30–60 Day Caps: Work From Anywhere Policy Playbook for HR

Allow work from anywhere as a controlled, temporary benefit, not an unlimited perk. The single most important guardrail is a hard duration cap, commonly 30 to 60 days per country per year, paired with mandatory pre-trip approval from HR, payroll, IT, and legal. What follows gives you the template fields, the tax and immigration rationale, and the approval workflow to make that stance defensible.

TL;DR:

• Work from anywhere should be limited to 30 to 60 days per country per year, with pre-approval and proper documentation required.
• Eligibility depends on roles being fully remote-capable, non-customer-facing, and below senior decision-making levels, excluding contractors and EOR workers.
• Short trips can still create permanent establishment and tax liabilities, especially if employees have signing authority or perform revenue-generating activities abroad.
• HR must verify lawful work permits and visas before approval, rejecting requests without proper documentation to avoid legal exposure.
• An approval process involving managers, HR, IT, and legal, along with clear record-keeping, helps enforce compliance and manage risks long-term.

Work From Anywhere Policy Checklist and Template Fields

A usable policy needs specific language before it ever reaches a manager for sign-off. Vague permission (“employees may work remotely from abroad with approval”) invites inconsistent decisions and payroll surprises. Build the document around fields that force a decision, not a discussion.

Start with these core sections:

• Purpose and scope: state explicitly that work from anywhere is a temporary travel benefit, not a relocation or permanent remote work arrangement.
• Eligibility: name which roles, tenure levels, and employment types qualify.
• Duration limits: publish the cap per country per calendar year and the process for exceptions.
• No-go jurisdictions: list countries excluded for tax, sanctions, or data-residency reasons.
• Required attestations: employee confirms lawful right-to-work status, provides visa or permit proof, and signs an acknowledgment of policy terms.
• Security and equipment requirements: company-managed device, VPN, and encryption mandates.
• Payroll and benefits notes: confirmation that pay, tax withholding, and benefits stay tied to the employee’s home work location.
• Revocation clause: the company’s right to deny, pause, or recall a WFA arrangement at any time.

Template providers like Deel publish free digital nomad policy templates covering these same fields, which makes a useful starting draft for legal review rather than a from-scratch build.

Who Should Be Eligible for a Work From Anywhere Arrangement?

Work from anywhere and standard remote work are not the same thing, and your policy needs to say so in plain language. Standard remote work usually means an employee’s home is their designated work location for payroll and tax purposes. Work from anywhere means the employee temporarily performs that same job from a different country, on a defined start and end date, with the intent to return.

Eligibility should hinge on role, not seniority or tenure alone. A policy that grants WFA broadly, then tries to walk it back for specific job functions, creates morale problems and inconsistent enforcement. Screen for these criteria instead:

• The role is fully remote-capable with no fixed office or facility requirement.
• The employee has no customer-facing duties that involve signing contracts or closing revenue-generating deals abroad.
• The role sits below executive or senior decision-making levels, where a single person’s presence can more easily be read as establishing a business presence.
• The employee is a direct employee, not a contractor or an Employer of Record (EOR) hire, since those arrangements carry separate legal structures that a WFA policy should not override.

International hires already working through an EOR need a different process entirely. Their work location is already tied to a specific compliance structure, and layering a WFA request on top of that arrangement can create duplicate registrations. Handle those cases outside the standard WFA workflow, on a case-by-case legal review.

What Legal and Tax Risks Does Work From Anywhere Create?

The biggest exposure is Permanent Establishment (PE), the risk that an employee working abroad creates a taxable business presence for the company in that country. OECD guidance from its 2025 consultation on global mobility makes clear that PE depends on facts and circumstances, not a fixed number of days. A home office abroad becomes a “fixed place of business” based on factors like whether the employee has authority to sign contracts, how long the arrangement lasts, and whether the work is core to the business or merely auxiliary.

OECD’s own framing matters here: durations under six months are generally less likely to raise PE concerns, but no single threshold guarantees safety. That is why duration caps in your policy should be read as risk mitigation, not legal certainty.

This is why a 30 to 60 day cap functions as a conservative buffer rather than a guarantee. Roles with any authority to negotiate, sign, or close deals need a stricter cap, often 30 days or less, or exclusion from WFA altogether. Deep-knowledge guidance on compliant WFA templates recommends excluding senior decision-makers and sales roles from standard eligibility for exactly this reason: even a short trip can create employer obligations if the employee performs revenue-generating activity in the host country.

Beyond PE, three other triggers deserve their own checks during approval:

• Personal income tax: many countries start counting tax residency well before six months, and a short trip can still trigger local filing obligations depending on treaty terms.
• Social security: without a bilateral agreement or certificate of coverage, a host country may require local social security contributions even for a brief stay.
• Payroll registration: some jurisdictions require an employer to register locally once any employee physically performs work there, regardless of duration.

Google’s own reported tightening of its work-from-anywhere program, where a single day abroad now counts as a full week against annual limits, shows how even large, well-resourced employers are pulling back toward stricter counting rules instead of looser ones.

What Right-to-Work Documents Should HR Require?

An employee cannot work legally in another country on a tourist visa, full stop. Tourist status typically prohibits any form of paid work, remote or otherwise, and a company that knowingly permits it takes on immigration risk alongside the employee. Your policy needs to require lawful work authorization before approving any request, not after.

Documentation to collect before travel is approved:

• A valid digital nomad visa, work permit, or citizenship/residency status that legally permits remote work in the destination country.
• A signed employee attestation confirming the accuracy of their visa or permit status.
• Copies of supporting immigration documents attached to the request record.

Pro Tip: Reject any request where the employee cannot produce documentation before the travel date. “I’ll sort out the visa when I get there” is the single most common way WFA arrangements turn into legal exposure for both the employee and the company.

Employer sponsorship is rarely appropriate for short WFA trips; that level of support belongs to formal international assignments or relocations. For temporary WFA, responsibility for securing lawful status sits with the employee, and HR’s job is verification, not procurement. Our guide on visa sponsorship for remote roles breaks down when employer support does make sense.

How Should the Approval Workflow Actually Run?

A policy without a repeatable approval process is a policy nobody follows consistently. Build the workflow as a sequence with clear owners at each step, following guidance from the Remote workforce wellness: A practical HR leader’s guide:

1. Employee submits a request at least four weeks before travel, including destination, dates, and right-to-work documentation.
2. Direct manager reviews for operational fit: does the role and timing allow for the absence without disrupting deliverables?
3. HR and payroll screen for duration cap compliance, tax residency triggers, and social security exposure.
4. IT security reviews device, network, and data-access requirements for the destination.
5. Global Mobility or legal escalates any request flagged for PE risk, sanctioned or no-go countries, or a role with contract-signing authority.
6. Final approval or denial is recorded in writing, with the decision and rationale kept on file for audit purposes.

Auto-reject conditions should be built into step one, before a request even reaches a manager: missing visa documentation, a destination on the no-go list, or a request that exceeds the annual duration cap without an exception already granted. Anything that clears the auto-reject filter but still raises a PE or tax flag should route straight to Global Mobility rather than getting resolved informally between manager and employee. Recordkeeping matters here as much as the decision itself: a standard request form capturing dates, host location, and signed attestations gives you a clean audit trail if a tax authority or immigration office ever asks questions later.

How Should Pay and Benefits Work During a Work From Anywhere Trip?

Base salary should not change for a short WFA trip, and your policy should say so explicitly to prevent ad hoc negotiation. Cost-of-living adjustments belong to permanent relocations, not temporary travel, and offering them for a 30 day trip sets a precedent that is expensive to unwind.

A few payroll rules deserve specific mention in the policy text:

• Salary, benefits enrollment, and retirement contributions stay tied to the employee’s home work location for the duration of a WFA trip.
• Hourly and non-exempt employees need closer scrutiny, since local minimum wage and overtime rules in the host country can apply even for short stays, depending on local labor law.
• If a request would trigger local payroll registration or withholding obligations for the company, payroll should have explicit authority to pause or deny the trip, even after manager approval.

That last point matters because it is the most common place informal approvals go wrong: a manager says yes, the employee books flights, and payroll discovers weeks later that the destination country requires registration the moment work begins there.

What IT and Security Controls Does Work From Anywhere Require?

Data security risk rises the moment an employee works outside a controlled office network, and your policy needs technical requirements that apply regardless of destination. Set the baseline non-negotiable:

• Company-managed devices only, with disk encryption, multi-factor authentication, and an approved VPN client installed before departure.
• No sensitive work performed on public Wi-Fi networks, including airports, cafes, and co-working spaces without vetted network security.
• A secure home office or private workspace requirement for roles handling regulated data, financial records, or client information.
• An IT approval checkpoint as part of the pre-trip workflow, confirming device compliance and access permissions before travel dates are finalized.

Pro Tip: Require employees to report lost devices or suspected network compromise within 24 hours, not at the end of the trip. A stolen laptop reported on day one is a manageable incident; the same laptop reported three weeks later is a much harder breach to contain.

Point employees toward vetted resources, like our roundup of remote work tools for digital nomads, so IT is not fielding ad hoc software requests mid-trip.

What Duration Limits and No-Go Countries Should You Set?

Publish a specific number, not a vague “reasonable period.” A common conservative cap limits Work From Anywhere to a moderate number of days per country per calendar year, with potential for exceptions through higher-level review.

Maintain the no-go list as a living document, not a one-time draft. Sanctions status, tax treaty changes, and data-residency laws shift, and a list reviewed once at policy launch goes stale fast. Every exception request, whether for duration or destination, needs its own documentation trail and a named approver, so no single manager can quietly override the policy on a case-by-case basis. For employees planning longer stints abroad, our piece on slow travel for digital nomads is worth sharing so they understand why longer trips need a different approval path entirely.

How Do You Roll Out a Work From Anywhere Policy?

Rolling out a new policy company-wide on day one invites chaos. Run a pilot first, then scale.

1. Select a pilot group of 20 to 50 remote-eligible employees across two or three departments, with clear owners assigned in HR, payroll, legal, and IT.
2. Set a review timeline, typically 90 days, to catch process gaps before wider rollout.
3. Track core metrics: number of requests submitted, approval and denial rates, average processing time, and any compliance incidents or unplanned payroll registrations.
4. Train managers on eligibility criteria and their role in the approval chain before opening requests broadly.
5. Communicate to employees through a short policy summary, FAQ, and a designated point of contact for questions, rather than relying on the full legal document alone.

Widening access without this groundwork usually means discovering your gaps through an actual compliance incident instead of a controlled pilot.

How Should HR Govern and Enforce the Policy Long Term?

Review the policy annually at minimum, and immediately after any major regulatory change, a new no-go country designation, or a compliance incident. Keep audit evidence on file for every approved request: dates, documentation, approver sign-off, and any exception rationale.

• Enforce violations progressively: a first unreported trip might warrant a documented warning, while repeated violations or knowingly false attestations justify revoking WFA privileges entirely.
• Revoke access immediately for any employee who travels without approval or misrepresents their right-to-work status.
• Consult external tax or immigration counsel whenever a request touches a jurisdiction with no established precedent in your policy, rather than guessing based on a similar-sounding case.

Good-faith compliance is easier to demonstrate with a paper trail than with a policy nobody can point to after the fact.

What Authority Backs These Policy Recommendations?

These rules aren’t arbitrary caution. They track guidance and precedent already established by institutions with far more legal exposure than most private employers.

• OECD’s 2025 consultation reinforces that duration alone never fully resolves PE risk, which is why a facts-and-circumstances review belongs in every approval chain, not just a calendar check.
• UW–Madison’s flexible work policy restricts international remote work in most circumstances and defaults to a 21-day limit without special authorization, a useful benchmark for corporate policies drafting their own caps.
• Flexibility remains an expected benefit, not a luxury: only 26% of companies changed their hybrid or remote policy in the past year, and 41% of hybrid or remote employees say they would look for a new job if flexibility were removed.

Balancing that retention pressure against compliance risk is exactly why a controlled WFA benefit, rather than an outright ban, tends to serve both sides better.

If your team is building out a distributed workforce and wants to reach candidates who already understand these guardrails, posting a verified remote role through Nomadcareers puts your listing in front of job seekers actively searching for genuine work-from-anywhere positions. Employers can start with the Self-Serve posting option or add visibility through features like homepage placement. For teams evaluating what competitive WFA benefits look like across the market, the directory of verified work-from-anywhere jobs is a useful benchmark, and Nomadcareers’ own pricing page outlines options from the free Nomad Pro tier up to the Nomad Pro Annual plan at $69.99 per year for job seekers building a long-term remote career.

Where Should HR Look for Further Guidance?

Start with the primary sources behind this playbook rather than secondary summaries:

• OECD’s 2025 global mobility consultation document for PE and tax framework detail.
• UW–Madison’s remote work policy as an institutional precedent.
• Deel’s digital nomad policy template as a drafting starting point.

Treat all three as a foundation, then bring jurisdiction-specific questions to legal or tax counsel before finalizing your own policy language.

Sources

• State of Hybrid Work 2026 | US Report
• OECD: Global mobility of individuals (2025 consultation document)
• UW–Madison flexible work/remote work policy (UW-5087)
• Work from Anywhere: How to create a compliant policy template
• Deel — Free digital nomad policy template

FAQ

Is Remote Work Going Away in 2026?

No. Flexible work has stabilized as an expected benefit rather than a temporary pandemic-era perk, with only 26% of companies changing their hybrid or remote policy in the past year. Employers are more focused on tightening the rules around international work from anywhere than eliminating remote work itself.

Which Companies Allow You to Work From Anywhere?

Policies vary widely, and some large employers have recently tightened their rules rather than loosened them; Google, for example, now counts a single day abroad as a full week against its annual limit. Job seekers can find current, manually verified work-from-anywhere listings through the Nomadcareers job directory rather than relying on outdated company reputation alone.

Is “Work From Anywhere” a Legitimate Job Category?

Yes, but it requires verification, since many listings labeled “remote” actually restrict work to specific countries or time zones. Nomadcareers manually verifies each listing to confirm it is a genuine work-from-anywhere role before it goes live, reducing the risk of applying to a mislabeled or low-quality posting.

What Are the Basic Guidelines for Working Remotely From Another Country?

At minimum, an employee needs lawful right-to-work status in the destination, such as a digital nomad visa or permit, and employer approval that accounts for duration limits and tax exposure. Most compliant policies cap trips at 30 to 60 days per country per year and require documentation before travel, following the structure outlined in OECD guidance and practitioner templates.