Startup founders are builders. They focus on product, customers, and revenue. Compliance is the thing they plan to “get to later.” The problem: “later” usually arrives in the form of a VC’s legal counsel sending a due diligence checklist-and discovering that “later” has become Rs 70,000 in accumulated penalties, a deactivated DIN, a company at risk of strike-off, and a tax benefit worth Rs 15+ lakh that was never claimed.
This blog documents the compliance gaps we find most often in Indian startups, the real cost of each gap, and how we fix them. For the complete registration guide, see our startup registration guide (https://www.patronaccounting.com/blog/what-is-startup-registration-complete-guide-indian-businesses). For company registration (https://www.patronaccounting.com/private-limited-company-registration) clients, we set up the compliance calendar at incorporation to prevent these gaps from ever forming.
The 8 Compliance Gaps We Find in 80% of Startup Audits
Gap 1: INC-20A Not Filed (Strike-Off Risk)
What it is: Form INC-20A is the Declaration for Commencement of Business. After incorporation, you must deposit the subscribed share capital in the bank account and file INC-20A within 180 days.
What we find: Approximately 40% of startups we audit have not filed INC-20A. Founders open a bank account, deposit capital, and start operating-but never file the form. Without INC-20A, the company legally cannot commence business. After 180 days, the Registrar can initiate strike-off proceedings.
Cost of the gap: Rs 50,000 penalty on the company + Rs 1,000/day on officers. In extreme cases: company name struck off, requiring Rs 80,000+ and 7 months for restoration. For businesses using professional accounting services (https://www.patronaccounting.com/accounting-services), INC-20A is filed within the first 30 days after bank account opening.
Gap 2: DIR-3 KYC Not Filed (DIN Deactivated)
What it is: Every director must file DIR-3 KYC by 30 September each year to keep their DIN active.
What we find: Directors of early-stage startups forget DIR-3 KYC because they think it’s a “one-time thing” done during incorporation. It’s annual. Miss it once: DIN is deactivated. Deactivated DIN means you cannot sign any MCA form, file any return, or even file annual accounts-creating a compliance cascade.
Cost of the gap: Rs 5,000 per director to reactivate. But the real cost: you cannot file AOC-4 or MGT-7 until the DIN is restored, which delays all other filings and compounds penalties.
Gap 3: AOC-4 and MGT-7 Not Filed (Annual Return Default)
What it is: AOC-4 (financial statements) due by 30 October. MGT-7 (annual return) due by 29 November. Mandatory for ALL companies, every year, even with zero revenue.
What we find: The single most common filing gap in startups. Founders assume “no revenue = no filing.” Wrong. Non-filing for 3 consecutive years triggers director disqualification under Section 164(2)-a 5-year ban from being a director in any company.
Cost of the gap: Rs 100/day per form per day of delay (company + officers). 2 years of non-filing: approximately Rs 70,000 in penalties. 3 years: director disqualification + Rs 1,00,000+ penalties. This is the gap that investors flag first during DD.
Gap 4: Auditor Not Appointed (ADT-1 Missing)
What it is: First auditor must be appointed within 30 days of incorporation (board appointment). ADT-1 filed within 15 days of AGM appointment.
What we find: Many startups never appoint an auditor in Year 1. No auditor = no audited financial statements = cannot file AOC-4 = annual filing cascade failure. Some founders appoint a “friend CA” informally but never file ADT-1 with MCA.
Cost of the gap: Rs 10,000 penalty + Rs 100/day until appointment is made. Plus the cascade effect on AOC-4 filing.
Gap 5: Section 80-IAC Tax Benefit Not Claimed
What it is: DPIIT-recognised startups can claim 100% profit tax exemption for 3 consecutive years within the first 10 years. Requires separate IMB application after DPIIT recognition.
What we find: Startups that have DPIIT recognition but never applied for 80-IAC. They are paying full tax on profits when they could be paying zero. One startup we audited had Rs 50 lakh in cumulative profits over 3 years and was paying Rs 15 lakh in tax that was entirely avoidable.
Cost of the gap: The unclaimed tax benefit. For a startup with Rs 50 lakh profit: Rs 15 lakh in avoidable tax (at 30% effective rate). This is money that should have been reinvested in the business. For businesses managing income tax return filing (https://www.patronaccounting.com/income-tax-return), the 80-IAC application should be coordinated with ITR filing for maximum benefit.
Gap 6: ESOPs Granted Without Board Resolution
What it is: ESOPs must be granted under a formal ESOP scheme approved by shareholders via special resolution. Each grant must have a board resolution. TDS applies at exercise.
What we find: Founders promise equity to early employees over WhatsApp or email without a formal ESOP scheme, board resolution, or shareholder approval. When the startup raises funding, the investor’s lawyer discovers that “promised” ESOPs have no legal basis. This creates messy cap table issues, tax complications, and employee disputes.
Cost of the gap: No direct penalty-but the due diligence impact is severe. Investors delay or reduce valuation when ESOP documentation is informal. Formalizing retroactively is expensive and creates tax exposure for employees.
Gap 7: Founder IP Not Assigned to the Company
What it is: If the product (code, design, brand, algorithms) was built before or during incorporation by founders in their personal capacity, the IP belongs to the founders-not the company-unless formally assigned.
What we find: This is the #1 due diligence red flag. Investors expect the company to own all IP. If the founder’s employment agreement or an IP assignment deed has not been executed, the company’s most valuable asset is legally not its own. For businesses managing GST registration (https://www.patronaccounting.com/gst-registration) and IP simultaneously, the IP assignment should be completed before any revenue is generated using the IP.
Cost of the gap: No direct penalty-but investors will not invest in a company that does not own its core IP. Fundraise blocked until assignment is completed. Stamp duty may apply on the assignment deed.
Gap 8: Share Certificates Not Issued
What it is: Share certificates must be issued within 60 days of allotment. Stamp duty must be paid. Register of Members must be maintained.
What we find: Most early-stage startups never issue physical share certificates. Founders think it is a “formality.” Investors think differently: missing share certificates = unclear ownership = unclear cap table = no investment until regularized.
Cost of the gap: Regularization cost + potential stamp duty on delayed issuance. Due diligence delay of 2-4 weeks. For businesses using tax audit services (https://www.patronaccounting.com/tax-audit), share certificate issuance and Register of Members should be verified during the statutory audit.
Our 5-Step Startup Compliance Audit Process
| Step | Activity | What We Check | Output |
|---|---|---|---|
| 1 | MCA/ROC Filing Review | INC-20A, ADT-1, AOC-4, MGT-7, DIR-3 KYC, PAS-3, DPT-3, board meeting minutes. Check MCA portal for filing status and any defaults. | Filing gap register with penalty computation |
| 2 | Tax Compliance Review | ITR-6 filing history, TDS returns (24Q/26Q), advance tax, GST returns (GSTR-1/3B/9), professional tax. Section 80-IAC claim status. | Tax compliance report with unclaimed benefits |
| 3 | DPIIT and Startup India Review | DPIIT recognition status, annual self-certification, 80-IAC IMB application status, angel tax compliance, Startup India portal profile. | DPIIT benefit utilisation report |
| 4 | Corporate Governance Review | ESOP scheme and grants, IP assignment, shareholder agreements, share certificates, statutory registers, board resolutions, employment agreements, NDA/confidentiality. | DD-readiness assessment |
| 5 | Remediation Plan | Prioritise gaps by severity (deal-breaker vs penalty vs best practice). Create timeline for filing regularisation, document execution, and benefit claiming. | Actionable remediation calendar with costs |
Timeline: 1-3 weeks depending on company age and complexity. For pre-fundraise audits, we recommend starting 8-12 weeks before the expected DD start date to allow time for remediation.
What Investors Actually Check (The DD Checklist)
When a VC or angel investor sends their legal counsel to conduct due diligence, here is what they check-and what triggers a red flag:
| DD Area | What They Check | Red Flag If Missing |
|---|---|---|
| Corporate | COI, MoA/AoA, board minutes, AGM minutes, statutory registers, ROC filing history, INC-20A | Any filing default or gap in minutes = governance concern |
| Cap Table | Share certificates, Register of Members, PAS-3 filings, ESOP scheme document, grant letters, vesting schedules | Informal ESOP promises, missing share certificates = ownership unclear |
| Tax | ITR filing history, TDS records, GST compliance, advance tax, 80-IAC utilisation, angel tax declarations | Missing ITR, unclaimed 80-IAC, TDS mismatches = financial discipline concern |
| IP | IP assignment agreements, employment agreements with IP clauses, trademark/patent filings, domain ownership | Founder IP not assigned to company = deal-breaker for most investors |
| Labour | Employment agreements, EPF/ESI registration, offer letters, NDA/non-compete, POSH compliance | No employment agreements for key team = HR risk |
| DPIIT | Recognition certificate, self-certification filings, 80-IAC application status, Startup India portal profile | DPIIT lapsed or self-certification missed = benefits at risk |
Our compliance audit is designed to simulate this DD checklist before the actual DD happens. Every gap we find and fix before DD is one fewer red flag, one fewer negotiation point, and one fewer reason for the investor to delay or reduce the valuation.
Key Takeaways
Startup compliance is not optional, even for zero-revenue companies. The 8 most common gaps we find (INC-20A, DIR-3 KYC, AOC-4/MGT-7, auditor appointment, unclaimed 80-IAC, informal ESOPs, unassigned IP, missing share certificates) each have a direct cost in penalties, investor perception, or unclaimed benefits. The total exposure from 2 years of non-compliance can easily exceed Rs 1,00,000 in penalties plus Rs 15+ lakh in unclaimed tax benefits.
The 5-step audit process (MCA review, tax review, DPIIT review, governance review, remediation plan) takes 1-3 weeks and produces an actionable calendar. The investment: Rs 15,000-50,000 for the audit. The return: penalty avoidance, benefit claiming, and a clean DD outcome that preserves valuation and closes the fundraise faster.
The best time to do this audit is 8-12 weeks before your first fundraise. The second-best time is today. Every month of delay adds to the penalty exposure and narrows the 10-year 80-IAC window. Compliance gaps do not fix themselves-they compound.
Get DD-Ready Before Investors Ask
Every compliance gap found during investor DD costs you time, money, and negotiating leverage. Our compliance audit finds and fixes these gaps before DD starts-so your startup presents a clean compliance record, a claimed 80-IAC benefit, a formalised ESOP scheme, and an assigned IP portfolio. The audit pays for itself in avoided penalties and preserved valuation.
Explore our professional accounting services (https://www.patronaccounting.com/accounting-services) for startup compliance audit, regularisation filing, 80-IAC application, ESOP formalization, and ongoing compliance management.
For queries, reach out at +91 945 945 6700 or WhatsApp us directly.
