HR Statutory Compliance Starter Kit for Growing Businesses in India

Executive answers

Statutory HR obligations switch on by headcount, and the switch is the date the threshold is crossed, not the date you notice. Employers that scale from a handful of employees to a few dozen cross a sequence of triggers within a few hiring cycles: 10 employees (Gratuity, Maternity Benefit, the POSH Internal Committee, ESIC in most States, and factory status where a manufacturing process with power is carried on), 20 employees (EPF, Bonus, the Grievance Redressal Committee under the Industrial Relations Code, and the contract labour threshold in States that use 20), and 50 employees (creche under the Maternity Benefit Act, and the contract labour threshold in States and under the Code that use 50). Coverage runs from the day the threshold is crossed, so late registration is a default for the gap period.

Foundation-level liabilities, in order of cost.

1. EPF and ESI contributions (interest, damages and prosecution for non-remittance, and personal exposure for deducted-but-unpaid amounts).
2. Wage law: minimum wages, timely payment of wages, overtime at twice the ordinary rate, bonus and wage records.
3. Gratuity: an accruing liability that matures at five years of continuous service, with compulsory funding or insurance, and a statutory payment timeline.
4. POSH: a missing or non-functional Internal Committee carries a fine of up to Rs 50,000 under Section 26, with enhanced penalty for repeats, and exposes the employer in any complaint.
5. State establishment law: Shops and Establishments registration, leave, hours, registers and display, plus Professional Tax and Labour Welfare Fund enrolment.
6. Employment documentation: appointment letters, policies and records that establish terms, confidentiality and conduct standards, and that prove compliance when a dispute or inspection arrives.

Statutory governance priorities. Fix one accountable owner (the HR Head or the Finance Director) for each statute, one central calendar, and one evidence file per month. Register before hiring crosses a threshold, not after. Keep policies, registers and payroll rules aligned, because most defaults arise where payroll, policy and registration disagree.

Risk mitigation matrix for newly scaling operations.

Scope and applicability

Headcount and activity thresholds

Counting rules

• Who is counted. Count all persons employed on any day of the preceding 12 months, including full-time, part-time, probationers, trainees on payroll, fixed-term employees and, for EPF and ESIC and CLRA purposes, workers engaged through contractors. Interns and apprentices are treated differently by each statute, so classify each category.
• Look-back. Most thresholds use the preceding 12 months, so a seasonal peak above the threshold can create coverage that persists.
• Location. Establishment-level statutes (Shops and Establishments, ESIC sub-codes, POSH Internal Committee at an office or branch) count per location, while entity-level statutes (EPF, Gratuity, Bonus) count per establishment as defined in the Act, which can combine locations. Confirm the unit of count for each statute.
• Permanence. Once covered, most statutes continue to apply even if headcount falls below the threshold.
• Fixed-term and remote employees count toward thresholds. Remote employees also trigger State-level obligations by place of work (see the Multi-State Labour Compliance Guide).

Detailed guide

Statutory registration set-up

• EPFO. On reaching 20 employees (or earlier by voluntary coverage), register on the EPFO Unified Portal with a digital signature certificate and the authorised signatory, obtain the establishment code, enrol employees with UANs, and file the Electronic Challan cum Return each month by the 15th. Coverage runs from the day the threshold was crossed. The PF Compliance Checklist for HR & Payroll Teams covers the monthly workflow.
• ESIC. At 10 employees (20 in some States), where the location is in an implemented area, register on the ESIC employer portal, obtain the 17-digit employer code and, for each location, a sub-code. Register covered employees (wages up to Rs 21,000) and file the contribution by the 15th. See the ESIC Compliance Checklist for HR & Payroll Teams.
• Professional Tax. In each State that levies it, register for the employer's enrolment certificate and the registration certificate for deduction, configure the State's slab in payroll, and pay and file on the State's cycle.
• Labour Welfare Fund. In each State that levies it, register with the State Board, deduct the employee share, and pay with the employer share on the State's frequency (monthly, half-yearly or annual).
• Shops and Establishments registration. Register or intimate each location with the State labour department within the Act's window, display the certificate and notices, and renew where the State requires. Treat registration as a pre-opening step.
• Gratuity. On reaching 10 employees, give the notice of opening (Form A under the Central Rules) to the controlling authority within the prescribed period, arrange the compulsory insurance with an approved insurer or set up an approved gratuity trust (Section 4A), and put nomination collection in the onboarding flow.
• Other set-up items. TAN and TDS on salary, Employees' Compensation insurance, and, where contract labour is used, the CLRA registration. The Business Registration & Labour Licensing Guide sets out the sequence.

Core employment policies and documentation

Appointment letter. Issue a written appointment letter before the first day of work (the Codes require it, and the State Acts and Standing Orders do in most cases). Do not use a generic template. The letter should carry:

• Employer's legal name and registered address, employee's name, designation, grade, place of work and date of joining.
• Remuneration structure with each component, the wage period, the date of payment, and the statutory deductions (PF, ESI, PT, LWF, TDS) and employer contributions, so that the PF wage definition and the 50 per cent wage rule are visible.
• Probation period, the confirmation process, and the notice period during and after probation.
• Working hours, weekly off, leave entitlements by reference to the State Act and the leave policy, and the holiday list.
• Statutory benefits: provident fund, ESI where applicable, gratuity, maternity benefit, bonus and compensation, and the nomination requirement.
• Confidentiality, intellectual property assignment for work product, and conflict of interest clauses. Post-employment non-compete restraints are generally unenforceable in India under Section 27 of the Indian Contract Act, 1872, so draft restraints that are enforceable (confidentiality, non-solicitation of confidential information, in-term exclusivity).
• Code of conduct, disciplinary process, POSH and anti-harassment acknowledgment, data protection notice, termination grounds, notice, dues and exit formalities, and the governing law and jurisdiction.
• Stamping and signature requirements. Some States require stamping of employment agreements and service bonds. Electronic signature is valid under the Information Technology Act, 2000 for most employment documents.

Standing Orders and Code of Conduct. Where the Standing Orders threshold is met, certify Standing Orders with the certifying officer (or adopt the model standing orders under the Code, as the rules allow). Below the threshold, adopt a Code of Conduct and disciplinary procedure by contract and policy. In either case it should define misconduct, the inquiry procedure with notice and an opportunity to be heard, penalties, suspension, and appeal. Some States exempt IT and ITES units from specified provisions by notification, so confirm.

POSH policy. Adopt a written policy that defines sexual harassment under Section 2(n), names the Internal Committee and its contact route, states the complaint and inquiry timelines, and sets out the penalties. Display the policy and the committee details, and issue it at onboarding. The workplace under Section 2(o) includes any place visited arising out of employment, which includes remote and hybrid work.

Statutory leave policy. Draft State-wise annexes that meet each State's Shops and Establishments Act for earned, casual and sick leave, public holidays and weekly off. Add maternity leave and related benefits under the Maternity Benefit Act, with the 26-week entitlement, the pre-delivery and post-delivery split, the creche rule, the work-from-home option after the benefit period where the nature of work allows, adoption and commissioning mother leave, and the written notice of entitlements at appointment. Where the woman is covered by ESI, the ESI maternity benefit applies instead.

Data and records policy. Employee data is personal data under the Digital Personal Data Protection Act, 2023, whose rules were notified in 2025 with phased commencement. Give a notice on the purpose of collection, restrict use to employment purposes, secure the records, and set retention periods. Confirm the commencement date of each obligation.

Statutory registers and returns

Registers to set up (formats vary by State and Code rules, so use the applicable State format or the Code's prescribed format where in force):

• Muster roll and attendance register.
• Register of wages, with each component, deductions and net pay.
• Register of overtime.
• Register of leave with wages (and leave ledger by category).
• Register of deductions, fines and advances.
• Register of employees (with date of joining, designation and UAN and IP numbers).
• Registers under the Shops and Establishments Act of each State (employment, wages and leave formats), and the register of contractors where contract labour is used.
• Accident register, inspection book, and the POSH complaints register.
• Gratuity nomination register and the gratuity liability record.
• Maternity register, where the Act requires it.

Returns: EPF ECR monthly, ESIC contribution monthly, PT and LWF per State cycle, TDS monthly deposit and quarterly return, annual returns under State Acts where prescribed, and the POSH annual report to the District Officer.

Physical and digital maintenance. The Information Technology Act, 2000 recognises electronic records, and the Codes and many State rules permit electronic registers on conditions: retrievable on demand, printable in the prescribed format, secured with an audit trail and available for inspection at the establishment. Where the State rules are silent or ambiguous, keep a signed print copy. Retain registers for the longest period in the applicable rules (commonly not less than three to five years), and longer where a dispute or notice is pending.

Statutory deductions and onboarding protocols

Build these into a single joining workflow, completed before the first payroll freeze.

• Form 11 (EPF). The declaration on previous membership, previous UAN and exit date. It decides existing-member status and the ceiling treatment, and prevents duplicate UANs. Retain it, and have the employee complete the online e-nomination for EPF, EPS and EDLI.
• Form 1 (ESIC). The declaration and registration for the IP number, with family details and nominee, for covered employees.
• Form F (Gratuity nomination). The Central Rules prescribe Form F for the nomination under the Payment of Gratuity Act. Collect it within the period the rules allow after joining, and update it on marriage or other change. (Form I is the claim application, not the nomination.)
• Tax declaration. The employee's choice of tax regime and, under the old regime, the declaration of investments and deductions with proofs at year end, so that TDS on salary is computed correctly. Use the forms and sections of the Income-tax Act, 2025 as renumbered.
• PT and LWF data. The State of work, for State slabs and funds.
• KYC and documents. Aadhaar, PAN, bank account, age proof (to confirm the employee is not a child or adolescent in a prohibited occupation), previous employment records, and education records, with consent for background verification.
• Maternity notice, POSH policy and handbook acknowledgment, signed at joining.
• Payroll sync. Each deduction in payroll is mapped to the statute and the wage definition, with the State rule for PT and LWF.

Probation versus permanent: statutory coverage

Probation is a contractual status, not a statutory one. The employee is an employee for every statute from the first day.

Extend probation only by written order within the period stated in the appointment letter, and confirm in writing.

Checklist

Operational starter matrix. Thresholds, rates and forms are those in force at the time of writing, and several are being aligned to the Labour Codes and State rules. Verify each row against the current text for each State.

Common mistakes

1. Using generic off-the-shelf appointment letters. The template has no remuneration structure, no confidentiality or intellectual property clause, no probation and notice mechanics, and no statutory references. Consequence: the employer cannot prove the agreed terms, the work product may not vest in the company, and an inspector or a labour court reads silence against the employer. Clauses that purport to restrain post-employment competition are void under Section 27 of the Indian Contract Act and give no protection.
2. Delaying the Internal Committee past 10 employees. The committee is formed only after a complaint arrives. Consequence: breach of Section 4 of the POSH Act, a fine of up to Rs 50,000 under Section 26 (with higher penalty and possible cancellation of licence or registration for repeat contraventions), and an inquiry that is vulnerable to challenge because the committee was not validly constituted.
3. Missing the coverage start for EPF or ESIC. The establishment registers months after the threshold is crossed. Consequence: contribution arrears from the date of coverage with interest and damages, and employees without cover when an illness or accident occurs.
4. Deducting without remitting. The employee share is deducted in payroll but the contribution is not paid by the 15th, or the file is rejected and nobody follows up. Consequence: the most serious default under both the EPF Act and the ESI Act, with prosecution exposure for the persons in charge.
5. Failing to maintain localised muster rolls and registers. Attendance sits in a single system without location-wise records, or in a format that does not match the State rules. Consequence: inability to produce prescribed records at inspection is an independent offence, and the employer cannot rebut a wage or overtime claim.
6. Miscalculating probation versus permanent liabilities. The employer treats probationers as outside PF, ESI, gratuity service or maternity eligibility until confirmation. Consequence: statutory coverage runs from the first day, so the employer faces arrears, benefit claims and a gratuity liability that is understated because service from joining counts.
7. Unfunded gratuity and missing nominations. The liability is not computed and no insurance or trust is in place. Consequence: a lump-sum payout at the point of exit that the business has not provided for, a statutory payment timeline with interest for delay, and a dispute over beneficiaries when there is no Form F.
8. A single national leave and hours policy. The head office policy is applied to every State. Consequence: a breach of each State's minimums, with claims and inspection findings.
9. Ignoring State Professional Tax and LWF. Registration is skipped until a notice arrives. Consequence: back tax with interest and penalty for every month and employee.
10. Informal wage payment. Salaries are paid late, in cash, or without wage slips. Consequence: breach of wage payment timelines and record rules, claims for delayed wages, and no evidence of what was paid.
11. No contract labour controls. Vendors are engaged on purchase orders with no Principal Employer registration, licence check or remittance proof. Consequence: the principal employer carries secondary liability for wages, EPF and ESI, and an unregistered establishment cannot lawfully employ contract labour.
12. Treating compliance as an annual exercise. Filings, renewals and registers are reviewed at year end. Consequence: monthly defaults accumulate interest and damages, and the first audit finds a year of gaps.

Action Plan: 30-60-90 Day HR Compliance Rollout

Days 1 to 30: Portal Registrations, Mandatory Policy Formulation and POSH ICC Constitution

1. Run a threshold test. Count headcount by location, including contract and remote staff, on the 12-month look-back, and mark each statute as triggered, approaching (within 10 per cent) or not triggered.
2. Complete registrations for every triggered item: TAN and TDS, Shops and Establishments for each location, PT and LWF for each State, EPFO and ESIC, Gratuity notice and insurance, and Employees' Compensation cover.
3. Constitute the POSH Internal Committee at each office or branch with 10 or more employees. Appoint a senior woman as Presiding Officer, at least two employee members, and one external member, with at least half the members being women. Issue the order, display the details, adopt the policy and schedule awareness sessions.
4. Issue the policy set: appointment letter template, Code of Conduct and disciplinary procedure (or certified Standing Orders where required), State-wise leave annexes, maternity policy, POSH policy and data protection notice.
5. Assign owners. One named owner for each statute and each location, with a deputy.
6. Open the evidence file for each statute, with certificates and acknowledgments.

Days 31 to 60: Statutory Registers Setup, Payroll Deduction Synchronisation and Contractual Standardisation

1. Set up registers for each location in the State format, or the Code format where in force, and decide which are maintained electronically and which in print.
2. Synchronise payroll. Map each pay head to the PF and ESIC wage definitions, configure PT and LWF by State, set overtime and leave rules by State, and test with a parallel run. Confirm the minimum wage compliance for each State and skill level.
3. Standardise onboarding. One joining checklist: appointment letter, Form 11 and e-nomination, ESIC Form 1, Form F nomination, tax declaration, KYC, maternity notice, POSH and policy acknowledgment, and data notice.
4. Re-paper existing employees. Issue letters or addenda to current staff that bring the terms in line with the standard, and collect the missing nominations and declarations.
5. Standardise contracts. Vendor and consultant agreements with statutory compliance warranties, document delivery, audit rights, set-off and indemnity. Review employment-adjacent contracts such as intern and consultant arrangements for misclassification risk.
6. Compute the gratuity liability and arrange funding or insurance.

Days 61 to 90: Internal Statutory Audit, Vendor Onboarding Governance and File Archival Protocol Setup

1. Run an internal statutory audit. Sample the registrations, registers, payroll rules, PF and ESIC filings, POSH records, and appointment files against the checklist above, and close each finding with an owner and date.
2. Set up vendor onboarding governance. Licence and registration checks, statutory remittance proofs, Principal Employer registration where needed, and a pre-invoice verification step.
3. Install the compliance calendar with every filing, renewal and payment date by statute and State, with owner and escalation path.
4. Set up the archival protocol. A monthly evidence pack for each statute and location (returns, challans, receipts, registers, reconciliations), a naming convention, access control, retention periods and backups.
5. Train managers on the appointment process, leave and hours rules, POSH and complaint routing, and notice handling.
6. Report to leadership. A dashboard of registrations, filings, open findings and exposure, with a quarterly review.

Frequently asked questions