This guide is written for the approver, not the initiator: the CFO, COO or head of legal who has to understand what the company is actually signing up for. It covers the three models side by side, what really creates misclassification exposure in LATAM, what changes when contractors touch US customer data, and how to pick a model without overpaying for protection you don't need.
This is a general overview, not legal or tax advice. Employment law is local and it changes — Argentina passed a major labor reform in 2026. Validate any structure with counsel in the country where the person lives.
The three models in plain terms
You sign a services agreement with an individual (or their one-person company) and pay invoices. Lowest overhead and fastest to start. You carry the classification risk and every compliance task yourself.
A local entity legally employs the engineer on your behalf, runs payroll and statutory benefits under local labor law, and invoices you. You direct the day-to-day work. The person is a full employee — just not on your entity.
A provider supplies the engineer and is accountable for the engagement — sourcing, HR, payroll and replacement if it doesn't work out. You manage the work; the provider manages the person's employment or contract.
Side by side
| Direct contractor | EOR | Staff augmentation | |
|---|---|---|---|
| Legal relationship | Services contract with you | Employee of the EOR | Employee or contractor of the provider |
| Misclassification exposure | Yours | Low — it's real employment | Mostly the provider's |
| Statutory benefits | None | Full, per local law | Depends on the provider's model |
| Cost structure | Rate only | Salary + employer costs + fee | All-in hourly or monthly rate |
| Speed to start | Fastest | Fast, once the offer is signed | Fast |
| Best for | 1–3 people, defined scope | Long-term core team in one country | Speed, flexibility, several countries |
What actually creates misclassification risk
US finance teams often reach for the IRS common-law test. It's the wrong lens. For an engineer who lives in Buenos Aires, São Paulo, Bogotá or Mexico City, the question of whether they are really an employee is decided by local labor law, and local courts look at the reality of the relationship, not the title on the contract.
The signals are remarkably consistent across the region: exclusivity, fixed working hours, being managed like any other team member, company equipment and accounts, an indefinite duration and a fixed monthly payment. A long-term, full-time contractor embedded in your team ticks most of those boxes. That doesn't make it illegal — but it is the profile that generates claims.
Country notes
Argentina. The Labor Modernization Law (Ley 27.802, in force since March 2026) narrowed the presumption that a service relationship is employment. The presumption no longer applies to professional services that are invoiced and paid through the banking system. That lowers the risk of a well-documented contractor arrangement, but it doesn't eliminate it: if the day-to-day reality is dependent employment, it can still be treated as such.
Brazil. The line between a CLT employee and a contractor billing through a company (PJ) is one of the most litigated questions in Brazilian labor law. Long-term, exclusive, full-time PJ arrangements are the classic risk profile.
Mexico. The 2021 subcontracting reform prohibited supplying personnel through third parties, with an exception for specialized services registered in the REPSE registry. If a provider engages engineers through a Mexican entity, ask how they comply.
Colombia. The constitutional principle of primacy of reality over form means a "services contract" that functions like employment can be reclassified.
The practical rule: the longer, more exclusive and more integrated the engagement, the more an employment-based model (EOR or your own entity) earns its cost. Short, scoped, genuinely independent work is where contractors fit best.
Data protection when contractors touch US customer data
Classification is half the question. The other half is what happens to your customers' data. Whatever the model, anyone with production access needs to be covered by a written data processing agreement (DPA) or equivalent confidentiality and security clauses, plus the access controls your own employees get: SSO, MFA, managed devices and documented onboarding and offboarding.
The model changes who signs what. With a direct contractor, you sign with each individual and enforce the terms yourself. With an EOR or staff augmentation provider, the provider signs the DPA with you and flows the obligations down to its people — one contract instead of twenty. Local privacy laws also apply on their side: Argentina's Ley 25.326, Brazil's LGPD, Colombia's Ley 1581 of 2012 and Mexico's federal data protection law.
If you're SOC 2 audited, auditors will ask for the same onboarding, access review and offboarding evidence for contractors and provider staff as for employees. Our guide to hiring GRC and SOC 2 talent in LATAM covers who keeps that evidence in order.
What you actually pay for
Contractors cost their rate — our 2026 LATAM rate benchmarks put senior contractors at $35–55/hr in Argentina and Brazil and $30–50/hr in Colombia — plus your own time on contracts, payments and compliance.
An EOR costs the gross salary, the statutory employer costs and the EOR's fee. In Argentina, employer contributions add roughly a quarter on top of gross salary, before workers' compensation insurance, the 13th salary (aguinaldo) and the severance provision. Our Employer of Record in Argentina guide breaks those components down.
Staff augmentation is quoted as one all-in rate that includes the provider's margin, HR and replacement terms. It looks more expensive per hour than a contractor and is often cheaper than discovering a classification problem two years in.
How to choose
- 1–3 engineers, defined scope or a few months → direct contractors or staff augmentation
- Speed, replacement guarantees or several countries at once → staff augmentation
- A long-term core team concentrated in one country → EOR
- Retention matters and candidates want employee benefits → EOR
- Dozens of people in one country for years → plan your own entity, starting on an EOR
- Anyone touching customer data → a DPA and real access controls, whatever the model
Final thoughts
There is no universally right model — there is a right model for each mandate. The mistake we see most often is choosing the wrapper by habit: contractors because it's what the first hire used, or an EOR for a three-month project. Decide the model when you scope the role, not after the offer is accepted.
IT Mates sources and vets senior engineers across Latin America and works with whichever model fits the mandate. For large roll-outs in Argentina we offer an Employer of Record service through a local partner, so recruiting and employment run as one program.
Sources
- Ley 27.802 — Ley de Modernización Laboral (InfoLeg)
- REPSE — Registro de Prestadoras de Servicios Especializados (STPS, Mexico)
- Lei 13.709/2018 — LGPD (Brazil)
Not sure which model fits your next hire?
Get a vetted LATAM shortlist in 72 hours.
Tell us the role, the country and how long you need the person. We'll shortlist senior candidates and tell you which engagement model makes sense — contractor, staff augmentation or EOR.