Co-Employment Liability Risks Startups Accept Inside a PEO

Co-employment is not an incidental legal byproduct when you hire a professional employer organization. It is the mechanism the entire PEO model runs on, and the structure itself creates a specific set of liabilities that the startup, not the PEO, ultimately bears. The articles in this guide explain where those liabilities come from and what a founder can do about them.

A PEO cannot add a startup's workers to its group health plan, its workers' compensation policy, or its payroll tax accounts unless those workers are also, in some legal sense, the PEO's employees. That shared employment relationship is the product. Whether a particular startup has signed up for a co-employment arrangement or not, the legal structure is the same: the PEO and the startup are joint employers.

The PEO's marketing materials reframe this structure as risk transfer. The pitch is that the PEO absorbs HR liability so the startup does not have to. That framing obscures a structural truth: the Client Service Agreement allocates responsibilities between two private parties, but courts and federal agencies do not automatically defer to what two private parties agreed. The tax authority, the wage agency, the civil rights agency, and the labor board each apply their own statutory tests to determine who is liable. A contract clause that says the PEO will handle payroll taxes does not change how the IRS defines a responsible person under Section 6672. A clause that says the PEO will defend discrimination claims does not change who the EEOC names as a respondent. The liability follows the statute, not the signature block.

This distinction matters because of what it means for the startup. When a PEO sells co-employment as risk transfer, the startup hears that it has moved its employment liability to a third party. What actually happens is that the startup has added a second employer to its workforce, and both employers now sit inside the statutory tests that agencies apply. The question is whether the startup is also liable, and under most statutes the answer is yes.

The five liability categories a startup inherits the moment it signs a co-employment agreement

Co-employment does not distribute liability evenly or cleanly. The startup inherits exposure across five discrete legal categories, and the PEO's contract cannot fully extinguish any of them. Each category attaches by statute, not by agreement, which means the exposure exists from the first day of the relationship.

The first category is wage and hour exposure. As a joint employer, the startup is independently liable for unpaid minimum wage and overtime under the federal wage statute and applicable state wage laws for the full duration of the relationship. A startup that has used a PEO for three years and then faces a misclassification claim is looking at three years of retroactive wage exposure, not just the current pay period.

The second category is payroll tax liability. Under IRC Section 6672, the IRS can hold corporate officers, owners, and even bookkeepers personally liable for unpaid trust fund taxes: the employee-side income tax and Social Security and Medicare withholdings that the PEO was supposed to remit. This is not a corporate liability that can be discharged in restructuring. It is an individual, personal obligation. The Trust Fund Recovery Penalty reaches individuals even when the PEO, not the startup, processed and held the funds. A founder whose PEO failed to remit quarterly payroll taxes can find their personal assets at risk, not just the company's.

The third category is missed statutory benefits. The benefits liability often exceeds the direct wage liability because it includes premiums for unreported coverage periods and exposure to medical claims that should have been covered. A worker who should have had health insurance for two years and instead incurred out-of-pocket medical costs creates a liability that goes well beyond the value of the unpaid premiums.

The fourth category is employment discrimination. A joint employer is jointly liable for discrimination, harassment, retaliation, and NLRA violations involving covered workers, regardless of which entity's managers committed the act. This includes liability for conduct by PEO HR personnel that the startup had no direct visibility into. A supervisor at the PEO who mishandles a leave request or retaliates against an employee for raising a concern creates exposure for the startup, even though the startup never employed that supervisor and never saw the conduct.

The fifth category is the class action multiplier. The same legal test that catches one worker catches all workers in the same arrangement. Settlement exposure in joint employer class actions can run multiples of the direct wage liability once class mechanics, attorney fees, and reputational impact are factored in.

Why "the PEO handles it" is not a legal defense, and when it is

The most common assumption a founder brings to a PEO signing is that hiring the PEO makes employment compliance the PEO's problem. That assumption is wrong in most cases, and the reason is structural rather than technical. The statute determines liability first. The contract determines who pays second. A startup that relies on the contract as its primary protection has inverted the order.

There is one real way to shift federal payroll tax liability, and it deserves precise treatment. A Certified Professional Employer Organization is treated as the sole employer for federal employment taxes under IRC Section 3511. That means the client is generally not liable if the CPEO fails to remit. The certification matters, and the distinction between a certified and uncertified PEO is not a technicality. It is the difference between personal exposure and statutory protection for the largest single liability category a startup faces.

But CPEO certification is revocable, which makes it an ongoing verification requirement rather than a one-time diligence item. The only reliable way to confirm current status is to check the IRS's public CPEO database directly. Marketing language on a PEO's website is not an authoritative source, and a certification badge that was accurate at signing may not be accurate six months later.

The indemnification clause in a Client Service Agreement deserves the same precision. The startup must first absorb the liability judgment or agency finding, then pursue the PEO for reimbursement. That sequencing matters in a cash-flow or M&A context, where a seven-figure liability finding cannot wait for a separate contract action against the PEO to resolve.

The insurance gap most CFOs don't find until a claim is filed

The statutory liability categories are not the only exposure a PEO arrangement creates. The insurance structure that PEOs sell as part of their package has its own hidden weakness, and it sits adjacent to the statutory discussion in a way that catches finance chiefs off guard. A startup inside a PEO may believe it has Employment Practices Liability Insurance coverage when it is actually sharing an aggregate limit with every other client on the PEO's master policy. That shared aggregate can be partially or fully eroded by claims the startup has no visibility into. If you join mid-year or your claim comes late in the policy year, the available limit may already be reduced by losses you knew nothing about.

What adequate EPLI coverage looks like is straightforward. Companies above a certain headcount threshold are generally better protected at $2 million or above. A startup at 30 employees with a shared $1 million aggregate that has already absorbed two unrelated claims is not meaningfully insured, regardless of what the PEO's coverage summary says.

Workers' compensation has its own geographic trap. In monopolistic states, coverage must be purchased directly from the state fund, and a PEO's master policy does not automatically satisfy the requirement. The four monopolistic states are Ohio, North Dakota, Washington, and Wyoming. The gap is invisible until a claim is filed, and then it is a regulatory violation, not just an insurance shortfall.

How co-employment liability surfaces at the worst possible moment — funding rounds and M&A

Co-employment liability that has built up silently inside a PEO arrangement does not stay invisible forever. It surfaces in due diligence, and by then the cost of resolution has typically grown substantially. The time to think about what a data room needs to show is not after a term sheet is signed.

Buyers and their counsel look for specific things when a target company sits inside a PEO. The first is employment structure clarity: is the company the common law employer, and what does the PEO agreement say about that? The second is tax filing history: were federal and state employment taxes remitted on time, and under whose FEIN? The third is retroactive wage and benefit exposure: are there any worker classifications that could be challenged? The fourth is CPEO status verification: was the PEO certified during the entire period, and can that be confirmed with IRS records rather than PEO representations? A buyer that finds a gap in any of these areas will either reprice the deal or walk away.

The unwinding timeline creates its own deal risk. That timeline competes with deal pressure, adds complexity to the closing schedule, and creates a period of benefits disruption for employees during an already uncertain time. If you wait until the buyer asks about PEO transition timing, you are already behind.

The contract itself can be a deal liability. In an acquisition, the acquirer may inherit the PEO agreement and its remaining term. Assignment and termination clauses must be reviewed before any round or sale, not after term sheets are signed.

What the startup remains responsible for regardless of what the PEO agreement says

The compliance the PEO administers and the compliance the startup remains legally responsible for are not the same list. Most Client Service Agreements do not make that distinction clearly, and the gap between the two lists is where retained liability lives. The ACA employer mandate applies to employers with 50 or more full-time-equivalent employees. A PEO administers the offer of coverage on the startup's behalf, but it does not erase the test or the underlying obligation. The startup owns the test. The PEO only runs the paperwork.

ERISA fiduciary duties follow a similar pattern. When the PEO sponsors health and retirement plans, it assumes primary fiduciary responsibility. But the client company typically retains fiduciary duties around plan selection decisions, contribution levels, and investment monitoring for 401(k) plans. The startup must verify that required notices are delivered on time and that Form 5500 filing obligations for certain plans are met. The PEO may administer these items, but the startup remains the fiduciary that signed up for them.

State-mandated paid leave programs add another layer. The startup's obligation exists at the state level regardless of how the PEO structures its filings. If you have remote employees spread across seven of those states, you have seven separate obligations, and none of them disappear because a PEO processed payroll.

Multi-state registration is the same story. You have state unemployment insurance registration, income tax withholding registration, and new-hire reporting obligations in every state where employees work. The obligation to verify registration and accuracy sits with the startup as the common law employer.

And the common law employer test persists at the center of all of it. Regardless of what the PEO agreement says, the startup remains the common law employer in the eyes of most state agencies and federal bodies that conduct their own control-based analysis. The startup controls all of them, which means the startup is the common law employer, which means the startup owns the liability.

How to audit a PEO arrangement for the gaps that the co-employment structure creates

Because liability follows statute rather than contract, the only reliable mitigation is independent verification, not reliance on PEO representations, across each of the categories where co-employment creates exposure. An audit that asks the PEO to confirm its own compliance is not an audit. The CPEO status check should happen at least quarterly, not annually. The check is a database lookup, not a phone call to the PEO's account manager. A founder or CFO should also confirm the PEO's FEIN appears on the startup's federal payroll filings. If it does not, the liability protection that CPEO certification is supposed to confer may not apply.

Ask for the actual EPLI policy documents, not a summary. The startup should confirm that it is a named insured, not simply a covered party under the PEO's policy, and that the aggregate limit is dedicated to the startup rather than shared across all PEO clients. Workers' comp coverage should be confirmed in every state where employees work, with particular attention to monopolistic-state requirements in Ohio and Washington.

The Client Service Agreement has contract-level traps that are independent of the statutory issues. Auto-renewal clauses and their notice windows can lock a startup into another full contract term if a notice deadline is missed. Assignment clauses determine whether the agreement transfers automatically to an acquirer and what rights the acquirer has to terminate or renegotiate. Each of these terms should be read before a round or sale, not after.

An independent compliance calendar is the operational backbone of the audit. The startup should maintain a separate record of federal and state filing deadlines: Form 5500, ACA reporting, state SUI and withholding registrations. For multi-state workforces, registration status should be confirmed in every state where employees work, not just the states the startup knew about at signing.

Finally, the audit should include a decision trigger for evaluating whether the PEO structure still makes sense. The pooled benefit pricing that justifies the arrangement at 15 employees is often offset by per-employee fees at larger headcounts. The four-to-six-month unwinding timeline means the decision to exit is a decision made well before the transaction, not during it.