Virtual Assistant
How to start a virtual assistant business, and what comes after
Landing your first client and building a service list are the parts everyone plans. The access you're handed, the contract that protects you and the client, insurance sized for real work, and the notification duty a breach on your end can trigger, most guides skip the sequence that gets you actually running.
What makes a virtual assistant business different from the rest of consulting
A VA business shares its legal shape with consulting, engagements, fees, scope, but the work itself puts a VA somewhere most consultants never go: inside the client's own systems. Six things set it apart:
You hold the keys, not just the advice.
Most consulting engagements end with a recommendation the client acts on. A VA engagement runs inside the client's own inbox, calendars, and payment tools, access is the product, not just how you deliver one.
A breach on your end is legally the client's problem too.
When a VA's own device or account is breached, state breach-notification law reaches a business holding data it doesn't own, the VA owes the client notice, and the client may then owe its own customers notice.
Your liability shape is administrative error, not bad advice.
The claim that actually shows up for a VA is the missed filing deadline or the double-booked meeting made with access the client granted, a different shape than the advice-gone-wrong claim most consulting E&O is built around.
Your own worker classification can run in reverse.
Most classification risk in consulting is about who a business hires. For a VA, heavy control from one dominant client can flip the same federal test onto the VA, classifying the VA as that client's employee instead of a contractor.
Subcontracting adds a second layer of confidentiality.
Building toward an agency model means flowing your own confidentiality and IP terms down to the VAs you bring on, and settling, in writing, who the client relationship belongs to.
The line between "admin support" and "bookkeeping" is a scope decision you draw, except where federal tax law draws it for you.
General administrative work needs no license; paid tax preparation needs a federal PTIN no matter what else is on your business card.
The order the work arrives in
Every business moves through the same broad stages. What changes by industry is what each stage demands. For a virtual assistant business:
- 01
Plan the business.
For a virtual assistant business: decide your scope up front, general administrative support, inbox and calendar management, and social-media help sit outside licensing, while bookkeeping, payroll, and paid tax preparation each carry their own rules, and anyone preparing federal tax returns for compensation needs a PTIN regardless of how the work is billed.
What you sell, who buys it, and how you charge.
- 02
Make it official.
Entity, registrations, and business finances kept separate from your own.
- 03
Set up the money systems.
For a virtual assistant business: invoice against a signed engagement letter that states hours or retainer terms, and if bookkeeping-adjacent work is part of what you offer a client, keep those records separate from your own books so the scope stays provable if it's ever questioned.
Bookkeeping and invoicing that follow documented terms.
- 04
Set up your tools and systems.
For a virtual assistant business: every client gets separate logins and access scoped to what the engagement actually needs, view, edit, or payment authority, never one shared password sheet across accounts, and every credential set to revoke the day an engagement ends.
The operational systems the business runs on, chosen so they work together.
- 05
Protect it.
For a virtual assistant business: E&O insurance in place before the first client, sized for administrative-error claims rather than advice claims; a contract with confidentiality and data-handling terms spelled out; and a breach-notification plan, since a breach on your systems can start a notification clock the client is relying on you to meet.
Insurance and core agreements before the exposure starts.
- 06
Get ready for customers.
For a virtual assistant business: an intake process that confirms exactly what a new client is authorizing you to access before you touch a single password, and marketing copy that describes your services plainly rather than implying a credential you don't hold.
Marketing and sales practices that won't need retrofitting.
- 07
Run and grow.
For a virtual assistant business: if you're building toward an agency model, subcontracted VAs need your confidentiality and IP terms flowed down in writing, and the agreement should say plainly who the client relationship belongs to if a subcontractor moves on.
Delegation and day-to-day operations on documented terms.
StartBlox sequences these for your stage and industry, one step at a time, reordered as your answers change.
These rules are local
Most of what a virtual assistant business runs on is the same everywhere, but three things aren't: whether you need a local business license, and where to file for one, is set by your city or county; if you work from home, home-occupation rules (permit requirements, and sometimes limits on client visits, signage, or parking) are set locally too; and if a breach on your systems exposes client data, the notification duty that follows is set state by state, not federally. Check your state and city.
The risks most virtual assistant founders don't see coming
You can probably name two or three of these. The full list is longer, and part of it isn't yours to control once a client hands you access.
Shared password sheets instead of per-client access.
One spreadsheet or note holding every client's logins is a single point of failure, a breach anywhere touches every client at once, and it makes proving an offboarding access review actually happened nearly impossible.
A breach on your end becomes the client's legal problem too.
State breach-notification law doesn't stop at the company whose name is on the data, a business that holds computerized personal information it doesn't own has its own duty to notify the data's owner, immediately, once a breach is discovered.
No confidentiality or data-handling terms in the contract.
Without documented terms for what you can access, how it's stored, and what happens to it at offboarding, "confidential" is a verbal understanding, not an enforceable one.
E&O sized for advice, not admin errors.
The classic VA claim isn't a bad recommendation, it's the missed filing deadline or the double-booked meeting made on a client's behalf. Coverage needs to fit the actual work.
Your own worker status, not just who you hire.
VAs typically work as independent contractors for multiple clients, but heavy control from one dominant client, over hours, methods, and most of your working time, can flip the classification test onto you instead.
Subcontracting without flow-down terms.
Bringing on other VAs without carrying your confidentiality and IP terms down to them, and without settling who the client relationship belongs to, turns an agency model into an exposure instead of a growth plan.
Crossing from admin support into licensed work without noticing.
General administrative tasks need no credential; bookkeeping, payroll, and paid tax preparation each carry their own requirements, and anyone paid to prepare a federal tax return needs a PTIN regardless of what else is on their business card.
Your clients
access limited to what each engagement actually needs, confidentiality terms in writing, and a breach-notification plan that protects their own duty to their customers.
Your subcontractors
flow-down confidentiality and IP terms, and clarity in writing about who owns the client relationship.
Regulators
state breach-notification law once a breach is discovered, and the federal PTIN requirement if paid tax preparation is part of the work.
You, the founder
your own worker classification if one client comes to dominate your schedule, and E&O coverage sized for administrative error rather than advice.
These are scored against your answers as part of the business-services risk set, sequenced into your setup plan, and re-scored as your business changes.
What keeps coming back
Formation services stop at "you're registered." A virtual assistant business's obligations run on a per-client and calendar cycle:
Every new client: access granted at the right tier, confidentiality terms signed, and an intake that documents exactly what you're authorized to touch.
Every client offboarding: credentials revoked and access reviewed, the step most shared-password setups quietly skip.
Every new subcontractor: confidentiality and IP terms flowed down before they touch a client account.
On the calendar: E&O and other insurance come up for review with your broker, business licenses and registrations renew, and your PTIN renews every year if paid tax prep is part of the work.
StartBlox treats these as recurring obligations that come back when they're due. A "What's due" view collects what's overdue and what's coming up, and completed items reset on their real schedule instead of staying checked off forever.
How this guidance is built
The sequence and risks on this page come from a library of documented, predictable founder failure patterns, refined for each supported industry, not opinion, not motivational advice. The scoring is consistent and transparent: the same answers always produce the same result, and every score traces to the answers behind it. An AI advisor explains results in plain language, but it never changes a score. StartBlox is educational: it is not legal, financial, or insurance advice, and when a step needs a licensed professional, it says so and shows qualified options side by side. Anyone can complete the diagnostic and see their full setup plan free; every plan starts with a 14-day full-capability trial, no credit card.
Frequently asked questions
This page covers what's specific to a virtual assistant business. The full picture for business services and consulting, the documented risks, the setup sequence, and the obligations that keep coming back, is on the main guide: Starting a consulting business
See what comes after your first client
A short intake, then your full business-services setup plan, virtual assistants included, sequenced for your stage. Free to start, no credit card.