If you’re searching “India GCC compliance checklist”, “India subsidiary compliance”, or “GCC legal requirements India”, you’re protecting long-term value. Compliance in India isn’t a one-time setup—it’s an operating system that must run cleanly from Day 0 through scale.
This guide is a field-tested, execution-ready checklist—what to do, when to do it, who owns it, and what breaks if you don’t.
Executive Snapshot (Board View)
-
Day 0–30: Entity, banking, payroll readiness
-
Day 31–90: Employment, POSH, IP & data controls
-
Month 4–12: Governance, audits, tax cadence
-
Year 2–3: Scale compliance, multi-city readiness, maturity audits
Rule: Miss early basics → pay compounding penalties later.
Phase 1: Day 0–30 — Entity, Banking & Payroll Readiness
Mandatory Incorporation & Registrations
| Item | Authority | Owner |
|---|---|---|
| Certificate of Incorporation | MCA | Legal |
| DIN & DSC | MCA | Legal |
| PAN & TAN | Income Tax | Finance |
| Bank account | Indian Bank | Finance |
| GST (if applicable) | GST Council | Finance |
What breaks if skipped: You can’t run payroll or sign compliant contracts.
Phase 2: Day 31–60 — Employment & Labor Law Foundation
Employment Compliance (Non-Negotiable)
| Requirement | Applies When | Owner |
|---|---|---|
| India-specific offer letters | All hires | HR/Legal |
| Shops & Establishments Act | State-wise | HR |
| Provident Fund (PF) | ≥20 employees | Finance |
| ESI | Salary threshold | Finance |
| POSH policy & ICC | ≥10 employees | HR |
| Leave & attendance policy | All | HR |
Common failure: Copy-pasting US/EU templates.
Phase 3: Day 61–90 — IP, Data & Security Controls
IP Protection
-
IP assignment clauses in contracts
-
Invention disclosure policy
-
NDA for employees & vendors
-
Clear jurisdiction language (India)
Data & Security
| Control | Standard |
|---|---|
| Access management | Role-based |
| Logging & retention | Policy-backed |
| Cloud security | ISO-aligned |
| Vendor access | Least-privilege |
Why it matters: Without airtight IP, ownership can be challenged.
Phase 4: Month 4–6 — Payroll, Tax & Audit Cadence
Payroll & Tax (Recurring)
| Item | Frequency |
|---|---|
| PF, ESI, TDS filings | Monthly |
| TDS returns | Quarterly |
| Payslips & registers | Monthly |
Corporate Governance
| Item | Frequency |
|---|---|
| Board meetings | Quarterly |
| ROC filings | Annual |
| Statutory audit | Annual |
Tip: Lock a compliance calendar by Month 4.
Phase 5: Month 7–12 — Operating at Scale
What Changes at ~50–100 HC
-
Dedicated HR Business Partner
-
Internal audits (payroll, POSH, access)
-
Policy refresh (leave, WFH, security)
-
Vendor compliance reviews
Goal: Audit-ready by default.
Phase 6: Year 2–3 — Maturity & Multi-City Readiness
Advanced Compliance
| Area | Action |
|---|---|
| Multi-city labor laws | State mapping |
| Data protection | SOC2/GDPR alignment |
| Transfer pricing | Annual documentation |
| Disaster recovery | Tested plans |
Outcome: Scale without surprises.
Compliance Cost (Realistic Annual Ranges)
| Area | Cost (USD) |
|---|---|
| Company secretarial | $3k–6k |
| Payroll & HR compliance | $5k–10k |
| Statutory audit | $2k–5k |
| Legal advisory | $5k–15k |
Insight: Compliance is cheap. Non-compliance isn’t.
30-60-90 Day Owner Checklist (Copy-Paste)
Day 0–30
-
Incorporation complete
-
Bank & payroll live
-
Offer templates finalized
Day 31–60
-
PF/ESI active
-
POSH ICC formed
-
IP & data policies enforced
Day 61–90
-
First internal audit
-
Compliance calendar locked
-
Board cadence live
Red Flags Auditors Notice First
🚩 Late PF/ESI filings
🚩 Missing POSH documentation
🚩 Weak IP clauses
🚩 Ad-hoc vendor access
🚩 No audit trail
Fix these early.
How Supersourcing Keeps GCCs Clean from Day 0 to Year 3
Supersourcing designs GCCs with compliance baked in, not bolted on.
Why teams trust Supersourcing
-
CMMI Level 5 execution maturity
-
Google AI Accelerator Batch participant
-
LinkedIn Top 10 company recognition
-
End-to-end compliance ops (entity → payroll → audits)
-
Tier-2 GCC specialization for stable scale
You build products.
They keep your GCC audit-ready, always.
Final Takeaway (For Searchers)
India rewards companies that:
-
Start compliant
-
Stay consistent
-
Scale deliberately
Use this checklist and your GCC will remain low-risk, high-ROI for years.
