TL;DR
Start with worker classification, because it decides whether payroll tax, benefits and wage rules apply at all. Obligations follow the worker's actual location, not your headquarters. A remote worker who follows your hours and tools for years can look like an employee whatever the contract says. Register and comply everywhere your people actually work, and put the reviews on a calendar.
Most companies build their HR compliance checklist for remote teams after something goes wrong. A misclassification letter arrives from a state agency. A payroll tax notice comes from a place they did not know they operated in. A resignation email turns into a wage claim.
The checklist below is built to get ahead of those moments. It covers what actually triggers penalties for distributed teams, in the order those triggers usually show up.
One shift in thinking before the list. Compliance obligations follow the worker, not your headquarters. If your company is registered in Delaware, your operations lead lives in Colorado and your customer support team sits in the Philippines, you have obligations in all three places. Every item below flows from that one fact.
This is a practical checklist, not legal advice. For anything specific to your company, check with an employment lawyer in the relevant state or country.
Start with worker classification, because everything else depends on it
Classification comes first for a reason. It decides which of the other obligations apply at all.
An employee triggers payroll tax withholding, benefits eligibility, wage and hour rules and workers' compensation. A contractor triggers almost none of that, but only if the relationship truly qualifies.
Work through these questions for every remote worker on your roster:
- Who controls how the work gets done? If you set their hours, provide their tools and direct their daily tasks, most tests lean toward employee status no matter what the contract says. The IRS publishes its common law test for worker classification. It looks at behavior, finances and the nature of the relationship, not the label on the agreement.
- Is the relationship long-term and exclusive? A contractor who has worked 40 hours a week for you alone for two years looks like an employee to an auditor, whatever the invoice says.
- Which jurisdiction's test applies? California's ABC test is stricter than the federal standard. Several countries treat long-running contractor relationships as employment automatically. The test that matters is the one where the worker lives.
Neither model is wrong. Contractors give you speed and flexibility. Employees give you retention, control and simpler IP ownership.
The compliance failure is drift. You hire someone as a contractor and then manage them like an employee for three years without ever revisiting the setup. If you engage people abroad, the stakes are higher. Our guide to hiring contractors internationally covers the mechanics.
Checklist items:
- Document the classification reasoning for every worker, in writing, at the point of hire.
- Re-run the analysis whenever a role changes in a real way: hours, exclusivity or management structure.
- Review any contractor relationship older than 12 months against the local test.
- For international workers, confirm whether the country allows independent contracting for that type of role at all.
Register where your people actually work
This item catches growing companies most often, because nothing forces you to notice it until a notice arrives.
When you hire an employee in a new US state, you usually need to register for state payroll taxes, unemployment insurance and sometimes workers' compensation before the first paycheck. Hire in a new country and the list grows: a local entity or employer of record, social contributions, statutory benefits and mandatory notice periods.
Checklist items:
- Keep one master list of every state and country where you have workers, and update it at every hire.
- Register for payroll tax and unemployment insurance in each new state before the first pay run.
- Confirm workers' compensation rules per state. Several states require coverage even for a single remote employee.
- For each country, choose the engagement model on purpose: local entity, employer of record or a compliant contractor arrangement.
- Check reciprocity and convenience-of-the-employer rules when an employee lives in one state and you withhold in another.
The cost of skipping this step grows quietly. Back taxes, interest and late registration penalties build up from the hire date, not from the date you get caught.
| Where you hire | What to set up before the first pay run |
|---|---|
| A new US state | State payroll tax account, unemployment insurance, workers' compensation where required |
| A new country, as employees | Local entity or employer of record, social contributions, statutory benefits, compliant contract |
| A new country, as contractors | A contract that fits local rules, a classification check, IP and confidentiality terms |
For international hires, an employer of record removes most of the registration work. We run payroll through Deel, with compliant contracts in 150+ countries and pay twice a month, on the 15th and the 30th.
Wage, hour, and leave rules travel with the worker
Remote work does not exempt anyone from wage and hour law. The Fair Labor Standards Act still governs overtime and minimum wage for non-exempt US employees wherever they sit. Tracking hours for remote non-exempt staff is harder, not easier, because you cannot see when someone logs back in at 9pm.
State and local rules matter more than most operators expect. Paid sick leave, meal and rest breaks, final paycheck deadlines and pay transparency rules all vary by the worker's location. A job post that is fine for your Texas team may break pay range disclosure rules the moment a Colorado resident can apply.
Checklist items:
- Classify every US role as exempt or non-exempt, and write down why.
- Use real time tracking for non-exempt remote employees, plus a policy on work outside hours.
- Map paid leave obligations for every state and country where you employ people. Statutory leave abroad is often far more generous than US defaults.
- Set final pay procedures per state. Some require payment on the day of termination.
- Include pay ranges in job posts whenever an applicant could live in a disclosure state.
Data security and privacy are HR compliance now
A distributed team moves employee data and company data across home networks, personal devices and borders. Regulators treat that as your problem. GDPR applies the moment you employ someone in the EU or process EU residents' data. Several US states now have their own privacy laws, and some cover employee data.
The practical exposures are ordinary:
- An offboarded contractor who still has access to a shared drive.
- Payroll data emailed as an unencrypted spreadsheet.
- A laptop with customer records stolen from a coworking space in a country where you have no entity.
Checklist items:
- Issue managed devices, or enforce minimum security standards such as disk encryption, screen lock and updates, for anyone who touches sensitive data.
- Require MFA and a password manager across the team. Make it part of day-one onboarding, not a suggestion.
- Keep a written offboarding runbook that removes every access within 24 hours of departure.
- Map where employee personal data lives and which privacy rules apply to it.
- Write down an incident response step: who gets told, and within what window, when something leaks.
Access control failures cluster at the start and end of employment. That is why structured onboarding matters as much for compliance as for ramp-up speed. Our guide to remote onboarding best practices includes the access setup sequence most teams improvise badly.
Policies that exist, in writing, where workers can find them
Auditors and plaintiffs' lawyers both start with the same request: show me the policy. A distributed company needs its handbook to do the work a hallway conversation used to do.
The core set for a remote team:
- Remote work policy: eligibility, expense reimbursement, equipment ownership and availability expectations. Several states require employers to reimburse necessary business expenses for remote employees, which can include part of the home internet bill.
- Anti-harassment policy with a remote complaint channel: harassment training is mandatory in several states, and video calls and chat channels are where remote misconduct actually happens.
- Time and attendance policy for non-exempt staff, covering messages outside hours and expected response windows.
- Equipment and acceptable use policy: who owns the laptop, what happens to it at offboarding and what personal use is allowed.
- Handbook acknowledgment: collected digitally, versioned and stored where you can find it three years later.
A policy nobody can find is nearly as bad as no policy. Keep the current version in one place, and log acknowledgments every time it changes in a real way.
Put compliance on a calendar, not in a drawer
A checklist you run once is a snapshot. The risk moves the day after.
Remote work is now a lasting part of the labor market. Bureau of Labor Statistics data shows about one in five US workers teleworked in its recent measures, and legislatures keep adding location-based rules. The teams that stay compliant treat it as recurring operations work with an owner and a schedule.
A schedule that works for most companies under 200 people:
| When | What to review |
|---|---|
| At every hire | Location check, registration check, classification memo, policy acknowledgment |
| Quarterly | The location list against actual payroll registrations. People move and do not always tell you. |
| Twice a year | Re-run classification on long-tenured contractors, and audit system access against the current team list |
| Annually | Refresh the handbook, review leave and pay rules per location, and confirm workers' compensation still matches where people work |
The quarterly location check deserves emphasis. Remote employees relocate without thinking of it as a compliance event. One employee moving from Florida to New York changes your withholding, leave and disclosure obligations overnight.
What quietly fails
Three patterns show up again and again in companies that get burned.
Borrowed templates. A handbook downloaded from a template library and never adapted gives you policies that conflict with the actual law in half the places you hire. Worse, it proves you knew a policy was needed and got it wrong.
Compliance by payroll software. Payroll tools calculate what you configure. They do not know an employee moved, a contractor drifted into employment or a state added a sick leave rule your settings ignore. Software carries out decisions. Someone still has to own them.
Assigning it to nobody. In most companies under 100 people, compliance is a slice of an operations leader's job, done in the gaps. That works until the number of locations grows past a handful, and then it stops working. At that point the real decision is whether to hire dedicated HR capacity or hand the recurring work to a partner. Our guide to outsourcing HR operations covers how that handoff works in practice.
Where to start
Run the location inventory first. One spreadsheet: every worker, their classification, the state or country they actually work from and whether you are registered there. That single exercise surfaces most of your exposure in a day or less. It also turns the rest of this checklist from abstract to concrete.
If the inventory turns up more gaps than your team has hours to close, that is a capacity problem, not a knowledge problem. Our HR outsourcing service runs the HR layer for distributed teams: compliant contracts, payroll through Deel and the review schedule above. Every placement also gets a dedicated manager and performance management with formal reviews twice a year. Book a free consultation and we will map your current footprint against what each location requires.
Frequently asked questions
Do remote contractors need to be on an HR compliance checklist at all?
Yes. Contractors are the highest-risk group on most remote rosters, because misclassification penalties, back taxes and backdated benefits claims all attach to relationships nobody reviewed. At a minimum, document the classification reasoning at hire and re-test any contractor relationship that passes the one-year mark.
Which state's laws apply to a remote employee?
Generally the state where the employee physically does the work, not where the company is registered. That covers minimum wage, overtime, leave rules and final pay. A handful of states apply convenience-of-the-employer rules to income tax, so withholding can get more complicated than the general rule suggests.
How often should we update the checklist itself?
Review it every year and after any structural change: entering a new country, crossing a headcount threshold that triggers new duties (50 employees for FMLA, for example) or moving between contractor and employee models. Location-based rules change every legislative session, so once a year is the minimum.
Do we need an HR compliance checklist if we use an EOR platform?
Yes. An employer of record covers the employer-side duties for the workers it employs on your behalf. It does not cover your direct employees, your contractors, your data security practices or your internal policies. Treat it as one part of the checklist, not a replacement for it.
Written by the people who recruit, pay and manage remote teams every day, with Nate Ginsburg and Menno Gottmer. About Adaptive Teams
