Annual ESOP Compliance Requirements for Indian Startups

Most Indian startup founders understand that setting up an ESOP scheme requires compliance board resolutions, scheme documents, ROC filings. What fewer appreciate is that the compliance does not stop at setup. An ESOP scheme creates a set of annual and event-triggered compliance obligations that persist for as long as the scheme is active. Miss them, and the penalties accrue. Let them accumulate over three years, and the Series A due diligence process becomes an exercise in damage control.

This guide maps every compliance requirement that a running ESOP scheme creates for an Indian startup annual obligations with fixed deadlines, event-triggered obligations that arise each time an ESOP action is taken, and the DPIIT-specific requirements for registered startups. It covers the statutory basis for each requirement, the deadline, the responsible party, the penalty for non-compliance, and the common gaps that surface during due diligence. Use it as a reference document and a compliance calendar.

KEY TAKEAWAYS

• ESOP compliance has two categories: annual obligations with fixed deadlines (independent of ESOP activity) and event-triggered obligations that arise each time a specific action occurs.
• The most critical annual obligation is the annual return filing with the ROC (MGT-7 / MGT-7A) which must reflect the current ESOP scheme position, pool balance, and any grants or cancellations in the year.
• Event-triggered obligations include PAS-3 filing within 30 days of each exercise allotment, TDS deduction and deposit within 7 days of the month of exercise, and scheme document updates after any pool top-up.
• DPIIT-registered startups have an additional annual obligation: renewing or confirming DPIIT recognition to maintain eligibility for the tax deferral benefit for new grants.
• Non-compliance with ESOP filing requirements attracts penalties under the Companies Act ranging from Rs 1,000 to Rs 25,000 per default, plus Rs 100–Rs 500 per day of continuing default.

Structure: Annual Obligations vs Event-Triggered Obligations

ESOP compliance falls into two distinct categories that require different tracking approaches. Annual obligations happen on a fixed schedule regardless of whether any ESOP activity has occurred in the year. Event-triggered obligations arise specifically because of an ESOP action a grant, an exercise, a leaver, or a scheme amendment and have their own deadlines tied to the date of the event.

The most common compliance failure pattern is treating all ESOP compliance as annual compliance and missing the event-triggered deadlines. A company that correctly files its annual return but fails to file a PAS-3 within 30 days of an exercise allotment has committed a default even though the annual obligations were met. Understanding both categories separately is the foundation for managing compliance correctly.

Part 1: Annual Compliance Obligations

Annual Obligation 1: Annual Return MGT-7 / MGT-7A

What it is: Every Indian company must file an annual return with the ROC in Form MGT-7 (for companies with paid-up capital above Rs 10 crore or turnover above Rs 50 crore) or Form MGT-7A (for other companies, including most Seed-stage startups). The annual return includes a comprehensive disclosure of the company's capital structure, shareholder details, and critically for ESOP purposes the status of the ESOP scheme.

What the ESOP disclosure in the annual return must include: The total number of options authorised under the scheme, options granted during the year, options vested, options exercised and shares allotted, options lapsed, options outstanding at year end, and the balance available in the pool for future grants. This disclosure must reconcile with the scheme document, the grant register, and any PAS-3 filings made during the year.

Deadline: 60 days from the date of the Annual General Meeting (AGM). For most companies with a March 31 financial year end, the AGM must be held by September 30, making the MGT-7 deadline approximately November 30. Small companies under Section 2(85) have a slightly different timeline.

Responsible party: Company Secretary, with data provided by the founder and verified against the ESOP register.

Penalty for default: Under Section 92(5) of the Companies Act, failure to file the annual return within the due date attracts a penalty of Rs 50,000 for the company and Rs 5,000 per day of continuing default. Officers in default are personally liable for penalties up to Rs 5 lakh.

Annual Obligation 2: Financial Statement Disclosure Form AOC-4

What it is: The annual financial statements (Balance Sheet, P&L, Cash Flow) must be filed with the ROC in Form AOC-4 along with the Board's Report. The Board's Report must include a specific disclosure on ESOPs under Rule 12 of the Companies (Share Capital and Debentures) Rules, 2014.

What the ESOP disclosure in the Board's Report must include: For each scheme, the disclosure covers: options granted, exercised, forfeited, and outstanding; the exercise price; the fair value of options; the method used to determine fair value; the assumptions used in the option pricing model; the weighted average exercise price; and the dilutive effect of outstanding options on EPS.

Deadline: AOC-4 must be filed within 30 days of the AGM. For a September 30 AGM, the AOC-4 deadline is October 30.

Common gap: Many small startups do not prepare the ESOP-specific disclosures required in the Board's Report, treating it as a large company obligation. It applies to all companies operating an ESOP scheme.

Annual Obligation 3: Valuation Report Renewal

What it is: Not a statutory filing, but a critical annual compliance action. The Rule 11UA FMV determination for ESOP exercise prices should be renewed annually or more frequently for fast-growing companies. A valuation report prepared in the previous year may no longer accurately reflect the company's FMV for the current year's grant batch, particularly if a funding round has occurred.

Deadline: Before the first grant batch of the year or immediately after a material event (funding round, significant revenue milestone) that changes the FMV.

Common gap: Founders using a two-year-old valuation report for the current year's grants, unaware that the income tax department may challenge the contemporaneity of the FMV determination.

Annual Obligation 4: DPIIT Recognition Renewal

What it is: DPIIT recognition is not automatic startups must maintain their eligibility and confirm it annually for the tax deferral benefit to apply to new grants. While DPIIT recognition itself does not expire (it is granted once and remains valid unless the startup no longer meets the criteria), startups must be able to confirm at each grant date that they continue to meet the DPIIT eligibility conditions including the turnover threshold (below Rs 100 crore), the age threshold (within ten years of incorporation), and the nature of business.

Deadline: Check and confirm DPIIT eligibility before each year's grant batch. If the company has approached or exceeded any DPIIT threshold, seek legal advice on whether the deferral benefit still applies to new grants.

Common gap: Companies that obtained DPIIT recognition three years ago and have since crossed a threshold continue to apply the deferral benefit without checking current eligibility.

Part 2: Event-Triggered Compliance Obligations

Event 1: New ESOP Grant

Every new grant batch triggers the following compliance actions, each with its own deadline:

• Board resolution: Must be passed before grants are issued. The resolution must specify the grantees (or eligibility criteria), the number of options, the exercise price, and the vesting schedule. The exercise price must not be below the Rule 11UA FMV at the grant date.
• Grant letter issuance: Must be issued to each grantee within a reasonable period of the grant date typically within two weeks. Each letter must be signed by an authorised director and acknowledged by the employee.
• ESOP register update: The statutory grant register must be updated to reflect the new grants including grantee details, grant date, exercise price, and vesting schedule.
• Scheme document check: Verify that the grant is within the scheme's authorised pool, that the grantees are eligible under the scheme's eligibility criteria, and that the exercise price meets the minimum threshold specified in the scheme.

Event 2: ESOP Exercise and Share Allotment

Exercise events generate the most time-critical compliance obligations in the ESOP programme:

• TDS deduction: The perquisite tax (FMV at exercise minus exercise price, times shares exercised, times employee tax rate) must be deducted from the employee's salary or collected from the employee in the month of exercise. For DPIIT-eligible employees claiming the deferral, confirm eligibility before applying the deferral.
• TDS deposit: The deducted TDS must be deposited with the income tax department by the 7th of the month following the month of exercise. Late deposit attracts interest at 1.5% per month.
• Board resolution for allotment: A board resolution formally allotting the exercised shares must be passed. This is a separate resolution from the grant resolution.
• Demat allotment: Shares must be allotted in demat form to the employee's demat account under the company's ISIN, for companies subject to the MCA demat mandate.
• PAS-3 filing: Return of allotment must be filed with the ROC in Form PAS-3 within 30 days of the date of allotment. Late filing attracts additional fees and can be compounded if significantly late.
• TDS Return (Form 26Q): The quarterly TDS return (filed within 15 days of the end of each quarter) must reflect the exercise perquisite and TDS deducted, with correct employee details so that Form 16A can be generated for each employee.

The TDS Deadline Chain at Exercise What Must Happen When

Exercise date: 18 October

7 November: TDS deducted in October must be deposited with income tax department

30 November: PAS-3 must be filed with ROC (30 days after allotment, assuming allotment processed by 1 November)

15 January: Quarterly TDS return (Form 26Q) for Q3 (October–December) must be filed

If an employee exercises on 18 October and the company does not deposit TDS by 7 November:

• Interest at 1.5% per month from 7 November until deposit date
• If TDS is not deposited by 31 March, the related salary expense may be disallowed in the company's tax return

Missing the TDS deadline is one of the most common compliance failures in Indian ESOP programmes and one of the easiest to prevent with a proper compliance calendar.

Event 3: Employee Departure

• Departure date recording: The exact departure date must be recorded not approximated. This date determines the final vested count.
• Vesting calculation: The final vested balance as of the departure date must be formally calculated and recorded in the grant register.
• Unvested option cancellation: A formal entry cancelling the unvested options must be made in the register, with the pool balance restored.
• Exercise window notification: The departing employee must be formally notified of their exercise window the period during which their vested options can be exercised. This notification should be in writing, with the closing date specified.
• Post-departure monitoring: The company must monitor the exercise window and process any exercise request received before the deadline. If no exercise is received, a formal lapse entry must be made in the register when the window closes, with the pool further restored.

Event 4: ESOP Pool Amendment (Top-Up)

When the ESOP pool needs to be increased typically as a pre-closing condition for a new funding round additional compliance is required beyond the board resolution:

• Shareholder resolution: An increase to the ESOP pool requires shareholder approval under Section 62(1)(b) of the Companies Act, in addition to board approval. A special resolution (75% majority) is typically required where the increase exceeds the prescribed limits.
• Scheme document amendment: The scheme document must be formally amended to reflect the new pool size. The amendment must be approved by the board and filed with the ROC.
• MGT-14 filing: Board resolutions and shareholder resolutions for ESOP scheme amendments must be filed with the ROC in Form MGT-14 within 30 days of the resolution.

Common Compliance Gaps and What They Cost

Gap 1: PAS-3 Filed Late or Not Filed

This is the single most common ESOP compliance failure in Indian startups. Exercise allotments are processed, shares are credited to demat accounts, but the PAS-3 is either not filed or filed weeks late because nobody set a reminder. The penalty for late PAS-3 filing is an additional fee that increases with the delay and significantly late PAS-3 filings can only be compounded through the ROC's compounding process, which involves legal fees and CS time far exceeding the original filing cost.

Gap 2: TDS Not Deducted or Deposited Correctly

Exercise perquisites are salary income the company is required to deduct TDS at source. For DPIIT startups applying the deferral, TDS is deferred (not eliminated) and must be tracked and deposited at the deferral expiry. For non-DPIIT startups, TDS must be deducted in the month of exercise and deposited by the 7th of the following month. Missing this creates interest liability and the risk that the exercise expense is disallowed in the company's tax return.

Gap 3: Board's Report ESOP Disclosure Missing or Incomplete

The Board's Report's ESOP disclosure is often the item that a startup's CA is least familiar with it requires option pricing model assumptions, weighted average exercise prices, and dilutive EPS calculations that are more complex than a simple register summary. The section is frequently omitted from small startup Board's Reports, which is a non-compliance that surfaces during due diligence and must be corrected through an addendum or amendment.

Gap 4: Scheme Document Not Updated After Pool Top-Up

When a funding round requires an ESOP pool top-up, the shareholder and board resolutions are typically passed and the cap table is updated. But the scheme document itself which specifies the maximum pool size is sometimes not formally amended to reflect the new pool. The result: grants made from the increased pool are technically grants from an unapproved pool, as the scheme document still shows the original size. This is a Companies Act non-compliance that must be corrected before the scheme document can be represented as current and valid.

The Annual ESOP Compliance Calendar

When Compliance Gaps Become Due Diligence Findings

Every compliance gap listed above will be checked during Series A due diligence. The investor's legal team follows a standard ESOP audit checklist that covers every annual and event-triggered obligation. The findings they raise fall into three categories of severity:

• Remediable findings gaps that can be corrected before closing with appropriate filings, amended documents, or retroactive compliance actions. Examples: late PAS-3 filings that can be compounded, missing grant letter acknowledgements that can be obtained, Board's Report disclosures that can be corrected through an addendum.
• Findings requiring investor acceptance gaps that cannot be fully remediated but can be disclosed and accepted through appropriate representations and warranties. Examples: TDS defaults from prior periods that have been paid with interest but cannot be uncorrected, grants from periods where the valuation report was not perfectly contemporaneous.
• Dealbreaker findings gaps that create unresolvable legal or financial exposure. Examples: grants made outside the approved scheme to ineligible individuals, scheme documents that were never filed with the ROC, persistent TDS defaults with no evidence of eventual payment.

The Bottom Line

ESOP compliance is not a one-time setup task. It is a recurring annual obligation and a set of event-triggered requirements that arise each time the programme is active. The annual return, the Board's Report disclosure, the valuation report, and the DPIIT eligibility check are fixed obligations regardless of ESOP activity. The PAS-3 filings, TDS deadlines, grant letter timelines, and leaver processing requirements arise from each specific ESOP event.

Founders who build these obligations into a compliance calendar with named owners and specific deadlines maintain a clean record that survives due diligence. Founders who treat ESOP compliance as something the CS handles without a structured calendar accumulate the gaps that become Series A due diligence findings at the worst possible time. The compliance is not complex. It requires discipline, a calendar, and the right support from a CS and CA who understand the ESOP framework specifically.

Also Read: Complete ESOP Compliance Checklist for Indian Startups

Also Read: Do You Need a Valuation Report to Issue ESOPs in India?

Frequently Asked Questions

Does a startup need to file separately with the DPIIT each year to maintain ESOP tax deferral eligibility?

No DPIIT recognition does not require annual renewal filings. Once recognised, the recognition remains valid until the startup no longer meets the eligibility criteria (age, turnover, nature of business). However, the startup must actively verify that it continues to meet the criteria before each grant batch. If the startup has crossed the Rs 100 crore turnover threshold or is more than ten years old from incorporation, new grants may not qualify for the deferral even though the DPIIT recognition certificate has not been revoked.

What happens if a PAS-3 is filed very late for example, two years after the allotment date?

Late PAS-3 filings can be compounded by the ROC under Section 441 of the Companies Act. Compounding involves paying a penalty and obtaining the ROC's order regularising the default. The penalty for a significantly late PAS-3 is higher than the standard additional fee for a moderately late filing. Very late PAS-3 filings also create a discrepancy between the allotment date and the filing date that must be explained during due diligence investors' legal teams note the discrepancy and require an explanation of the gap.

Do small startups with fewer than five ESOP holders still need to comply with all these requirements?

Yes. The Companies Act compliance requirements (PAS-3, MGT-7, AOC-4) apply regardless of the number of option holders. The income tax requirements (TDS, Form 26Q) apply to each exercise event regardless of scale. The DPIIT requirements apply to each grant if the startup wants to preserve the deferral benefit. Company size does not provide an exemption from ESOP compliance it only changes how operationally intensive the compliance is. For a startup with three option holders and one exercise per year, the compliance load is light. For a startup with twenty-five option holders and multiple exercises per quarter, the load is substantial and requires systematic management.

Can a company revoke an ESOP grant after it has been issued to an employee?

A properly issued grant under a registered ESOP scheme cannot be unilaterally revoked by the company without the employee's consent. The grant letter creates a contractual obligation. The only way options can be removed from an employee is through the scheme's own provisions typically forfeiture on bad leaver terms or expiry of the exercise window after departure. Attempting to revoke a grant without a contractual basis exposes the company to an employee dispute and potentially a claim for the value of the revoked options.

How does a startup handle ESOP compliance if it does not have a dedicated company secretary?

Many Seed-stage startups use a part-time CS or a CS services firm rather than a full-time in-house CS. This works for the annual filing obligations the CS firm handles MGT-7, AOC-4, and PAS-3 filings on instruction. Where it breaks down is the event-triggered obligations: if the startup does not notify the CS firm promptly when an exercise occurs or an employee departs, the 30-day PAS-3 deadline and the 7-day TDS deadline may be missed before anyone has even contacted the CS. The solution is a clear internal protocol whenever an ESOP event occurs, the founder or HR contacts the CS firm within 48 hours to initiate the compliance chain.