Startup Compliance in India: The Ultimate 2025 Guide

Startup Compliance in India: The Ultimate 2026 Guide

Indian startups operating in FY 2026-27 face compliance obligations across seven distinct regulators — MCA, CBDT, CBIC, RBI, DPIIT, labour ministries, and now the operationalised DPDP Board. A single missed filing can freeze a funding round, trigger director disqualification, or attract penalties running into crores. This guide maps every compliance head in one place, with exact due dates, current form names, worked Rs. examples, and the mistakes that most founders make in years one through three. Read it with a spreadsheet open and start building your calendar today.

Your Seven Regulators: The Compliance Landscape

Think of Indian startup compliance as seven parallel tracks, each with its own calendar, portal, and penalty regime. No track is optional once you cross the relevant threshold.

Most startups handle MCA and income tax reasonably well in year one. Failures accumulate in FEMA, ESIC, POSH, and DPDP — areas that surface only when a Series A investor commissions legal due diligence.

MCA Filings: Annual, Event-Based and Director-Level

Annual Filings

Every company incorporated under the Companies Act 2013 must file two core annual forms:

• AOC-4 (financial statements with Directors' Report): within 30 days of the Annual General Meeting (AGM)
• MGT-7 / MGT-7A (annual return): within 60 days of the AGM

The AGM itself must be held within six months of the financial year-end — by 30 September for an April–March FY — and the gap between two consecutive AGMs cannot exceed 15 months. Small companies file MGT-7A (a condensed form); all others file MGT-7.

Late fee structure: ₹100 per day per form, with no upper cap. A startup that files both AOC-4 and MGT-7 ninety days late pays ₹9,000 per form — ₹18,000 total — before any NCLT adjudication. If the delay stretches past 270 days, the ROC can initiate strike-off proceedings under Section 248, which results in the company name being removed from the register. Reinstating a struck-off company requires a High Court order.

Event-Based Filings

These are the filings that get missed because there is no fixed calendar date — they are triggered by corporate events you create yourself:

Worked example on PAS-3: Your startup closes a seed round on 15 June 2026 and allots 10,000 equity shares to three investors. PAS-3 is due by 15 July 2026. You file on 5 September 2026 — 52 days late. The penalty is 52 × ₹100 = ₹5,200 on that single form. More critically, the allotment is legally incomplete until PAS-3 is registered with MCA, which means your shareholders' register is defective and cannot support a valuation certificate for the next round.

Director KYC: DIR-3 KYC

Every director holding a Director Identification Number (DIN) must file DIR-3 KYC by 30 September each year. The annual fee is nil; the penalty for missing it is a ₹5,000 reactivation fee and — more damagingly — immediate deactivation of the DIN. A deactivated DIN means the director cannot sign any board resolution, statutory filing, or bank mandate, effectively paralysing the company's operations until the fee is paid and the DIN is reactivated on MCA V3.

Board Meeting Minimum

Private companies (the structure most startups use) must hold at least two board meetings per financial year, with no more than 120 days between consecutive meetings. Document minutes within 30 days. Verbal decisions taken over WhatsApp have no legal standing and will not survive an investor due-diligence query or an NCLT inquiry.

Income Tax: CBDT Obligations for AY 2027-28

ITR-6 and the Tax Audit

Companies (other than those claiming exemption under Section 11) file ITR-6 on the Income Tax portal. The due date depends on whether a tax audit applies:

• Tax audit mandatory under Section 44AB (broadly: if turnover exceeds ₹1 crore for business income, or the prescribed threshold for professional receipts, as notified): ITR-6 due 31 October of the assessment year
• No tax audit required: due 31 July

For AY 2027-28, the auditor must upload the tax audit report in Form 3CA/3CB + 3CD before the ITR is filed. The practising CA conducting the audit must have a valid UDIN for the report.

Advance Tax

If your total tax liability for the year exceeds ₹10,000, advance tax must be paid in four instalments:

Interest under Sections 234B and 234C accrues at 1% per month on any shortfall. A startup with a ₹15 lakh annual tax liability that defers all payment to March 2027 pays approximately ₹15,000 in Section 234C interest (three instalments missed) plus further 234B interest if the final payment is itself late. Plan tax provisioning monthly from April — your CFO or finance manager should book a monthly advance-tax-review meeting.

TDS Returns: 24Q and 26Q

• 24Q (TDS on salary): quarterly returns due 31 July, 31 October, 31 January, and 31 May
• 26Q (TDS on non-salary domestic payments — rent, professional fees, contractor payments): same quarterly schedule
• 27Q (TDS on payments to non-residents): same quarterly schedule

File on the TRACES / TIN-NSDL portal. Late filing attracts ₹200 per day under Section 234E, capped at the TDS amount. The downstream consequence is equally harmful: the deductee cannot claim their TDS credit until you file, which damages your relationship with every contractor, freelancer, and landlord you pay. Deposit TDS by the 7th of the following month (or the 30th of April for March deductions).

Section 56(2)(viib): Angel Tax and the Form 2 Exemption

When your startup issues shares at a premium to a resident Indian investor and the issue price exceeds the Fair Market Value computed under Rule 11UA (net asset value or discounted cash flow method), the excess is taxable as "income from other sources" in the hands of your company.

The exemption route: Obtain DPIIT recognition and then file Form 2 on the Startup India portal before the allotment for which you seek exemption. DPIIT recognition alone is not sufficient. Form 2 must be filed and acknowledged before shares are allotted in each round where issue price may exceed FMV.

GST: Registration, Returns and E-Invoicing

Registration Thresholds

GST registration becomes mandatory once aggregate turnover in a financial year crosses:

• ₹40 lakh for suppliers of goods (intra-state, general category states)
• ₹20 lakh for service providers (general category states)
• ₹10 lakh in special category states (Manipur, Mizoram, Nagaland, Tripura)
• Immediately and without turnover limit for e-commerce operators, businesses making any inter-state taxable supply, or those receiving supplies under Reverse Charge Mechanism

Voluntary registration before crossing the threshold is worth considering if your B2B customers need to claim ITC from your invoices.

Monthly Return Cycle

Interest on late payment of GST: 18% per annum on outstanding tax. On a ₹5 lakh liability paid 60 days late, interest = ₹5,00,000 × 18% × 60 ÷ 365 = ₹14,795 — before any late fee under Section 47.

Critical reconciliation step: Before filing GSTR-3B each month, download your GSTR-2B (auto-populated from your suppliers' GSTR-1 filings). Claim ITC only for what appears in GSTR-2B. GSTN's AI-driven matching system flags mismatches and the department issues demand notices for excess ITC claims with 18% interest and a potential 100% penalty.

E-Invoicing

E-invoicing — generating invoices through the Invoice Registration Portal (IRP) before sending them to customers — is currently mandatory for taxpayers whose aggregate turnover in any preceding financial year from 2017-18 has exceeded ₹5 crore. Each IRP-generated invoice carries an IRN (Invoice Reference Number) and QR code. Invoices issued without IRN are not valid documents for ITC purposes.

FEMA and RBI: Cross-Border Money Flows

FEMA filings are the most frequently missed compliance item for early-stage startups raising from foreign angels, foreign venture funds, or Singapore/US holding structures.

FC-GPR: Receiving Foreign Equity Investment

When a resident Indian company allots shares to a non-resident investor, file FC-GPR on the RBI's FIRMS portal (firms.rbi.org.in) within 30 days of allotment.

Step-by-step FC-GPR filing:

1. Register the company as a "Reporting Entity" on FIRMS under Single Master Form (SMF)
2. Navigate to Foreign Investment Reporting → FC-GPR
3. Upload FIRC (Foreign Inward Remittance Certificate) and KYC documents of the non-resident investor
4. Attach board resolution, allotment letter, and Demat credit confirmation
5. Submit; your Authorised Dealer (AD) bank reviews and endorses the filing in the portal

Worked example: A US-based investor wires USD 1,00,000 (≈ ₹83 lakh at ₹83/$) on 1 July 2026. Shares are allotted on 10 July 2026. FC-GPR is due by 9 August 2026. If you miss it and file on 9 November 2026 — 92 days late — you must file a compounding application with the RBI. Compounding fees typically range from 0.5%–1% of the inward remittance, meaning ₹41,500–₹83,000 in compounding fees alone, plus professional costs for preparing the application.

FC-TRS: Transfer of Shares Between Resident and Non-Resident

When existing shares transfer between a resident and a non-resident (e.g., a founder selling secondary shares to a foreign fund), file FC-TRS within 60 days of receipt of consideration or date of transfer of shares, whichever is earlier.

Annual FLA Return

Every Indian company that has received FDI or made overseas direct investment must file the Annual Return on Foreign Liabilities and Assets (FLA) with the RBI by 15 July each year, via the FLAIR portal. Missing this triggers an RBI show-cause notice and may require compounding.

Labour Laws: EPF, ESIC, POSH and the Pending Four Codes

EPF and ESIC Obligations

• EPF registration is mandatory once you have 20 or more employees. Employer contributes 12% of basic wages; employee contributes 12%. Monthly ECR (Electronic Challan-cum-Return) challan is due by the 15th of the following month on the EPFO Unified Portal.
• ESIC registration is mandatory from 10 or more employees (in notified categories of establishments). Employer contributes 3.25% of gross wages; employee contributes 0.75%. Monthly contribution is also due by the 15th of the following month on the ESIC portal.

Directors who are functionally the employer can be personally prosecuted for contribution defaults.

POSH Act: Internal Committee

The Prevention of Sexual Harassment at the Workplace Act 2013 (POSH Act) requires every employer with 10 or more employees to constitute a functioning Internal Committee (IC). The requirements are specific:

1. Presiding Officer must be a senior woman employee
2. Minimum two other employees as members (at least one from a scheduled caste/tribe or minority community, where possible)
3. One external member from an NGO, association, or legal background committed to women's causes
4. Reconstitute the IC at least every three years
5. File an annual report with the District Officer by 31 January (covering the preceding calendar year)
6. Conduct documented POSH awareness training for all employees at least once a year

A company that constitutes a paper IC but conducts no training and files no annual reports has no legal protection in harassment proceedings. The fine for non-constitution is ₹50,000; repeat offences can result in cancellation of business licences.

The Four Labour Codes: Monitor State Notifications

Parliament enacted the Code on Wages 2019, Industrial Relations Code 2020, Code on Social Security 2020, and Occupational Safety, Health and Working Conditions Code 2020. These will eventually subsume 29 central labour laws. As of mid-2026, most states have not yet notified their implementing rules, so the legacy Acts — Payment of Wages Act, EPF Act, ESI Act, Factories Act — continue to apply in full. Track state-level notifications for every state where you have employees or a registered office; do not assume the Codes are live.

DPDP Act 2023: Your Data Privacy Obligations

The Digital Personal Data Protection Act 2023 (DPDP Act) is operationalised, with the Data Protection Board of India constituted. If you collect, store, or process the personal data of any Indian resident — including your own employees, app users, or customers — you are a Data Fiduciary under the Act.

What You Must Have in Place

1. Privacy Notice at point of collection: Plain language, specific to purpose, cannot be buried in terms and conditions. Must be available in English and, where users prefer it, in the Eighth Schedule languages.
2. Granular, revocable consent: Separate consent for each purpose. Pre-ticked boxes or consent bundled with service terms are non-compliant.
3. Grievance Officer: Name and working contact details must be published on your website and app. Draft rules indicate a 48-hour acknowledgement and 30-day resolution window. Appoint this person before you scale user acquisition.
4. Data retention and erasure policy: Delete personal data as soon as the purpose for which it was collected no longer exists, or when the user withdraws consent. Automated deletion pipelines are best practice.
5. Significant Data Fiduciary obligations (if notified): Certain categories of Data Fiduciaries face additional requirements including Data Protection Impact Assessments and periodic audits. Watch for MeitY notifications classifying your sector.
6. Breach notification: Notify the DPDP Board and affected individuals in the event of a significant data breach within the prescribed timeline.

Penalties: Up to ₹250 crore for failure to notify a breach; up to ₹200 crore for failure to implement adequate security safeguards. Build privacy architecture into your product from day one — retrofitting it before a Series B closes, under a two-week due-diligence deadline, is expensive and disruptive.

DPIIT Recognition and Startup-Specific Benefits

Eligibility and Maintenance

Apply on the Startup India portal (startupindia.gov.in) under the Recognition module. Eligibility in 2026:

• Incorporated as a Private Limited Company, LLP, or Registered Partnership Firm
• Less than ten years from date of incorporation or registration
• Annual turnover not exceeding ₹100 crore in any preceding financial year
• Working towards innovation, development, or improvement of products, processes, or services, or has a scalable business model with high potential for employment generation or wealth creation

Maintain the recognition by updating the portal annually with financial data and activity details. Recognition lapses if the company stops updating, and a lapsed recognition invalidates both the angel-tax exemption and the 80-IAC holiday mid-year.

Section 80-IAC: Three-Year Tax Holiday

A DPIIT-recognised startup can claim a 100% deduction on profits for any three consecutive assessment years out of the first ten years of incorporation, under Section 80-IAC. Conditions:

• IMB (Inter-Ministerial Board) approval required; apply through the Startup India portal
• Incorporated on or after 1 April 2016
• Turnover not exceeding ₹100 crore in the year of deduction

The three-year window is your choice within the first ten years. If you anticipate peak profitability in AY 2029-30 through 2031-32, apply in time for those years. The deduction reduces your effective tax rate to zero on profits during those years — this is worth planning with your tax advisor at the business-planning stage, not after the profitable year closes.

Common Mistakes and Pitfalls to Avoid

1. Treating DPIIT recognition as a one-time checkbox. Founders obtain recognition in year one and never update the portal. Recognition lapses silently, and the angel-tax exemption window closes without warning — discovered only when the next round's CA checks the status.

2. Missing FC-GPR because the CA was not looped in at term-sheet stage. Wire receipts and allotment happen fast in seed rounds. FC-GPR has a hard 30-day clock from allotment. Assign one named person to track FIRMS filings from the day an investor's term sheet is signed.

3. Filing GSTR-3B without reconciling GSTR-2B. ITC claimed in GSTR-3B that does not appear in your GSTR-2B is now flagged by GSTN's automated mismatch system. Reversals attract 18% interest and can spiral into an audit.

4. No formal board minutes for decisions taken over email or messaging apps. Board resolutions must be formally documented and minuted within 30 days. Informal decisions have no legal standing and will not survive investor due diligence or an NCLT inquiry.

5. Deferring all advance tax to March. Section 234C interest accrues on each missed instalment separately. Across three missed instalments on a ₹20 lakh liability, the interest cost can exceed ₹45,000 — entirely avoidable with quarterly review.

6. Constituting a POSH IC on paper and never training employees. Courts have held that a dormant IC provides no protection to the employer. Training sessions must be held and documented annually.

7. Outsourcing all compliance without an internal calendar owner. Monthly GST, quarterly TDS, annual MCA, and event-triggered FEMA filings live on different portals and have different due dates. Outsourcing execution is fine; outsourcing awareness is not.

Worked Example: 12-Month Compliance Calendar for a SaaS Startup (FY 2026-27)

Assumptions: Private limited company, incorporated April 2024; 25 employees (EPF and ESIC applicable); turnover ₹4 crore (monthly GST filer, GSTR-9C not required); one US angel investor on cap table; DPIIT recognised; no prior foreign investment filings pending.

Reviewing this calendar in a 30-minute monthly compliance meeting catches 90% of gaps before they become penalties.

Key Takeaways

• AOC-4 and MGT-7 late fees are ₹100 per day per form with no cap — set calendar alerts the moment your AGM date is confirmed, not after it passes.
• FC-GPR has a 30-day hard clock from allotment to non-resident investors; missing it requires a compounding application costing 0.5%–1% of the inward remittance, plus professional fees.
• Form 2 on the Startup India portal must be filed and acknowledged before each allotment where issue price may exceed FMV — DPIIT recognition alone does not protect you from Section 56(2)(viib) angel tax.
• GSTR-2B reconciliation before GSTR-3B prevents ITC mismatches that attract 18% interest and trigger automated GSTN notices; build this into your monthly close process.
• DPDP Act penalties reach ₹250 crore — publish a Grievance Officer contact, implement per-purpose consent mechanisms, and write a data deletion policy before you scale user acquisition.
• POSH IC constitution plus documented annual training is a legal requirement from 10 employees; a paper committee that conducts no sessions offers no legal protection in proceedings.
• A single internal compliance calendar with named owners — not just an outsourced CA file — is the most cost-effective compliance investment a startup can make; the alternative is personal director liability, frozen fundraises, and reinstatement orders.