The annual ROC filing trap: MGT-7A, AOC-4, DIR-3 KYC and DPT-3 deadlines founders keep missing

A founder closes a seed round in March, ships product all year, and assumes that because the company "isn't really doing much yet" there is nothing to file with the Ministry of Corporate Affairs. Twelve months later a buyer's due-diligence team pulls the MCA master data and finds the company's status flagged as "ACTIVE-non-compliant," two directors' DINs deactivated, and a penalty clock that has been running at ₹100 a day with no cap. None of this required wrongdoing. It only required silence. Annual ROC compliance is not triggered by revenue, profit, or activity — it is triggered by the mere existence of a registered company, and the deadlines do not move because you were busy.

This is the checklist of the four filings that catch private limited companies most often — AOC-4, MGT-7/MGT-7A, DIR-3 KYC and DPT-3 — what the Companies Act 2013 actually requires, the exact penalties, and the order in which to do them.

What the law actually requires

Annual filing for a private limited company rests on a small cluster of provisions in the Companies Act 2013, read with the relevant rules. Each form discharges a separate statutory obligation, and filing one does not cover another.

AOC-4 — filing of financial statements. Section 137 of the Companies Act 2013 requires every company to file a copy of its audited financial statements (balance sheet, profit and loss account, and accompanying documents) with the Registrar of Companies. The form must be filed within 30 days of the Annual General Meeting. Because the AGM for most companies is held by 30 September, the practical AOC-4 deadline is around 30 October. If the AGM is not held, the clock still runs from the date by which it should have been held.

MGT-7 / MGT-7A — annual return. Section 92 requires every company to prepare and file an annual return capturing its shareholding, directors, registered office and other particulars. It must be filed within 60 days of the AGM — typically by 29 November. Crucially, "One Person Companies" and "small companies" file the abridged form MGT-7A under Rule 11 of the Companies (Management and Administration) Rules, 2014, while every other company files MGT-7. A small company here means one with paid-up capital up to ₹4 crore and turnover up to ₹40 crore (subject to the standard exclusions such as holding/subsidiary companies and Section 8 companies). Many founders file the wrong variant and treat the obligation as met — it is not.

DIR-3 KYC — director KYC. Rule 12A of the Companies (Appointment and Qualification of Directors) Rules, 2014 requires every individual holding a Director Identification Number (DIN) as on 31 March of a financial year to file DIR-3 KYC by 30 September of the immediately following year. This is a personal obligation that attaches to the director, not the company. A director sitting on five boards files once; a director who has resigned from all of them but still holds an active DIN must still file.

DPT-3 — return of deposits and non-deposit money. Rule 16 of the Companies (Acceptance of Deposits) Rules, 2014 requires every company (other than a government company) to file DPT-3 by 30 June each year, reporting outstanding loans and money received that are not treated as deposits as on 31 March. This is the filing founders forget the most, because they reason "we never took public deposits." But DPT-3 also captures director loans, inter-corporate loans, share application money pending allotment, and amounts from holding companies — almost every startup has at least one of these on its books.

Practical implications — what actually happens when you miss them

The penalty design under the Companies Act is deliberately unforgiving, and the MCA21 system now enforces it automatically.

For AOC-4 and MGT-7/7A, late filing attracts an additional fee of ₹100 per day per form, with no upper ceiling. Two forms filed three months late is roughly ₹18,000 in pure late fees before any adjudication. Beyond the per-day fee, Section 137(3) and Section 92(5) provide for separate penalties on the company and on every officer in default — running into lakhs for prolonged default.

Continuous default has a sharper edge: under Section 164(2), if a company fails to file financial statements or annual returns for any continuous period of three financial years, every person who is or was a director becomes disqualified and cannot be reappointed or appointed in any company for five years. The MCA21 v3 system flags this automatically and deactivates the DIN — the director often discovers it only when a new filing bounces.

For DIR-3 KYC, missing 30 September deactivates the DIN with the reason "Deactivated due to non-filing of DIR-3 KYC." Reactivation requires filing the form with a ₹5,000 late fee. While deactivated, that director cannot sign any MCA filing — which can freeze the company's own AOC-4 and MGT-7 in turn.

For DPT-3, non-filing is penalised under Rule 21 and Section 76A: the company faces penalties and every officer in default can be fined. More damaging in practice, an unfiled DPT-3 leaves loans on the books that may be reclassified as deposits, exposing the company to the far heavier deposit-acceptance penalty regime under Section 76A (which starts at ₹1 crore or twice the amount involved, whichever is lower).

On MCA21 v3, all of this surfaces publicly. The portal stamps non-filers as "ACTIVE-non-compliant," which any investor, lender, or acquirer sees instantly in the master data. A clean compliance record is now a diligence checkbox; a flagged one is a deal delay.

Step-by-step: what to do

• Map your DINs first (by 30 September). List every individual holding a DIN as on 31 March and file DIR-3 KYC for each. Use the eForm DIR-3 KYC only when details have changed; otherwise the DIR-3 KYC-WEB service confirms an unchanged record. Doing this first keeps directors able to sign the later forms.
• File DPT-3 by 30 June. Pull a 31 March snapshot of all outstanding loans and money received not treated as deposits — director loans, inter-corporate loans, share application money. File even if the figure is nil-as-deposits but there are reportable non-deposit amounts.
• Hold the AGM by 30 September. Lay the audited accounts before members. The AGM date is the anchor for both AOC-4 and MGT-7, so fixing it correctly fixes both downstream deadlines.
• File AOC-4 within 30 days of the AGM (≈30 October), attaching the audited financials, board report and auditor's report.
• File MGT-7 or MGT-7A within 60 days of the AGM (≈29 November). Confirm whether you qualify as a small company before choosing the variant.
• Reconcile against the MCA master data. A week after filing, check the company's status on the MCA21 portal to confirm it reads "ACTIVE-Compliant" and that all DINs are active.

Closing

The pattern that ends in disqualified directors and "non-compliant" stamps almost always starts the same way — a founder who assumed inactivity meant nothing was due. The four filings above are predictable, the deadlines are fixed, and the penalties are mechanical. Build them into your calendar before 30 June, not after a buyer's diligence team finds the gap.

For a compliance audit of your company, visit pvtltd.co.

---

See Also

• Lending Between Your Own Group Companies: Section 185 or Section 186? What the Companies Act Actually Requires
• "We charge our UK parent whatever is convenient": What arm's-length pricing actually requires
• Leaving Form AOC-2 blank: What the Companies Act actually requires for related-party disclosure

Need help with this?

Our team handles the paperwork. You focus on your business.