Keep a clean compliance spine

Compliance is not a pile of forms. It is a calendar of promises to customers, employees, owners, government, regulators, lenders, vendors, and the public.

As of 8 August 2026, this chapter is a source-directed map. It does not tell you that a rule applies. It tells you how to find out, assign responsibility, and keep proof. The exact answer depends on entity, turnover, supply type, customer location, state, employees, contractors, funding, foreign exchange, sector, data, product claims, and business model.

The founder remains accountable even when an adviser prepares the filing.

Build one register

Use a living compliance register with these columns:

Official/ Trigger/ profes

Record “not applicable” only with reasoning and a review trigger. Silence is not a conclusion. “The CA handles it” is not a control unless the register shows what the CA handles, when, with what evidence, and who reviewed it.

Entity and governance

Track incorporation or registration records, registered office, partner/shareholder approvals, board or founder decisions, statutory registers, beneficial ownership or similar disclosures where applicable, cap table, vesting, ESOPs, share transfers, minutes, related-party transactions, loans, guarantees, and authority limits.

The risk is not only missing a form. It is making decisions the company cannot later prove were authorised.

Tax and accounting

Map PAN, TAN, GST, invoicing, books, bank reconciliation, expense evidence, income-tax filing, withholding/ TDS, GST returns/payments if applicable, payroll/statutory deductions, tax or statutory audit triggers, foreign receipts, transfer pricing, FEMA or cross-border issues where relevant.

GST is not one universal turnover sentence. Supply type, aggregate turnover, state, e-commerce, exports, reverse charge, special categories, and compulsory-registration rules can matter. The official CBIC/GST registration rules page and GST portal should be checked with an adviser before deciding that registration is or is not required.

Protected money is not float. Tax, payroll, GST, TDS, statutory dues, refundable deposits, and customer- purpose funds must be separated in the cash review.

People

Map offer letters, employment agreements, contractor agreements, wage and leave obligations, state establishment requirements, provident fund, employee state insurance, professional tax, gratuity, bonus, shops and establishment obligations, workplace safety, prevention of sexual harassment requirements, confidentiality, IP assignment, access control, devices, and offboarding.

Worker classification follows reality, not the heading on a document. A contractor treated like an employee can create legal, tax, payroll, and trust problems. Ask a labour/payroll specialist to document the basis for classification and the trigger that changes it.

Customer, product, data, and technology

Track truthful marketing, consumer commitments, master agreements, statements of work, service levels, warranties, refund/termination terms, liability, dispute process, open-source obligations, code/content ownership, data inventory, lawful purpose, notices/permissions, minimisation, access, retention, deletion, vendor controls, incident response, backups, monitoring, and security review. If the product touches finance, health, education, employment, payments, children, encryption, cross-border transfer, or consequential automated decisions, slow down. Use qualified counsel and domain specialists. Do not paste customer data into third-party AI systems without authority, contract review, and safeguards.

For data-protection posture, use the Ministry of Electronics and Information Technology’s data-protection framework resources as a starting point and confirm current commencement, rules, sector obligations, and applicability with counsel.

Securities, investment, and fraud exposure

Do not give individualized securities advice unless lawfully authorised. Do not hold yourself out as an investment adviser casually. SEBI’s official investor pages warn against assured high returns, unregistered investments, unlicensed sellers, opaque disclosures, difficulty receiving payments, advisers trading for clients, and advisers handling client cash or securities. Use SEBI’s Caution to Investor and scam-awareness pages as standing references.

Any offer promising high, assured, urgent, or unusually consistent returns deserves verification before conversation becomes transfer.

Continuity and proof

Compliance without evidence is memory. Keep copies of filings, challans, acknowledgements, contracts, advice emails, board/founder approvals, invoices, bank records, payroll records, security reviews, data maps, licences, insurance policies, nominations, and incident logs. Use least-privilege access and ensure the company can function if one device, password holder, accountant, or founder is unavailable.

The professional circle

Build a verified bench:

• • chartered accountant for accounts and tax;
• • company secretary for corporate/secretarial matters where relevant;
• • lawyer for contracts, employment, IP, disputes, data, and sector questions;
• • payroll/labour specialist;
• • security/privacy specialist;
• • insurance adviser or broker with disclosed incentives;
• • SEBI-registered investment adviser where individualized securities advice is required.

Check credentials, scope, fees, conflicts, data handling, who performs the work, and what written output you receive. Pay for real review. Free advice from a confident person can become the most expensive document you never had.

· GE ch. 38 · Official sources checked 8 Aug. 2026: CBIC/GST, Income Tax, Ministry of Labour, MCA, MeitY, SEBI, Udyam. Compliance content is a dated decision map; no volatile thresholds are reproduced.