General Counsel Handbook: India Compliance for Foreign Companies

Why General Counsel Need an India-Specific Compliance Framework

India's regulatory environment is among the most layered and dynamic in Asia. Foreign companies operating through wholly owned subsidiaries, branch offices, or liaison offices must comply with overlapping requirements from at least six regulatory bodies: the Ministry of Corporate Affairs (MCA), Reserve Bank of India (RBI), Income Tax Department, Goods and Services Tax Network (GSTN), state labour authorities, and increasingly, the Data Protection Board of India.

The financial year 2025-26 has introduced substantial changes across corporate compliance norms, driven by digitization, regulatory tightening, and India's push toward global competitiveness. For general counsel sitting in New York, London, or Singapore, the challenge is not just understanding these requirements but building systems that ensure consistent compliance across Indian operations.

This handbook provides a structured, actionable reference organized by regulatory body and compliance category.

MCA Compliance: Companies Act, 2013

Entity Registration and Ongoing Filings

Every company incorporated in India under the Companies Act, 2013, must maintain its registration with the Registrar of Companies (ROC). Foreign companies that establish a place of business in India must also register using e-Form FC-1 within 30 days of establishment.

Key ongoing MCA filings for a private limited company (the most common structure for foreign subsidiaries) include:

Board Meeting Requirements

A private limited company must hold at least four board meetings per year, with no more than 120 days between consecutive meetings. At least one meeting per year must be conducted with directors physically present (not via video conference). One-Person Companies (OPCs) and small companies may hold only two meetings per year.

For companies with foreign directors, participation via video conference is permitted for most agenda items, but certain matters (such as approval of financial statements and board reports) require physical presence unless exempted.

Annual General Meeting

The AGM must be held within six months of the financial year end, meaning by September 30 for companies following the standard April-March financial year. The first AGM of a newly incorporated company must be held within nine months from the close of its first financial year.

RBI and FEMA Compliance

Investment Reporting

Foreign investment reporting is one of the most critical compliance obligations. Key filings include:

• FC-GPR (Foreign Currency-Gross Provisional Return): Must be filed within 30 days of allotment of shares to a non-resident investor. Late filing attracts compounding fees.
• FLA Return (Foreign Liabilities and Assets): Annual return due by July 15, reporting all foreign investment in the Indian entity and overseas investments by the Indian entity.
• Annual Return on Foreign Assets and Liabilities: Separate from FLA, this is a census requirement for companies with foreign equity.

The RBI's FIRMS (Foreign Investment Reporting and Management System) portal handles all investment-related filings electronically. General counsel should ensure that the Indian subsidiary's company secretary has authorized access to this portal.

ECB and Trade Credit Compliance

If the Indian entity borrows from its foreign parent or other overseas entities, External Commercial Borrowing (ECB) regulations under FEMA apply. Key requirements include:

• Borrowing limit: under the Foreign Exchange Management (Borrowing and Lending) (First Amendment) Regulations, 2026 (effective 16 February 2026), an eligible borrower may raise ECB up to the higher of USD 1 billion or 300% of net worth. The earlier all-in-cost ceiling (benchmark rate plus 500 basis points) has been removed, with pricing now driven by prevailing market conditions
• Minimum average maturity period (generally 3 years, with relaxations for the manufacturing sector)
• End-use restrictions (ECBs cannot be used for real estate, capital market investments, or on-lending)
• Monthly reporting via ECB-2 form on the RBI's FIRMS portal

FEMA Contraventions and Compounding

Non-compliance with FEMA can result in penalties up to three times the amount involved. The RBI offers a compounding mechanism where contraventions can be regularized by paying a compounding fee, which is significantly less than the maximum penalty. General counsel should establish a quarterly FEMA compliance review to catch and compound violations before they escalate.

Tax Compliance Framework

Corporate Income Tax

Foreign subsidiaries in India are taxed as domestic companies if incorporated under the Companies Act. The effective corporate tax rate for domestic companies is:

Most foreign subsidiaries opt for the Section 115BAA regime at 25.168% effective rate, though this requires foregoing certain deductions and exemptions. The Section 115BAB 15% rate is unavailable to newly incorporated companies because that regime required manufacturing to commence on or before 31 March 2024.

Transfer Pricing

Transfer pricing is one of the highest-risk areas for foreign-owned Indian companies. All transactions between the Indian subsidiary and its associated enterprises (defined under Section 92A, which includes the parent company) must be at arm's length. Key compliance requirements include:

• TP documentation: Maintain contemporaneous documentation (Form 3CEB) to be filed by the due date of the tax return
• Master file (Form 3CEAA): Required where consolidated group revenue exceeds INR 500 crore and the aggregate value of international transactions exceeds INR 50 crore (or INR 10 crore for intangible-property transactions). The master file must be filed by the due date
• CbCR (Form 3CEAD): Applies only where consolidated group revenue exceeds INR 6,400 crore (aligned with the OECD EUR 750 million threshold); generally filed by the parent entity in its home jurisdiction
• APA (Advance Pricing Agreement): Consider applying for a bilateral APA to reduce audit risk for high-value intercompany transactions

For detailed guidance, see our transfer pricing guide for foreign subsidiaries.

Withholding Tax (TDS)

The Indian subsidiary must deduct tax at source on virtually all payments, including salaries, rent, professional fees, and payments to non-residents. For payments to the foreign parent, Section 195 applies, requiring TDS on any payment chargeable to tax in India. Key forms include:

• Form 26Q: Quarterly TDS return for non-salary payments
• Form 24Q: Quarterly TDS return for salary payments
• Form 15CA/15CB: Required for every outward remittance to a non-resident

GST Compliance

If the Indian entity provides goods or services, GST registration is mandatory. Key compliance obligations include:

• Monthly GSTR-3B filing (due by the 20th of the following month)
• Monthly GSTR-1 filing for outward supplies (due by the 11th of the following month)
• Annual GSTR-9 return and GSTR-9C reconciliation statement
• E-invoicing mandatory for turnover exceeding INR 5 crore (threshold effective April 2025)

Note that from July 2025, GSTR-3B returns cannot be edited after filing, increasing the need for accuracy in monthly filings.

Labour Law Compliance

New Labour Code Framework

India has consolidated 29 central labour laws into four new codes, effective from November 2025:

1. Code on Wages, 2019: Covers minimum wages, payment of wages, bonus, and equal remuneration
2. Industrial Relations Code, 2020: Covers trade unions, standing orders, and industrial disputes
3. Social Security Code, 2020: Covers EPF, ESI, gratuity, maternity benefits, and social security for gig workers
4. Occupational Safety, Health and Working Conditions Code, 2020: Covers workplace safety, working hours, and conditions of employment

Key Statutory Contributions

The EPF contribution ceiling is calculated on basic wages. Where basic wages exceed INR 15,000 per month, employee contribution on the excess goes entirely to EPF (no pension fund allocation). The employer's contribution of 12% is split: 8.33% to Employees' Pension Scheme (capped at INR 15,000 basic) and 3.67% (or balance) to EPF.

Fixed-Term Employment

Under the new codes, fixed-term employees must receive identical wages and benefits as permanent employees, including EPF, ESI, and medical insurance. Gratuity eligibility for fixed-term employees begins after one year of service (reduced from five years for permanent employees). This has significant implications for GCCs and project-based staffing.

Data Protection: DPDP Act 2023 and Rules 2025

The Digital Personal Data Protection Act, 2023 and its implementing rules (finalized in November 2025) create India's first comprehensive data protection framework. The phased rollout extends through 2027:

• November 2025: Data Protection Board of India constituted
• November 2026: Consent Manager registration process implemented
• May 2027: Full enforcement of consent, privacy notice, and security requirements

Key Obligations for Foreign Companies

The DPDP Act applies to foreign companies that process digital personal data of individuals in India, regardless of where the company is located. Key obligations include:

• Consent framework: Consent requests must be accompanied by clear, plain-language notices specifying data collected and processing purpose
• Breach reporting: Any personal data breach must be reported to the Data Protection Board. The Act mandates encryption, access control, logging, and data backups
• Significant Data Fiduciaries (SDFs): Entities processing large volumes of Indian personal data face enhanced obligations including annual DPIAs, audits, algorithmic fairness assessments, and mandatory appointment of a Data Protection Officer

Maximum penalties under the DPDP Act reach INR 250 crore (approximately USD 30 million) for serious violations.

Annual Compliance Calendar: Key Deadlines

Environmental, Social, and Governance (ESG) Compliance

Corporate Social Responsibility

Under Section 135 of the Companies Act, companies meeting any of the following thresholds must spend 2% of average net profits of the preceding three years on CSR activities: net worth of INR 500 crore or more, turnover of INR 1,000 crore or more, or net profit of INR 5 crore or more. Many foreign subsidiaries with established Indian operations exceed these thresholds.

CSR activities must fall within the categories specified in Schedule VII of the Companies Act. The CSR committee (mandatory for qualifying companies) must include at least one independent director. Unspent CSR amounts must be transferred to a designated fund (such as the Prime Minister's National Relief Fund) within six months of the financial year end.

SEBI ESG Disclosures

While primarily applicable to listed companies, foreign companies considering an eventual IPO or those with listed Indian partners should be aware that SEBI mandates Business Responsibility and Sustainability Reporting (BRSR). For the top 250 listed entities, independent third-party assurance of ESG disclosures is required, including Scope 3 emission disclosure covering indirect supply chain impact.

Anti-Money Laundering and KYC Requirements

Foreign subsidiaries engaged in financial services, real estate, or other regulated sectors must comply with the Prevention of Money Laundering Act (PMLA), 2002. Key requirements include:

• Customer Due Diligence (CDD) and Know Your Customer (KYC) procedures for all business relationships
• Suspicious transaction reporting to the Financial Intelligence Unit (FIU-IND)
• Record maintenance for 5 years after the cessation of transactions or business relationship
• Appointment of a Principal Officer and Designated Director for PMLA compliance

Even non-financial companies should maintain robust vendor KYC processes, as violations can result in penalties and attachment of property under PMLA.

Intellectual Property Compliance

Foreign companies with IP assets deployed in India should maintain active registrations and monitor for infringement. Key considerations include:

• Trademark renewals: Indian trademark registrations are valid for 10 years and must be renewed. Late renewal incurs surcharges.
• Patent maintenance fees: Annual maintenance fees are payable for granted Indian patents, with different rates for small entities and others.
• Technology transfer agreements: Any agreement involving transfer of technology from the parent company must comply with FEMA pricing guidelines and transfer pricing arm's-length requirements.
• Registered user filings: If the Indian entity uses the parent's trademarks, a registered user application should be filed with the Trademarks Registry.

For detailed guidance on protecting intellectual property in India, see our IP protection guide for foreign companies.

Regulatory Change Management

India's regulatory landscape changes frequently. In a typical year, the MCA issues 30-50 notifications, the RBI publishes 100+ circulars, the CBDT and CBIC issue dozens of tax notifications, and state governments amend local laws. General counsel should:

• Subscribe to MCA, RBI, SEBI, and CBDT/CBIC notification feeds
• Engage an Indian law firm or compliance consultant for quarterly regulatory updates
• Participate in industry body briefings (CII, FICCI, NASSCOM) that often provide advance notice of regulatory changes
• Maintain a regulatory change impact assessment register that maps new regulations to affected business processes

The most significant upcoming change is the full enforcement of the DPDP Act by May 2027. Companies should begin their compliance gap assessment now, as implementing consent management, data processing agreements, and breach response protocols typically takes 12-18 months.

Building a Compliance Operating Model

Governance Structure

General counsel should establish a compliance governance structure with clear reporting lines:

• India Country Head or MD: Accountable for all compliance. Under the Companies Act, directors face personal liability for non-compliance.
• Company Secretary (CS): Mandatory for companies with paid-up capital exceeding INR 10 crore. Responsible for MCA filings, board meeting procedures, and statutory registers.
• Chief Financial Officer (CFO): Responsible for tax filings, transfer pricing documentation, and financial reporting.
• External statutory auditor: Mandatory annual audit. The auditor must report on fraud and compliance failures to the central government.

Technology and Systems

Invest in compliance management technology that tracks deadlines across all regulatory bodies. Key systems include:

• MCA V3 portal access for all corporate filings
• RBI FIRMS portal for investment reporting
• GSTN portal for GST compliance
• TRACES portal for TDS compliance
• EPFO and ESIC portals for labour compliance
• Digital Signature Certificates (DSC) for authorized signatories (mandatory for most electronic filings)

Quarterly Compliance Review Cadence

Implement a quarterly compliance review with three components:

1. Backward-looking review: Confirm all filings for the prior quarter were completed on time. Identify any missed deadlines and initiate compounding or late filing as needed.
2. Forward-looking calendar: Map all deadlines for the upcoming quarter with responsible persons and backup assignees.
3. Regulatory change tracking: Review MCA notifications, RBI circulars, CBDT/CBIC notifications, and SEBI orders from the prior quarter for any compliance impact.

Penalties and Personal Liability

Indian law imposes personal liability on directors and officers for compliance failures. Key exposure areas include:

• Companies Act: Directors face fines of INR 50,000 to INR 5 lakh and imprisonment up to 3 years for certain offenses (such as fraud under Section 447)
• FEMA: Penalties up to three times the amount involved in the contravention
• Income Tax: Prosecution under Section 276B for failure to deposit TDS, with imprisonment up to 7 years
• Prevention of Corruption Act: Under the 2018 amendments, companies can be prosecuted for bribery, with vicarious liability for directors only where personal involvement is established (per recent Supreme Court clarification)

General counsel should ensure that D&O insurance coverage extends to Indian director liability and that indemnification agreements with the parent company are in place.

Key Takeaways

• India's compliance framework spans at least six regulatory bodies with overlapping filing deadlines; a centralized compliance calendar is essential
• MCA and RBI filings carry daily penalties (INR 100/day for late AOC-4/MGT-7, FEMA compounding fees) that compound quickly
• Transfer pricing is the single highest-risk area for foreign subsidiaries; invest in contemporaneous documentation and consider bilateral APAs
• The DPDP Act 2023 introduces penalties up to INR 250 crore; full enforcement begins May 2027, but preparation should start now
• The four new labour codes consolidate 29 laws; fixed-term employees now get gratuity after 1 year instead of 5
• Partner with specialists like Beacon Filing's annual compliance service and FEMA-RBI compliance team to build a robust compliance operating model