Employer of Record (EOR) due diligence should confirm five things before you sign: who legally employs each worker, whether the arrangement fits local rules, how payroll is checked, which contract terms shift risk back to you, and how employee data is protected. Ask for documentary evidence by country. A provider’s country count or compliance promise is not enough.
The biggest EOR risks often appear after the sales demonstration: a local partner is the actual employer, an invoice applies the wrong statutory ceiling, an employment role does not fit the provider’s local structure, or a contract makes the client fund provider-caused claims. This checklist helps your legal, finance, security and People Operations teams test those risks before the first employee is onboarded.
What Is EOR Due Diligence?
EOR due diligence is the process of verifying that a provider can lawfully employ, pay and support your workers in each target country under acceptable commercial and operational terms.
It is different from a feature comparison. Features show what a platform can do. Due diligence checks the employing entity, legal basis, contract, payroll controls, data handling, employee support and exit plan behind those features. If you are still deciding whether the model fits your expansion plan, start with how an Employer of Record works.
Ten Checks Cover the Main EOR Risks
| Check | Evidence to request | Risk it tests |
| Legal employer | Registered name and company record for each country | An undisclosed third party employs your worker |
| Local legal basis | Licence, registration or written country assessment | The arrangement does not fit local rules |
| Employment contract | Current local template and amendment process | Terms are copied across markets or incomplete |
| Responsibility split | Country-specific responsibility matrix | Payroll, supervision or termination duties are unclear |
| Payroll controls | Calendar, sample register, approval flow and correction process | Errors or late filings are not detected promptly |
| Pricing | Sample invoice showing statutory costs, fees, deposits and foreign exchange | The headline fee hides material costs |
| Contract risk | Master service agreement, liability caps and indemnities | Provider-caused costs return to your company |
| Data protection | Data-processing agreement, subprocessor list and transfer map | Payroll data moves without adequate controls |
| Employee support | Service levels, escalation path and sample onboarding plan | Employees cannot resolve pay or benefit issues |
| Exit plan | Transfer procedure, notice periods and data-return terms | A provider change disrupts pay or employment continuity |
Local Evidence Differs Across Southeast Asia
An EOR is a commercial label, not one uniform legal category across Southeast Asia. Ask the provider to state the exact local structure for the proposed role and working arrangement.
| Market | Official rule to test | Evidence to request |
| Singapore | The Ministry of Manpower distinguishes employment-agency work from recruiting a company’s own employees. Separate rules apply when work-pass holders are sent to client premises. | Employing entity record, relevant employment-agency licence where applicable, work-pass sponsor and written supervision model |
| Indonesia | Government Regulation 35/2021 makes the outsourcing company responsible for worker protection, wages and working conditions. A 2026 manpower regulation limits outsourcing to stated supporting activities. | Business licence, written role mapping, outsourcing agreement and recording evidence [VERIFY: Indonesian counsel to confirm how Regulation 7/2026 applies to the proposed EOR model] |
| Malaysia | Private employment-agency licensing and contractor-for-labour rules are separate. Peninsular Malaysia and Labuan also differ from Sabah and Sarawak. | Employing entity, applicable licence, work location and written explanation of which legal framework applies |
| Philippines | The Department of Labor and Employment requires legitimate contractors or subcontractors to register. Registration alone does not prove that an arrangement avoids prohibited labour-only contracting. | Current regional registration, corporate and business records, service agreement, proof of capital or equipment, and control model |
| Vietnam | Labour dispatch is a conditional business limited to specified jobs and, where the regime applies, a maximum period of 12 months. | Labour-dispatch licence, permitted-job mapping, employing entity and proposed duration |
The safest approach is to test the provider country by country. A group-level certificate cannot answer whether one proposed role, location and supervision model is permitted.
A Sample Payroll Test Can Expose Weak Controls
Ask every shortlisted provider to calculate one sample employee before contract signature. The test should show gross pay, employee deductions, employer contributions, net pay, provider fees and funding dates on separate lines.
For example, take a Singapore Citizen aged 55 or below who earns SGD 10,000 entirely as Ordinary Wages. According to the CPF Board’s rates effective 1 January 2026, the employer rate is 17% and the monthly Ordinary Wage ceiling is SGD 8,000.
- CPF-assessable Ordinary Wages:
min(SGD 10,000, SGD 8,000) = SGD 8,000 - Employer CPF:
17% x SGD 8,000 = SGD 1,360 - Employee CPF:
20% x SGD 8,000 = SGD 1,600 - Total CPF:
SGD 1,360 + SGD 1,600 = SGD 2,960
A calculation of 17% on the full SGD 10,000 would overstate employer CPF by SGD 340. This test checks whether the provider uses the current ceiling, separates employer and employee amounts, and can explain its payroll logic.
How to Review an EOR Before You Sign
1. Map Each Country and Role
List the work location, nationality, job, reporting line, contract term and expected headcount. Ask the provider to confirm the employing entity and legal structure for each combination in writing.
2. Verify the Entity and Permission
Check government directories or records where available. Match the licence holder and registered entity to the company named in the employment contract. If a local partner is involved, request its identity and role.
3. Review the Responsibility Matrix
Document who handles hiring decisions, work supervision, payroll approval, statutory filings, benefits, leave, workplace safety, discipline and termination. “The EOR handles compliance” is too broad to assign accountability.
4. Test Payroll and Funding
Review the payroll calendar, data cut-off, approval workflow, correction deadline and failed-payment process. Run a sample calculation. Then match the payroll register to the invoice, bank funding and statutory amounts.
5. Read the Commercial Terms
Compare the full cost, not only the monthly fee. Employer of Record costs and pricing can include deposits, benefits, foreign-exchange charges, setup work and exit costs.
6. Test the Exit Before Entry
Ask how employees transfer to your own entity or another EOR. Confirm notice periods, final pay, benefit continuity, deposit refunds, document ownership and data return. A documented exit plan also makes it easier to switch EOR providers without disrupting employees.
What Employers Get Wrong About EOR Selection
Treating Owned Entities as an Automatic Guarantee
An owned entity can shorten the accountability chain, while a partner network can extend country coverage. Neither structure proves service quality or local compliance. Verify the actual employing entity, payroll operator, escalation path and contract for every country.
Accepting Certifications Without a Data Map
Payroll administration involves identity, salary, bank and tax information. Ask where data is stored, who accesses it, which subprocessors receive it, how overseas transfers are handled, when incidents are reported, and what happens to the data after exit.
Singapore’s Personal Data Protection Commission specifically uses payroll administration as an example of processing by a data intermediary. The customer organisation still retains obligations for personal data processed on its behalf.
Comparing Only the Monthly Fee
Two quotes with the same per-employee fee can have different deposits, foreign-exchange methods, benefits mark-ups and termination charges. Request a sample invoice for your target country and salary. If your planned headcount is stable and long term, compare EOR versus local entity setup before committing.
The Right Choice Depends on Headcount and Control
Use an EOR when you need to hire in a supported market without your own entity and the provider can document a suitable local structure for the role. Prefer your own entity when you need commercial licences, direct sponsorship or employment control that the proposed EOR model cannot support, or when stable headcount makes entity ownership operationally sensible.
Do not choose based on country count alone. Choose the provider that can produce the clearest country evidence, payroll controls, responsibility split and exit path for your actual hiring plan.
FAQ About EOR Due Diligence
What Questions Should I Ask an EOR Provider Before Signing?
Ask who the legal employer is, whether it is owned or partnered, which licence or registration supports the arrangement, who files payroll obligations, how errors are corrected, where employee data goes, which fees sit outside the headline price, and how employees transfer out. Request evidence for every answer.
What Risks Should Leadership Know About?
The main risks are an unsuitable local employment structure, permanent-establishment exposure, payroll or filing errors, worker misclassification, unclear liability, insecure data transfers, service interruption and a difficult exit. An EOR can reduce employment administration, but it does not remove every client-company obligation or tax risk.
Are Owned EOR Entities Better Than Partner Networks?
Owned entities give the provider direct control over its local employer and can shorten escalation. Partner networks can provide wider coverage and strong local expertise. Assess the model country by country: identify the employer, check the partner agreement and service levels, and confirm who fixes payroll or compliance errors.
Who Is Liable if the EOR Makes a Compliance Error?
The answer depends on local law and the contract. Review indemnities, liability caps, claim procedures and exclusions with counsel. Confirm whether the provider covers penalties or employee claims caused by its own error and which costs your company must pre-fund or reimburse.
What Happens Between Contract Signature and First Payroll?
A sound implementation normally covers entity and role validation, local contract preparation, worker documentation, statutory registration, benefits enrolment, payroll data setup, funding, approval and a first-payroll check. Put owners and deadlines against each step rather than accepting a general onboarding estimate.
Assess EOR Coverage for Your Southeast Asia Hires
You can establish a local entity and build country payroll controls internally, or appoint an EOR whose structure fits each proposed hire. Glints TalentHub’s Employer of Record service supports hiring and employment administration across Southeast Asia; ask for a country-specific structure, cost breakdown and implementation plan before deciding.
