Is Remote Work on a Tourist Visa Illegal? Spain, Portugal & UAE Legal Risks in 2026

Alex is a software engineer based in Taipei. Every morning he opens Slack, joins the standup meeting, then spends the afternoon writing code and reviewing PRs. The only difference is he's sitting in a Barcelona Airbnb, having entered Spain on a tourist visa. He figures there's no issue — after all, his salary comes from a Taiwanese company and lands in a Taiwanese bank account.

Then, on April 10, 2026, the EU Entry/Exit System (EES) went fully operational. This system replaces passport stamps with biometric tracking, automatically counting how many days you've spent in the Schengen area, with records stored for five years. Alex's old strategy of "entering and exiting without anyone noticing" officially stopped working on that day.

This article isn't here to scare you. It uses specific legal provisions and real enforcement data to help you understand: what rules does remote work on a tourist visa actually violate, what happens if you get caught, and in the 2026 landscape, how to make an informed choice.

TL;DR

• The law cares about where you work, not where your paycheck comes from. Answering emails from Spain on a tourist visa is technically illegal work, regardless of whether your employer is in Taiwan or on the moon.
• Yet there is not a single documented case worldwide of a digital nomad being deported from Spain or Portugal for remote work performed for a foreign employer. The law is strict; enforcement is virtually nonexistent.
• EES going live on April 10, 2026 changed the game. Automated 90/180-day tracking, five-year record retention, and data shared across all Schengen borders make "flying under the radar" significantly harder.
• The UAE has the strictest enforcement of the three. An official warning was issued on April 8, explicitly prohibiting any work activity on a tourist visa.
• Taiwan has no income tax treaty with Spain, Portugal, or the UAE, creating a real risk of double taxation.

"My Salary Comes from Taiwan, So It's Legal" — That's Not How the Law Works

This is probably the most common misconception in the remote work community: "I work for a company back home, my salary goes into my home bank account, I'm just physically somewhere else. I'm not taking jobs from locals."

Sounds reasonable. But the legal standard is entirely different.

The legal frameworks in Spain, Portugal, and the UAE share a common principle: the definition of "work" is based on where the labor is performed, not where the salary is paid. If you're writing code in a Barcelona cafe, it doesn't matter whether your employer is in Taipei or San Francisco — legally, you are "performing labor on Spanish territory."

Kevin is a small business owner who visits Dubai every two months, staying three to four weeks each trip. While in Dubai, he handles his company's affairs, meets with local suppliers, and uses corporate credit cards. He considers this "business travel, not work." But UAE law is clear: commercial activities conducted on UAE territory, including dealings with local suppliers, require a corresponding work permit.

So what about answering an email? Under strict legal interpretation: performing any form of labor on another country's territory constitutes work. But here's the important caveat: in practice, no country pursues tourists for answering a few emails at a hotel. The real risk isn't about any single action — it's about patterns. More on that later.

There's another point worth clarifying: many countries offer visa-free entry or tourist visas to certain passport holders. This is an "entry permit" — it is not a "work permit." Visa-free access lets you enter a country for tourism; it does not authorize you to work there.

EU EES Goes Live: The Biggest Border Control Shift in the Schengen Area in 20 Years

On April 10, 2026, the EU Entry/Exit System (EES) became fully operational. This wasn't a minor update — it's the most significant border control overhaul in the Schengen area in two decades.

How EES Works

Every non-EU citizen entering the Schengen area now has biometric data collected: fingerprints and facial scans. This data replaces traditional passport stamps, with entry and exit times automatically recorded by the system.

Specifically:

• 90/180-day limits are now calculated automatically. Previously, officials manually counted passport stamps, leaving room for ambiguity. Now the system computes it instantly — overstaying by even a single day is caught.
• Records are retained for 5 years and shared among border officials across all 27 Schengen member states. Your entry record at Barcelona is visible to a border officer in Lisbon.
• Since the pilot phase began in October 2025, the system has recorded over 52 million entries and exits and flagged over 27,000 entry refusals.

What This Means for Non-EU Passport Holders

The old strategy might have been: spend 85 days in the Schengen area, fly to the UK or Morocco for a few weeks, then come back to "reset" the clock. Under the old system, if a border officer missed a stamp or two, you might slip through.

After EES went live, that margin disappeared. The system automatically tracks your cumulative days within the entire 180-day rolling window, regardless of where you fly in between.

The good news: EES doesn't apply retroactively. The system began recording from April 10, 2026 onward. Past entry/exit records won't be dug up. But from that date forward, every crossing is logged.

It's also worth noting that some Schengen states may apply a temporary flexibility period of up to 90 days after EES launch to manage peak summer travel. This means some border points might temporarily skip biometric collection — but this pause does not affect EES entry records. Your time still counts toward the 90/180-day cumulative total; only the collection method is temporarily adjusted. Don't assume that reduced biometric screening at some borders in summer means your stay isn't being tracked.

For a deeper dive into how EES affects digital nomads, see this EES compliance guide.

Spain: Strictest Law, Near-Zero Enforcement

What the Law Says

Spain's rules are clear-cut. Ley Orgánica 4/2000 (the Foreigners' Rights Act), Article 53, classifies "working in Spain without authorization" as a "serious infringement" (infracción grave). The consequences:

• Fines of EUR 501 to EUR 10,000
• Possible deportation
• Schengen entry ban of 6 months to 5 years

And it's not just about you. Article 54.1 of the same law states that employers who hire unauthorized foreign workers face "very serious infringement" penalties of EUR 10,001 to EUR 100,000 per unauthorized worker.

But What About Enforcement?

Honestly: after an exhaustive search across global English and Chinese media, I could not find a single documented case of a digital nomad being deported from Spain for remotely working for a foreign employer. Not one.

This doesn't mean the risk is zero. It means the risk materializes through pathways you might not expect.

In Spain, the real trigger isn't immigration officers raiding your Airbnb. It's the tax authority (Agencia Tributaria) launching an investigation. If you stay beyond 183 days and become a tax resident, or if your spending patterns get flagged by financial institutions, a tax investigation can cascade into immigration issues. In 2026, Spain's Agencia Tributaria and the Dirección General de Migraciones are increasing their scrutiny of digital nomads.

Spain's Digital Nomad Visa (DNV) as an Alternative

If you plan to stay in Spain beyond the 90-day visa-free limit, or want to reduce your legal exposure, Spain offers a dedicated digital nomad visa:

• Income requirement: Approximately EUR 2,850/month (200% of Spain's minimum wage)
• Application fee: Approximately EUR 73
• Duration: 1 year when applied from abroad; up to 3 years when applied from within Spain
• Conditions: Your employer or clients must be based outside Spain
• Tax benefit: Eligible for the Beckham Law — a flat 24% tax rate on employment income for the first 6 years (capped at EUR 600,000/year)

Portugal: An Officially Acknowledged Gray Zone

Portugal's stance is the most lenient of the three, but "lenient" doesn't mean "risk-free."

The Official Position

For remote workers employed by foreign companies and staying under 90 days, the Portuguese government takes what amounts to a gray-zone policy: it doesn't actively pursue enforcement. This is different from Spain's "explicitly illegal but unenforced" approach. Portugal is closer to "we know what you're doing, but under 90 days, we're not going to intervene."

But there are conditions:

• You must genuinely be working for a foreign employer — not sourcing clients or freelancing locally within Portugal
• Your stay doesn't exceed 90 days
• You're not generating local income in Portugal

New Risks of Frequent Entry

Mei is a freelance designer whose clients are mostly European and American companies. She planned to base herself in Lisbon long-term, with this strategy: stay on a tourist visa for 85 days, fly to Morocco for a week, then return for another 85 days. Previously, this approach had some gray area, since border officers might not carefully count every passport stamp.

After EES went live, this strategy carries significantly higher risk. The system automatically tracks cumulative days within the 180-day rolling window. A pattern of repeatedly approaching the 90-day limit will get flagged, and border officers have grounds to deny entry.

The D8 Digital Nomad Visa

If you want to live in Portugal legally long-term, the D8 visa is the proper route:

• Income requirement: EUR 3,680/month (4x Portugal's minimum wage of EUR 920)
• Spouse adds 50% (EUR 5,520/month); each child adds another 30%
• Bank deposit: At least EUR 11,040 (12 months of minimum wage)
• Processing time: Officially 60 days; in practice 4 to 7 months
• Long-term value: After 5 years, you can apply for permanent residency, opening a path to EU citizenship

Mei's challenge is that her income fluctuates — sometimes high, sometimes low — making it hard to consistently hit EUR 3,680 every month. In practice, the approach is to provide average income documentation over 6 to 12 months rather than a single month's proof. If your annual income reaches EUR 44,160 (EUR 3,680 x 12), most officials will accept the application even with monthly fluctuations.

If annual income still falls short of the D8 threshold, Spain's DNV is another option: the monthly income requirement is approximately EUR 2,850 (lower than D8), the application fee is cheaper, and the Beckham Law offers a flat 24% tax rate (capped at EUR 600,000). The trade-off is a 3-to-4-month processing time and the requirement that all clients be based outside Spain. For freelancers with lower income or still building their client base, the DNV threshold is more realistic.

UAE: Strictest Enforcement of the Three, Three Crackdowns in 2026

If Spain is "strict law, loose enforcement" and Portugal is "we know but don't care," then the UAE is "we're watching, and we're acting."

Three Specific Tightening Moves in 2026

January 27: Remote Work Visa threshold adjustment. Bank statement requirements extended from 3 months to 6 months, with an income requirement of USD 3,500/month.

February 11: Visa overstay fines standardized at AED 50/day (approximately USD 14), applied uniformly across all emirates.

April 8: Industry media reported Dubai stepping up enforcement against illegal work on tourist visas, reminding tourist visa holders that any work activity is prohibited. This coincided with the launch of the MOHRE-ICP integrated database, which can cross-reference visa categories against local salary and invoice records.

Kevin's Scenario: Does It Count as Work?

Kevin visits Dubai every two months, staying three to four weeks each time — handling his company's affairs, meeting local suppliers, and using corporate credit cards. He says, "This is business travel, not work."

UAE law disagrees. Commercial activities conducted on UAE territory — including dealings with local suppliers, local meetings, and use of local office facilities — require a corresponding work or business permit. Tourist visa holders engaging in these activities face:

• Fines of up to AED 50,000 (approximately USD 13,600)
• Deportation
• A permanent labor ban (affecting future entry and commercial activities)

UAE Virtual Working Programme

The good news is that the UAE's remote work visa is the fastest to obtain among the three:

• Application fee: USD 287 (total costs including medical, Emirates ID, etc.: approximately USD 1,100 to USD 2,100)
• Income requirement: USD 3,500/month
• Processing time: 5 to 7 business days
• Duration: 1 year, renewable
• Important note: Unlike Europe, many passport holders need to apply for an e-visa before traveling to the UAE — check your country's requirements

If, like Kevin, you need to visit Dubai regularly, the ROI on this visa is high: starting at USD 1,100 per year, it's far less than a single fine.

For a more detailed guide on applying for the UAE remote work visa, see this UAE virtual work visa guide.

The Triple-Trigger Risk Framework: What Actually Gets You in Trouble

As noted earlier, answering an email won't get you deported. So what actually triggers real risk?

Based on enforcement cases and analysis from immigration lawyers, the real danger isn't any single action — it's when three factors appear simultaneously:

Trigger 1: Physically Visible Work Activity

• Regularly appearing at coworking spaces or shared offices
• Using a local company's office facilities
• Being spotted by immigration or labor inspectors at a coworking space (there are reports of increased spot checks at Dubai Internet City and DIFC)

Trigger 2: Work Evidence on Social Media

• LinkedIn showing "Working from Barcelona" alongside work-related posts, or any geotagged professional content (new project launches, client testimonials, completed assignments) — this signals "professional activity at this location," not just "I said I work here"
• Instagram check-ins at coworking spaces
• Public Slack channels or Twitter/X work discussions with geotags

Trigger 3: Repeated Entry Patterns

• Multiple entries approaching the 90-day limit (EES now tracks this automatically)
• Long-term rentals in the same city (treated as de facto residence rather than tourism)
• Frequent border crossings ("visa run" patterns)

A single trigger appearing alone: low risk. All three appearing simultaneously: risk jumps to medium-high. Because this combination gives border officials and tax authorities sufficient grounds to initiate a formal investigation.

And note: these three triggers don't just affect immigration status — they can also detonate a tax pathway. If the tax authority determines you have substantial economic activity locally, even if all your income is wired from abroad, you may be required to pay local taxes.

Quick Self-Assessment: Your Risk Level

Use this simple framework to evaluate your situation:

• Trigger count 0-1: Low risk. Most short-term remote workers fall here.
• Trigger count 2: Medium risk. Start planning a legalization pathway and reduce your social media visibility.
• Trigger count 3: High risk. Prioritize applying for a proper visa and minimize traceable work activity.

The Double Taxation Risk You Probably Haven't Considered

This section may be the part of this article that catches most people off guard. Many remote workers only worry about "will I get caught by local authorities" and never think about taxes.

Tax Residency: It Follows You

Many countries define tax residency based on domicile, citizenship, or a combination of factors. For example, Taiwan considers anyone with household registration a tax resident regardless of where they actually live. This means worldwide income — including income earned while working abroad — must be reported.

Taiwan's overseas income is calculated under the Alternative Minimum Tax (AMT) system:

• Reporting threshold: When a household's annual overseas income reaches NTD 1 million (approximately USD 32,000), the entire amount must be included in basic income
• Exemption: NTD 7.5 million (approximately USD 240,000, raised since 2024)
• Tax rate: 20%
• Formula: Basic tax = (Basic income - NTD 7.5 million) x 20%

If your basic income is below NTD 7.5 million, even if overseas income exceeds the NTD 1 million reporting threshold, you won't actually owe additional AMT. But the reporting obligation still exists. (Example: annual overseas income of NTD 1.5 million, basic income approximately NTD 1.5 million — well below the NTD 7.5 million exemption — basic tax = 0, but you must still file.)

When the Host Country Also Wants Its Share

Here's where the double risk kicks in:

• Spain: Staying in Spain for more than 183 days in a year makes you a Spanish tax resident, with worldwide income subject to Spanish taxation.
• Portugal: Same 183-day rule. Exceed it, and Portugal can tax your worldwide income.
• UAE: Currently no personal income tax (0%). There is a 9% corporate tax on business profits exceeding AED 375,000, but this mainly applies to entities registered in the UAE (company registration or trade license). Individuals on a Virtual Work Visa working remotely for a foreign employer typically don't owe UAE corporate tax — but if you have a local company or business registration in the UAE, consult a tax professional.

No Tax Treaty = Real Double Taxation

This is where it really hurts. Taiwan currently has no Double Taxation Agreement (DTA) with Spain, Portugal, or the UAE. Taiwan's tax treaties cover European countries like Germany, Luxembourg, the Netherlands (shipping), Norway, and Sweden, but do not include Southern Europe or the Middle East.

What does the absence of a DTA mean? If you're taxed in Spain, Taiwan won't automatically recognize that tax payment. What you can do is apply for a foreign tax credit when filing your Taiwan return, but this credit is capped (limited to the Taiwan tax amount attributable to that income), and the documentation process is cumbersome.

Practical advice: If you plan to stay in any single country for more than 90 days, it's strongly recommended to plan your tax strategy before you leave. Hiring an accountant familiar with overseas income reporting is far cheaper than being chased by two tax authorities simultaneously.

If you're interested in digital nomad tax pitfalls across more Asian countries, this Asia digital nomad tax risk guide offers a more comprehensive comparison.

Legalization Options: Keep Using Your Tourist Visa vs. Getting a Proper Visa

Should you actually go through the hassle of getting a digital nomad visa? The decision comes down to two variables: how long you plan to stay and your income structure.

Three-Country Visa Comparison

	Spain DNV	Portugal D8	UAE Virtual Work
Income requirement	~EUR 2,850/month	EUR 3,680/month	USD 3,500/month
Application fee	~EUR 73	Varies by consulate	USD 287 (total ~USD 1,100+)
Processing time	3-4 months	4-7 months	5-7 business days
Duration	1-3 years	1 year (renewable)	1 year (renewable)
Long-term pathway	Permanent residency after 5 years	Permanent residency/citizenship after 5 years	No residency pathway
Tax benefit	Beckham Law 24%	NHR regime (modified)	0% personal income tax

The Freelancer's Dilemma

Mei is a freelance designer with monthly income fluctuating between USD 2,000 and USD 6,000. She can't consistently hit the D8 threshold of EUR 3,680/month.

Practical approaches:

1. Provide 6-12 months of average income. Most consulates look at the average, not the lowest single month.
2. Contracts + invoices as supporting documentation. Show ongoing client relationships and income sources.
3. Bank deposits as a safety net. Even with monthly income volatility, a healthy bank balance strengthens the application.

A Pragmatic Choice for Short Stays

If you only plan to spend 30 to 60 days in one place, honestly, the time and money required for a visa application may not be worth it. In this case, the more practical approach is:

• Make sure you don't trigger the triple-trigger risk combination
• Comply with the 90/180-day rule
• Track your entry/exit dates (EES does this for you now, but keep your own records as backup)
• Avoid leaving traceable work evidence on social media

But if you plan to rotate through Europe or the UAE long-term — say, switching cities every three months — seriously consider getting a proper visa. In the long run, the peace of mind from legal compliance and the flexibility for tax planning far outweigh the visa fees.

Action Checklist by Risk Level

Risk Level A — Low Risk

Your situation: Short stays (under 30 days), working from your accommodation, no engagement with local business, no work-related content on social media.

Recommended actions:

1. Track your entry/exit dates and ensure 90/180-day compliance
2. Avoid spending extended time at coworking spaces
3. Stay updated on policy changes at your destination

Risk Level B — Medium Risk

Your situation: Staying 30-90 days, using coworking spaces, or 1-2 risk triggers already present.

Recommended actions:

1. Adjust your social media settings — avoid geotagging alongside work content
2. Start researching digital nomad visa options for your destination
3. Consult an accountant to plan your overseas income tax filings
4. Consider applying for a proper visa before your next trip

Risk Level C — High Risk

Your situation: Frequent UAE visits, already exceeded 90 days in the Schengen area, or all three triggers present.

Recommended actions:

1. Immediately stop any traceable work activity at your location
2. Prioritize applying for a proper visa (UAE is fastest — 5-7 days to obtain)
3. Consult an immigration lawyer to assess your entry records
4. Set up dual-jurisdiction tax planning for both your home country and host country

Conclusion

The legal gray zone for remote work on a tourist visa is shrinking rapidly in 2026. EES makes "going unnoticed" harder, and the UAE's successive crackdowns raise the cost of "hoping for the best."

But the goal of this article isn't to say "you must get a visa." It's to make sure you know: what the risks are, how significant they are, and what your options look like.

If you're Alex — spending a month in Barcelona, working quietly from your accommodation — the practical risk remains low. If you're Kevin — regularly visiting Dubai for business — spending USD 1,100 on a Virtual Work Visa is the cheapest insurance you can buy. If you're Mei — with fluctuating income but wanting to live in Europe long-term — start documenting three months of average income and prepare for the D8 application.

Before making any decision, first figure out where you stand in the triple-trigger risk matrix. An informed choice is always the best choice.

This article provides general legal information analysis and does not constitute legal advice. If your situation involves cross-border tax or immigration issues, consult a licensed professional in the relevant jurisdiction.