ROC compliance for startups

ROC Compliance for Startups

Every private limited startup in India must complete a defined set of Registrar of Companies (ROC) filings starting from the day the Certificate of Incorporation is issued — regardless of revenue, team size, or DPIIT recognition. The critical annual filings are INC-20A (within 180 days of incorporation), AOC-4 (within 30 days of the AGM), MGT-7 or MGT-7A (within 60 days of the AGM), DIR-3 KYC (by 30 September each year), and DPT-3 (by 30 June). Missing any of these triggers escalating additional fees on the MCA V3 portal, can deactivate director DINs, and will surface in every investor due diligence.

Your First 180 Days: Day-One Filings After Incorporation

Getting the Certificate of Incorporation through SPICe+ is not the finish line — it is the start of a compliance clock that begins ticking immediately. Most early ROC defaults in startups happen not from laziness but from founders not knowing these deadlines exist.

INC-20A: Declaration of Commencement of Business

This is the single most consequential early filing and is still routinely missed by first-time founders. Section 10A of the Companies Act 2013 requires every company incorporated on or after 2 November 2018 to file Form INC-20A on the MCA V3 portal before it commences any business or exercises any borrowing powers. The hard deadline is 180 days from the date of incorporation.

To file INC-20A successfully, you need:

1. Bank statement confirming that every subscriber has paid their share subscription money into the company's dedicated bank account
2. Proof of registered office, if not already established through INC-22
3. A valid Digital Signature Certificate of a director

The consequences of missing this are serious. Under Section 10A(2), the company faces a penalty of Rs. 50,000, and every officer in default faces Rs. 1,000 per day for the continuing default, up to a maximum of Rs. 1,00,000. Beyond the financial penalty, a Registrar can initiate strike-off proceedings against a company that has not filed INC-20A, treating it as a shell entity. No startup wants to explain a strike-off notice to Series A investors.

ADT-1: Auditor Appointment

The first board meeting must occur within 30 days of incorporation. At that meeting, the board formally appoints the first statutory auditor under Section 139(6). Form ADT-1 must then be filed within 15 days of that board meeting. The auditor holds office until the conclusion of the first AGM, at which point shareholders ratify or change the appointment.

A common sequencing error: founders hold the first "founders meeting" casually in month three and think the 30-day clock started then. It did not — it started at incorporation. Set your first formal board meeting for around Day 15 and file ADT-1 by Day 30 at the latest.

INC-22: Registered Office Confirmation

If the SPICe+ form used a temporary address, you have 30 days from incorporation to file INC-22 with proof of the permanent registered office. Required documents include a utility bill not older than two months and either an ownership document or a lease or rent agreement. This address will appear on all public MCA records and must be a valid physical address where official correspondence can be received.

First Financial Year AGM Note

For startups incorporated mid-financial year (say, between October and March), the first AGM may be held within nine months of the end of that first financial year — not the standard six months. A startup incorporated in November 2025 has its first financial year ending 31 March 2026, with a first AGM deadline of 31 December 2026. From the second financial year onwards, the six-month rule (AGM by 30 September) applies.

Annual ROC Filings Every Startup Must Make

Once past the first year, a predictable set of annual filings recurs on a fixed schedule. The financial year ends 31 March. The AGM must be held by 30 September for all companies from their second year. Every filing below flows from that AGM date.

AOC-4: Filing Your Audited Financial Statements

AOC-4 carries the audited Balance Sheet, Profit & Loss Account, Cash Flow Statement (mandatory for companies not qualifying as small companies), auditor's report, and Board's Report as an attachment. It must be filed within 30 days of the AGM. For a startup that holds its AGM on 30 September 2026, the AOC-4 deadline falls on 30 October 2026.

The MCA V3 portal charges an additional fee of Rs. 100 per day on late AOC-4 filings, starting from the day after the due date. There is no cap on this accumulation — the meter simply keeps running. The company's normal filing fee (determined by authorised capital) sits on top of this.

MGT-7 / MGT-7A: Annual Return

The annual return captures the company's shareholding structure, list of directors and KMPs, details of meetings held, and indebtedness — all as on the last day of the financial year. Two versions exist:

• MGT-7A (shorter form): Available to small companies — those with paid-up share capital not exceeding Rs. 2 crore and turnover not exceeding Rs. 20 crore. Most seed- and pre-Series A startups qualify.
• MGT-7 (full form): Required for all companies that do not qualify as small companies, including startups that have crossed the capital or turnover thresholds.

The deadline is 60 days from the AGM date. For a 30 September AGM, the MGT-7 / MGT-7A deadline is 29 November. Late filing attracts Rs. 100 per day additional fee, same as AOC-4.

DIR-3 KYC: Annual Director Verification

Every individual holding an active DIN (Director Identification Number) must file DIR-3 KYC or the web-based DIR-3 KYC Web by 30 September each year. The web version — used when name, address, and contact details have not changed since the last filing — takes under 15 minutes and costs nothing if filed before the deadline.

If missed, the DIN is marked "Deactivated due to non-filing of DIR-3 KYC" on 1 October, and the director must pay Rs. 5,000 to reactivate it. A deactivated DIN means that director cannot digitally sign any MCA form — paralysing all company filings until the DIN is restored. In a startup where both founders are directors and both miss the 30 September deadline, the company cannot file anything on MCA until Rs. 10,000 in restoration fees has been paid.

DPT-3: Return of Deposits (and Amounts Not Considered Deposits)

DPT-3 must be filed by 30 June each year. It covers all amounts received by the company that are not classified as deposits under Section 73 — primarily inter-company loans, director loans, loans from shareholders, and security deposits from customers. Even if every one of these is zero, a nil return must be filed. Default attracts the same Rs. 100 per day additional fee regime.

MSME-1: Half-Yearly Return for Outstanding MSME Dues

If your startup procures goods or services from vendors registered under the MSME Development Act and has any amount outstanding to them for more than 45 days, you must file MSME-1 on a half-yearly basis:

• 30 April — covering outstanding dues for the period October–March
• 31 October — covering outstanding dues for the period April–September

If your startup has no MSME vendor dues beyond 45 days, you are not required to file. But document that determination explicitly in your board minutes for each cycle, so you have a defensible record if the question is ever raised.

Event-Based Filings: Where Most Startups Create Lasting Problems

Annual filings are predictable. Event-based filings are not — and they are the primary source of ROC non-compliance at growth-stage startups. A missed annual filing is usually fixable with fees. A missed event-based filing can create structural legal defects that haunt every future funding round.

Director Changes: DIR-12

Any appointment, resignation, or removal of a director — including independent directors, nominee directors from investors, and Key Managerial Personnel such as the CFO and Company Secretary — requires Form DIR-12 within 30 days of the event. The form requires the board resolution, consent letter (for new appointees), and in the case of resignation, the resignation letter.

Investor nominee directors are particularly prone to late DIR-12 filing. Startups receive term sheets, close rounds, and add nominee directors to the board informally — then discover weeks later that the MCA record still shows the old board composition. Every competent legal counsel will check MCA records during due diligence, and a mismatch is an instant red flag.

Share Capital Changes: SH-7 and PAS-3

Two forms govern changes in share capital:

• SH-7: Filed within 30 days of passing the resolution to increase authorised share capital. This must happen and be approved before shares are allotted at the new capital level.
• PAS-3: Filed within 30 days of an allotment of shares. Covers equity allotments, CCPS conversions, and ESOP allotments. Attach the board resolution and the complete list of allottees with PAN and address details.

The correct sequence is: Pass SH-7 resolution → file SH-7 → receive approval → pass allotment resolution → allot shares → file PAS-3. Startups that allot shares first and file SH-7 later create a date-sequencing defect that the MCA V3 system detects and that will require adjudication to resolve.

Special Resolutions: MGT-14

Any resolution passed as a special resolution at a general meeting — including changes to the Memorandum of Association, adoption of an ESOP scheme, related-party transactions above thresholds, and approval of certain loans — must be filed via MGT-14 within 30 days. Skipping this means the resolution, though validly passed at the meeting, is not on the public register. An ESOP scheme for which MGT-14 was never filed has a cloud over every grant made under it.

Foreign Investment: FC-GPR

When a startup receives foreign direct investment from a foreign VC, angel, or strategic investor, an FC-GPR (Foreign Currency – Gross Provisional Return) must be filed on the RBI's FIRMS portal within 30 days of the date of allotment of shares to the foreign investor. This is a Reserve Bank of India requirement, separate from MCA — but intimately connected, because the allotment data in PAS-3 feeds directly into the FC-GPR. File PAS-3 first, then use the same allotment data to prepare FC-GPR.

Board Meetings and Statutory Registers: The Infrastructure Layer

A filing system is only as good as the underlying corporate records. The Companies Act 2013 mandates at least four board meetings per financial year, with a maximum gap of 120 days between consecutive meetings. A startup that holds its first quarterly board meeting in April and its second in August is within the window — but if the third slips to January, the 120-day gap between August and January has been breached. Set a standing quarterly schedule at the start of every financial year.

Minute books — one for board meetings, one for general meetings — must be signed by the chairperson within 30 days of each meeting and kept at the registered office. Board minutes are working legal documents, not summaries. They must record the DINs of attending directors, record of dissents, and actual resolutions passed.

Statutory registers that must be maintained in prescribed forms under the Companies (Management and Administration) Rules 2014 include:

• Register of Members (Form MGT-1)
• Register of Directors and Key Managerial Personnel (Form MBP-4)
• Register of Charges (Form CHG-7)
• Register of Loans, Guarantees and Investments (Form MBP-2)

Share certificates must be issued within two months of allotment, with the correct state stamp duty affixed and cancelled. Failure to issue certificates on time is itself a default under the Companies Act.

Worked Example: What Non-Compliance Actually Costs

Here is a scenario that plays out more often than most founders realise.

Setup: A two-director startup incorporated in September 2023. FY 2023-24 ends on 31 March 2024. The AGM is due by 30 September 2024. The founders are heads-down on fundraising, defer the statutory audit, and eventually file everything on 28 February 2025.

Calculating the damage:

Total additional portal outgo: Rs. 55,500 — before professional fees for catching up, auditor costs incurred under a deadline, and any Registrar notices.

Now add the funding round context: the startup is in the middle of Series A due diligence when the investor's legal counsel pulls up MCA records and flags non-compliance across all four forms, plus two deactivated DINs. The founders spend the next three weeks running between their CA, CS, and the MCA V3 helpdesk instead of closing the round. The fee is manageable. The distraction is not.

What DPIIT Recognition Does (and Does Not) Change for ROC Compliance

DPIIT recognition through the Startup India portal unlocks genuine advantages — but none of them extend your MCA filing deadlines by a single day.

What DPIIT recognition actually gives you:

• Section 80-IAC income tax deduction: 100% of profits are deductible for any three consecutive assessment years out of the first ten years from incorporation. Available to startups incorporated between 1 April 2016 and 31 March 2030 (as extended by Finance Act 2024), subject to an Inter-Ministerial Board Certificate.
• Angel tax abolition: Section 56(2)(viib) was repealed in its entirety by Finance Act 2024 for all investors — resident and non-resident — effective from AY 2025-26. For FY 2026-27 / AY 2027-28, angel tax simply does not apply, regardless of DPIIT status. The recognition was historically important for this exemption; it is now largely redundant on this specific point, though it matters for other benefits.
• Self-certification under labour laws: DPIIT-recognised startups can self-certify compliance under nine central labour laws for three to five years, significantly reducing inspector visits.
• Fast-track exit: Simplified winding-up under Insolvency and Bankruptcy Code provisions, allowing closure without full NCLT proceedings in qualifying situations.

What DPIIT recognition does not give you:

• Any extension on AOC-4, MGT-7, DIR-3 KYC, or DPT-3 deadlines
• Exemption from event-based filings
• Relief from additional fees already accrued
• Any relaxation in board meeting frequency requirements

Treat MCA filing timelines as equally binding whether or not your startup carries DPIIT recognition.

Common Mistakes Startups Make — and How to Fix Them

1. Treating INC-20A as conditional on having revenue. The law does not ask whether you have started earning. It asks whether you have started a company. File INC-20A as soon as subscription money hits the bank account — even if it is Day 15.

2. Confusing the ADT-1 timeline. ADT-1 is not "within 30 days of incorporation." It is within 15 days of the first board meeting, which must itself happen within 30 days of incorporation. Conflating the two gives you a false sense of security and a technical default.

3. Allotting shares before filing SH-7. The correct sequence is always: increase authorised capital first (SH-7), then allot. Reversing this creates a sequencing defect detectable on MCA V3 that requires adjudication — a time-consuming and expensive fix during a funding round.

4. Skipping DIR-3 KYC during a fundraising sprint. 30 September is exactly when term sheets are being negotiated. Directors are travelling, distracted, and missing portal notifications. Set a standing reminder for 10 September — three weeks early — so you are never at risk of a DIN deactivation. The web KYC for unchanged details takes 15 minutes.

5. Filing MGT-14 late for ESOP resolutions. An ESOP scheme without a timely MGT-14 on record is a scheme with a legal cloud over it. Make MGT-14 a mandatory line item in the ESOP drafting checklist, not an afterthought.

6. Treating DPT-3 as optional when deposits are nil. A nil return is still a mandatory return. Include DPT-3 on your June compliance checklist without attaching any condition — it is due, period.

7. Relying on MCA portal reminders as the primary alert system. MCA V3 sends reminders, but they are not consistently delivered for all forms. Use a separate internal calendar with two-week lead reminders, assigned to a named person, reviewed in every monthly finance meeting.

Building Your FY 2026-27 Compliance Calendar

The simplest, most effective compliance tool is a single, shared calendar with named owners and pre-set reminders. The table below covers every major ROC deadline for a startup with an AGM held on 30 September 2026.

For every event-based trigger — a new director, a share allotment, an ESOP grant, a name change, a foreign investment — add the corresponding form and its 30-day window to this calendar the day the event occurs. Do not batch them for later.

Subscribe to MCA V3 email alerts linked to your CIN, but treat these as a backup confirmation, not the primary alert. The primary alert is your internal calendar.

Key Takeaways

• INC-20A must be filed within 180 days of incorporation, after subscription money is received. Missing it risks a Rs. 50,000 fine, Rs. 1,000-per-day officer penalties, and potential Registrar strike-off proceedings.
• Annual filings chain off the AGM: AOC-4 within 30 days, MGT-7 or MGT-7A within 60 days. Additional fees run at Rs. 100 per day per form with no ceiling, and they compound silently.
• DIR-3 KYC by 30 September is non-negotiable. A deactivated DIN freezes all MCA filings until a Rs. 5,000 restoration fee is paid per director.
• Event-based filings — DIR-12, SH-7, PAS-3, MGT-14 — are where most startups accumulate structural problems. File within 30 days of the event, every time, without exception.
• DPT-3 is mandatory even when the return is nil. File it by 30 June as a standing obligation, not a conditional one.
• DPIIT recognition delivers real tax and labour law benefits, including the Section 80-IAC profit deduction and self-certification under nine labour laws — but provides zero relaxation on ROC timelines.
• A compliance calendar with named owners, reviewed monthly, eliminates virtually all ROC defaults. The total cost of staying compliant — professionally — is a fraction of the fees, management bandwidth, and deal-room scrambling that a single missed annual filing cycle creates.