You found someone good. Four rounds of messages on OnlineJobs.ph, a paid test task that came back clean, and you have agreed $6 an hour for 40 hours a week starting Monday. Somebody in the thread sent you a one-page template with “Independent Contractor Agreement” across the top. You changed the names, you both signed it, and in your head the paperwork is done.
That document is the part most people get wrong. Usually it is a quiet mismatch between what the contract says and what happens daily, sitting there until something forces a look.
The short version: whether your overseas virtual assistant is a contractor or an employee is decided by how the work really runs, not by the title on the agreement. Who controls the method, who supplies the tools, whether someone else could do it, whether they work for anyone else, whether the role is integrated into your business. Two or three different authorities can each apply their own version of that test to the same person, and they can reach different answers. For most small buyers the real exposure is modest. It is worth an hour now rather than a surprise in year three.
What follows is general information drawn from official guidance, not legal or tax advice. Status is fact-specific, and once an arrangement is full-time or long-running you want a short paid conversation with an adviser in your own country.
“Contractor” is a conclusion, not a choice
Every tax authority treats the label as evidence, and weak evidence at that. The IRS sets out three categories for US payers. Behavioral control: does the business control, or have the right to control, what the worker does and how they do it. Financial control: how the worker is paid, whether expenses are reimbursed, who provides the tools. Type of relationship: written contracts, employee-type benefits, whether the relationship will continue, and whether the work is a key aspect of the business. No single factor decides it.
Read those back against a typical virtual assistant arrangement. You set hours that overlap yours. You specify the tool and often the method. You bought the Workspace seat and the password manager licence. The relationship is open-ended, and the work is the administrative spine of the business. Five indicators, all pointing one way.
The UK version splits in an unhelpful place. GOV.UK says someone is probably self-employed if most of a short list holds: they bid or quote for work, they are not under direct supervision, they invoice, they pay their own tax and National Insurance, and they get no holiday or sick pay. The trap is the note underneath. HMRC may treat someone as self-employed for tax while their employment law status differs, so a UK buyer has two questions, not one. HMRC’s CEST tool answers the tax one, and HMRC says it stands by the result as long as your inputs were accurate. Keep the printout.
The Philippine test, which matters more than buyers realise
If your assistant is in the Philippines, Philippine labour law has its own view, and it is the one they would rely on if things ended badly. The Supreme Court applies the four-fold test, put in Felicilda v. Uy as “(1) the selection and engagement of the employee; (2) the payment of wages; (3) the power of dismissal; and (4) the power to control the employee’s conduct, or the so-called ‘control test.'”
The fourth element carries the weight. The Court calls the power to control the work “the most significant determinant” of the relationship, and what catches foreign buyers is this: it covers the right to determine both the ends and the means, and actual supervision is not required. You do not have to watch them. Having the power to tell them how is enough.
What actually changes if you have it wrong
US payers. Domestic misclassification means back employment taxes and penalties, with relief routes including the Voluntary Classification Settlement Program for employers who reclassify prospectively. Cross-border is structurally different. The IRS sources personal service income by where the services are performed, “regardless of where the contract was made, or the place of payment, or the residence of the payer,” so work done by a non-resident alien entirely outside the United States is foreign-source income. That is why you are generally not issuing a 1099-NEC to a VA in Cebu and not withholding US tax. Collect a Form W-8BEN so your file shows why.
UK payers. The off-payroll rules target workers supplying services through their own intermediary, which is not the shape of a direct engagement with an individual abroad. The exposure is less about PAYE than about what you told your insurer and what you tell a client who asks who touches their data.
The Philippines. The one people ignore because it feels remote. An assistant who believes they were an employee can put the question to DOLE or the NLRC, and the four-fold test is what gets applied. The realistic downside is not a raid. It is a claim for statutory entitlements you never budgeted for, brought by someone holding three years of Slack messages showing you directing their work hour by hour.
Honest read on likelihood. A part-time assistant with other clients, on their own laptop: this rarely goes anywhere. A full-time exclusive assistant of four years on your equipment, your schedule, with an @yourcompany.com address and a slot on your team page: the label is doing no work at all.
The Philippine specifics that catch people out
13th month pay is statutory, and narrower than the forums suggest. Under Presidential Decree 851 and DOLE’s annual guidance, most recently Labor Advisory No. 16, Series of 2025, rank-and-file private sector employees who worked at least one month in the calendar year get it: one twelfth of total basic salary earned that year, on or before 24 December, no exemptions or deferrals, with a compliance report filed through DOLE’s portal by 15 January. The advisory is written for employees. A genuine contractor sits outside it.
Which creates a trap. Many buyers pay a 13th month bonus voluntarily because it is customary, and that is often smart. Just know what you are doing: paying a statutory employee benefit to someone you classify as a contractor is another fact on the employee side. Call it a discretionary performance bonus in writing, and do not tie it to one twelfth of annual pay.
On the three contribution systems: for a contractor engaged directly by a foreign client you remit nothing and they handle their own.
- SSS. Coverage of self-employed persons is compulsory under the Social Security Act for anyone not over 60 at initial registration, and they pay their own contributions on declared monthly earnings. Your assistant is a self-employed member, not your employee for SSS purposes.
- PhilHealth. The rate for direct contributors is 5% for 2026, the final scheduled step under the Universal Health Care Act, with an income floor of ₱10,000 (a fixed ₱500 a month) and a ceiling of ₱100,000 (capped at ₱5,000). Self-paying members carry the whole 5%; an employed member splits it with an employer.
- Pag-IBIG. Mandatory for the formal employed sector. Self-employed and non-fixed-income workers join voluntarily, from around ₱100 a month, with no employer counterpart.
Your assistant funds SSS and PhilHealth out of the rate you agreed, with no employer share behind it. That gap between your $6 an hour and a local employer’s equivalent is worth weighing when you set the number.
When a virtual assistant creates a tax presence for you abroad
Permanent establishment gets either ignored or wildly overstated. If someone acting on your behalf abroad does enough there, that country can treat you as having a taxable presence, with filings and a slice of profit attributed to it.
HMRC’s international manual sets out the dependent agent test, which has the same shape in most modern treaties. Under older wording, an agent who “habitually exercises an authority to conclude contracts in the name of the non-resident enterprise” creates one. Under the 2017 OECD Model wording the bar moved lower, catching someone who habitually concludes contracts or “habitually plays the principal role leading to the conclusion of contracts that are routinely concluded without material modification by the enterprise.” Promotion or marketing that does not directly result in a contract does not count.
Apply that to real VA work. Inbox triage, calendar management, data entry, bookkeeping support, research, social posting: none of it concludes contracts. Low risk. The picture changes when the job title drifts, as it very often does, into sales. If your assistant negotiates terms, issues quotes you rubber-stamp and closes deals in your name from Manila, you are in the zone the rule was written for, and that needs a cross-border tax adviser rather than a blog post. Two things cut the exposure cheaply: keep pricing and final acceptance of contracts with you, in writing, and do not hand an offshore assistant signing authority because it is convenient.
What an employer of record does, and what it costs
An employer of record already has a legal entity in your assistant’s country. It hires them there on a local contract, runs payroll, remits statutory contributions, handles 13th month pay where it applies, and manages termination under local rules. You keep direction of the work; the EOR carries the employment relationship. Short of opening your own entity, it is the only clean way to run a full-time, exclusive arrangement.
Deel lists EOR at $599 per employee per month on top of salary, contractor management at $49, and a contractor-of-record product at $325 for engagements where classification risk is the thing being bought out. Read those as list prices, before negotiation and before country add-ons such as mandatory benefits or deposits.
My view, and it is a view: at $6 an hour full-time, $599 a month is a 57% uplift on a roughly $1,040 salary. That is a lot for one administrative hire, and most buyers with a single VA should not use an EOR. It earns its fee at three or more people in one country, for a hire holding something you genuinely cannot lose, or where a customer contract or an investor requires you to show clean employment.
The data protection duty almost nobody puts in the contract
This is the part most likely to be tested, and customers do the testing rather than governments: the first serious B2B client you win will send a security questionnaire asking who has access to their data.
If you are in the UK or EU and your assistant handles personal data belonging to your customers, you are the controller and they are a processor. UK GDPR Article 28(3) requires a written contract covering eight things: processing only on documented instructions, a duty of confidence, appropriate security, sub-processor terms, help with individuals’ rights, assistance with security, breach notification and DPIAs, deletion or return of data at the end, and submitting to audits. That duty does not scale with the size of the processor. A one-person assistant in Davao is a processor in exactly the way AWS is.
Then the transfer. Sending personal data to the Philippines is a restricted transfer, and the Philippines does not appear in UK or EU adequacy regulations. ICO guidance says every restricted transfer must rest on adequacy regulations, appropriate safeguards, or an exception. For a small buyer that means the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, plus a transfer risk assessment showing protection is not materially lower after the transfer. Both are free and take an afternoon.
The Philippine side applies too. The Data Privacy Act of 2012 reaches entities outside the Philippines where the processing relates to personal information about a Philippine citizen or resident, or where other links exist such as doing business there. Section 14 lets a controller subcontract processing but makes it responsible for ensuring proper safeguards, and Section 21 keeps the controller accountable for information transferred to a third party.
Practical minimum, whatever your size: a signed processor annex covering those eight points, access through a password vault you own with no shared logins, accounts in your tenancy rather than theirs, no customer data in personal Gmail or Drive, and an offboarding step that revokes everything the same day.
What to actually do, if you are hiring one person
Most buyers engage a contractor directly, pay through Wise or Payoneer, sign two pages and never look again. For a part-time assistant with other clients that is defensible, and the gap between it and doing the job properly is four documents and an hour.
- A contract that matches reality. If they are a contractor, write it like one: deliverables rather than hours, their equipment, their method, an explicit right to work for others, a right to propose a substitute, and invoicing. If you cannot live with those terms, you do not have a contractor.
- A processor annex covering the eight Article 28(3) terms, plus an IDTA or Addendum and a transfer risk assessment if you are UK or EU.
- Tax paperwork on file. W-8BEN for US payers, and invoices from the assistant, kept, for everyone.
- A written line on IP. Copyright assignment is not automatic for contractors in most systems, so if your VA writes content or builds anything you resell, say it transfers on payment.
Payment rails, and why the record matters more than the rail
No payment method changes employment status, so choose on cost. Wise’s USD to Philippine peso page shows, for a $500 transfer at a mid-market rate of 1 USD = 62.5736 PHP, fees of $3 from a Wise balance, $4.18 by direct debit, $9.43 by bank transfer and $35.38 by credit card. Payoneer publishes local-currency bank withdrawals at a fixed $1.50, €1.50 or £1.50, with conversion at up to 3%, falling to 0.5% above 50,000 a month in eligible regions.
On a $1,000 monthly payment a few dollars of transfer fee is noise, while up to 3% on conversion is $360 a year, most of a month’s pay to your assistant. The spread is the cost, not the headline fee. What matters for compliance is unglamorous: pay against an invoice, on a fixed date, from a business account, with a reference tying to the invoice number.
Then revisit the arrangement when it changes character, not on the calendar. The trigger is not the twelve-month anniversary. It is the day they go exclusive, the day you ship them a laptop, the day they start speaking to customers in your name.
If assembling contracts, processor annexes and payment plumbing for one hire is not how you want to spend the week, that is a sensible place to hand it over. AB7 Solutions supplies remote professionals through contract staffing and staff augmentation, where the engagement structure, the data handling terms and the payment arrangement come with the service and the classification question sits with a supplier rather than with you. To talk through whether your role is better run as a direct contractor engagement, an EOR placement or a managed one, call +1 321 341 7733, email ab@ab7solutions.com or director@ab7solutions.com, or see what the team covers at www.ab7solutions.com.
Questions that come up next
Do I need to register as an employer in the Philippines to hire a VA there? Not for a genuine contractor engagement, where the individual is self-employed and handles their own SSS and PhilHealth. Employing someone there means being an employer under Philippine law, with the registration, remittances and termination rules that carry. That is what an entity or an EOR is for.
My VA has my customers’ names and emails. Is that really “processing”? Yes. Names and email addresses are personal data, and someone handling them on your instructions is a processor. Size is irrelevant to the Article 28 requirement, and a one-page annex meets it.
Three years in with no contract at all. What do I fix first? Put a written agreement in place now, dated now, describing the arrangement as it is rather than as you wish it were. Do not backdate anything. Then close the data access gaps. Then, if the work is full-time and exclusive, get an adviser to look at restructuring it.
Sources: IRS, Independent contractor or employee (common law rules); IRS, Source of income: personal service income; GOV.UK, Employment status: self-employed and contractor; GOV.UK, Check employment status for tax (CEST); HMRC International Manual INTM264510, dependent agent permanent establishment; Supreme Court of the Philippines, Felicilda v. Uy, G.R. No. 221241; DOLE Labor Advisory No. 16, s.2025 on 13th month pay and Grant Thornton Philippines summary; SSS, self-employed membership; Philippine Information Agency on PhilHealth’s 2026 premium rate and PhilHealth Advisory 2025-0002; Philippine News Agency on Pag-IBIG membership for non-fixed-income workers; ICO, what needs to be included in a controller-processor contract; ICO, international transfers guide; National Privacy Commission, Republic Act 10173; Deel published pricing; Wise, send money to the Philippines; Payoneer pricing.
Related reading
Related AB7 service: cybersecurity and compliance services (managed SOC, VAPT).
[…] Before hiring, check the basics that often get skipped; see what nobody checks before hiring a virtual assistant overseas. […]
[…] For other checks people skip, see what nobody checks before hiring a virtual assistant overseas. […]
[…] What Nobody Checks Before Hiring a Virtual Assistant Overseas […]