Keeping your NRI-owned Indian company compliant with the ROC each year

A private limited company carries an annual compliance load whether or not the business was active. A dormant company still files. The two core ROC filings each year:

Form AOC-4 : the company files its financial statements (balance sheet, profit and loss account, and related reports) with the Registrar of Companies. Form MGT-7 : the annual return: a snapshot of the company's shareholding, directors and key particulars at year end.

Both follow the accounts being approved by the board and then adopted by shareholders at the AGM. The ROC filings and the company's income-tax return are separate obligations to separate authorities on their own deadlines, filing one does nothing for the other.

The annual filings aren't standalone uploads; they follow a sequence of company actions, and skipping the order is what creates problems later.

The accounts for the year are first approved by the board at a board meeting, then adopted by the shareholders at the annual general meeting (AGM). The AGM is normally held by 30 September following the end of the financial year. Only once the accounts are adopted do the ROC forms follow: AOC-4 is generally filed within 30 days of the AGM, and MGT-7 within 60 days of it.

A company is also expected to hold board meetings through the year, not just one at year end. For an overseas founder, the meetings can be held with proper notice and minutes regardless of where the directors physically are, what matters is that they actually happen and are recorded, because the minutes underpin the filings that follow.

Every director holding a DIN must verify their KYC with the ministry once every three years, DIR-3 KYC, confirming current details including a personal email and mobile verified by one-time code. (The MCA moved from an annual to a three-year cycle effective 31 March 2026, web verification due by 30 June of the relevant year.)

This trips up overseas directors more than any other filing because it is tied to the individual, not the company. If DIR-3 KYC isn't filed by its due date, the DIN is deactivated and a fee applies to reactivate it, during which the person cannot validly act as a director or sign filings.

For an NRI director, the snag is usually the verification contacts: the email and mobile on record must be ones the director can actually receive a code on while abroad. Sorting that out before the deadline is the whole game.

The filings themselves are routine. What goes wrong is almost always timing and communication.

The AGM date drifts across time zones, pushing AOC-4 and MGT-7 late. A director's DIR-3 KYC lapses because the reminder went to an email they no longer check, and the DIN deactivates. Books left to year end mean the accounts aren't ready in time. Each carries a cost: ROC late filing adds an additional fee per day of delay, and prolonged default can disqualify a director.

Someone on the Indian side owns the calendar, chases the documents early, and files well before the dates. That's the CA's job here.

A company that earned nothing in the year still owes the same two ROC filings. AOC-4 carries its financial statements; MGT-7 (or MGT-7A) carries its annual return. "No business" is not a reason to skip them. If the company is never going to trade again, the way out is to close it by strike off rather than keep paying to file it.

Both filings are due even with no business; only the annual-return form differs by size. A small company files the shorter MGT-7A instead of the full MGT-7.

What makes a missed filing expensive is how the late fee works. Beyond the normal fee, AOC-4 and MGT-7/7A add ₹100 per form per day of delay, with no upper cap. A return left three months late on each form runs into tens of thousands of rupees, on a company that made nothing. This is why a dormant NRI-owned company is filed on time, not parked.

Worried you filed the FLA wrong because your accounts weren't audited by 15 July? You probably didn't, RBI built the deadline around exactly that: file first, revise later.

An NRI-owned company has a second annual return that has nothing to do with the Registrar of Companies. It goes to the Reserve Bank of India. The FLA return, Foreign Liabilities and Assets, is due each year by 15 July, covering the financial year ended the prior 31 March. Any company that has received FDI (foreign share capital) or made an overseas investment must file it, and an NRI founder's company almost always took foreign capital at incorporation, so it is almost always in scope. File online through the RBI's FLAIR portal.

File by 15 July on provisional, unaudited figures, then file again, a revised FLA return, using the audited numbers by 30 September. Skip that second step and the record stays incomplete even though you hit the first deadline. Two more things trip people up: the obligation continues even in a year with no fresh investment, if foreign capital from earlier years still sits on the books, the FLA is still due; and it is entirely separate from the MCA filings (AOC-4, MGT-7) and the company's tax return, filing those does nothing for the FLA. Missing either step is a breach under FEMA and can draw its own penalty from the RBI.

Every Indian company must have an auditor, and the appointment itself is a filing. A newly incorporated company appoints its first auditor within 30 days of incorporation; thereafter the auditor is appointed at the AGM, usually for a five-year term.

The appointment is reported to the ROC on Form ADT-1, filed within 15 days of the appointment. For any company appointing its first auditor on or after 14 July 2025, ADT-1 is now mandatory even for that first board-appointed auditor (Companies (Audit and Auditors) Amendment Rules, 2025); a company whose first auditor was appointed on or before 13 July 2025 isn't required to file retroactively for that original appointment. A step that used to be skipped for newer companies.

For an overseas founder this is easy to miss at two moments: just after incorporation, when the first auditor must be in place fast, and again whenever the auditor changes. Neither is automatic; both need the form filed on time.

Size lowers the meeting count, but it doesn't remove it. A small company still has to hold meetings and record them.

Most companies hold a board meeting in each quarter. A small company, one-person company, or dormant company has a lighter rule under Section 173(5): two board meetings a year, one in each half, with at least 90 days between them. (A one-person company with a single director is exempt from this meeting requirement.) On top of that sits the AGM, normally held by 30 September, where the shareholders adopt the accounts.

The meetings can be held from anywhere, what matters is proper notice and signed minutes, because the minutes are the record the AOC-4 and MGT-7 filings rest on. A company that files its forms but never actually held or minuted the meetings has a gap that surfaces later. Keeping the cadence is part of the compliance, not a formality on top of it.

Meera, an NRI in Dubai, incorporated a small consultancy in 2025, with her brother in Hyderabad as the resident director. Year one closes 31 March 2026.

The sequence is fixed: finalise accounts, board approval, AGM by 30 September 2026, then AOC-4 within 30 days and MGT-7 within 60 days. Because the company took foreign share capital at incorporation, it also files DPT-3. The annual return of money not treated as deposits, easy to forget when the inflow was a one-off at setup.

The filing that nearly catches Meera is personal. Both she and her brother hold DINs, so each has a DIR-3 KYC. Meera's recorded mobile is an old Indian number she cannot receive on in Dubai. If KYC isn't filed by its due date, her DIN is deactivated and a ₹5,000 reactivation fee applies per DIN, and while deactivated, she cannot sign any company filing, which stalls AOC-4 and MGT-7.

A late AOC-4 or MGT-7 adds ₹100 per form per day of delay; prolonged default can disqualify a director. The CA owns the calendar from April: books finalised, board meeting and AGM convened, all three filings within their windows, and both directors' DIR-3 KYC details refreshed well before the date.