The annual filings every Indian company owes
Once a private limited company exists, it carries an annual compliance load that runs whether or not the business did much that year. A dormant company still files. The core ROC filings each financial year are two.
Form AOC-4 is where the company files its financial statements — the balance sheet, profit and loss account, and the related reports — with the Registrar of Companies. Form MGT-7 is the annual return: a snapshot of the company's shareholding, directors and key particulars as at the year end. Both follow the accounts being approved, first by the board and then by the shareholders at the annual general meeting.
Alongside these sits the company's own income-tax return and, for most companies, a statutory audit (covered on the audit page below). The ROC filings and the tax filing are separate obligations to separate authorities, on their own deadlines — a common source of confusion for founders who assume filing the tax return covers everything.
Board meeting, AGM, then the filings — in that order
The annual filings aren't standalone uploads; they follow a sequence of company actions, and skipping the order is what creates problems later.
The accounts for the year are first approved by the board at a board meeting, then adopted by the shareholders at the annual general meeting (AGM). The AGM is normally held by 30 September following the end of the financial year. Only once the accounts are adopted do the ROC forms follow: AOC-4 is generally filed within 30 days of the AGM, and MGT-7 within 60 days of it.
| Step | What happens | Usual timing |
|---|---|---|
| Board meeting | Board approves the accounts | Before the AGM |
| AGM | Shareholders adopt the accounts | By 30 September |
| AOC-4 / MGT-7 | Financials + annual return filed | Within 30 / 60 days of AGM |
A company is also expected to hold board meetings through the year, not just one at year end. For an overseas founder, the meetings can be held with proper notice and minutes regardless of where the directors physically are — what matters is that they actually happen and are recorded, because the minutes underpin the filings that follow.
The annual director KYC that's personally yours (DIR-3 KYC)
Separate from the company's own filings is a personal one that every director carries: DIR-3 KYC. Anyone holding a director identification number (DIN) has to verify their KYC with the ministry each year, confirming their current details — including a personal email and mobile that are verified by one-time code.
This one trips up overseas directors more than any other, because it's tied to the individual, not the company, and it's easy to assume the company's filings cover it. They don't. If a director's DIR-3 KYC isn't filed by its annual due date, the DIN is deactivated and a fee applies to reactivate it — and a deactivated DIN means that person can't validly act as a director or sign filings until it's restored.
For an NRI director, the practical snag is usually the verification: the email and mobile on record have to be ones the director can actually receive a code on while abroad. Sorting that out before the deadline, rather than during a scramble, is the whole game.
What actually slips when the director is abroad
The filings themselves are routine. What goes wrong is almost always timing and communication, and the pattern repeats.
The AGM date drifts because nobody's coordinating it across time zones, which pushes AOC-4 and MGT-7 late. A director's DIR-3 KYC lapses because the reminder went to an email they no longer check, and the DIN deactivates. The accounts aren't finalised in time because the bookkeeping was left to year end. Each of these carries a cost: ROC late filing attracts an additional fee that accrues per day of delay, and prolonged default can lead to a director being disqualified — a serious consequence that's entirely avoidable.
The fix is unglamorous: someone on the Indian side owns the calendar, chases the documents early, and files well before the dates rather than on them. That's the job a CA does here — not the upload, which is minutes, but the year-round tracking that means the upload is never the emergency.