How to Start a Cybersecurity or Managed IT (MSP) Company for US Clients from Abroad (2026), Without Visiting: US LLC or C-Corp, EIN Without an SSN, Bank Account, Cyber Insurance, Penetration Testing Authorisation, HIPAA, FTC Safeguards and CMMC

Most small US businesses have no IT department. A 30-person law firm in Ohio, a dental group in Arizona or a logistics company in New Jersey pays a managed service provider (MSP) a monthly fee to look after its laptops, Microsoft 365, backups, firewalls and security alerts. Much of that work is now done remotely, and a growing share is done from India, the Philippines, Eastern Europe and Latin America.

The same is true for cybersecurity. US companies buy 24/7 security monitoring, penetration tests, vulnerability management and part-time security leadership from teams who never set foot in their offices.

A US company lets you sign those clients, get listed with US vendors and distributors, buy the right insurance and get paid in dollars. This guide explains how to set it up without visiting the USA, and the rules and contract terms that matter when you hold the keys to your clients' systems.

In short: A non-resident can form a US LLC or C-Corporation without visiting, get an EIN without an SSN or ITIN, and open a US business bank account remotely. With your engineers working abroad, a foreign-owned single-member LLC usually owes no US federal income tax, but files Form 5472 every year. US clients will ask for cyber liability and technology E&O insurance. Never start a penetration test without written authorisation. Clients in health, finance and defence bring HIPAA, the FTC Safeguards Rule and CMMC. On-site work in the USA and reselling software licences change the tax picture.

What MSPs and security companies sell

Many offshore companies start by supporting US MSPs rather than end clients. The US MSP owns the client relationship, and your team does the after-hours helpdesk, monitoring or projects under its brand. It is easier to win and needs less US presence. Selling direct to end clients pays more but brings more contract, insurance and on-site questions.

Can you start an MSP or cybersecurity company in the USA without visiting?

Yes. All of the set-up is remote:

• Form the LLC or corporation online through a registered agent
• Get the EIN without an SSN or ITIN with Form SS-4
• Open a US business bank account without visiting
• Sign up with US distributors and vendors, such as Microsoft partner programmes and security tool vendors, which usually want a US entity, EIN and US bank account
• Sign client contracts electronically

Expect four to eight weeks for the company, EIN and bank account. See opening a US company without visiting, EIN for non-residents and the US business bank account guide. A US business address helps with vendor accounts; see virtual office addresses.

US LLC or C-Corp?

US LLC formation for an MSP

A single-member LLC suits a company whose engineers all work abroad. The LLC is disregarded for US tax, and fees for services performed outside the USA are generally foreign-source, so it usually owes no US federal income tax. It files Form 5472 with a pro forma 1120 every year, with a $25,000 penalty if missed. See Form 5472 explained.

A Wyoming LLC with EIN is $249, or $348 with a bank account, then $121 a year.

US C-Corp formation for a cybersecurity company

A C-Corporation (21% federal tax) fits better if you:

• send US technicians on site, or hire US staff
• build and sell your own security product
• plan to raise money or sell the company, which is common among MSPs

On-site work in the USA by your people, or by US contractors working for you, is US-source income and can be effectively connected with a US business. That makes a C-Corporation, which files its own return, simpler than an LLC passing US income through to a foreign owner. A Delaware corporation with EIN is $358, then $578 a year. See LLC vs Inc and effectively connected income.

Insurance US clients will ask for

An MSP has admin access to its clients' systems. If an attacker gets into your remote management tool, every client can be hit at once, as happened in several well-known supply-chain attacks. US clients and their insurers know this, so they ask for:

• Cyber liability insurance, covering breach response, ransomware and third-party claims
• Technology errors and omissions (E&O), covering claims that your service failed
• Often general liability, and certificates naming the client as additional insured

Many US insurers will cover a US company with a foreign team, but they ask detailed questions about MFA, backups, privileged access and where staff are. Budget for this before quoting enterprise clients.

Contracts

An MSP or security contract should cover:

• scope: which users, devices and systems are covered, and what costs extra
• service levels: response and resolution times, hours of cover, escalation
• access: how your staff connect, MFA, logging, and who approves new access
• limitation of liability, tied to fees or insurance limits
• client duties: approving patches, keeping licences current, not disabling security tools
• incident response: who does what in a breach, and who pays for forensics
• data location: where logs and backups are stored, and whether staff abroad can see client data
• termination and handover: returning credentials, documentation and data

See contracts with US clients.

US rules that affect security work

Penetration testing and the CFAA

The Computer Fraud and Abuse Act makes unauthorised access to computers a federal crime, and most states have similar laws. A penetration test is legal only because the owner authorised it. Before any test, get a signed authorisation and rules of engagement that list:

• the systems, IP ranges and apps in scope
• the dates and times allowed
• what techniques are allowed, such as phishing or social engineering
• who at the client can approve and stop the test

Make sure the person signing actually owns or controls the systems. Testing a client's cloud provider, hosting company or a third-party app without that party's permission can be unauthorised access even if your client agreed. Cloud providers publish their own testing policies.

Digital forensics and investigator licensing

Some states treat digital forensic investigations done for others, for example after a breach or for a lawsuit, as private investigation that needs a licence. Texas and Michigan are often cited. If you plan to sell forensics or expert witness work, check the state rules or partner with a licensed US firm.

Healthcare clients: HIPAA

An MSP that can access patient data for a clinic, hospital or health plan is a business associate and signs a business associate agreement (BAA). That brings HIPAA security duties on access, encryption, audit logs, training and breach notification. Dental and medical practices are one of the biggest MSP markets, so expect this early. See the medical billing company guide for HIPAA work from abroad.

Financial clients: FTC Safeguards Rule and others

Under the FTC Safeguards Rule, many non-bank financial businesses, including tax preparers, mortgage brokers, car dealers and finance companies, must run a written security programme and oversee their service providers. Their MSP is usually where that programme lives: MFA, encryption, monitoring and annual reports to the owner. Some must report certain breaches to the FTC. Banks, investment advisers and New York-regulated financial firms have their own rules, all of which require them to vet vendors like you.

Defence contractors: CMMC

US Department of Defense contractors handling controlled unclassified information (CUI) must now meet CMMC requirements, phased into contracts from late 2025. An MSP that manages their CUI systems is an external service provider inside the assessment. CUI can also be export-controlled, which may bar foreign staff from accessing it. A team abroad should generally avoid managing defence contractors' CUI environments, or take only work that the client confirms can be done by non-US persons.

State breach notification laws

Every US state has a data breach notification law. Your client usually has the duty to notify, but your contract will require you to tell the client quickly, often within 24 to 72 hours, and to help investigate.

Your team abroad

• Engineers employed through a local company in your home country, which invoices the US company under an intercompany service agreement. These related-party payments go on Form 5472
• Freelance engineers sign contractor agreements with confidentiality and IP terms and give Form W-8BEN. See paying contractors abroad
• Access controls: named accounts, MFA, privileged access management and logs. Clients and insurers will ask
• Night shifts for US hours: a real selling point, since your daytime can be the client's night. Follow local rules on night work

Indian owners follow the ODI rules; see ODI and FEMA rules.

On-site work in the USA

Most MSP work is remote, but end clients sometimes need someone to install a firewall, swap a laptop or cable an office. Options:

• US field-service marketplaces or local US technicians paid per visit
• Partner with a US MSP that handles on-site work
• Ship pre-configured devices and support remotely

Paying US technicians for on-site work in the USA means part of your income is earned in the USA. Keep it small and separately invoiced, or use a C-Corporation if it is regular. US contractors who are US persons give you a Form W-9, and you may need to file Form 1099-NEC for them.

Sales tax on IT services and licences

Most US states don't tax remote IT services, but some do:

• several states tax IT services, data processing or computer services, including Texas, and Washington since late 2025
• reselling software licences, such as Microsoft 365, antivirus or backup subscriptions, is taxable in many states as software or SaaS
• hardware you sell to clients is taxable in almost every state with a sales tax

Bundling licences and services into one per-user price can make the whole bundle taxable in some states. Each state has its own economic nexus threshold for registering. See state taxes for a foreign-owned LLC.

Getting paid

• give clients your US company's Form W-9; see W-8BEN-E vs W-8BEN
• bill monthly in advance for managed services; it keeps cash flow steady
• collect by ACH debit or card; see receiving payments from US clients and Stripe for non-residents

Examples

These examples are illustrative.

Rohan, Pune: MSP for US dental practices. Rohan's 12 engineers manage IT for 40 US dental offices. A Wyoming LLC signs the contracts, signs a BAA with each practice and holds cyber and E&O insurance. Firewall installs are done by a US partner MSP on a revenue share. All other work is done from Pune, so the LLC files Form 5472 and owes no US federal income tax. Microsoft 365 licences resold to practices in sales tax states are taxed where required.

Maricel, Manila: white-label SOC. Maricel's team watches security alerts overnight for six US MSPs, under their brands. The US MSPs own the end clients, so contracts are simple service agreements. The analysts work in a secure office with logged access, and the US LLC is paid monthly by ACH.

Tomás, Buenos Aires: penetration testing. Tomás tests web apps and cloud set-ups for US SaaS companies. Every job starts with signed rules of engagement, and AWS and Azure testing follows their published policies. A client once asked for a test on a payment provider's systems; Tomás declined until the provider gave its own permission.

Elif, Istanbul: vCISO and SOC 2 readiness. Elif helps US start-ups prepare for SOC 2 audits and acts as their part-time security lead. After hiring a US sales director in Austin, Elif moved the business into a Delaware C-Corporation, which files Form 1120 and pays US tax on its profit.

Common mistakes

• Starting a penetration test on a verbal OK, or testing systems the client doesn't own.
• No cyber or E&O insurance when clients assume you have it.
• Shared admin accounts without MFA or logging.
• Taking defence contractors' CUI work with a team abroad.
• Ignoring sales tax on resold licences and hardware.
• Regular on-site work through a foreign-owned LLC without considering US tax.
• Forgetting Form 5472 because the LLC owes no US income tax.

Frequently asked questions

Can I start an MSP or cybersecurity company for US clients from India without visiting? Yes. The company, EIN and US bank account are all set up remotely.

Do I need an SSN or ITIN for the EIN? No. Foreign owners apply with Form SS-4.

Do I need a licence to provide IT or security services in the USA? Generally no. Digital forensics may need a private investigator licence in some states, and some clients require certifications or insurance.

Will my US LLC pay US tax? Usually not if all work is done abroad. Regular on-site work in the USA can change that.

Can my team abroad work for US defence contractors? Usually not on controlled unclassified information, which may be export-controlled. Check with the client first.

How UCB can help

We form US LLCs and C-Corporations for MSPs and cybersecurity companies outside the USA, get the EIN without an SSN, and help open a US business bank account without visiting, through our formation, EIN and bank account package. Each year we prepare Form 5472 with the pro forma 1120, Form 1120 or Form 1065, through our US tax filing service. We do not provide insurance, security compliance, export control or legal advice.

Related guides: IT services and software development, IT staffing and SaaS founders.

Starting an MSP or cybersecurity company for US clients? WhatsApp us at +1 315 961 2956 or email enquiries@ucbsolutions.com.