In an increasingly connected world, the idea of working from anywhere (WFA) has gained immense popularity. Companies are now reimagining their work policies to allow employees to work remotely, whether they are at home, on workation in the Alps, or a cozy café in Lisbon. While the benefits of such a policy are undeniable, creating a comprehensive and effective WFA policy can be a bit more complex than it seems.
Beyond the obvious compliance risks (tax, social security, employment law, etc.) that we talk about so often, here are five crucial things to consider when building a WFA policy.
Sanctions List Countries: Beware of Restrictions
One of the first things to consider when developing a WFA policy is the list of sanctioned countries. Sanctions are measures imposed by governments and international bodies to maintain or restore international peace and security. These restrictions can affect trade, financial transactions, and, of course, your employees’ ability to work from certain countries. In most cases, companies typically explicitly prohibit employees from working in sanctioned countries to avoid any legal complications.
Your insurance (e.g. health, life and accident) coverage may also have limitations on which countries employees can work from, so ensure you consult with your insurance provider to ensure this is considered as part of your country offering. These requirements can vary widely, making it important to consult with an insurance expert to ensure your employees are adequately covered wherever they choose to work.
There may be other providers, such as your duty of care provider or other security advisors who might be worth consulting as part of this exercise.
Cyber Risk Countries: Protect Your Data
Cybersecurity is a top priority for any organization, and different countries have varying levels of cyber risk. When crafting your WFA policy, consider excluding high-risk countries from the list of approved work locations. Ensuring that your employees’ data remains secure, even when working remotely, is essential to maintaining your organization’s integrity. Some useful places to start might be public resources such as the NCSI index or the Nord Cybersecurity ranking, but it is strongly recommended to consult with your internal and/or external cybersecurity advisors when putting together such a list.
Regional Variations: One Size Does Not Fit All
The world is a vast and diverse place, and different regions have unique legal and cultural considerations. In the European Union, for example, some companies may allow up to 30-90 days of WFA within the EU but only half that number of days outside of it. Part of the reason here is the freedom of movement within the EU reduces somewhat the risks to the company, certainly for trips less than 30 days. Freedom of movement is not, at the same time, a carte blanche to ignore the compliance risks, far from it, but we do see many companies offer that bit more flexibility within the EU. Understanding these regional nuances is essential to creating a policy that aligns with the law and culture of each specific location.
Restricted Roles: High Risks and Regulations
Not all roles are equal when it comes to WFA. Some roles may carry high permanent establishment risks or are heavily regulated, making it necessary to restrict them from working remotely. Sales roles that generate substantial revenue, or jobs that require strict oversight due to legal regulations, for example, may need to remain in-country. In some cases, you might have specific government grants tied to the presence of certain executives in local offices, so care should be taken in understanding which roles are part of a “plug and play” policy (e.g. fine to work from anywhere in permitted countries for up to 30 days) and which need to be risk assessed in each case. This should be complimented with a list of do’s and don’ts so that the employee is clear on the rules of the road (e.g. if sales employees are allowed to temporarily work from anywhere, then they should avoid negotiating and/or signing material sales contracts).
Country of Origin: A Personal Touch
When it comes to work from anywhere, many people have a vision of somebody working by a beach, but in many other cases it is often someone wanting to spend a few weeks close to family. This is where some policies include an additional layer of flexibility for somebody working in their country of origin. This personal touch can be a valuable perk for employees who wish to reconnect with their roots or spend extended periods with their families. It fosters goodwill and demonstrates your commitment to your employees’ well-being. However guardrails need to be put in place, for example if an employee has other ties to a country (e.g. property in Germany) or has spent a certain number of days in a country over the preceding 5 years (e.g. lookback period for residency in India), this can have an impact on residency and/or payroll requirements.
Conclusion: Customize Your Workation Policy Based on Your Risk Appetite
In conclusion, implementing a WFA policy requires a deep understanding of the legal, tax and cybersecurity implications of allowing employees to work from anywhere. By considering these five crucial factors, you can begin to craft a policy that not only empowers your employees but also ensures the success and security of your organization in an increasingly global and digital world. Flexibility and adaptability are key, but so is thorough planning and risk management.
P.s. Did you know that we have also published a Work From Anywhere compliance framework? You can access that here.
Need help crafting your own Work From Anywhere policy? Then look no further than Imelda Keane (imelda@wfa.team), our Head of Global Mobility Strategy who can help you build a policy that reflects your needs and risk appetite.

John Lee
John is Co-founder of the Work From Anywhere team, a platform to help companies execute a hire or work from anywhere strategy. John is a Chartered Accountant who speaks 6 languages and was previously the senior finance leader of a €4 billion division of FTSE-listed CRH Plc. John and his family are passionate about travelling and his eldest daughter, Rosa, while only 5 years old has already travelled to 25 different countries.
