When you start a company, building it is the fun part. Compliance is the part nobody warns you about — and it begins on day one, whether or not you’ve made a single rupee.
The good news: most of it is cheap to do on time and only expensive when you don’t. Here’s the full compliance landscape a startup faces, area by area — the what. (For the deadlines, see the annual compliance calendar.)
The short version
- Compliance starts at incorporation, not at profit.
- A Private Limited company is audited every year and files with the ROC every year — no exceptions.
- Income tax, GST, labour law, FEMA and IP each bring their own filings.
- Labour rules switch on as you hire (PF at 20, ESI and POSH at 10 employees).
- DPIIT recognition makes several of these lighter.
1. Company law (ROC / MCA)
The non-negotiables for a Private Limited company, every year, whatever your size:
- a statutory audit — mandatory every year, regardless of turnover;
- annual ROC filings — AOC-4 (financial statements) and MGT-7 (annual return);
- an AGM and board meetings with proper minutes;
- DIR-3 KYC for every director, and up-to-date statutory registers.
And event-based filings when things happen: INC-20A (commencement, within 180 days of incorporation), PAS-3 when you issue shares, DIR-12 for director changes.
2. Income tax
From incorporation you’ll need a PAN and TAN. After that: file the company’s income-tax return every year, deduct and deposit TDS on salaries, rent and professional fees and file quarterly TDS returns, pay advance tax in four instalments, and get a tax audit if your turnover crosses the threshold.
3. GST
Register for GST once turnover crosses ₹40 lakh (goods) or ₹20 lakh (services) — or immediately if you sell interstate or through an e-commerce platform, where registration is required from rupee one. Then file your returns — GSTR-1 and GSTR-3B (monthly or quarterly) — and the annual GSTR-9. E-invoicing applies once you cross the prescribed turnover.
4. Labour & employee compliances
These switch on as you hire, so they sneak up on growing teams:
- EPF (provident fund) — once you have 20+ employees;
- ESI — once you have 10+ employees within the wage threshold;
- Professional tax — state-specific, deducted from salaries;
- Shops & Establishment registration for your premises;
- POSH — an Internal Committee becomes mandatory at 10+ employees.
Plus minimum wages, gratuity, and the new labour codes as they roll out.
5. FEMA — if you take foreign money
The moment a foreign or NRI investor comes in, FEMA applies: issue shares at or above fair value, file FC-GPR within 30 days of allotment, and file the annual FLA return. Miss the reporting and a routine round becomes a contravention. Full detail here →
6. Protect the brand, unlock the benefits
Not strictly mandatory, but worth doing early:
- Trademark your name and logo before someone else does;
- Udyam (MSME) registration — for the 45-day payment protection and other benefits;
- DPIIT recognition — the one that lightens a lot of the rest.
The startup relaxations worth knowing
The bottom line
Compliance isn’t optional and it isn’t one-time. Keep a calendar, get the cheap things done on time, and use DPIIT recognition to lighten the load. The cost of staying compliant is a small fraction of the cost of cleaning up after you haven’t — in penalties, in lost funding due-diligence time, and in stress.
This article is for general information and isn’t legal or tax advice. Thresholds and rules change, and your situation deserves advice specific to it.
Frequently asked questions
What compliances must a startup follow from day one?
Company-law filings (statutory audit, AOC-4, MGT-7, board meetings, DIR-3 KYC), income tax (ITR, TDS, advance tax), GST once registered, and labour registrations as you hire.
Does a startup need a statutory audit from year one?
Yes. A Private Limited company must be audited every year, regardless of turnover or whether it has made a profit.
When does a startup need GST registration?
Once turnover crosses ₹40 lakh (goods) or ₹20 lakh (services), or immediately if you sell interstate or through an e-commerce platform.
When do PF and ESI apply to a startup?
EPF applies once you have 20 or more employees; ESI applies at 10 or more employees within the wage threshold.
Is POSH mandatory for startups?
An Internal Committee under the POSH Act is required once you have 10 or more employees.
Does DPIIT recognition reduce compliance?
Yes. It allows self-certification under several labour and environment laws and unlocks tax benefits such as the 80-IAC holiday and the ESOP tax deferral.
Read next
Part of A Founder's Guide to Startups in India — structure, funding, ESOPs & compliance.
Quick answers: Startup annual compliance · Annual ROC filings · Compliance calendar
