Meta description: Build a compliance obligation register for an Indian business with the right fields, legal sources, owners, review triggers and software controls.

A missed row can cost more than a missed date. Under Section 92(5) of the Companies Act, 2013, failing to file an annual return on time can cost a company ₹10,000 plus ₹100 for each continuing day, up to ₹2 lakh. If the obligation never entered your system, no reminder could have saved you.

A compliance obligation register is the master list of laws, rules, licence conditions, contractual commitments and voluntary standards that apply to your business. This guide gives Indian SMEs, compliance teams and CA/CS practices a practical template, a method for deciding applicability and a clear test for when a spreadsheet has stopped being enough.

What Does a Compliance Obligation Register Actually Do?

The register connects a legal or other requirement to a specific business fact. It should answer six questions:

  1. What must be done or avoided?
  2. Why does the requirement apply?
  3. Which entity, site, activity or employee group is covered?
  4. Who owns compliance and who reviews it?
  5. What evidence proves compliance?
  6. What change would make the entry outdated?

It is not merely a list of Acts. “Companies Act compliance” is too broad to operate. One useful row would say: “File the annual return with the Registrar within 60 days of the annual general meeting under Section 92(4) of the Companies Act, 2013.” That row can have an applicability basis, owner, evidence and review date.

There is no single Indian government form called a compliance obligation register for every business. It is an internal management control. Specific laws still prescribe their own registers, returns, records and licences. A master obligation register helps you identify and control those separate requirements; it does not replace them.

The concept is also used in formal management systems. ISO 37301:2021, the international standard for compliance management systems, covers an organisation's full range of compliance obligations. ISO's published FAQ says implementation includes identifying obligations related to products, services and activities, then evaluating compliance risks. ISO 14001:2026 separately provides the current environmental management system framework and addresses relevant legal requirements.

Keep the Obligation Register, Risk Register and Calendar Separate

These three tools should connect, but they do different jobs.

Tool | Main question | Typical unit

Compliance obligation register | What applies, to whom and on what legal basis? | One distinct obligation

Compliance risk register | What can fail, how serious is it and are controls effective? | One failure scenario

Compliance calendar | What action is due, on what date and for which period? | One task or recurrence

Suppose a private limited company holds an annual general meeting on 25 September. The obligation register contains Section 92(4) of the Companies Act, 2013 and its 60-day filing rule. The risk register records the failure scenario and control weakness. The calendar generates the actual MGT-7 or MGT-7A task from the meeting date.

If you need to score failure exposure, use this regulatory compliance risk assessment template. If your problem is due-date execution, compare compliance calendar software with Excel.

Copy This Compliance Obligation Register Template

Create one row for each action, prohibition, licence condition or continuing duty. Use these fields:

Field | What to record

Obligation ID | Permanent code, such as LAB-EPF-001

Legal entity and site | Company, LLP, factory, branch, shop or warehouse

Business activity | Manufacturing, hiring, food sale, import, discharge, storage or another trigger

Jurisdiction | Central, state, municipal, sectoral or contractual

Regulator or counterparty | MCA, EPFO, State Pollution Control Board, customer or certification body

Source type | Act, rule, notification, licence, court order, contract or voluntary standard

Exact source | Full title, section, rule, clause, notification number and official link

Obligation in plain language | The required action or prohibited conduct

Applicability test | Threshold, location, activity, registration, product or commitment that makes it apply

Frequency or event | Continuous, monthly, annual, renewal-based or event-based

Responsible owner | One named role that performs or coordinates the work

Reviewer | Independent checker or approving role

Evidence | Return acknowledgement, challan, licence, minutes, register, report or photograph

Consequence | Penalty, interest, prosecution, suspension, closure, contract loss or audit finding

Status | Applicable, not applicable, uncertain, suspended or under review

Effective and end dates | When this version starts and, if known, stops applying

Review trigger | Law change, new state, threshold crossing, product launch, notice or licence amendment

Last verified | Date, reviewer and primary source checked

Linked task or control | Calendar rule, control ID and evidence location

Do not type only a penalty amount. Cite the provision and record the last verification date because amendments, notifications and court decisions can change the operational position.

“Not applicable” also needs a reason. For example: “EPF Act threshold not met; 14 persons employed across the establishment as at 31 July 2026; review monthly and on acquisition.” That conclusion must be revisited if headcount or structure changes.

Build the Register in Eight Steps Without Missing a Jurisdiction

1. Define the business boundary

List every legal entity, establishment and operating location. A central-office checklist cannot safely represent a factory in Maharashtra and a shop in Karnataka.

Record the facts that drive applicability: entity type, states, employee count, turnover, installed power, products, imports, waste streams, licences, customer commitments and regulated processes.

2. Map obligations from business activities

Start with what the business does, not an alphabetical list of laws. Hiring creates payroll and workplace duties. Manufacturing can create safety, environmental, fire and local permissions. Selling food creates licence, labelling and hygiene requirements.

3. Search each jurisdictional layer

For every activity, check:

Use blogs only for discovery. The final register should link to an Act, rule, notification, regulator page, licence or signed contract.

4. Turn legal text into one plain-language action

Preserve the exact citation, but translate the duty for the owner. Avoid “comply with Section 92.” Write “Prepare and file the annual return with the Registrar within 60 days of the AGM.”

Under Section 92(4) of the Companies Act, 2013, every company must file a copy of its annual return within 60 days of the annual general meeting, or the date on which it should have been held. Section 92(5) sets the ₹10,000 initial company penalty, ₹100 per continuing day, and caps of ₹2 lakh for the company and ₹50,000 for an officer in default.

5. Write an applicability test that can be checked

“Applicable to us” is a conclusion, not a test. State the decisive facts.

The Employees' Provident Funds and Miscellaneous Provisions Act, 1952 generally applies under Section 1(3) to specified factories and notified establishments employing 20 or more persons. Section 1(5) says an establishment remains covered even if employment later falls below 20. A useful register entry therefore records the establishment boundary, headcount evidence, original coverage date and continuing-coverage rule.

Once covered, Paragraph 38(1) of the Employees' Provident Funds Scheme, 1952 requires contributions within 15 days after the close of each month, as the EPFO's official FAQ confirms. Coverage and monthly payment should be separate entries because they have different tests and evidence.

6. Assign one owner and one reviewer

“HR” or “consultant” is not accountable enough. Assign a role such as Payroll Manager, Plant EHS Head or Company Secretary. Name a reviewer for high-consequence obligations.

An outside adviser may prepare a return, but management still needs evidence that the correct entity, site and period were covered. The register must show who obtains and reviews the acknowledgement.

7. Define acceptable evidence before work begins

Evidence must prove the obligation. A payment screenshot without the correct establishment code and period may be useless. A licence must match the premises and authorised activity.

For recurring obligations, define the evidence package once and generate it for each period. Link the register entry to the evidence repository rather than stuffing documents into the master file.

8. Approve, verify and date the entry

Have a qualified reviewer verify high-risk entries. Record the source version, effective date and verification date. Mark uncertainty openly.

See What Completed Entries Look Like

These simplified examples show structure, not a universal checklist.

ID | Applicability and obligation | Owner and evidence | Review trigger

CORP-001 | Every company; file annual return within 60 days of AGM under Companies Act, 2013, Section 92(4) | Company Secretary; filed form and MCA acknowledgement | AGM date, form or law change

LAB-001 | Covered establishment under EPF Act, 1952, Section 1; deposit monthly contributions within 15 days after month-end under EPF Scheme, Paragraph 38(1) | Payroll Manager; ECR, challan and payment receipt | Headcount, restructuring or scheme amendment

POSH-001 | Workplace with 10 or more employees; constitute Internal Committee under Section 4 of the Sexual Harassment of Women at Workplace Act, 2013 | HR Head; constitution order and member records | Headcount, member departure or office opening

ENV-001 | Specific plant and activity subject to its consent order; comply with each operating condition | Plant EHS Head; consent, monitoring report and condition-wise evidence | Process, capacity, discharge or consent amendment

CONTRACT-001 | Customer agreement requires annual supplier compliance declaration | Account Owner; signed declaration and supporting pack | Renewal, scope change or customer revision

For the POSH entry, Section 26 of the 2013 Act allows a fine up to ₹50,000 for failures including not constituting the Internal Committee. A repeat conviction can bring twice the punishment and cancellation, withdrawal or non-renewal of a business licence or registration. That consequence belongs in the entry, while complaint records should remain in a restricted system with appropriate confidentiality.

How Do You Keep the Register Current?

A register without change control becomes a historical artefact. Use two review loops.

First, review business facts monthly or quarterly. Ask whether the company opened a site, entered a state, crossed a threshold, launched a product, altered capacity or accepted a new customer condition.

Second, monitor legal sources. A notification should be assessed against the affected entity, activity and jurisdiction. Record one of four outcomes: creates a new obligation, changes an existing entry, removes an obligation or has no impact. Keep the assessment and reviewer even when the answer is “no impact.”

Do not overwrite history. Close the old version with an end date, create the revised version and update future tasks. Completed periods must retain the legal basis used at that time.

At minimum, report these metrics to management:

Excel or Software: Which Is Right for Your Register?

A controlled spreadsheet can work for one entity, one location and a stable set of obligations. Protect formulas, restrict edit access, use stable IDs, keep version history and schedule professional review.

Evaluate software when you have multiple entities or sites, state-specific requirements, more than three owners, frequent changes, hundreds of entries or evidence scattered across email and drives.

The buying test is not whether the product has coloured dashboards. Ask it to:

  1. explain which business fact makes an obligation applicable;
  2. show the official source, exact section and last verification date;
  3. distinguish central, state, municipal and sector requirements;
  4. version an amended obligation without rewriting completed history;
  5. connect one obligation to recurring tasks, risks and evidence;
  6. route a legal change to only the affected entities and sites;
  7. export the full register and audit trail; and
  8. preserve role-based access for sensitive evidence.

Reject a system that gives confident answers without sources. Also reject a generic task manager pretending that reminders equal applicability research.

Frequently Asked Questions

Is a compliance obligation register mandatory in India?

No single law prescribes this exact master template for every Indian business. Individual laws, licences and standards may require particular records. The register is an internal control that maps those requirements to your operations.

What is the difference between a legal register and an obligation register?

A legal register often lists applicable laws. An obligation register goes further by recording the specific duty, applicability trigger, owner, evidence, consequence and review trigger. The names are sometimes used interchangeably, so check the fields rather than the label.

Can a compliance obligation register be maintained in Excel?

Yes. Excel is reasonable for a small, stable scope with controlled access and disciplined review. It becomes fragile when entities, states, owners and legal changes multiply.

How often should the register be reviewed?

Review business changes at least quarterly and high-change areas more often. Reassess immediately after a new site, product, activity, threshold, licence condition, notice or relevant legal update. Perform a full-scope review at least annually.

Who should own the register?

One compliance coordinator should control structure and versioning, but operational roles must own individual obligations. Finance, HR, company secretarial, legal, EHS and plant teams should validate the facts in their areas.

Should voluntary standards and contracts be included?

Yes, when the organisation has chosen or agreed to comply. Mark the source as voluntary or contractual so it is not confused with legislation. Customer codes, tender conditions and certification requirements can still have serious commercial consequences.

Turn the Register Into a Working Compliance System

A compliance obligation register is useful only when every entry connects a current source to a real business fact, named owner, acceptable evidence and review trigger. Build the master inventory once, then let risks, calendars and controls refer back to stable obligation IDs.

The first question is not “Which spreadsheet template should we download?” It is “Which obligations apply to this entity, site and activity today?”

Check your compliance posture free at complianceradar.in. Describe your business once to see applicable compliances, timelines, government schemes and regulatory-change alerts, then use the results to build and maintain your register.

This article provides general information, not legal advice. Verify current laws, notifications, licence conditions and contractual terms for your facts before acting.