How to Evaluate an EOR Provider in India (2026 Scorecard)

Each of the ten categories below gives you the same five things for assessing an employer of record in India: what it is, why it matters to a US company specifically, what a 4-out-of-4 answer looks like, what a 0-to-1 answer looks like, and the document to demand.

Category 1 · Legal employer & India entity ownership: 15 points

Why does it matter to you? If the employing entity is a partner rather than the provider you are contracting with, your employee’s PF account, ESIC number and statutory record sit with a company you have no agreement with. Under the Labour Codes, contract labour is generally barred in core business activities, which sharpens this considerably.

There are two entity models for an employer of record in India, and the difference is not cosmetic. In an owned-entity model, the company you sign with is the company on your employee’s contract. 

In a partner-network model, the provider contracts with a local firm, and that local firm, not your counterparty, becomes the registered employer, holds the EPFO and ESIC registrations, and appears on the payslip. 

You have no agreement with them.

Many providers claim owned entities as a differentiator. Here is a test you can apply yourself: ask for the CIN, then look the company up yourself on the Ministry of Corporate Affairs master-data search. It takes two minutes, it is free, and it tells you the incorporation date, the registered office, the directors and whether the company is active. 

If the entity was incorporated last year and the provider is selling you two decades of India experience, you have learned something a reference call would not have told you.

Ask the follow-ups that nobody asks: 

• If the partner relationship ends, what happens to my employees’ Provident Fund accounts and Universal Account Numbers? 
• Who holds the TAN under which tax is deducted from their salary? 
• If the partner defaults on its own statutory obligations, does that attach to my employees?
• Three documents settle the entity question quickly, and a compliant provider has all three to hand.
• Certificate of Incorporation. It confirms the company exists, when it was incorporated and who its directors are. Cross-check the CIN yourself on the MCA master-data search.
• Udyam registration certificate. Udyam is India’s basic business registration. It matters here for one specific reason: it records how many people the business employs, so it is a fast, independent read on whether the entity you are being shown is the one actually running a workforce. GST and the other registrations follow from this base.
• Shops and Establishment registration. This one is state-level, issued by the state labour department, and it is what makes it lawful for that entity to employ someone in that state. You need one per state of hire, not one for India.
• Settle the contract question in the same conversation. Your employee signs an employment contract with the Indian entity, not with you; you sign a services agreement with the provider. Ask to see both together, and check that the entity named in the first is the entity named in the second.

What a 4 out of 4 looks like

A named Indian private limited company, its CIN, its Certificate of Incorporation, and MCA master data you can verify yourself in two minutes, plus a contractual commitment that this entity, and no other, is the employer.

What a 0 to 1 looks like

“We have entities in 150+ countries.” No entity named. Partner arrangements described as “our local presence”.

Category 2 · Statutory execution proof: 15 points

Why it matters to you. This is the difference between a provider that says it is compliant and one that demonstrably files. Provident Fund must be deposited and the Electronic Challan-cum-Return filed within 15 days of month end; ESI by the 15th; TDS by the 7th. 

A provider that files correctly can produce three months of proof in an afternoon.

The specific numbers behind the ask: employee contributes 12% of wages; employer contributes 12%, split 8.33% to the pension scheme and 3.67% to the Provident Fund; EDLI at 0.5% (employer-only, on top) and administrative charges at 0.5%, with a minimum of ₹500 (about $5) a month per establishment. 

Employees’ State Insurance applies at gross wages up to ₹21,000 a month (about $219), employee 0.75%, employer 3.25%, and under the Code, ESIC coverage is now pan-India rather than limited to notified districts (PIB).

The cost of getting this wrong is arithmetic, not anxiety. Late Provident Fund attracts 12% per annum penal interest under section 7Q plus damages under section 14B, which since 14 June 2024 run at a flat 1% per month, a combined exposure of roughly 24% a year on the amount outstanding. 

Employees’ State Insurance default carries 12% simple interest plus damages of up to 25% of arrears under two months and up to 35% for persistent default, with criminal exposure on top. These are the numbers to put in front of a board.

What a 4 out of 4 looks like

Codes supplied, challans and ECR acknowledgements for three consecutive months, a named compliance owner, and a written undertaking to indemnify statutory defaults.

What a 0 to 1 looks like

“Our compliance team handles all of that.” No codes, no challans, no named owner.

Category 3 · Total landed cost & FX transparency: 12 points

Why it matters to you. The headline per-employee fee is the smallest variable. The statutory base moved twice in 2026, and most cost models omit gratuity accrual entirely, which, for an above-ceiling engineer, exceeds the Provident Fund cost.

Ask for the quote the way a CFO needs it: a single engineer, at a stated cost-to-company, itemised to the rupee. Then check it for the five things that leak.

• The FX method. What spread is applied converting your billing currency to rupees, and against which reference rate? “Market rate” is not an answer. A 2% spread on a $40,000 salary is $800 a year per head that appears nowhere in the fee.
• The deposit. How many months, when is it refunded, and does it sit on your balance sheet or theirs? A one-to-one-and-a-half-month deposit per employee is real working capital.
• Whether Provident Fund is computed on basic or on gross. This materially changes the bill and is a legitimate structuring choice, but it should be a disclosed one.
• Gratuity accrual. Is it billed monthly as it accrues, or does it arrive as a lump sum when someone leaves? The second is a nasty surprise and, worse, may mean nobody has funded it.
• The per-event fees. Onboarding, offboarding, equipment procurement, expense reimbursement handling, mid-cycle changes, and conversion to your own entity. Get them in an annexure.

Then ask the question that costs nothing and reveals everything: “Can you send me a specimen invoice for this exact hire?” 

A provider with a clean, itemised invoice template will send it. 

A provider whose invoice would raise questions will offer a call instead.

What a 4 out of 4 looks like

A line-by-line quote at a stated CTC, showing PF/EDLI/admin, gratuity accrual, professional tax by state, the provider fee, the FX spread against a named reference rate, the deposit amount and its refund trigger, and every onboarding, offboarding, equipment and reimbursement fee, with a commitment that nothing else will appear on the invoice.

What a 0 to 1 looks like

A single per-employee-per-month number and “statutory costs are passed through at actuals”.

Category 4 · State coverage: 10 points

Why it matters to you. There is no single “India registration”. India has 28 states and 8 union territories, and Shops & Establishment registration and professional tax are state-level, with roughly twenty states levying professional tax and several levying none. 

A provider registered in Karnataka cannot lawfully onboard your Pune hire next week without a Maharashtra registration.

Professional tax is levied by roughly twenty states and union territories, with no national rate and a constitutional ceiling of ₹2,500 (about $26) per person per year under Article 276. Several states, Delhi, Uttar Pradesh, Haryana and Rajasthan among them, do not levy it at all. Slabs change, and published third-party slab tables are frequently out of date, so the only reliable source is the relevant state commercial-tax portal. 

On that basis, “we cover all of India” is not a compliance statement. It is a marketing one.

So ask for the list, with certificate numbers, and then ask for the lead time in writing, in business days, for a state they do not currently hold, plus who bears the cost of the delay. 

That second half is the part that makes it a commitment rather than a hope.

What a 4 out of 4 looks like

A state-by-state list of current registrations with certificate numbers, plus a contractual lead time (in business days) for a new state and who bears the cost of the delay.

What a 0 to 1 looks like

“We cover all of India.”

Category 5 · 2026 legal currency: 10 points

Why it matters to you. India’s four Labour Codes came into force on 21 November 2025, consolidating 29 central statutes, and the EPF wage ceiling rose to ₹25,000 (about $261) on 17 September 2026, mid-wage-month, with proration guidance that was initially unclear. A provider’s own paperwork tells you whether it has kept up.

For an employer of record in India, regulatory currency is not an abstract virtue; it is a dated, checkable property of the provider’s own paperwork. Two documents settle it.

The employment agreement template. Drafted to the Codes, or still citing repealed Acts? This is binary and takes ten seconds.

The September 2026 payroll note. The Provident Fund wage ceiling changed mid-wage-month, and initial proration guidance was unclear. Every provider in India had to make a decision about how to handle that month. A good one documented it, told clients before it hit the invoice, and can send you the note. A weak one handled it silently and hopes you do not ask.

Then ask the forward-looking version: how do you track state rules as they are notified? Most major states had not finalised their rules as of the latest public tracking, which means the compliance picture will keep moving through 2026 and 2027. “We have an in-house legal and compliance team” is a 2. “Here is our regulatory-change log, here is who owns it, and here is the client note we sent when the ceiling changed” is a 4.

What a 4 out of 4 looks like

A template drafted to the Codes, a dated internal note on how it prorated September 2026, and a documented process for tracking state rules as they are notified.

What a 0 to 1 looks like

A template still naming the Industrial Disputes Act 1947, the Payment of Gratuity Act 1972 or the Payment of Bonus Act 1965 as live law, it is citing superseded statute.

Category 6 · PE & misclassification posture: 10 points

Why it matters to you. Permanent Establishment risk turns on what your India-based person actually does, not whose payroll they sit on. Under the India–US tax treaty a service PE can arise at 90 days, and for services performed for a related enterprise there is no day-count test at all. 

A provider that promises to remove your PE risk is either misinformed or selling.

This is the category where the sales process is least reliable, because the honest answer is less attractive than the one you want to hear.

Under Article 5 of the India–US tax treaty (full text, hosted by the IRS), a service permanent establishment can arise where activities continue more than 90 days in a twelve-month period, and where the services are performed for a related enterprise, there is no day-count test at all. 

That exception is the single most consequential sentence in this article for a US parent putting engineers in India to work on the parent’s own product, and it is often missed. A dependent-agent permanent establishment arises separately where someone habitually exercises authority to conclude contracts, or habitually secures orders, for the foreign enterprise.

India’s courts apply substance over form. Analysing the Supreme Court’s approach to fixed-place permanent establishment, Nishith Desai Associates describes the test as “not merely physical access but whether the premises are operationally ‘at the disposal’ of a foreign enterprise,” decided on a “substance-over-form approach.” 

You cannot paper around that with a vendor contract.

We should also be precise about what the case law does not say. The frequently cited Northern Operating Systems judgment is a service-tax secondment case, not an income-tax permanent-establishment case and not an EOR case, and the Central Board of Indirect Taxes and Customs has instructed field formations not to apply it mechanically to every secondment. 

And our research found no Indian court or advance-ruling decision squarely holding that a third-party EOR arrangement creates a permanent establishment. 

That is an honest gap, and we would rather state it than fill it.

The other half of this category is misclassification. India has no statutory definition of an independent contractor; courts apply control and integration tests and will look past a label. On reclassification the exposure is cumulative and retrospective (see the FAQ on contractors). 

Read more: India contractor misclassification. 

Ask the provider how it handles converting your existing Indian contractors, and whether it will indemnify historical misclassification. Most will not. The ones that will say so clearly, in a clause, are worth more than the ones that are vague about it.

What a 4 out of 4 looks like

A written statement of the activity boundary (no contract-signing authority, no habitual order-securing, no client-facing revenue generation in India), a documented contractor-conversion process addressing retrospective PF and ESI exposure, and a willingness to say “this role is not suitable for EOR”.

What a 0 to 1 looks like

“Using our EOR eliminates permanent establishment risk.” Treat this as a hard stop.

Category 7 · Onboarding, termination & gratuity execution: 8 points

Why it matters to you. There is no at-will employment in India. Final wages are due within two working days of exit, fixed-term employees now accrue pro-rata gratuity after one year rather than five, and gratuity insurance or an approved fund is mandatory. A speed claim without a contractual remedy is marketing.

Protected “workers” are owed one month’s notice (or pay in lieu) plus retrenchment compensation of 15 days’ pay per completed year, and from 300 workers up you need prior government permission. Managerial staff follow their contract and the state Shops & Establishment Act, commonly 30 to 90 days’ notice. 

Read more: Employee termination in India: a guide for US companies

Final wages are due within two working days of removal, retrenchment, dismissal or resignation (KPMG India). A US team used to a two-week notice and a final paycheck on the next cycle will break this without realising. Your provider is the one who has to not break it.

On speed: every provider in this market advertises an onboarding time. None of them, as far as we can find, publishes a way to verify it. So convert the claim into a contract. Ask what physically has to happen, identity and tax documents, Universal Account Number generation or transfer, Employees’ State Insurance number, bank account, the payroll cut-off calendar, and a state registration if this is a new state, then ask which of those steps sit outside the provider’s control, and then ask for an SLA with a remedy. 

A speed claim with no remedy is marketing. A speed claim with a remedy is a product.

And ask the gratuity funding question, because it is where the balance-sheet risk hides: gratuity insurance or an approved fund is now mandatory for private employers. 

Is your provider insured, holding an approved fund, or carrying a book provision? 

If it is the third, you may be relying on a liability that is not funded, and on exit, continuity of service means it does not simply disappear.

What a 4 out of 4 looks like

A contractual onboarding SLA with a named remedy, a documented list of which steps sit outside the provider’s control, a sample full-and-final settlement, and evidence of how gratuity is funded, insured, held in an approved fund, or carried as a provision you may inherit.

What a 0 to 1 looks like

“We onboard in 24 hours.” No SLA, no remedy, no gratuity funding answer.

Category 8 · IP assignment & chain of title: 8 points

Why it matters to you. Your employee signs a contract with the provider’s Indian entity, not with you. If IP vests there and no onward assignment exists, your chain of title has a gap that will surface in an acquirer’s diligence, and the gap is widest for work your contractors created before conversion.

So do not ask “is IP protected?” Ask to see the two clauses and follow the chain: 

employee → the provider’s Indian entity → your company. 

You want a present assignment in the employment agreement and an express onward assignment in the services agreement, not a best-efforts obligation to assign later.

Then ask the question that trips most companies up: what about the work your Indian contractors created before you converted them? That IP was created under a different contract, often a thin one, sometimes none, and it may never have transferred. Converting the person does not retroactively convert the IP. 

A provider with a real conversion process will have a remediation step for this. Most do not, because most have never been asked.

What a 4 out of 4 looks like

A present assignment in the employment agreement, an express onward assignment to your company in the services agreement, treatment of pre-existing contractor-created IP, and a confidentiality regime you can show an acquirer’s diligence team.

What a 0 to 1 looks like

“Standard IP protection is included.” No clause shown.

Category 9 · Data protection (DPDP Act 2023): 7 points

Why it matters to you. India’s Digital Personal Data Protection Rules, 2025 were notified by MeitY on 14 November 2025 (MeitY notification and rules text) with full compliance due on 13 May 2027. A US employer can be covered even without an Indian entity, and the employer remains the data fiduciary and stays responsible even where a vendor processes the data. 

Penalties reach ₹250 crore (about $26 million) for failing to maintain reasonable security safeguards.

Ask this of every employer of record in India you are considering, because the reflex answer from a US buyer is “we are SOC 2, so we are fine.” The Digital Personal Data Protection Act is a different regime with different roles and much larger numbers, and it can reach a US employer even without an Indian entity.

You cannot contract the data-fiduciary obligation away to your EOR. What you can do is contract for the cooperation you will need to discharge it.

Practical obligations to get into the addendum: a plain-language consent notice stating purpose, data categories, retention period and how to withdraw consent; a published contact point; a commitment to respond to access, correction and erasure requests within the statutory window; and breach notification to the Data Protection Board and to affected individuals.

Also ask where the data physically lives, who in India can access payroll records, and what happens to that data on exit, which connects directly to category 10.

What a 4 out of 4 looks like

A signed DPDP addendum, a named grievance contact, documented consent-notice practice, a breach-notification commitment with a timeline, data-residency disclosure, and ISO 27001 or SOC 2 evidence.

What a 0 to 1 looks like

“We are GDPR compliant” offered as the answer to a DPDP question, or a claim that the obligation transfers away from you.

Category 10 · Exit, continuity & portability: 5 points

Why it matters to you. Almost nobody asks this before signing, and it is where the money is. Transferor and transferee are jointly liable for unpaid social-security dues on a business transfer, so an exit from a provider with arrears can follow you.

Six things need answers: PF/UAN transfer, ESI continuity, gratuity continuity of service, Form 16 across a split year, DPDP data return and deletion, and the conversion fee if you move people onto your own entity. Section 8 sets out what should happen for each.

What a 4 out of 4 looks like

A contractual exit and transition window, written confirmation of UAN and PF portability and ESIC continuity, treatment of gratuity service continuity, Form 16 across a split financial year, data return and deletion under DPDP, and a stated conversion fee for moving employees onto your own entity.

What a 0 to 1 looks like

“We would handle that at the time.”

4 · Is an EOR provider the right model for you at all?

You can incorporate your own Indian company, use an employer of record in India, or engage contractors. 

• The first gives you maximum control and maximum administrative load. 
• The second transfers employment-law execution and takes days rather than months. 
• The third looks least expensive on paper and carries the exposure that most often turns into a bill.

Sources: MCA incorporation process and timelines; Code on Social Security 2020; Deloitte, India Tax Highlights 2025 on corporate rates; India–US tax treaty Article 5.

Is an employer of record in India legal?

Yes. The India chapter of the Littler International Guide, published by the world’s largest employment-law firm, with the India chapter contributed by Nishith Desai Associates, states that EOR, PEO and staffing arrangements are not subject to particular legal restrictions, provided the provider complies with applicable law. We cite that rather than our own assurance deliberately: it is a question you should not take a vendor’s word on.

Read more: Hire employees in India without an entity

When should you outgrow your EOR provider?

There is no fixed headcount. You outgrow an EOR provider when running your own compliance function costs less than the per-head fees, and when you need an Indian balance sheet, usually because you start selling in India. A good provider will tell you when you reach that point, and will quote a conversion fee up front.

Read more: EOR vs own entity in India (2026) · EOR vs entity vs contractor · How to set up a private limited company in India

5 · How it happens normally vs. with an employer of record in India

Doing it yourself means incorporating a company, obtaining six or more registrations, and then running a monthly statutory cycle correctly, forever. Doing it through an employer of record in India means adding a person to an establishment that already exists and already files. The difference is not effort. It is who carries the liability while you learn.

Sources: MCA/SPICe+ incorporation process; EPFO and ESIC filing calendars; Code on Wages 2019 s.2(y); Industrial Relations Code 2020; MeitY DPDP Rules 2025. Husys operational benchmarks from Husys Data Labs (2026).