no PE exposure. This reasoning is structurally flawed in most jurisdictions, and the flaw is worth addressing directly.
First, a live protocol is not self-governing in practice. It requires governance decisions, security management, upgrade proposals, treasury management and community engagement. The humans who perform those functions – wherever they sit – are performing business activity on behalf of the entity. Their activity creates presence. Second, most domestic tax codes assess PE on the basis of where business is effectively managed, not merely where the autonomous technology operates. A protocol entity whose board meets once a year in the Cayman Islands but whose core contributors make daily operational decisions from European capitals will typically fail the effective management test in the Cayman Islands and pass it in Europe. Third, even where a jurisdiction accepts that an autonomous protocol creates no traditional PE, it may assert taxing rights on a different basis – for example, by treating the protocol as a conduit for royalty income sourced from users in its territory.
The more sophisticated version of this assumption is that a DAO (decentralized autonomous organization) – an on-chain governance structure in which token holders vote on proposals without a central management body – has no legal personality and therefore cannot have a PE. The DAO structure does not resolve the PE question for the foundation, association or other legal wrapper that holds the DAO's assets and interfaces with the legal system. That wrapper entity is the subject of PE analysis, and its PE is determined by the activity of its officers and authorised contributors, wherever they are located.
Self-Assessment: Mapping Your Group's Permanent Establishment Exposure
The following checklist does not substitute for legal advice, but it identifies the factual questions that determine where a distributed crypto operation's PE exposure concentrates. Operators who cannot answer each question with documentary support are likely to have unmanaged exposure.
First: where are each of your founders, directors and authorised officers tax-resident, and where do they habitually perform their functions for the business? The answer to this question is almost always the primary PE indicator. If the answer changes frequently, or if it differs across founders, the analysis must be done jurisdiction by jurisdiction for each individual.
Second: who has authority to conclude contracts on behalf of each entity in your group? Where do they exercise that authority, in practice? The formal signatory on a DocuSign envelope and the person who negotiated the agreement are both relevant. If the negotiator is in a different jurisdiction from the signatory, both jurisdictions are in play.
Third: where are your banking and treasury management functions performed? Who controls the multisig wallets or the fiat bank accounts, and from where? Treasury control is consistently treated by tax authorities as a management activity. An offshore treasury managed by a founder in a high-tax jurisdiction gives that jurisdiction a strong PE argument.
Fourth: where are your servers, nodes and protocol infrastructure hosted, and who in your organization manages them? If your engineering team is in one jurisdiction and your entity is in another, the engineering management activity creates presence in the engineer's jurisdiction.
Fifth: what do your regulatory filings say about where you operate? As noted above, CASP applications under MiCA, VASP registrations under frameworks such as the BVI FSC's VASP Act, and AML compliance documentation all assert facts about operational geography. Those facts must be consistent with your tax position or one of the two is wrong.
FAQ
Where should a token-issuing entity be domiciled?
Domicile selection for a token issuer depends on several intersecting factors: the jurisdiction's tax treatment of token sale proceeds and subsequent protocol revenue, its treaty network, its regulatory classification of the tokens being issued and the substance requirements it imposes on resident entities. There is no universally correct answer. The Cayman Islands, Switzerland, Singapore and certain EU jurisdictions are each appropriate for different profiles. The decision must be made jointly with personal residency planning for the founders, because the entity's domicile is only effective if the founders' activity supports genuine substance there.
How are staking rewards taxed?
The tax treatment of staking rewards is not settled in most jurisdictions. Common approaches treat rewards as income on receipt, taxable at the recipient entity's applicable rate. Where the staking activity is conducted by a business entity, the income is typically characterized as business income, taxable where that business has its PE. For holding entities or passive investors, some jurisdictions characterize rewards as a return of capital or defer tax to the point of disposal. The applicable treatment varies by jurisdiction and by the nature of the staking arrangement. Advice specific to your structure and residency is essential before your protocol goes live.
Does remote working create tax residency risk?
Yes, in most jurisdictions. A director, founder or senior employee who habitually performs substantive business functions – commercial decisions, contract execution, treasury management, technical governance – from a jurisdiction where they are personally tax-resident creates PE risk for the employing or directing entity in that jurisdiction. The risk is present regardless of where the entity is incorporated. Remote-working arrangements for senior personnel should be reviewed as a tax-structuring matter, not merely an HR one, before they are formalised.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We align founder residency with holding structures and exit plans – a coordination that, in our experience, is the single most valuable step a distributed crypto operation can take before its first significant revenue quarter. To discuss your situation, contact info@oboluslaw.com.
To pressure-test your structure before you commit, message us via t.me/oboluslaw or contact us at Map your options.
By Lydia Brennan, Tax & Structuring Analyst – specialising in cross-border holding structures, PE analysis and crypto tax characterisation for digital-asset businesses operating across multiple jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.