Key Takeaways:
- VPNs can make remote employees appear to be working in another state and complicate income sourcing and apportionment.
- Cost-of-performance states source income where the work is physically performed, not necessarily where the company’s headquarters, customers, or servers are located.
- Misaligned data can expose organizations and employees to unexpected multistate tax filing and withholding obligations.
—
Virtual private networks (VPNs) have become the quiet backbone of remote work. They keep data secure and employees connected, no matter where they log in. But there’s a hidden side effect that few companies consider: when a VPN makes it appear as though an employee in Texas is working from a server in California, the data trail can mislead tax systems, auditors, and even internal finance teams.
With each state applying unique sourcing rules, and budget shortfalls prompting closer scrutiny, that digital illusion can translate into very real tax exposure.
The Sourcing Framework
One of the obligations for companies providing services is determining the correct state in which those services are sourced for income tax purposes (and possibly sales and payroll tax purposes). In this context:
- Sourcing means the method a state uses to assign a portion of a company’s receipts (especially from services or intangibles) to that state.
- There are two primary methods for sourcing income:
- In cost-of-performance (COP) states, receipts are attributed to where the “income-producing activity” is performed.
- In market-based sourcing (MBS) states, receipts are attributed to the state where the customer receives the service benefit or where the intangible is used.
Most states now use market-based sourcing. However, a handful of states use cost-of-performance rules or mix them with market-based regulations.
Remote Work + VPN = Sourcing Risk
Now, layer remote working arrangements, VPNs, and multistate operations onto that patchwork of sourcing rules across states.
A VPN essentially acts as a tunnel between an employee and a server location. So, for example, the system may show the employee working in California based on an IP address or VPN endpoint, even though the employee is working from their home in Texas or a client’s office in North Dakota.
If the company reports time or allocates revenue based on the VPN location rather than tracking the employee’s actual physical work location, the sourcing basis may be incorrectly skewed.
With a cost-of-performance sourcing state, the place where the work is performed is critical. If the employee is physically in Texas but the VPN makes it appear that the work was performed in California, the company may misassign where the income-producing activity occurred.
When employees travel or work in multiple states, tracking their location can be complex. Without accurate records, such as timesheets with locations, travel logs, and other documents, the company and its employees may face unexpected multistate filing obligations.
One Employee, Three States, and a Surprising Tax Bill
Here’s an example of how tax obligations can catch employees off guard. Say ABC Company is based in California and hires a remote employee living in Texas and regularly traveling to corporate locations in Oklahoma and Kansas for work.
The employee may assume that because their home state of Texas has no individual income tax, they don’t have to file any state income tax returns. However, Oklahoma requires workers to file non-resident income tax returns if they earn $1,000 or more in the state and requires employers to start withholding state income tax if employees earn more than $300 in any quarter. Kansas requires workers to file non-resident income tax returns and their employers to withhold income taxes if the employee spends one day working in the state.
Since the company has corporate locations in Oklahoma and Kansas, it presumably is aware of its income, sales, and payroll tax obligations in those states. But the employee could be caught off guard at tax time when they realize they need to file non-resident returns in two states.
Income-Sourcing Issues to Address
Consider the following three steps to protect your organization and its employees:
1. Track Actual Work Locations
If an employee is physically working at a location other than your premises, you should have a process to capture that location, even if they’re using a VPN. For example, maintain timesheets that specify the state, travel logs for employees working in other states, and periodically confirm the employee’s state of residence. These records help support audit positions and align apportionment with where the work is performed rather than the virtual network location.
2. Communicate With Employees
Employees should understand that if they work in another state due to travel or relocation, they may trigger individual income tax or withholding obligations in that state. Communicate with them clearly so they’re not surprised by multistate filings or withholding changes.
3. Establish Internal Controls for Sourcing Revenue
Consider how you track where services are performed for sourcing purposes. Don’t rely solely on VPN logs or billing addresses. Make sure you have a process for reconciling the employee’s actual location.
Budget shortfalls are forcing many states to pursue audits around remote work and income sourcing, so ignoring the issue and hoping you won’t get audited isn’t a sound strategy.
How MGO Can Help
As remote work, VPNs, and multistate teams blur the boundaries between states, it’s crucial to accurately capture where employees perform their jobs and consider where revenue is sourced — and what that means for your business and its employees. Missteps in revenue sourcing rarely stem from willful disregard for the rules. They come from legacy systems that aren’t designed for today’s tax climate and workforce realities.
MGO’s State and Local Tax (SALT) group helps organizations navigate these complexities. We can help you analyze where employees are working and your current revenue sourcing processes, and identify potential exposure issues before they become audit risks.
Reach out to our SALT group to assess your exposure and create a strategy that aligns with the modern workplace without leaving tax exposure in its wake.