One engine, every country

1. The country problem

In Zero Touch Payroll I wrote about removing the cut-off date — the artefact of an older world that made payroll end early because the data ended early. This piece is about the other axis of the same product: not when payroll runs, but where. The same engine runs the cycle in India, in the UAE, in Indonesia, in Singapore — 25 markets across SEA, MEA, Europe, and India. This is how.

Multi-country payroll is hard for a reason that has nothing to do with software. Every country is a sovereign statutory regime with decades of accumulated law: its own tax method, its own social-security branches, its own idea of what a payslip must legally contain, its own file format the receiving bank expects, its own calendar of filing deadlines, its own opinions about where an employee's data may physically sit.

The naive way to absorb that complexity is to build a country into the code. A module for India. A branch for the UAE. A fork for Germany. It works for three countries and collapses at thirty: every statutory change is a code release, every new country is an engineering project, and the codebase becomes a museum of every jurisdiction's exceptions, none of which the next engineer dares touch.

Every country is a sovereign statutory regime that has never heard of your architecture.

2. Country is configuration, not code

The architectural decision that makes global payroll tractable is a single inversion: a country is not a thing you build. It is a thing you describe. Everything that makes India different from Germany — the tax method, the contribution bands, the pay components, the formulas, the payslip layout, the report set, the payment file, the calendar — is data the engine reads, not logic the engine contains.

We call that bundle of data a localization pack. It is the country's DNA expressed declaratively. Onboarding a country means authoring its pack and certifying it. The engine that runs the cycle never changes; it consumes a different pack and produces a different, correct result. This is the same lesson that shows up everywhere in the HONO platform — the pipeline pattern we keep rebuilding is exactly this discipline applied to agentic workflows: find the invariant, push everything else into configuration.

A country is a pack, not a branch.

Here is the whole model on one page before the deep dive. Each block is unpacked in the sections that follow.

3. What is actually inside a localization pack

A country's pack is not a vague configuration blob. It is a precise set of things, each of which someone had to research, encode, and certify:

• The statutory model — the income-tax method (slab, cumulative, withholding at source), the social-security and contribution rules with their bands, ceilings, and employer/employee split, the mandatory funds, and the rounding conventions.
• The national-versus-expat split — in much of the Gulf, social insurance applies to nationals and other GCC citizens only, and expats are treated entirely differently. Getting this wrong misstates every contribution.
• The payslip — its legally-mandated layout and fields, the language, the currency and decimal conventions, the year-to-date display rules.
• Statutory reports — the filing forms and frequencies, the authority file formats, year-end certificates, new-hire and leaver notifications.
• The payment file — SEPA pain.001 in the euro zone, BACS in the UK, the Wage Protection System file in the GCC, local ACH elsewhere, each with its own validation rules.
• The calendar and compliance frame — pay-frequency norms, statutory due dates, thirteenth-month or holiday-allowance conventions, data-residency and retention obligations.

The engineering insight is that this list is the same list for every country. What changes is the values, not the shape. Once the pack has a fixed schema, onboarding a country becomes filling it in — which is a research task with an engineering safety net, not an engineering task with a research footnote.

4. Formula is data, not logic

The load-bearing piece of the pack is the formula engine. Pay components — earnings, deductions, contributions — do not carry hardcoded arithmetic. They carry expressions the engine evaluates, with a dependency graph that resolves the order of evaluation and a library of reusable functions for the primitives every jurisdiction shares: band lookups, ceilings, floors, min and max, proration.

This is what makes statutory change survivable. When a country revises a tax slab or lifts a contribution ceiling — which happens somewhere in a 25-country book several times a year — the fix is an edit to an expression with an effective date on it. No branch, no build, no release train, no regression risk to the other 24 countries. The engine that computed last month's cycle computes next month's with a different number, because the number lived in data all along.

When the tax slab changes, you edit data with a date on it — you do not ship code.

5. Statutory rules as a versioned plugin

Effective dating is not a nicety; it is the difference between a payroll system and a spreadsheet. Every rule in a pack is versioned and dated. This April's rates and last April's rates coexist. The cycle for a given period resolves against the rules that were in force for that period, not the rules that are in force today.

The moment this earns its keep is retro. An employee's salary is restructured backdated three months; the change creates arrears that must be recomputed across three prior periods — each against the rule version that applied then, which may differ from now if a statutory boundary fell in between. The provident-fund arrears war story in the Zero Touch Payroll piece is exactly this problem in one country; the versioned-plugin model is what stops it from becoming twenty-five separate problems.

Last year's payslip and this year's rules have to coexist, because an audit will ask for both.

6. Onboarding Germany — the worked example

Germany is the country we are onboarding now, and it is a good stress test because it is genuinely demanding. Working through its pack is the clearest way to show that the hard part is reading the law, not writing the engine.

The German pack has to encode Lohnsteuer (wage tax) with its tax classes, church tax as a derived component for employees who are liable, and the four branches of social insurance — health, pension, long-term care, and unemployment — each with its own rate and contribution ceiling, split between employer and employee. The payment file is SEPA pain.001. The payslip has a legally-prescribed shape in German. And two things that never appear in a tax-rate table shape the work as much as the rates do: works councils, whose agreements can bind pay-adjacent rules, and GDPR data residency, which governs where the payroll data may physically be processed and stored.

None of that requires touching the engine. It requires a pack, authored against the same schema every other country uses, reconciled to the cent against a parallel run, and signed off by someone who knows German payroll law. The seven-step pipeline — discover, author the pack, map the statutory data fields, parallel-run against the incumbent, certify, go live, maintain — is the same pipeline that onboarded the country before it and will onboard the country after.

Germany is not harder to build. It is more law to read.

7. Twenty-five countries, five shapes

The thing that stops a 25-country book from feeling like 25 unrelated problems is that they cluster. Learn the shapes and most of the detail becomes predictable:

• The Gulf — no personal income tax, so the traps are not the maths: they are the Wage Protection System file, end-of-service gratuity accrual, and social insurance that applies to nationals only. The mistake everyone makes is assuming no tax means easy.
• Francophone Africa — French-derived systems: progressive salary tax, a social- security fund, training levies, often a second reporting currency alongside the local one.
• Anglophone Africa — pay-as-you-earn plus a social fund plus a rotating cast of new levies (housing, skills-development, health) that legislate fast; the trap is staying current.
• South Asia — provident-fund-heavy, with employer and employee retirement contributions dominating, and, in India, variation by state on top of the national rules.
• South-East Asia — social insurance with caps, a mandatory thirteenth-month or holiday allowance, and contribution tables that get revised mid-year.

Europe is the sixth shape and the outlier: not a coverage problem but a depth-and-integration one, which is why it gets its own section below.

Twenty-five countries, five shapes — learn the shapes and the detail falls out.

8. The part nobody puts on a slide

The engine is the easy quarter of the work. The expensive, unglamorous, never-finished part is statutory-content operations: keeping every country's pack legally current as the law moves underneath it. A tax slab shifts in one country, a contribution ceiling is lifted in another, a health-insurance scheme replaces the old one in a third — and each change has to be researched, encoded as dated configuration, regression-tested against the countries it must not affect, and shipped before the cycle that depends on it.

This is why the “country is configuration” model is a means, not the whole answer. Configuration is what makes the change cheap to apply; it does nothing to make the change cheap to know about. The real global-payroll business is a legislative-tracking function plus a local-expert network plus the discipline to release effective-dated updates on time, in every jurisdiction, forever. The architecture buys you the ability to keep that promise; it does not make the promise for you.

The engine is a quarter of the work. Keeping twenty-five rulebooks current is the other three.

9. Why Europe is a different kind of hard

Everywhere else, you can pattern countries into shapes. Europe resists it, for three reasons that never appear in a rate table.

Data residency is a sales gate, not a footnote. GDPR means EU personal data generally has to be processed and stored in-region, with defined retention limits and a right to erasure. Payroll is the most sensitive HR data there is, so where the compute physically sits becomes an architectural pre-condition, not a deployment detail.

You integrate with the state, not file to it. The UK submits to HMRC in real time on every pay run (RTI); France's DSN is a single monthly nominative declaration that replaced dozens of filings; Germany reports electronically to the tax and social-insurance authorities. These are systems you build against, not PDFs you email.

Collective agreements override the statutory floor. Sector and company agreements — the French convention collective, the German Tarifvertrag, works-council co-determination — modify pay rules by industry and region, and none of it lives in the national statute. The pack has to carry it, which is exactly why a pack that only modelled tax and social security would ship a confidently wrong German payslip.

In Europe the government is not a recipient of your file. It is a system you integrate with.

10. Where humans and safety sit

Country-agnostic does not mean country-careless. Payroll has legal exposure everywhere, and the localization model has to be as disciplined about correctness as the guard rails on the HR assistant are about authority. Two controls gate every new country.

The first is the parallel run. Before a country goes live, its pack is shadow-run against the incumbent system or the manual calculation and reconciled to the cent, case by case — joiners, leavers, retro, the statutory edge cases the country is known for. A pack that does not match does not ship. The second is certification: a local expert who signs off that the tax, the filings, and the payslip are legally correct. The engine can be confident; the country cannot go live on confidence alone.

Everything downstream inherits the same audit discipline the single-country product already had — every figure on every payslip traceable to its input, its formula version, and its approval — which is what makes a mid-cycle rule change in one country a configuration edit rather than a controlled explosion.

You do not go live on a country you have not reconciled to the cent.