Startup Compliance Mistakes That Surface During Due Diligence

Your product can be brilliant and your growth curve beautiful. None of it matters to an investor's lawyer if your statutory registers don't match your cap table. These are the filings investors always ask about — and the messes that delay term sheets.

The short answer: due diligence checks whether your company exists on paper the way you describe it in the pitch. The findings that delay term sheets are almost always the same: a cap table that doesn't match the register of members, ESOP promises without paperwork, ROC filings pending at ₹100 a day per form, unfiled director changes, undisclosed related-party deals, and a registered office you moved out of years ago. All of it is fixable — in about three months of quiet cleanup before the raise, not during it.

Founders treat compliance the way students treat dental check-ups. Important, yes. Scheduled for later. Due diligence is the moment "later" arrives all at once, wearing a suit and carrying a document request list. Investor counsel doesn't care about your pitch deck; they verify — through MCA filings, registers and tax records — whether the company exists in the form you claim.

The cap table vs the statutory registers

This is the number one finding. Every time.

Your cap table — the spreadsheet showing who owns what — says one thing. The company's register of members, maintained under the Companies Act, says another. A founder transferred shares to a co-founder two years ago and updated the spreadsheet but never filed the share transfer with the board, never recorded it in the register, never filed the relevant returns.

The investor's lawyer will find this in an afternoon. Then the process stops while you reconstruct two years of paper trail. The fix is dull but non-negotiable: every share issuance, transfer and buyback must be recorded in the register of members and backed by board resolutions and filings. Reconcile the cap table against the register line by line before you fundraise — no investor puts money into a company where nobody can prove who owns the shares.

ESOP grants without paperwork

Startups hand out ESOPs like candy and document them like whispers. "We promised 1% to the CTO" is not a grant. A grant is a board resolution approving the ESOP scheme, shareholder approval where required, a grant letter with vesting terms, and entries in the register of employee stock options.

Due diligence will ask for all of it. When the paperwork doesn't exist, two problems appear. First, the promised options may not be legally enforceable — your early employees' equity is built on air. Second, the investor can't model dilution, because nobody knows what's actually been granted. If you've made verbal or informal ESOP promises, formalise them before the raise — our guide to how a private company issues ESOPs walks through the scheme, approval and grant-letter sequence.

Pending ROC filings and the late-fee clock

ROC annual filings — AOC-4 (financial statements, thirty days from the AGM), MGT-7 (annual return, sixty days from the AGM), ADT-1 (auditor appointment, fifteen days from the AGM) — are the startup world's most postponed obligation. The additional fee is ₹100 per day per form, and it runs without a cap. You can price your own delay precisely with the compliance fee calculator.

A three-year-old startup that has never filed can be sitting on late fees running into lakhs across forms. Investors see this immediately. Worse than the money is the signal: a company that can't file its basic returns on time is a company whose house isn't in order.

The cleanup is mechanical: file everything pending, pay the additional fees, get the record current — before the data room opens, not after the lawyer flags it. This is the standing work behind a private limited company once the certificate arrives; our post-incorporation compliance guide lists the full first-year set.

Related-party transactions nobody disclosed

Founder's cousin supplies the office laptops. The CEO's other company provides consulting services. The startup rents its office from a director's family member. All completely normal in early-stage India. All disclosable under the Companies Act.

Related-party transactions need board approval and, in many cases, disclosure in the board's report and the financial statements. When diligence uncovers undisclosed ones, the question isn't whether they were legitimate — they usually were. It's what else wasn't disclosed.

Map them before fundraising: list every contract with anyone connected to a director or key shareholder, and make sure the approvals and disclosures exist. A founders' agreement that names these arrangements early prevents most of this conversation.

Directors who joined but never filed

Startups add directors informally. "She's on the board" means she attends meetings. Legally, it means nothing until DIR-12 is filed with the ROC within thirty days of appointment and her consent is recorded.

Due diligence checks the MCA record of every director. If your "board member" doesn't appear there, she's not a board member. Resignations work the same way in reverse — a director who left two years ago but never filed a resignation is still legally a director, still liable, and still showing up in the records the investor's lawyer is reading.

Audit your board as the MCA sees it, not as your team sees it — and check DIN statuses, because a deactivated DIN on a key director takes weeks to fix.

The forgotten registered office

Startups move. The registered office on the MCA record often still shows the address from incorporation — a co-working desk in a building the company left two years ago.

The registered office is where the ROC sends notices, and the address on your GST registration and contracts. When it doesn't match reality, notices go unanswered and the lawyer starts asking how many other records are stale. Every move should trigger a change filing — a simple form and a board resolution closes a gap that looks worse than it is.

Statutory registers that don't exist

Beyond the register of members, the Companies Act requires registers of directors and key managerial personnel, charges, and related-party contracts. Most early-stage startups have none of these in any maintained form.

No investor expects a seed-stage startup to have a perfect secretarial department. But the registers need to exist and be broadly current by the time serious money is discussed — reconstructing them while the lawyer waits is slow, expensive and stressful.

Tax filings and the quieter skeletons

GST returns, TDS filings, income tax returns, advance tax — tax counsel will review all of it. Common findings: GST registration taken late, TDS not deducted on contractor payments, returns filed late or not at all.

These are fixable, but tax fixes take longer than ROC fixes — departments, interest calculations, sometimes scrutiny. Start a quarter before you plan to raise, and keep every notice, reply and order in one file. "We received a notice in 2024 and here's the order closing it" is fine. "We don't know where it went" is not.

How to clean up before the raise

1. Reconcile ownership. Cap table against register of members. Fix every mismatch with proper resolutions and filings.
2. Formalise ESOPs. Resolutions, scheme documents, grant letters, register entries.
3. File everything pending. All ROC forms, all tax returns. Pay the late fees and close the gaps.
4. Audit the board. MCA-recorded directors must match actual directors. Fix appointments, resignations, DIN statuses.
5. Map related parties. List, approve, disclose.
6. Update the registered office. Make the record match reality.
7. Build the registers. Get them created and current.
8. Organise the tax file. Every notice, every reply, every order, in one place.

None of this is glamorous. All of it is cheaper before the investor's lawyer is watching — founders who do it quietly, months ahead, are the ones whose diligence takes three weeks instead of three months.

The practical takeaway

Due diligence doesn't uncover exotic fraud. It uncovers ordinary neglect — the filing nobody did, the resolution nobody passed, the register nobody maintained. Run the eight-step cleanup before you need it, so the lawyer's report says the house is in order.

Questions founders ask us before a fundraise

What does due diligence check in a startup's compliance?

Ownership first — cap table against the register of members — then ESOP paperwork, pending ROC filings, director records on MCA, related-party disclosures, statutory registers, the registered office, and the tax file.

How much can pending ROC filings cost a startup?

₹100 per day per form, with no cap. A company three years behind on AOC-4, MGT-7 and ADT-1 can owe lakhs in late fees alone. File and pay before the data room opens; the receipt is part of the cleanup proof.

Are verbal ESOP promises enforceable?

Treat them as a problem, not a grant. A real grant needs an approved scheme, board and shareholder approvals, a grant letter with vesting terms, and an entry in the ESOP register — formalise every promise before the raise.

My co-founder's appointment was never filed. Does it matter?

Yes. Until DIR-12 is filed within thirty days of appointment and the director appears on the MCA record, she is not legally a director — and a director who resigned without a filing is still liable. Reconcile the board on MCA with the board in your office before diligence starts.