Private Company Compliance Checklist

Private Company Compliance Checklist (FY 2026-27): Every Filing, Date, and Penalty You Need to Know

A private limited company registered in India faces roughly 25–30 distinct compliance obligations in a typical year — spread across MCA filings, income tax, TDS, and GST. Miss even two or three and the penalties compound fast. Miss the wrong three for three consecutive years and every director faces a five-year personal disqualification. This FY 2026-27 checklist sequences every major obligation with exact due dates, form numbers, penalty arithmetic, and the practical mistakes that generate most of the distress calls professionals receive.

Why Most Private Companies Fall Behind — and How to Stop

The pattern is consistent: a founder incorporates, appoints a CA, and assumes someone is "tracking all of that". The CA handles the audit and the ITR. Nobody owns the DPT-3. The DIR-3 KYC slips because a director was travelling in September. MSME-1 is filed late because nobody cross-checked the supplier list for Udyam registrations.

The solution is not a better CA — it is a documented calendar with named owners, reviewed at every quarterly board meeting. Use this checklist to build that calendar at the start of FY 2026-27.

Board and Shareholder Meetings: Your Statutory Calendar

Section 173 of the Companies Act, 2013 requires every private limited company to hold at least four board meetings per year, with a gap of not more than 120 days between any two consecutive meetings.

Exception for small companies: A company qualifies as a small company if its paid-up capital does not exceed Rs. 4 crore and its turnover does not exceed Rs. 40 crore (thresholds per the 2022 amendment). Small companies and One Person Companies (OPCs) need only two board meetings per year — one in each half of the calendar year. Holding, subsidiary, and associate companies are excluded from the small-company carve-out even if they meet the financial thresholds.

Other meeting-related obligations under the Act:

• First board meeting: Within 30 days of the date of incorporation (Section 173(1) proviso). This is the single most commonly missed obligation by newly incorporated companies.
• Annual General Meeting (AGM): On or before 30 September of the calendar year following the close of the financial year. For FY 2025-26 (which ended 31 March 2026), the AGM must be held by 30 September 2026.
• Notice: At least seven days written notice to every director at their registered address (or any alternate address communicated to the company), unless a shorter notice period is consented to by all directors.
• Minutes books: A separate bound or paginated minutes book for board meetings, committee meetings, AGM, and each EGM — signed by the chairperson within 30 days of the meeting. Section 118(8) makes any tampering with minutes a criminal offense.

The 120-day trap: Companies that bunch all four meetings into the October–March window technically comply on count but violate the 120-day inter-meeting gap for the April–September period. Schedule all four meeting dates in the first week of April every year.

Annual MCA Filings: Forms, Due Dates, and Fee Structure

AOC-4 — Financial Statements

AOC-4 is the form through which audited financial statements (Balance Sheet, P&L, Directors' Report, and Auditor's Report) are filed with the Registrar of Companies (RoC) on MCA V3 (mca.gov.in).

• Due date: Within 30 days of the AGM. If the AGM is held on 30 September 2026, AOC-4 must be filed by 30 October 2026.
• DSC: Mandatory from an authorised director.
• XBRL: Companies above prescribed thresholds (broadly, listed companies or those with paid-up capital of Rs. 5 crore or more / turnover of Rs. 100 crore or more) must attach an XBRL instance document. Verify applicability before filing.
• Late fee: MCA imposes an additional fee on a graduated scale: 2× normal fee for delays up to 30 days; 4× for 31–60 days; 6× for 61–90 days; 10× for 91–180 days; and 12× for delays beyond 180 days. These are separate from the Section 137 statutory penalty.

MGT-7 / MGT-7A — Annual Return

MGT-7 is a snapshot of the company's shareholding structure, directors, KMPs, and related-party disclosures as at 31 March. Small companies and OPCs file the simplified MGT-7A instead.

• Due date: Within 60 days of the AGM — i.e., 29 November 2026 if the AGM was on 30 September 2026.
• Sequence rule: The SRN (Service Request Number) generated on successful AOC-4 filing is a mandatory input in MGT-7. File AOC-4 first, always.
• MGT-8 certification: Companies with paid-up capital of Rs. 10 crore or more, or turnover of Rs. 50 crore or more, must have MGT-7 certified by a Company Secretary in practice. Confirm whether your company crosses this threshold before filing.

DPT-3 — Annual Return of Deposits

Every company (other than a government company) must file DPT-3 annually under Rule 16 of the Companies (Acceptance of Deposits) Rules, 2014. This is not only for deposit-accepting companies — it covers all outstanding amounts received by the company that are not classified as deposits, including director loans, inter-corporate borrowings, and customer advances held beyond the contractual delivery period.

• Due date: 30 June every year. For FY 2025-26, the deadline is 30 June 2026.
• Nil filing obligation: If your company has any such outstanding receipts at all, filing is mandatory even if no amount meets the deposit definition. Treat DPT-3 as a mandatory annual exercise immediately after the audit is completed.

MSME-1 — Outstanding Payments to MSME Suppliers

MSME-1 discloses payments due to MSME suppliers that have been outstanding for more than 45 days. It is filed half-yearly:

• 31 October: For the April–September period (due 31 October 2026 for H1 of FY 2026-27)
• 30 April: For the October–March period (due 30 April 2027 for H2 of FY 2026-27)

How to prepare: Pull a creditor ageing report at each half-year close. Cross-check each supplier's Udyam registration number (available on the Udyam portal). The filing obligation exists as soon as you have MSME-registered vendors in your payables — even if you pay on time and the form shows nil overdue amounts.

DIR-3 KYC — Director KYC Verification

Every individual holding a Director Identification Number (DIN) must complete KYC annually. Failure deactivates the DIN, freezing the director's ability to sign any MCA form until the late fee is paid.

• Due date: 30 September every year (i.e., 30 September 2026).
• Form options: First-time filers (or those with changes in mobile/email) file the full DIR-3 KYC with DSC. Directors who filed previously with no changes use the web-based DIR-3 KYC-Web — faster, no DSC needed.
• Late reactivation fee: Rs. 5,000 per DIN, flat. There is no daily accrual, but the DIN stays frozen until payment.

ADT-1 — Auditor Appointment Intimation

The company must notify the RoC of every auditor appointment or reappointment.

• Due date: Within 15 days of the AGM.
• The auditor also files acceptance separately, but that does not relieve the company of this obligation. Assign ADT-1 to the CS or compliance officer as a post-AGM checklist item.

Worked Example: The Real Cost of a 90-Day Filing Delay

Scenario: Tekflow Private Limited has authorised capital of Rs. 10 lakh, three directors (no MD or CFO designated), and holds its AGM on 30 September 2026. Due to a delayed audit, the company files AOC-4 on 28 January 2027 (90 days late) and MGT-7 on the same date (60 days late). All three directors also miss the DIR-3 KYC deadline.

AOC-4 — 90-day delay (due 30 October 2026; filed 28 January 2027)

Note: Section 137(3) caps company liability at Rs. 2,00,000 and per-director liability at Rs. 50,000. Tekflow's penalty is well below both caps.

MGT-7 — 60-day delay (due 29 November 2026; filed 28 January 2027)

DIR-3 KYC late reactivation: Rs. 5,000 × 3 directors = Rs. 15,000

All-in statutory exposure: Rs. 3,19,000 — for a company that was simply two to three months behind on paperwork. Add professional fees for rectification and the management hours spent with RoC correspondence, and the true cost is closer to Rs. 4 lakh.

Event-Based Filings: Trigger-Driven Obligations

These forms have no fixed annual due date. The clock starts the moment the corporate event occurs. There is no calendar reminder — you must build the habit of asking "does this event require an MCA form?" at every board meeting.

INC-20A is the most dangerous omission for new companies. No company may commence business or borrow until this declaration — confirming that every subscriber has paid up their subscribed shares — is filed with proof of payment. The RoC can initiate strike-off proceedings against companies that fail to file INC-20A within 180 days of incorporation. Banks also check this during loan documentation.

MGT-14 is frequently missed. Section 179(3) resolutions — covering borrowings, making investments, granting loans, providing guarantees, and several other board decisions — require MGT-14 filing within 30 days. A signed resolution in the minutes book is not sufficient.

Statutory Registers: The Paper Trail That Protects You

Registers are not filed with any authority in the normal course, but they are the first documents reviewed by an RoC inspector, an acquirer's due-diligence team, or a lender's legal counsel. Gaps are a disproportionately damaging red flag in fundraising rounds.

Maintain the following at the registered office (or at the principal place of business if relocated by board resolution):

• Register of Members (Section 88): Names, folios, shares held, calls paid, transfers — updated within 7 days of every allotment or transfer.
• Register of Directors and KMPs (Section 170): DIN, personal address, date of appointment, other directorships held — updated within 30 days of any change.
• Register of Contracts in which Directors are Interested (Section 189): Every related-party transaction, the nature of the director's interest, and the board approval obtained.
• Register of Charges (Section 85, Form CHG-7): All charges created, modified, or satisfied, with CHG-7 as the index.
• Register of Loans, Guarantees, and Investments (Section 186): Details of every inter-corporate loan, guarantee, security, and investment made by the company.
• Significant Beneficial Ownership Register (BEN-3): Names and details of every individual who ultimately holds 10% or more of shares or voting rights, either directly or through a chain of entities.
• Minutes Books (Section 118): Separate bound volumes for board meetings, committee meetings, AGM, and each EGM — paginated, and signed by the chairperson within 30 days.

Practice discipline: Maintain digital scans indexed by section number. When a fundraising investor sends a data-room request, you should be able to populate it within hours — not days of searching through physical files.

Income Tax, TDS, and GST Obligations

Advance Tax (Section 208, Income-tax Act, 1961)

Every company with an estimated tax liability of Rs. 10,000 or more in AY 2027-28 must pay advance tax in four instalments during FY 2026-27:

Interest at 1% per month applies under Section 234C for deferment of any instalment, and under Section 234B for aggregate shortfall exceeding 10% of final liability.

Income Tax Return

Companies subject to statutory audit file ITR-6. The standard due date is:

• 31 October 2026 for AY 2026-27 (FY 2025-26 income), where a tax audit under Section 44AB applies.
• 30 November 2026 for companies that also have international transactions requiring a Transfer Pricing report (Form 3CEB).

The Section 44AB tax audit threshold for FY 2026-27: business turnover exceeding Rs. 1 crore (or Rs. 10 crore where cash receipts and cash payments are each 5% or less of total receipts and payments).

TDS Returns

File quarterly on the TRACES/TIN portal:

TDS certificates (Form 16 / 16A) must be issued within 15 days of the TDS return due date. Delays attract interest at 1.5% per month from deduction to deposit, plus a late-filing fee of Rs. 200 per day under Section 234E.

GST

• GSTR-1: By the 11th of the following month for monthly filers; quarterly under QRMP.
• GSTR-3B: By the 20th of the following month (monthly filers); 22nd or 24th for QRMP.
• GSTR-9 (Annual Return): Due 31 December 2026 for FY 2025-26. Mandatory for all registered taxpayers with annual turnover above the notified threshold.
• GSTR-9C (Reconciliation Statement / Self-Certified): Mandatory for taxpayers with aggregate turnover exceeding Rs. 5 crore; due alongside GSTR-9.

Audit Requirements: Which Apply to Your Company

Statutory audit is mandatory for every private limited company without exception (Section 139, Companies Act, 2013). The first auditor must be appointed by the Board within 30 days of incorporation. Failing that, shareholders appoint within 90 days at an EGM. Subsequent appointments are ratified at each AGM for a 5-year term.

Tax audit (Section 44AB): Required if business turnover exceeds Rs. 1 crore (Rs. 10 crore for high-digital-transaction businesses). The audit report is filed in Form 3CA/3CB along with Form 3CD, which contains 44 detailed clauses of disclosures.

Cost audit (Companies (Cost Records and Audit) Rules, 2014): Required for companies in specified regulated sectors — pharmaceuticals, cement, sugar, electricity, petroleum, and others — once they cross the prescribed turnover threshold. Review applicability at the start of every year if your business touches any of these sectors.

Internal Financial Controls (IFC): Under Section 143(3)(i), every statutory auditor must report whether the company has adequate IFC over financial reporting and whether those controls are operating effectively. While the standard for smaller private companies is proportionate, the expectation is that core controls over revenue, procurement, payroll, and bank reconciliation are documented and tested.

Whole-time Company Secretary: Private companies with paid-up share capital of Rs. 10 crore or more must appoint a whole-time Company Secretary as a KMP (Rule 8A, Companies (Appointment and Remuneration) Rules, 2014).

Common Mistakes That Create the Biggest Exposures

1. Filing MGT-7 before AOC-4: MGT-7 requires the SRN of AOC-4 as a mandatory field. Sequence is non-negotiable — complete AOC-4 first.

1. Treating DPT-3 as optional if you have no deposits: Any outstanding director loan, related-party borrowing, or customer advance not covered by the deposit exemptions must be disclosed in DPT-3. Filing a nil return when exempted amounts exist is also a default.

1. Ignoring MSME-1 because you pay on time: The filing obligation exists once you have MSME-registered vendors. Late-payment status only affects the content, not the obligation to file.

1. Skipping MGT-14 for board borrowings: Section 179(3)(d) borrowings require MGT-14 within 30 days. Many boards assume the signed resolution in the minutes book is sufficient. It is not.

1. Counting the 120-day meeting gap from the resolution date: The gap runs from one meeting date to the next, not from the date the minutes are signed or the resolution is effective.

1. Signing MCA forms with an expired DSC: Digital Signature Certificates are valid for 2–3 years. In March each year, check every director's DSC expiry date and renew proactively. An expired DSC on filing day creates a 24–48-hour delay at minimum.

1. Forgetting INC-20A for new incorporations: Companies that skip this declaration cannot legally commence business, and the RoC can strike them off after 180 days. Banks flag this during KYC and loan documentation.

Director Disqualification: The Personal Stake in Getting This Right

Section 164(2) of the Companies Act, 2013 is the provision every director should read once a year. It provides that a person shall not be eligible to be re-appointed to that company or appointed as director of any other company for five years if their company:

• Has not filed financial statements or annual returns for any continuous period of three financial years, or
• Has failed to repay deposits, debentures, or declared dividends for over a year.

The disqualification is not limited to the company in default. It operates across every company where the individual holds a directorship. A serial founder with positions in four companies is disqualified from all four if any one of them defaults on filings for three consecutive years.

The MCA has run nationwide disqualification sweeps — deactivating DINs in bulk for directors of defaulting companies. Directors in those sweeps discovered their DINs were frozen when they tried to sign unrelated forms for profitable, compliant companies. The discovery is always worse than the cost of prevention.

If you are already in default: File overdue AOC-4 and MGT-7 immediately, paying the applicable additional fees. Where an amnesty scheme such as CFSS (Companies Fresh Start Scheme) is open, use it — the late fee is waived for the application period. Where a DIN has been deactivated, pay the Rs. 5,000 reactivation fee and file the overdue KYC. In cases of prolonged default requiring NCLT intervention, engage a qualified CS or advocate early.

FY 2026-27 Month-by-Month Compliance Calendar

Key Takeaways

• File AOC-4 before MGT-7, every single year. The SRN of AOC-4 is a mandatory input in MGT-7 on MCA V3. Sequence matters; a rework costs more time than getting the order right.
• DPT-3 is a mandatory annual filing for nearly every private company, not just those that accept deposits. Director loans, intercompany borrowings, and long-held customer advances must be disclosed. File by 30 June.
• DIR-3 KYC by 30 September is personal. A deactivated DIN freezes the director across all companies. Build a reminder for every director in your board calendar on 1 September each year.
• A combined AOC-4 + MGT-7 delay of 90 and 60 days respectively can cost a 3-director company over Rs. 3 lakh in statutory penalties under Sections 137 and 92(5) alone — before professional remediation costs.
• Event-based filings (DIR-12, PAS-3, MGT-14, CHG-1) have no calendar reminder. The clock starts when the event occurs. Train yourself to ask "does this resolution need an MCA form?" at every board meeting.
• Three consecutive years of non-filing of AOC-4 and MGT-7 triggers a five-year directorship ban under Section 164(2) — extending to all other companies where you hold directorships, not just the defaulting entity.
• Statutory registers are your first line of defence in due diligence and inspections. Keep MGT-1, the Section 170 register, Section 189 register, BEN-3, and minutes books current at all times — not just at fundraising events.