Investor Readiness, Due Diligence & Statutory Compliance — Complete Q&A Guide

A compliance audit report is a structured review of a company's adherence to its statutory obligations under all applicable laws — primarily the Companies Act, 2013, the Income Tax Act, the GST Act, and any sector-specific regulations.

For a startup, the compliance audit covers:

• Corporatstatutory compliance (Companies Act):
• Whether all mandatory ROC filings have been made on time (AOC-4, MGT-7, DIN KYC, event-based forms)
• Whether board meetings have been held at the required frequency and properly documented
• Whether statutory registers are complete and up-to-date
• Whether shareholder resolutions have been properly passed and recorded
• Whether the cap table on the MCA records matches the company's own records

• Tacompliance:
• Whether ITR has been filed for all financial years since incorporation
• Whether GST returns are current if the company is GST-registered
• Whether TDS has been deducted and deposited on all applicable payments
• Whether advance tax has been paid if applicable

• Employmenand labour compliance:
• Whether PF and ESI registrations and contributions are current
• Whether professional tax is paid in applicable states

• Iand contract compliance:
• Whether intellectual property created by founders and employees has been formally assigned to the company
• Whether employment contracts are in place

The output is a written report that identifies all complied items, all gaps, and a remediation roadmap — what needs to be fixed, in what order, and the estimated cost (late fees, penalties, professional fees).

Legal reference: Section 92, 137, 96, 88 — Companies Act 2013; Section 139AA — Income Tax Act; Section 37, 39 — CGST Act 2017

Yes — and the earlier the better. There are two specific reasons:

Investors will conduct their own due diligence regardless: Every VC, angel network, and institutional investor includes a legal and financial due diligence process. Their advisors will review the MCA portal, check all ROC filings, request all statutory registers, and review all board and shareholder resolutions. If there are gaps, they will find them. The question is not whether gaps will be discovered — it is whether you discover and remediate them before the investor does, or whether the investor discovers them first.

Discovery by investors has worse outcomes: When an investor finds a compliance gap during diligence, one of three things happens: (a) they ask for it to be fixed before close, which causes delay and negotiating leverage shifts to them; (b) they use it to reduce the valuation or introduce escrow provisions; or (c) they walk away from the deal entirely. When you find it first and fix it before raising, none of these outcomes occur.

• Whaa pre-fundraise compliance audit specifically checks:
• Completeness of all ROC filings since incorporation
• Accuracy of the MCA cap table vs. your own records (critical — mismatches are common and delay rounds)
• Existence of all required statutory registers
• Board meeting documentation completeness
• Employment and IP assignment documentation
• Any pending regulatory actions or notices

The standard recommendation is to conduct the compliance audit at least 3–4 months before you plan to begin investor conversations. This gives time to identify issues, file remediation forms, and obtain confirmation before the round begins.

Practitioner note: VC and angel firms typically engage a law firm or CA firm to conduct independent due diligence on every investment. This diligence process takes 4–8 weeks for an early-stage company. Running a self-audit first compresses this timeline and reduces the probability of a deal-breaking finding.

A thorough compliance audit for a startup covers the following checklist areas:

• Sectio1 — Incorporation and formation
• Verification of Certificate of Incorporation, CIN, PAN, and company name
• Review of Memorandum and Articles of Association for any restrictions relevant to the funding structure
• Confirmation that the company is in the correct business category (Private Limited) for investment

• Sectio2 — ROC filings (MCA portal verification)
• AOC-4 (Financial statements filing): filed annually within 30 days of AGM for each year since incorporation
• MGT-7 / MGT-7A (Annual return): filed within 60 days of AGM for each year
• DIR-3 KYC (Director KYC): filed by September 30 each year for all directors holding DIN
• MGT-14 (Resolutions): filed for special resolutions and specific board resolutions requiring MCA registration
• PAS-3 (Return of allotment): filed within 30 days of each share allotment
• SH-7 (Change in authorised capital): if applicable
• Event-based forms: INC-22 (change of registered office), DIR-12 (director appointment/resignation), etc.

• Sectio3 — Board meeting compliance
• Verification that at least 4 board meetings were held in each financial year
• Confirmation that no two consecutive meetings are more than 120 days apart
• Review of board minutes for completeness (quorum, attendance, resolutions passed, chairman signature)

• Sectio4 — Statutory registers
• Register of Members (Form MGT-1)
• Register of Directors and KMP (Form MBP-4)
• Register of Employee Stock Options (Form SH-6) if ESOP scheme exists
• Minutes books (board and general meetings)
• Register of Contracts with related parties (Form MBP-4)

• Sectio5 — Cap table reconciliation
• Comparison of MCA-filed allotment history (PAS-3 filings) against the company's own cap table
• Identification of any discrepancies in share numbers, types, or holder names

• Sectio6 — Tax compliance
• Income tax returns filed for all years
• GST registration and returns filed if applicable
• TDS payment and return compliance (Form 26Q, 24Q)

• Sectio7 — Employment and IP
• Employment agreements for all current and past senior employees
• IP assignment agreements from all founders and key technical employees
• ESOP scheme documentation if applicable

Legal reference: Section 92, 96, 137, 173, 88 — Companies Act 2013; Companies (Management and Administration) Rules 2014; Companies (Accounts) Rules 2014; Rule 12A — Companies (Appointment and Qualification of Directors) Rules 2014 (DIR-3 KYC)

The most reliable way to check is directly on the MCA portal (mca.gov.in):

Step 1: Access the MCA company master data Go to mca.gov.in → Services → MCA21 Services → View Company/LLP Master Data → Enter your CIN. This shows your company's basic registration details and current status.

Step 2: Check company filing history On the MCA portal → e-Filing → View Public Documents → Enter CIN → View Filing History. This shows every form filed with the ROC, the date of filing, and whether it was approved. Cross-reference this against what should have been filed.

• Ste3: What should have been filed since incorporation
• Foeach financial year since incorporation, verify:
• AOC-4 (financial statements): must be filed within 30 days of AGM
• MGT-7 or MGT-7A (annual return): must be filed within 60 days of AGM
• DIR-3 KYC for each director: must be filed by September 30 each year

• Foevery share allotment (each funding round, ESOP exercise):
• PAS-3 (return of allotment): must be filed within 30 days of allotment

• Foevery director change (appointment or resignation):
• DIR-12: within 30 days of the change

• Foevery special resolution passed:
• MGT-14: within 30 days of passing the resolution

Step 4: Identify the gaps Build a year-by-year matrix of what was due and what was filed. Any row where a "due" form has no corresponding "filed" entry is a gap that needs remediation.

What the MCA portal shows vs what it doesn't: The portal shows all forms submitted and their status. It does not verify whether the contents of the forms are accurate. A form can be "filed and approved" but contain incorrect data (wrong date, wrong share count). The compliance audit must also verify accuracy, not just existence.

Legal reference: Companies Act 2013 — Section 92 (annual return), Section 137 (financial statements), Section 403 (late fees); MCA portal at mca.gov.in

Practitioner note: For companies more than 5 years old with multiple funding rounds, this verification can be complex. Engaging a CA or Company Secretary who has experience with MCA filings significantly reduces the risk of missing a gap.

Investors in Indian startups — whether angel, seed VC, or Series A institutional fund — typically request the following documents as part of their due diligence process. The list below reflects what is standard across most Indian investment transactions:

• Corporatdocuments
• Certificate of Incorporation and CIN
• Memorandum and Articles of Association (with all amendments)
• Current list of shareholders with shareholding percentages (cap table)
• All share allotment documents (board resolutions, shareholder resolutions, PAS-3 filings)
• All existing shareholder agreements (SHA, SSA, investor rights agreements, convertible note agreements)
• Board minutes for all board meetings held
• Minutes of all general meetings (EGMs, AGMs)
• Register of Members
• Register of Directors

• Financiadocuments
• Audited financial statements for all completed financial years since incorporation
• Provisional or management accounts for the current financial year (unaudited)
• ITR acknowledgements for all filed years
• GST returns (GSTR-1, GSTR-3B) for the last 12–24 months
• Bank statements for the last 12 months
• Current cap table with fully diluted calculations

• Legaand compliance documents
• All existing material contracts (customer contracts above a threshold, vendor contracts, partnership agreements)
• Employment agreements for all key personnel
• ESOP scheme document and grant letters (if ESOP is in place)
• Intellectual property assignments from all founders and key technical employees
• Any IP registrations (patents, trademarks, copyrights)
• DPIIT recognition certificate (if obtained)
• Any litigation documents (notices, demand letters, pending cases)
• All licences and regulatory approvals relevant to the business

Practical observation: Many first-time founders underestimate the volume of documents requested and the time it takes to compile them. Investors typically send a due diligence checklist with 40–80 line items. Having these organised in a data room in advance of investor conversations reduces deal closure time and demonstrates management quality.

Missing ROC filings has consequences across three dimensions — financial penalties, legal exposure for directors, and practical consequences for the company:

• Financiapenalties (Section 403, Companies Act 2013)
• Latfees are levied for each day of delay beyond the due date. The current structure:
• For forms with no fee: ₹100 per day of delay (no cap specified in the Act, making extended delays very expensive)
• For forms with a filing fee: Additional fees apply on top of the regular filing fee

For illustrative context: If an annual return (MGT-7) is filed 200 days late, the late fee alone is ₹20,000 per filing. Multiply this across 3 financial years and multiple forms, and late fees can amount to several lakhs.

Director disqualification (Section 164(2), Companies Act 2013) If a company fails to file annual returns (MGT-7) or financial statements (AOC-4) for three consecutive financial years, every director of the company is automatically disqualified. A disqualified director cannot be appointed as director of any other company for a period of 5 years. This is enforced by the MCA, which periodically publishes lists of disqualified directors and marks their DINs as disqualified.

Company status risks The MCA has authority to strike off companies that fail to file annual returns for 2 or more consecutive years under Section 248. A struck-off company cannot legally operate, enter contracts, or maintain a bank account — and restoring it requires an NCLT application.

• Investment-blockinconsequences
• Investors will not complete an investment in a company with missing filings until the filings are completed
• The presence of pending penalties appears in the due diligence and must be disclosed to investors
• Title to shares cannot be cleanly established if allotment forms (PAS-3) have not been filed

Criminal liability Certain violations of the Companies Act carry criminal liability for officers in default — including fines and imprisonment in the most serious cases (though prosecution is rare for first-time administrative delays).

Legal reference: Section 92, 137 — annual compliance obligations; Section 403 — late fees; Section 164(2) — director disqualification; Section 248 — striking off; Section 172 — penalty for non-compliance with statutory register obligations

Yes. The Companies Act provides mechanisms for correcting most historical compliance gaps. The correction approach depends on the type of violation:

For late ROC filings (most common) Most forms can be filed late with additional fees under Section 403. The MCA portal allows late filing with the applicable late fee. There is no absolute cut-off after which a filing can never be made (though there are NCLT-route requirements for certain very late filings). This means a company that has missed 3 years of AOC-4 and MGT-7 filings can file all three years now, paying the accumulated late fee, and come into good standing.

For compounding of offences (Section 441) Certain Companies Act violations can be "compounded" — effectively settled by paying a fine to the Regional Director of the MCA without criminal prosecution. Compounding is available for violations that are not offences punishable with imprisonment only. For a startup, compounding is typically used for procedural violations where the underlying decision was legitimate but the statutory formality was missed.

For director disqualification (Section 164) The Supreme Court and various High Courts have provided relief in specific cases. The MCA has also periodically opened windows (such as the Condonation of Delay Scheme) where disqualified directors can file missing documents and have disqualification lifted. However, there is no permanent standing window — these are ad-hoc MCA schemes. The most reliable approach is to file missing documents before disqualification occurs.

What cannot be retroactively corrected Certain decisions that required prior shareholder approval (e.g., issuing shares at a discount, certain related-party transactions) cannot be retroactively regularised if the approval was not obtained. If shares were allotted without a valid shareholder resolution, the allotment may need to be examined for validity — this is a more complex situation requiring legal advice.

• Practicaapproach for remediation:
• Conduct a complete gap audit
• File all overdue forms in chronological order, paying applicable late fees
• Where compounding is required, engage a CA or lawyer for the NCLT/Regional Director application
• Document that the gaps have been remediated and present this to investors as part of due diligence disclosure

Legal reference: Section 403 — late fees for delayed filing; Section 441 — compounding of offences; Section 164(3) — disqualification relief; MCA Condonation of Delay Scheme (operational periodically — verify current status at mca.gov.in)

Practitioner note: The MCA has periodically announced special schemes (CFSS — Companies Fresh Start Scheme, CODS — Condonation of Delay Scheme) that allow filing overdue documents with reduced or waived late fees. These schemes are announced and closed periodically. Verify whether any current scheme is open before filing late documents, as timing can significantly reduce the cost of remediation.

The duration of a compliance audit depends on the company's age, the number of financial years covered, the complexity of the corporate history (number of funding rounds, director changes, ESOP grants), and the quality of existing records.

Typical timelines:

A seed-stage company, 2–3 years old, one or two funding rounds: 1–2 weeks for a thorough audit, including MCA portal verification and document review.

A startup, 4–6 years old, with multiple funding rounds, ESOP scheme, and a few director changes: 2–4 weeks for a comprehensive audit.

A more established company with subsidiaries, complex group structures, or significant related-party transactions: 4–8 weeks.

What drives the timeline:

MCA verification: Reviewing the MCA portal for every filing since incorporation is a systematic but time-consuming process. For a 5-year-old company with 4 directors and 3 allotments, verifying every required filing takes 2–3 days.

Document collection: Collecting physical and digital records from the founders, finance team, existing CA, and company secretary can take 1–2 weeks, particularly if records are scattered across multiple people or older records are paper-based.

Gap analysis and reporting: Once all records are collected and verified, preparing the written audit report with findings and recommendations takes 2–5 days.

Important caveat: The above timelines assume full cooperation from the company in providing documents. Delays in document provision by the company are the most common reason audit timelines extend. Companies that maintain a well-organised corporate document folder (see Section 5 of this guide) complete audits significantly faster.

A compliance audit for a startup in India involves professional fees for the CA or Company Secretary conducting the audit. Indicative market ranges:

Simple audit (company up to 2 years old, one round of funding, straightforward history): ₹15,000–₹30,000

Standard audit (company 2–5 years old, 1–2 funding rounds, standard ESOP): ₹30,000–₹60,000

Comprehensive audit (company 5+ years old, multiple rounds, ESOP, group structure): ₹60,000–₹1,50,000+

• Additionacosts beyond professional fees:
• Late fees on any overdue ROC filings discovered during the audit (Section 403 — ₹100 per day per form)
• Compounding fees if any offences need to be compounded
• Cost of preparing and filing any forms that were missed (typically ₹5,000–₹20,000 per form including professional fees for preparation)
• Cost of recreating any missing statutory registers or resolutions

What the audit fee covers: The audit fee covers the professional's time for: MCA portal review, document review, gap analysis, and written report. It does not typically include the cost of remediation (filing missing forms, preparing missing documents) — that is a separate engagement.

Value relative to the transaction: For a startup raising ₹1–5 crore, a compliance audit costing ₹30,000–₹60,000 is negligible. The alternative — having an investor discover gaps during their diligence — typically costs far more in deal delay, legal costs, and negotiating position.

Practitioner note: Fees above are indicative based on market rates at the time of writing. Actual fees depend on the CA/CS firm, the city, and the specific scope. Always obtain a written scope and fee proposal before engaging.

Investor due diligence preparation is both a document exercise and a process exercise. The following is a structured approach:

3–4 months before fundraising

• Conduca self-compliance audit (or engage a CA/CS to do it):
• Check all ROC filings against what was due
• Verify MCA cap table matches your records
• Review statutory registers for completeness
• Confirm tax compliance is current

File any missing or overdue documents immediately and collect evidence that they were filed (acknowledgement numbers, MCA filing confirmation).

2–3 months before fundraising

• Compilall corporate documents into a structured data room (digital folder, typically Google Drive or Dropbox for early-stage companies, or a proper data room tool like DocSend for Series A+). Organise by category:
• Incorporation documents
• Cap table and share issuance documents
• Board meeting minutes
• Shareholder resolutions and agreements
• Financial statements and tax returns
• Employment agreements
• IP assignments
• Licences and regulatory documents

1–2 months before fundraising

Reconcile the cap table in detail — ensure every share ever issued has a corresponding board resolution, shareholder resolution (if required), PAS-3 filing, and share certificate. Any unexplained gap will be flagged by the investor's counsel.

Have your auditor confirm that all financial statements are filed and compliant. If the current year's audit is not yet complete, have management accounts ready.

During fundraising

Share the data room index (list of contents) with the investor at the term sheet stage — this signals that you are organised and prepared. Follow with full access after term sheet signature. Being responsive to due diligence requests is as important as having the documents — delays in responding are interpreted as organisational weakness.

Yes. Most ROC forms that were not filed on time can still be filed later — with late fees. The MCA portal (mca.gov.in) allows late filing for the vast majority of forms. Here is how it works:

The late fee mechanism (Section 403, Companies Act 2013) When you file a form after the statutory due date, the MCA system automatically calculates the late fee based on the number of days of delay. The current late fee for most filings is ₹100 per day of delay beyond the due date. This is in addition to the regular filing fee (if any). The late fee must be paid at the time of filing.

• Formthat can be filed late (with late fees)
• AOC-4 (annual financial statements): can be filed late with late fees
• MGT-7/MGT-7A (annual returns): can be filed late with late fees
• PAS-3 (return of allotment): can be filed late with late fees
• DIR-12 (director changes): can be filed late with late fees
• SH-7 (change in authorised capital): can be filed late
• MGT-14 (resolutions): can be filed late

Forms requiring NCLT route for very old delays For some very old filings (typically where the ROC has issued a notice or the company has been marked as defaulting), the filing may need to go through the National Company Law Tribunal (NCLT) for condonation of delay, rather than directly through the MCA portal. This is a more complex and time-consuming process (4–6 months). However, for most startups with gaps of a few years, the direct MCA portal filing with late fees is sufficient.

Practical point: Filing overdue forms is not something the company should do without professional guidance. The forms must be completed accurately (which requires knowing the exact historical dates, share counts, and details), and errors in the filing create further compliance issues. Engage a CA or Company Secretary to prepare and file the overdue documents.

Legal reference: Section 403, Companies Act 2013 — late fees for delayed filing; Sections 92, 137, 117 — specific filing obligations; NCLT rules for condonation of delay in extreme cases

Fixing old compliance issues follows a structured process. The approach depends on the type of issue:

• Ste1: Catalogue every gap
• Beforfixing anything, know exactly what is broken. Build a complete list of:
• Every overdue ROC filing (form number, period covered, days overdue, estimated late fee)
• Every missing statutory register
• Every resolution that was not documented or filed when it should have been
• Every tax return or payment that was late or missing

• Ste2: Prioritise by investor impact
• Noall gaps are equally serious for fundraising. Prioritise in this order:
• Cap table discrepancies (share allotments not filed → investors cannot verify ownership — fix first)
• Missing annual returns and financial statements (most obvious on MCA portal)
• Missing director-related filings (DIN KYC, DIR-12 for appointments)
• Missing event-based filings (PAS-3 for each round, MGT-14 for key resolutions)
• Missing statutory registers (can be reconstructed from other records)

Step 3: File all overdue ROC forms in chronological order Starting from the oldest gap, prepare and file all overdue forms with applicable late fees. Filing in chronological order ensures that later filings don't conflict with unresolved earlier ones.

Step 4: Address tax gaps separately Outstanding tax returns, TDS payments, or GST returns must be addressed with the respective departments — Income Tax Department, GSTN — not through MCA. Each has its own filing mechanism and penalty structure.

Step 5: Document the remediation Keep a clear record of every remediation action taken — the form filed, the date filed, the acknowledgement number, and the late fee paid. This remediation log is presented to investors as evidence that the gaps have been resolved.

Step 6: Obtain professional confirmation Have the CA or CS who conducted the remediation provide a written confirmation that all identified gaps have been addressed. This is the document that replaces the compliance gap finding in the due diligence report.

This question requires a careful, honest answer. The short answer is: you can document and formalise records of decisions that were actually made, but you cannot fabricate resolutions for decisions that were never made.

• Thlegal position
• board resolution is a formal record of a decision made by the directors at a board meeting. Under the Companies Act, 2013:
• Board meetings must have a quorum (minimum directors present or participating via video conference)
• Minutes of board meetings must be recorded within 30 days of each meeting
• Minutes, once recorded and signed, are presumed correct

What can be done for past gaps If the company held board meetings (even informally, by a phone call between directors) and made decisions, but never formally recorded the minutes, the directors can confirm those decisions and prepare formal minutes to reflect what was actually decided. The directors must collectively confirm that the decisions were actually made at the stated time.

• Thiis different from inventing decisions that were never made. Preparing records that falsely represent a meeting that never occurred is:
• Potentially a criminal offence under Section 448 of the Companies Act (false statements)
• A misrepresentation to investors if the records are used in due diligence

• Whathis means in practice
• Ia startup issued shares to an investor but never formally passed a board resolution authorising the allotment, the situation requires careful handling:
• A CA/lawyer must review whether the allotment itself was valid (shares were actually received and issued)
• If the allotment was genuine, the board can pass a resolution ratifying/confirming the allotment
• The ratification must be disclosed to the investor as part of due diligence — not concealed

Honest disclosure is always better than concealment: Investors understand that early-stage startups often have procedural gaps. What they do not tolerate is discovering that records were fabricated to conceal those gaps. Disclose, remediate, and move on.

Legal reference: Section 118 — Minutes of board meetings (must be prepared within 30 days); Section 448 — punishment for false statements in documents submitted to the Registrar; Section 179 — powers of Board of Directors

Practitioner note: If your company has significant historical resolution gaps, engage a lawyer alongside your CA for the remediation process. The legal risk of incorrectly backdating or fabricating records is serious, and professional guidance on the line between legitimate ratification and impermissible fabrication is important.

Incomplete statutory registers have both immediate and longer-term consequences:

• Immediatconsequences — investor due diligence failure
• Investorspecifically request all statutory registers as part of diligence. A Register of Members (Form MGT-1) is the primary evidence of who owns how many shares. If this register does not match the cap table the company has represented, investors will either:
• Require the registers to be completed and reconciled before proceeding
• Treat the discrepancy as a major red flag about management quality

A missing or incomplete Register of Directors (Form MBP-4) raises questions about the governance history of the company.

Legal consequences The Companies Act, 2013 prescribes penalties for failure to maintain statutory registers:

Section 88 — failure to maintain Register of Members: penalty on the company (₹3 lakh) and on every officer in default (₹1 lakh) for the initial contravention, plus continuing penalty.

Section 172 — general penalty for non-compliance with Chapter VII provisions (relating to management and administration, which includes registers): company fined ₹25,000 to ₹5,00,000; officer in default fined ₹10,000 to ₹1,00,000.

Practical consequence — inability to issue share certificates A properly completed Register of Members is required before shares can be issued to new investors. The investor's name, address, and shareholding must be entered in the register on allotment, and the share certificate must reflect the register entry.

Remediation Incomplete registers can be completed if the underlying information is available from other records (PAS-3 filings, board resolutions, share certificates, cap table records). A CA or Company Secretary can reconstruct the register from these source documents and have the directors confirm its accuracy.

Legal reference: Section 88 — Register of Members; Section 89 — declaration of beneficial interest; Section 190 — Register of contracts/related party transactions; Section 170 — Register of Directors; Section 172 — penalty

Yes — and they will. The MCA portal (mca.gov.in) provides public access to all company filings. Any registered user can view the complete filing history of any company by searching the CIN. Investor due diligence teams and their lawyers routinely do this as a standard step.

• Whathe MCA portal reveals
• Every form ever filed for the company, with filing date and status
• Whether annual returns and financial statements have been filed for each year
• Whether director changes were reported
• Whether share allotments were filed

What a gap looks like on the portal If your company was incorporated in 2019 and the MCA filing history shows AOC-4 and MGT-7 filed for 2019-20 and 2020-21 but nothing for 2021-22 or 2022-23, the investor's counsel will immediately flag this as a compliance gap.

• Whais not visible but is requested
• Thcontent of the filings can be downloaded from the portal (some documents are free; others require payment of a small fee). Investors' lawyers download and review:
• The annual returns (MGT-7) to check directorship and shareholding details
• The financial statements as filed (to compare against the management accounts provided)
• The allotment forms (PAS-3) to verify each round of funding

The consequence of trying to conceal Any attempt to conceal compliance gaps from investors while simultaneously providing them as part of due diligence is a misrepresentation. Share purchase agreements typically include representations and warranties that the company has disclosed all material compliance matters. A false representation is a ground for rescission of the investment and personal liability of the founders.

Practitioner note: The practical advice is straightforward: assume investors will see everything on the MCA portal and have access to all filed documents. Conduct your own review from the investor's perspective before they do.

Penalties under the Companies Act, 2013 vary by the specific provision violated. The main penalty categories relevant to startups are:

Late filing fees (Section 403) — administrative ₹100 per day per form for late filing, applicable to all forms where statutory deadlines are missed. There is no cap specified in Section 403, making extended delays expensive. These are payable to the government at the time of late filing.

Penalties for specific violations (Chapter-specific penalties) Annual return (Section 92): company fined ₹10,000 to ₹2,00,000; officer in default fined ₹10,000 to ₹50,000.

Financial statements (Section 137): company fined ₹3 lakh; officer in default fined ₹1 lakh. Continuing penalty of ₹25 per day per form after the first 30 days of default.

Statutory registers (Section 172): company ₹25,000 to ₹5,00,000; officer in default ₹10,000 to ₹1,00,000.

Director disqualification (Section 164(2)) Automatic disqualification of all directors if the company fails to file annual returns or financial statements for 3 consecutive years. Disqualified directors cannot be appointed to any board for 5 years.

Striking off (Section 248) MCA can initiate striking off for non-filing of annual returns for 2 or more consecutive years, which would end the company's legal existence.

Note on enforcement: For most startups, the practical enforcement mechanism is the late fee on filing (Section 403) — this is automatic and unavoidable. Full penalties (Section 92, 137, 172 etc.) are typically assessed only if the ROC specifically initiates proceedings. Director disqualification under Section 164(2) is enforced periodically by MCA. The safest approach is to avoid defaults altogether.

Legal reference: Section 92 — annual return; Section 137 — financial statements filing; Section 403 — late fees; Section 164(2) — director disqualification; Section 172 — penalty for management and administration chapter violations; Section 248 — striking off

The timeline for remediation depends on the number and type of gaps:

Simple remediation (2–3 missing annual filings, no cap table discrepancy, no NCLT route required): 3–6 weeks, assuming the CA/CS starts immediately and the company provides required information promptly.

Moderate remediation (4–6 years of gaps, some allotment forms missed, statutory registers needing reconstruction): 6–10 weeks.

Complex remediation (director disqualification involved, NCLT application required, multiple allotment discrepancies, major register reconstruction): 3–6 months.

What drives timeline:

MCA portal processing: Filing forms on the MCA portal is typically acknowledged within 2–5 business days for forms that go through Straight Through Processing (STP). Some forms require ROC review and approval, which can take 2–6 weeks.

Information gathering: The company must provide all relevant historical information (dates of meetings, share allotment details, director details) to the CA/CS. Incomplete information gathering is the most common cause of delay.

NCLT-route filings: If any gaps require an NCLT application (typically for very old filings or where the ROC has specifically acted), the NCLT process can take 3–6 months.

Practical timeline for fundraising: Start remediation at least 3 months before you plan to commence investor conversations. This gives sufficient time to complete remediation, obtain confirmation, and have a clean compliance record available when investors begin their diligence.

Yes, and for most startup compliance issues, a CA is the right professional to engage for the remediation process. Here is how the responsibilities are typically divided:

• Whaa CA handles in compliance rectification
• Conducting the compliance audit (identifying all gaps)
• Preparing and filing all overdue ROC forms (AOC-4, MGT-7, PAS-3, DIR-12, etc.) on the MCA portal
• Calculating and advising on late fees and penalties
• Preparing missing financial statements if audit completion is needed (with the statutory auditor)
• Advising on compounding of offences where applicable
• Coordinating with the company's existing statutory auditor for any audit-related remediation

What a Company Secretary additionally handles Some aspects of compliance rectification — particularly statutory register reconstruction, preparing board and shareholder resolutions, and ESOP compliance — are specifically within the domain of a Company Secretary (CS). For companies that have not yet engaged a CS (which is common for small private companies below certain thresholds where CS is not mandatory), a CA working with a CS or a firm that has both CA and CS professionals is ideal.

When you also need a lawyer If the compliance gaps involve share allotments that may be technically invalid (issued without required approvals), related-party transactions without proper approvals, or any matter where criminal liability is possible, a lawyer should be part of the remediation team alongside the CA.

Finding the right professional Look for a CA or CA firm that specifically has experience with startup compliance and MCA filings — not just a generic CA who primarily does income tax. Startup-focused firms are familiar with the specific forms, the investor diligence process, and the remediation pathways available.

Legal reference: The Institute of Chartered Accountants of India (ICAI) regulates CA practice; The Institute of Company Secretaries of India (ICSI) regulates CS practice; Section 2(24) and Schedule V of Companies Act — defines officers in default

The Companies Act, 2013 mandates the following registers for a private limited company:

• 1Register of Members — Form MGT-1 (Section 88)
• Thprimary register showing all current and past shareholders — name, address, number and class of shares held, date of allotment, date of any transfer. This is the definitive record of company ownership. Every share allotment (at incorporation, each funding round, ESOP exercise) must be entered here.

• 2Register of Debenture Holders / Beneficial Owners (Section 88)
• Applicablif the company has issued debentures (including convertible notes or debentures). Must record all current and past debenture holders.

• 3Register of Directors and Key Managerial Personnel — Form MBP-4 (Section 170)
• Listall current and past directors, the whole-time key managerial personnel (KMPs), date of appointment, date of cessation, DIN/PAN, address, and declaration of non-disqualification.

• 4Register of Directors' Shareholding — Part of MBP-4 or separate (Section 170(1)(b))
• Recordthe shareholding and interests of each director in the company and in any body corporate.

• 5Register of Contracts and Related Party Transactions — Form MBP-4 (Section 189)
• Recordall contracts or arrangements in which any director is interested, including details of the interest, value of the transaction, and whether board approval was obtained.

• 6Register of Employee Stock Options — Form SH-6 (Rule 12(2)(b), Companies (Share Capital and Debentures) Rules, 2014)
• Mandatorif the company has an ESOP scheme. Records all option grants, vesting schedules, exercises, and lapsations.

• 7Minutes Books — Board and General Meetings (Section 118)
• Separatbound volumes (or digital equivalent) for board meeting minutes and for general meeting minutes. Must be maintained permanently and are not discarded.

• 8Register of Investments Not Held in Company's Name (Section 187)
• Ithe company holds any investment in the name of a nominee — records that the investment is beneficially owned by the company.

• 9Register of Charges (Section 85)
• Recordall charges (mortgages, hypothecations, pledges) created on company assets in favour of any lender. This is maintained automatically on the MCA portal through CHG-1 filings, but an internal register should also be maintained.

Legal reference: Section 88 (Register of Members), Section 170 (Register of Directors), Section 189 (Register of related party contracts), Section 118 (Minutes), Rule 12(2)(b) Companies (Share Capital and Debentures) Rules 2014 (ESOP register — Form SH-6), Section 85 (Register of Charges)

Yes. The statutory register obligations under the Companies Act, 2013 apply to all companies — public or private, large or small, at every stage from inception.

There is no exemption from statutory register maintenance based on company size, age, or turnover. A one-year-old startup with 3 founders and no funding has the same register maintenance obligations as a 10-year-old company.

The common misconception: Many early-stage founders believe statutory registers are only relevant for listed companies or large companies. This is incorrect. The obligation arises from the company's status as a registered company under the Companies Act — not from its size or revenue.

• Wha"private company" exemptions exist (and what they don't cover):
• Privatcompanies do have some exemptions under the Companies Act (for example, private companies are exempt from certain provisions on public deposits, certain SEBI regulations, and some governance requirements). However, these exemptions do not extend to:
• Register of Members
• Register of Directors
• Minutes books (board and general meeting)
• Register of Employee Stock Options (if ESOP scheme exists)
• Related party transaction records

Why this matters practically: Even if the regulatory enforcement risk is low for a small startup, the investor diligence risk is very real. Investors treat missing statutory registers as a signal about management quality and the reliability of other company records.

Legal reference: Section 88(1) — applies to every company; Companies Act 2013 — private company exemption provisions in Section 462 notifications apply to specific provisions but not to core register maintenance obligations

Different registers have different update frequencies — some must be updated immediately on the occurrence of an event, others have a specified time window:

Register of Members (MGT-1) — update within 30 days of allotment or transfer Section 56(2) requires that after a share transfer, the entry in the Register of Members must be made within 30 days. For new allotments (Section 56 read with PAS-3), the register should be updated at the time of allotment.

Register of Directors (MBP-4) — update immediately on appointment or cessation Section 170(2) requires that any changes to the Register of Directors be entered within 30 days. In practice, the register should be updated at the same time as the DIR-12 filing to ROC, which must be done within 30 days of the change.

Register of Related Party Transactions (MBP-4 / Form MBP-1) — update on occurrence of each transaction Directors must disclose interests in transactions at the beginning of each financial year (or on first appointment) via Form MBP-1. The register must reflect each transaction as it occurs.

Minutes Books — update within 30 days of each meeting Section 118(1) requires that minutes of every board and general meeting be entered in the minute book within 30 days of the meeting. Minutes become final once signed by the chairperson of that meeting or the next meeting.

ESOP Register (SH-6) — update on each grant, vesting, exercise, and lapsation As each ESOP event occurs, the register must be updated.

Annual review: Beyond event-triggered updates, the registers should be reviewed at least annually — typically at the beginning of each financial year — to confirm all entries are current and complete.

Legal reference: Section 56(2) — 30 days for register of members update on transfer; Section 170(2) — 30 days for register of directors; Section 118(1) — 30 days for minutes

Yes. The Companies Act, 2013 explicitly permits electronic maintenance of statutory registers and records, subject to certain conditions.

The legal basis Section 120 of the Companies Act, 2013 permits any document, record, register, minute book, or other document required under the Act to be maintained in electronic form. The Companies (Management and Administration) Rules, 2014 (Rule 27) specify the requirements for electronic maintenance.

• Conditionfor electronic maintenance
• Thelectronic registers must:
• Be accessible at all times
• Be capable of producing copies or extracts in printed form
• Not be susceptible to being altered, falsified, or tampered with
• Carry a digital signature of the appropriate officer where the physical register would carry a signature

• Practicaformats used
• Mosstartups maintain their statutory registers in one of:
• Excel/Google Sheets (functional but carries data integrity risks — no version control, susceptible to accidental alteration)
• Dedicated startup compliance software (tools like Leegality, Vakilsearch compliance tools, or CA firm-maintained systems)
• Structured PDF documents (appropriate for minutes books — each set of minutes is a signed PDF document)

What "electronic" doesn't mean The electronic registers must have proper version control and authentication. A Google Sheet that anyone can edit without a log is not a compliant electronic register — it lacks the tamper-evident quality required. The most appropriate electronic format for statutory registers is a system where changes are logged, signed by an authorised officer, and backed up.

Physical register books Companies that maintain physical (paper) statutory registers are still compliant. Many CS practitioners prefer physical registers for their durability and the difficulty of alteration — there is no legal obligation to move to electronic format.

Legal reference: Section 120, Companies Act 2013 — electronic maintenance of records; Rule 27, Companies (Management and Administration) Rules 2014 — requirements for electronic form

Yes — statutory registers are a standard item in every investor due diligence checklist for Indian startups.

What investors specifically look for:

• Registeof Members:
• Does it match the cap table the company has provided?
• Is every allotment in the register supported by a corresponding board resolution, shareholder resolution (if required), and PAS-3 filing?
• Are all names and addresses accurate?

• Boarminutes books:
• Are minutes of all board meetings available from incorporation?
• Are quorum requirements met in every recorded meeting?
• Do the resolutions in the minutes match the actions the company has taken (e.g., is there a board resolution authorising every share allotment)?
• Are minutes signed by the chairperson?

• Registeof Directors:
• Does it reflect the actual history of director appointments and resignations?
• Are all DINs correct?

• ESOregister (if applicable):
• Does the ESOP register match the ESOP grant letters issued to employees?
• Are all exercises and lapsations recorded?

• Thinvestor's counsel specifically cross-references:
• PAS-3 filings on MCA → Register of Members → Board resolution authorising allotment → Shareholder resolution (if required) → Share certificate
• DIR-12 filings on MCA → Register of Directors → Board resolution appointing director

Any break in this chain of documentation is flagged as a due diligence finding.

Practitioner note: In our experience conducting due diligence support for startups, the Register of Members and board minutes books are the two most frequently found to be incomplete. These are also the two that take the most time to reconstruct — so starting their maintenance from day one of incorporation is strongly recommended.

Yes — statutory registers can be reconstructed if the underlying information is available from other sources. However, reconstruction must be accurate and reflect actual historical events only.

Sources for reconstruction:

• Fothe Register of Members:
• PAS-3 forms filed with MCA (available on mca.gov.in) — show each allotment date, number of shares, and allottees
• Share certificates (if paper copies were issued to shareholders)
• Bank statements (showing receipt of share application money)
• Cap table records maintained by the company

• Fothe Register of Directors:
• DIR-12 forms filed with MCA — show appointment and resignation dates
• Employment records and appointment letters
• Board resolutions authorising appointments

• FoMinutes Books:
• Email correspondence between directors (as evidence of when meetings occurred and what was discussed)
• Board pack documents prepared for each meeting
• Action items taken after meetings (as evidence of decisions made)

The legal constraint on reconstruction: Reconstruction must reflect what actually happened. Directors must review and confirm the reconstructed records. Signing off on reconstructed records that contain inaccuracies is a compliance violation. Where the reconstruction relies on estimates or approximations (e.g., approximate meeting date), this should be noted internally.

Reconstruction as remediation: Reconstructed statutory registers are presented to investors with an acknowledgement that they were prepared retrospectively based on source records, along with the CA/CS certification that the reconstruction reflects the actual historical events of the company. Most investors accept this approach when it is transparently disclosed.

The Companies Act, 2013 and its Rules prescribe specific forms for certain statutory registers. Companies must use these prescribed formats:

Register of Members — Form MGT-1 Prescribed by Rule 3 of the Companies (Management and Administration) Rules, 2014. The form specifies mandatory columns including: Ledger Folio (optional), Name and Address, Distinctive numbers of shares held, Date of entry in register, Date of cessation, and Remarks.

Register of Directors and KMP — Form MBP-4 Prescribed by Rule 17 of the Companies (Meetings of Board and its Powers) Rules, 2014. The form records each director's: DIN, name, address, nationality, date of appointment, date of cessation, and shareholding.

Register of Employee Stock Options — Form SH-6 Prescribed by Rule 12(2)(b) of the Companies (Share Capital and Debentures) Rules, 2014. This form records each option grant with the employee name, grant date, exercise price, vesting schedule, exercise date, and lapsation details.

• MinuteBooks — no prescribed form, but specific requirements
• Sectio118 does not prescribe a form but requires:
• Separate minute books for board meetings and general meetings
• Each set of minutes must be signed by the chairperson of that meeting or the next meeting
• Minutes once entered and signed are admissible as evidence and cannot be altered

For registers without prescribed forms: The Register of Contracts (Section 189) and Register of Investments (Section 187) do not have a specific prescribed MCA form — companies maintain them in their own format capturing the information required by the respective sections.

Where to find the prescribed forms: All prescribed forms are available on the MCA website (mca.gov.in) under the respective Rules. The Companies (Management and Administration) Rules, 2014 forms are most relevant for routine register formats.

Legal reference: Rule 3, Companies (Management and Administration) Rules 2014 — Form MGT-1; Rule 17, Companies (Meetings of Board and its Powers) Rules 2014 — Form MBP-4; Rule 12(2)(b), Companies (Share Capital and Debentures) Rules 2014 — Form SH-6; Section 118 — Minutes requirements

A Private Limited company in India must complete the following annual compliance cycle under the Companies Act, 2013, the Income Tax Act, and the GST Act:

COMPANIES ACT — ANNUAL COMPLIANCES

Annual General Meeting (AGM) Section 96 requires every company to hold an AGM within 6 months from the close of the financial year. For a March 31 FY-end company, the AGM must be held by September 30.

First AGM: must be held within 9 months from the first financial year end (i.e., by December 31 for a March FY company).

Financial Statements filing — AOC-4 Must be filed with the ROC within 30 days of the AGM. If AGM is September 30, AOC-4 is due by October 30.

Annual Return — MGT-7 or MGT-7A MGT-7A is a simplified form for One Person Companies and small companies; MGT-7 applies to all others. Due within 60 days of the AGM. If AGM is September 30, MGT-7 is due by November 29.

DIR-3 KYC (Director KYC) Every director who has been allotted a DIN must file DIR-3 KYC by September 30 each year. Filing after September 30 requires a ₹5,000 fee to reactivate the DIN.

INCOME TAX — ANNUAL COMPLIANCES

Income Tax Return (ITR) For companies: ITR is due by October 31 (if a tax audit under Section 44AB is required). For companies not subject to tax audit, the due date is July 31. Most companies above the tax audit threshold (₹1 crore for business income) file by October 31.

Tax Audit Report (Form 3CA/3CD) Required when a company's annual turnover or gross receipts exceed ₹1 crore (or ₹10 crore for digitally intensive businesses). Auditor must submit by September 30.

GST — ANNUAL COMPLIANCES

GSTR-9 (Annual GST Return) For businesses registered under GST. Due by December 31 for the preceding financial year (i.e., for FY 2023-24, due December 31, 2024).

Other recurring compliances not annual-specific: Board meetings (at least 4 per year), TDS payments (monthly), GST monthly/quarterly returns — see other answers for details.

Legal reference: Section 96 — AGM; Section 137 — AOC-4; Section 92 — MGT-7; Rule 12A, Companies (Appointment and Qualification of Directors) Rules 2014 — DIR-3 KYC; Section 139AA and 44AB — Income Tax Act; Section 44 — CGST Act (GSTR-9)

The Companies Act, 2013 prescribes both the minimum frequency and the maximum gap between consecutive board meetings:

Minimum frequency: 4 board meetings per financial year Section 173(1) requires that every company hold a minimum of 4 board meetings in a financial year.

Maximum gap: 120 days between consecutive meetings No two consecutive board meetings can be more than 120 days apart. This means you cannot hold 4 meetings all in the same month — they must be spread throughout the year with at most a 120-day gap between any two consecutive meetings.

• Typicacompliant board meeting schedule for a March FY company:
• Meeting 1: April–May (first quarter of new FY)
• Meeting 2: July–August (second quarter)
• Meeting 3: September–October (AGM period)
• Meeting 4: December–January (third quarter)

Notice requirement Section 173(3) requires that a notice of a board meeting be sent to every director at least 7 days before the meeting. Notice can be given by hand delivery, post, or electronic means (email, if email is provided and consented to).

Video conferencing Section 173(2) permits directors to participate in board meetings via video conference or audio-visual means, subject to the Companies (Meetings of Board and its Powers) Rules, 2014. Participation via video conference is counted for quorum purposes.

Quorum Section 174(1): the quorum for a board meeting is the higher of: one-third of total directors, or 2 directors, whichever is higher. For a 3-director board: quorum is 2.

Penalty for non-compliance Section 173(4): every officer in default is liable to a fine of ₹25,000 for each failure. In practice, this is enforced through the diligence process rather than regulatory action against most private companies.

Legal reference: Section 173(1) — minimum 4 meetings per year; Section 173(2) — video conferencing permitted; Section 173(3) — 7-day notice; Section 174 — quorum; Section 173(4) — penalty for non-compliance

Both AOC-4 (financial statements) and MGT-7/MGT-7A (annual return) are due after the Annual General Meeting (AGM). Their due dates are therefore dependent on when the AGM is held:

AOC-4 — Filing of Financial Statements Due: within 30 days from the date of the AGM.

For a company that holds its AGM on September 30 (the last permissible date for a March FY company): AOC-4 is due by October 30.

If the AGM is held earlier (say August 31), AOC-4 is due by September 30.

• WhaAOC-4 contains:
• Balance sheet
• Profit and loss account
• Cash flow statement
• Notes to accounts
• Auditor's report
• Board's report

The accounts must be audited before filing — the auditor's signed report is a mandatory attachment.

MGT-7 / MGT-7A — Annual Return Due: within 60 days from the date of the AGM.

For a September 30 AGM: MGT-7 is due by November 29.

MGT-7A (the simplified form) is available only for OPCs (One Person Companies) and small companies. For all other private limited companies, MGT-7 is the applicable form.

• WhaMGT-7 contains:
• Registered office, principal business activities, and company details
• Details of shares and debentures
• Complete list of shareholders with their shareholding (for each category of shares)
• Details of promoters, directors, and KMPs
• Details of meetings held
• Remuneration details for directors and KMP
• Certifications (for larger companies, a CS must certify the annual return)

Late filing fees (Section 403): ₹100 per day of delay beyond the respective due dates for both forms.

Legal reference: Section 137 — filing of financial statements (AOC-4); Section 92 — annual return (MGT-7/MGT-7A); Section 403 — late fees; Rule 11, Companies (Management and Administration) Rules 2014 — MGT-7 format

Due date: September 30 every year

Every individual who holds a Director Identification Number (DIN) — whether or not they are currently a director of any company — must file DIR-3 KYC by September 30 each year. The requirement applies to all DIN holders, including those who have resigned from directorships but still hold a DIN.

First-time KYC vs. annual KYC First-time DIR-3 KYC: must be filed after a DIN is allotted for the first time. Submitted with all personal documents (PAN, Aadhar, mobile, email) for verification.

Annual DIR-3 KYC-WEB: from the second year onwards, directors who have no changes in their personal details can file an annual web-based confirmation (DIR-3 KYC-WEB) through the MCA portal — a simpler process than the initial filing.

If personal details have changed (address, mobile, email), a fresh DIR-3 KYC (not the web form) must be filed.

• Whahappens if DIR-3 KYC is missed
• IDIR-3 KYC is not filed by September 30:
• The director's DIN is automatically deactivated (marked as "Deactivated" on the MCA system)
• The director cannot participate in any company's filings until the DIN is reactivated
• The company cannot process any filing that requires the director's DIN — including annual returns, event-based filings, and allotment forms
• Reactivation requires filing DIR-3 KYC with a late fee of ₹5,000

Why this matters for startups If a director's DIN is deactivated and the company needs to file an allotment form (PAS-3) before a funding round closes, the filing will be rejected. This can delay or block a funding round close. Ensuring all directors' KYC is current is a basic diligence step before any transaction.

Legal reference: Rule 12A, Companies (Appointment and Qualification of Directors) Rules, 2014 — DIR-3 KYC; MCA notification specifying ₹5,000 late fee for DIR-3 KYC reactivation

The GST return obligations depend on the company's registration status, annual turnover, and whether they are on the regular scheme or the Quarterly Return Monthly Payment (QRMP) scheme.

GSTR-1 — Outward Supply Details (Sales) Regular taxpayers (turnover > ₹5 crore): monthly, due by the 11th of the following month. QRMP scheme (turnover ≤ ₹5 crore): quarterly, due by the 13th of the month following the quarter.

GSTR-3B — Monthly Summary Return and Tax Payment Regular taxpayers: monthly, due by the 20th of the following month. QRMP scheme: quarterly return with monthly payment; the quarterly form is due by the 22nd or 24th (varies by state); monthly tax payments under IFF (Invoice Furnishing Facility) are due by the 13th of the following month.

GSTR-9 — Annual Return Due by December 31 of the following financial year (e.g., GSTR-9 for FY 2023-24 is due by December 31, 2024). For businesses with annual turnover up to ₹2 crore, GSTR-9 filing is optional (not mandatory).

For pre-revenue startups If a startup is GST-registered but has no taxable supplies (no revenue, only purchases), it must still file NIL GSTR-1 and GSTR-3B returns on time. Failure to file — even a NIL return — attracts a late fee.

When does a startup need GST registration? GST registration is mandatory when: aggregate annual turnover exceeds ₹20 lakh (₹10 lakh for specified special category states), or the business makes inter-state supplies, or the business provides certain categories of services regardless of turnover (e-commerce operators, certain online services, etc.). Voluntary registration is also permissible.

Late fees for GST non-filing GSTR-1 and GSTR-3B: ₹50 per day (₹25 CGST + ₹25 SGST). For NIL returns: ₹20 per day (₹10 CGST + ₹10 SGST). Interest on late GST payment: 18% per annum on the tax outstanding.

Legal reference: Section 37 — GSTR-1; Section 39 — GSTR-3B; Section 44 — GSTR-9; CGST Act 2017; QRMP scheme notification; Section 47 — late fee; Section 50 — interest on delayed payment

TDS (Tax Deducted at Source) obligations apply to most payments a company makes to vendors, employees, professionals, and others above prescribed thresholds. The key TDS deadlines for startups:

TDS payment deadline TDS deducted in any month must be deposited to the government by the 7th of the following month. Exception: TDS deducted in March must be deposited by April 30.

If the 7th falls on a Sunday or public holiday, the payment is due on the next working day.

Quarterly TDS return deadlines TDS deductors must file quarterly TDS returns (Form 24Q for salary, Form 26Q for non-salary payments to residents, Form 27Q for non-residents):

• CommoTDS obligations for startups
• Salary payments to employees: TDS under Section 192 (at applicable slab rates)
• Professional fees to CA, lawyers, consultants above ₹30,000 per year: TDS at 10% under Section 194J
• Rent payments above ₹2,40,000 per year: TDS at 10% under Section 194-I
• Contractor/service payments above ₹30,000 per occasion or ₹1,00,000 per year: TDS at 1-2% under Section 194C
• ESOP perquisite at exercise: TDS under Section 192 (or deferred for DPIIT-recognised startups under Section 192(1C))

Late payment interest and penalty Interest: 1% per month (or part thereof) on TDS not paid by the 7th. Late filing penalty: ₹200 per day under Section 234E, up to the amount of TDS. Penalty for non-deduction: 100% of the tax not deducted, under Section 271C.

Legal reference: Section 192 — TDS on salary; Section 194C — TDS on contractor payments; Section 194J — TDS on professional fees; Section 194-I — TDS on rent; Section 200A — processing of TDS returns; Section 234E — late fee for TDS return; Section 271C — penalty for non-deduction; Section 192(1C) — DPIIT startup ESOP TDS deferral

The consequences of missing a filing deadline depend on which filing is missed and how long the delay lasts:

Immediate financial consequences Late fees under Section 403 of the Companies Act accumulate from the due date. At ₹100 per day per form, a 6-month delay on both AOC-4 and MGT-7 costs ₹18,000 + ₹18,000 = ₹36,000 in late fees alone, not counting any penalties.

For GST: late fees of ₹50 per day (NIL returns: ₹20 per day) plus interest at 18% on any outstanding tax.

For TDS: interest at 1% per month on the outstanding amount plus late return fee of ₹200 per day.

• Legaconsequences (Company and Directors)
• Forepeated failure to file annual returns and financial statements over 3 consecutive years:
• Section 164(2): automatic director disqualification — directors cannot serve on any board for 5 years
• Section 248: company may be struck off by the MCA

• FoTDS non-compliance:
• Section 271C: penalty equal to 100% of the tax not deducted
• Section 276B: prosecution (in serious cases) for failure to pay TDS

• Operationaconsequences
• DIN deactivation (if DIR-3 KYC missed): company cannot make any MCA filing until the DIN is reactivated with ₹5,000 fee
• GST registration cancellation: repeated non-filing can lead to the GST officer initiating cancellation
• Banking consequences: some banks request current compliance certificates before processing large transactions

Investment consequences Any outstanding penalties and late fees at the time of an investment are disclosed in due diligence and either must be paid before close, or the investor may require a price adjustment or escrow to cover the outstanding liability.

A compliance calendar is a structured schedule of all statutory due dates applicable to your company throughout the year. Here is how to build one:

• Ste1: Identify all applicable laws
• Fomost Indian private limited startups, the applicable laws are:
• Companies Act, 2013 (ROC filings, board meetings, registers)
• Income Tax Act, 1961 (ITR, advance tax, TDS)
• CGST/IGST Act (GST returns, if GST-registered)
• Profession Tax Act (if applicable in your state)
• Shops and Establishment Act (if applicable)
• PF and ESI (if applicable based on employee count)

Step 2: Map all due dates to a calendar For each law, list every recurring obligation and its due date. A sample structure for a March FY company:

*Monthly recurring*: TDS payment (7th of every month), GST return GSTR-3B (20th of every month for regular taxpayers)

*Quarterly*: Quarterly TDS returns (July 31, October 31, January 31, May 31), Board meeting (at least one per quarter)

*Annual*: AGM (by September 30), AOC-4 (within 30 days of AGM), MGT-7 (within 60 days of AGM), DIR-3 KYC (September 30), GSTR-9 (December 31), ITR (October 31 for tax audit cases), Advance tax installments (June 15, September 15, December 15, March 15)

Step 3: Assign responsibility Each item on the calendar should have a named responsible person — CA (for tax filings), CS (for ROC filings), internal finance team (for TDS payments). Without a named owner, items get missed.

Step 4: Build in lead time For every due date, add a "prepare by" date 2 weeks earlier. Filings should not be attempted on the due date — technical issues with MCA portal, auditor scheduling, and document preparation time all require buffer.

Step 5: Automate reminders Set Google Calendar or email reminders for every item. Many CA firms that provide annual compliance support also provide reminder services.

A startup should maintain the following categories of documents from day one of incorporation:

• Categor1 — Incorporation and formation
• Certificate of Incorporation (with CIN)
• Memorandum of Association (MoA) — original and all amended versions
• Articles of Association (AoA) — original and all amended versions
• Company PAN card
• DINs of all directors
• GST registration certificate
• All other licences and registrations (Shops & Establishment, PF/ESI, sector-specific licences)

• Categor2 — Corporate governance records
• Board meeting minutes (from incorporation to present)
• General meeting minutes (AGM and EGM minutes from incorporation)
• All resolutions passed (board and shareholder)
• Statutory registers (Register of Members, Register of Directors, etc.)

• Categor3 — Capital structure
• Complete cap table with full history
• Every share allotment document:
• Board resolution authorising allotment
• Shareholder resolution (if required)
• PAS-3 filing confirmation
• Share certificates issued
• Shareholder agreement for each investor
• Any convertible note or SAFE agreements
• ESOP scheme document, all grant letters, ESOP register

• Categor4 — Financial records
• Audited financial statements for all completed financial years
• Income tax returns for all completed years
• GST returns (last 3 years at minimum)
• Bank statements (last 2 years at minimum)
• Management accounts for current year

• Categor5 — Employment and HR
• Employment agreements for all current senior employees
• Offer letters for all current employees
• ESOP grant letters
• Confidentiality and non-disclosure agreements

• Categor6 — Intellectual property
• IP assignment agreements from all founders (pre-company period work)
• IP assignment agreements from all current and past technical employees
• Patent applications and grants
• Trademark registrations
• Domains and software licences

• Categor7 — Commercial contracts
• Material customer contracts
• Material vendor contracts
• Partnership and distribution agreements
• Any government contracts or licences

• Categor8 — Regulatory and compliance
• DPIIT recognition certificate
• Any regulatory correspondence or notices
• Compliance audit reports

A due diligence data room is a secure, organised digital repository of all company documents that is shared with investors and their advisors during the due diligence process. It is the structured version of the corporate document folder, prepared for external review.

What a data room is For early-stage startups (pre-seed, seed, early Series A), a data room is typically a Google Drive or Dropbox folder with controlled sharing (view-only access, no download permissions if desired, sharing only with named individuals). For Series A and beyond, companies often use dedicated data room tools (DocSend, Intralinks, Datasite, or Ideals) that provide access logging, document-level tracking, and NDA management.

How to structure the data room

A standard data room folder structure for an early-stage Indian startup — seven top-level folders:

• Corporate — Incorporation certificate, MoA and AoA, board resolutions, shareholder resolutions, minutes books
• Cap Table — Current fully-diluted cap table, all share allotment documents (PAS-3 copies, board resolutions), shareholder agreements, ESOP documents
• Financials — Audited financial statements by year, income tax returns, management accounts for current year, last 12 months of bank statements
• Compliance — ROC filing confirmations (MCA acknowledgements), DPIIT recognition certificate, all licences and registrations
• HR and Employment — Offer letter templates, signed employment agreements for all current senior employees, ESOP grant letters
• Intellectual Property — IP assignment agreements from founders and key technical employees, patent applications and grants, trademark registrations
• Commercial Contracts — Material customer contracts, material vendor contracts, any partnership or exclusivity agreements

Data room index Always provide a data room index — a one-page document listing every folder and its contents. Investors appreciate an organised index because it lets them confirm that all expected documents are present.

Timing The data room should be ready and populated before you send the term sheet for review. Receiving a term sheet and then taking 3 weeks to compile the data room signals poor organisation.

The documents investors specifically request before committing to a transaction fall into two phases: documents needed before the term sheet (for preliminary assessment) and documents needed for full due diligence (after term sheet).

• Beforthe term sheet (pitch stage)
• Company presentation or pitch deck
• Last 2 years of audited financial statements (or management accounts if recent audit not yet complete)
• Current cap table (fully diluted, with investor names, share counts, percentages, ESOP pool)
• Brief description of any material contracts, licences, or regulatory status

After the term sheet (full due diligence) This is the complete data room — all categories listed in the "What documents should a startup maintain?" answer above.

Documents that specifically require lead time to prepare Several documents cannot be retrieved instantly and require advance preparation:

• Audited financial statements: if the last audit is not complete, engaging the auditor and completing the audit for the most recent year takes 4–8 weeks minimum
• ESOP documentation: if the ESOP scheme was not properly documented or the register is incomplete, reconstruction takes 2–4 weeks
• IP assignment agreements: if founders have never signed formal IP assignments, collecting signatures (especially from founders who have left) can be complex
• Compliance gap remediation: filing missing ROC forms with late fees takes 3–6 weeks (including MCA processing time)

• Thdocuments most commonly missing at fundraise time
• IP assignment agreements from technical co-founders (often never signed at incorporation)
• Employment agreements for early team members (often only verbal or email-based)
• ESOP grant letters (scheme approved but individual letters never issued)
• PAS-3 filings for early allotments (often missed in the initial incorporation haste)
• Founders' vesting agreement (often not documented even when verbally agreed)

Practitioner note: Start compiling the data room at least 2 months before you plan to begin investor conversations. Investors form a significant part of their impression of management quality from how the data room is organised, how quickly documents are provided, and how complete the records are.

Corporate documents should be organised with two purposes in mind: day-to-day management use (finding a specific document quickly) and investor due diligence access (presenting documents in a format investors expect).

The folder structure principle: by legal entity and by category Every document belongs to a specific company (critical once you have a group structure) and to a specific category of document type. The folder structure should reflect both dimensions.

Naming conventions Consistent file naming significantly reduces time spent searching. A recommended format:

YYYYMMDD_DocumentType_Description_Version.pdf

• Examples:
• 20230315_BoardResolution_ESOPSchemeApproval.pdf
• 20230601_ShareCertificate_InvestorABC_1000shares.pdf
• 20240331_FinancialStatements_AuditedFY2324.pdf

Version control For documents that are amended (MoA/AoA, shareholder agreements), maintain all versions clearly labelled by date. Never delete old versions — they are legally relevant records of what the company agreed to at different points in time.

• Physicavs digital
• Thmost practical approach for startups: maintain a master set in digital form (Google Drive or similar, with folder-level permissions) and keep physical originals of key documents that have original signatures:
• Original Certificate of Incorporation
• Original share certificates
• Original signed shareholder agreements
• Original stamped documents

The MCA portal provides downloadable copies of all filed documents — these are official certified copies and can supplement the company's own records.

• Accescontrols
• Thcorporate document folder should not be freely accessible to all employees. Recommended access levels:
• Full access: CEO, CFO/finance lead, legal counsel
• Finance section access: auditor, CA
• Compliance section access: Company Secretary
• No access: general employees

Legal due diligence is the investor's systematic review of the company's legal structure, contracts, liabilities, and compliance. It is conducted by the investor's legal counsel — typically a law firm. Here is how to prepare:

Before due diligence begins

Ensure cap table accuracy: The cap table you present to investors must exactly match the MCA records (PAS-3 filings, Register of Members). Any discrepancy between your represented cap table and the MCA records is a material finding. Cross-check before sharing.

Complete all resolutions: Every significant corporate action (share allotment, director appointment, ESOP scheme, amendment to AoA) must have a corresponding resolution. Where resolutions are missing, prepare ratification resolutions and disclose this to the investor.

Prepare a litigation disclosure: List any pending litigation, arbitration, regulatory notices, or disputes — however minor. Investors expect to be informed of all disputes. Failing to disclose something that the investor's counsel subsequently discovers is a representation breach and can be used to rescind the deal.

Compile all material contracts: Identify all material contracts (typically: any contract with annual value above a threshold you set with your lawyer, any contract with change-of-control provisions, any contract with exclusivity or non-compete provisions). Provide a summary and the full contracts.

During due diligence

Respond to requests promptly: The investor's counsel will send a due diligence request list. Respond to every item — even if the answer is "this document does not exist" or "this was not done" (with an explanation). Silence or delay is interpreted negatively.

Proactively disclose known issues: If you know of a compliance gap before the investor's counsel finds it, disclose it proactively and explain what you have done or are doing about it. Proactive disclosure almost always leads to better outcomes than reactive disclosure.

Prepare a disclosure letter: A disclosure letter is a formal document (often required by the investor's counsel) where the company discloses all exceptions to the representations and warranties in the share purchase agreement. The data room and the due diligence responses form the basis of this disclosure letter.

Many corporate documents that were never prepared or have been lost can be recreated or reconstructed. The approach depends on the type of document:

Documents that can be recreated Statutory registers: If the underlying data is available from PAS-3 filings, share certificates, DIR-12 filings, and board resolution records, the registers can be reconstructed. The reconstruction must accurately reflect the historical record.

Minutes of board and general meetings: If there is contemporaneous evidence that meetings occurred (email chains, board packs, action items from that period), minutes can be prepared based on that record with the directors' confirmation of accuracy. These minutes should be identified as retrospectively prepared.

Employment agreements: Standard terms can be prepared and signed — even for long-term employees who never had formal agreements. Both parties sign to formalise the arrangement going forward.

IP assignment agreements: If an employee is still with the company, the assignment agreement can be signed now. If they have left, the company must contact them and request a signature — most former employees will sign, though some may require a nominal payment. If the former employee is unreachable or refuses, this is disclosed to the investor as an IP risk.

Documents that cannot be retroactively created Board resolutions for decisions that were never actually made: A resolution cannot be created for a decision that the board never made. If an ESOP scheme was never actually approved by the board, a retroactive resolution approving it would be a falsification — it must instead be a fresh resolution approving it now (with disclosure that it was not previously approved).

Tax returns: Past income tax returns and GST returns must be filed for the relevant periods — they cannot be "recreated" for past periods other than through the actual filing mechanism with the relevant department.

Share certificates for allotments that are now disputed: If an allotment is challenged for invalidity, recreating the certificate does not resolve the underlying legal issue.

The disclosure obligation Whenever a document has been retrospectively prepared or reconstructed, this must be disclosed to investors. Presenting reconstructed documents without disclosure — as if they were prepared at the time they purport to be dated — is a misrepresentation.

Digitising company records improves accessibility, supports remote due diligence, and protects against physical document loss. Here is a practical approach:

Step 1: Identify all physical documents Collect all physical documents from their current locations — founder's homes, office filing cabinets, past CA/CS firms, bank lockers. Common locations that are overlooked: the original CS firm that handled incorporation (many original filings were done by service firms who hold the physical records), the statutory auditor's files, and former co-founders.

• Ste2: Create a scanning priority list
• Noall documents need to be scanned immediately. Prioritise:
• Certificate of Incorporation (scan and store multiple digital copies)
• MoA and AoA
• All signed shareholder agreements
• All share certificates issued
• Original signed board and general meeting minutes
• All tax returns with acknowledgement receipts

Step 3: Scan to PDF/A format PDF/A is the archival format recommended for long-term document preservation. Use a scanner (not a phone camera where quality is insufficient for legal documents). Ensure the scan captures any stamps or seals on physical documents.

Step 4: Verify against MCA portal records For every physical document that corresponds to an MCA filing, download the corresponding filed version from the MCA portal and compare. In case of any discrepancy between the physical document and the filed version, note and investigate the discrepancy.

Step 5: Organise in a structured digital folder Follow the folder structure described in "How should corporate documents be organised?" — consistent naming, version control, and access permissions.

Step 6: Backup Maintain at least two backup copies in separate locations — the primary digital folder (Google Drive/Dropbox), plus a separate backup (external hard drive or secondary cloud storage). Physical originals of key documents (Certificate of Incorporation, original signed SHA, stamped documents) should also be retained in a secure physical location.

Step 7: Physical originals Original documents with stamps, seals, or wet ink signatures may be required for certain legal purposes (court proceedings, transfer of property). Do not destroy physical originals simply because you have a digital copy. Retain both.