After Incorporation: The First 90 Days of Compliance

The certificate of incorporation is a birth certificate, and newborns come with obligations. In the ninety days after the SECP registers a company under the Companies Act 2017, a cluster of deadlines falls due — some measured in days, one measured at exactly ninety — and missing them is how a week-old company acquires its first default. None of the obligations is difficult. All of them are easy to miss, because they arrive from four different regulators at once and no one sends a consolidated reminder. This briefing sequences them, as the law stands in July 2026, for a founder running the first quarter without an in-house company secretary.

Days one to fifteen: give the company an address and a record

A company must have a registered office capable of receiving notices, and the Companies Act 2017 requires the office to be in place within a short initial window and its address to be notified to the registrar [section 21 timing — thirty days to have the office, with notification of its situation within the prescribed period — TO BE VERIFIED BY REVIEWING LAWYER]. Everything the registrar, the tax authorities and future litigants send will go there, so a founder using a co-working space should confirm the operator will actually receive and forward official mail.

The same fortnight should produce the company's first board minutes. The first directors named in the incorporation documents hold office under the Companies Act 2017 until the first annual general meeting [term of first directors — TO BE VERIFIED BY REVIEWING LAWYER], and their first resolutions typically cover the appointment of the chief executive if not already named, the opening of a bank account with named signatories, the adoption of a company seal if the articles require one [whether a common seal remains mandatory under the Companies Act 2017 — TO BE VERIFIED BY REVIEWING LAWYER], and authority to complete the registrations described below. Start the statutory registers now — members, directors, and the register of ultimate beneficial owners required since the Companies (Amendment) Act 2020 inserted section 123A into the Companies Act 2017 [scope of the UBO obligation for newly incorporated companies — TO BE VERIFIED BY REVIEWING LAWYER]. Registers reconstructed months later, from memory, are the classic due diligence wound.

Days one to thirty: the bank account and the subscription money

The subscribers promised money for their shares; the law expects it to arrive. Under the Companies Act 2017, subscription money must be deposited within thirty days of incorporation, and the company must then file a verification of receipt with the registrar within the further prescribed period [section 17 mechanics and the forty-five-day verification filing, certified by a practising chartered accountant — TO BE VERIFIED BY REVIEWING LAWYER]. That makes the bank account the critical path of the first month, and account opening is not instant: banks apply know-your-customer and beneficial-ownership checks under State Bank of Pakistan AML/CFT regulations [applicable framework — TO BE VERIFIED BY REVIEWING LAWYER], and will want the certificate of incorporation, the memorandum and articles, the board resolution on signatories, and identity documents for directors and beneficial owners. A founder who walks into the branch in week one, with the board resolution already passed, protects the thirty-day deadline. One who waits until week three usually breaches it.

Days one to thirty: tax identity

The National Tax Number issues through the SECP–FBR integration at incorporation [current integration — TO BE VERIFIED BY REVIEWING LAWYER], but the company's tax file still needs attention in month one. The credentials for the FBR's IRIS portal must be secured and the registration particulars — business address, principal activity — checked and corrected, because errors here propagate into withholding statements and returns for years. Registration under section 181 of the Income Tax Ordinance 2001 also brings the company into the withholding regime: from its first payments of salaries, rent and services, the company is a withholding agent under the Ordinance, with monthly deposit and statement obligations [current statement cycle — TO BE VERIFIED BY REVIEWING LAWYER]. Founders should also confirm the company's appearance on the Active Taxpayers List once its first return cycle permits, because inactive status raises the withholding rates counterparties must apply [ATL mechanics — TO BE VERIFIED BY REVIEWING LAWYER].

Sales tax is conditional, not universal. A company supplying taxable goods registers under section 14 of the Sales Tax Act 1990; a company supplying services registers with the provincial authority where the services are rendered — the Sindh Revenue Board under the Sindh Sales Tax on Services Act 2011, the Punjab Revenue Authority under the Punjab Sales Tax on Services Act 2012, or their counterparts in Khyber Pakhtunkhwa, Balochistan and Islamabad [respective statutes — TO BE VERIFIED BY REVIEWING LAWYER]. The trap for startups is geography: a software company in Karachi serving clients in Lahore may face registration questions in more than one province, and the right answer depends on where the service is treated as rendered or received [place-of-provision rules — TO BE VERIFIED BY REVIEWING LAWYER]. Take advice before the first invoice, not after a notice.

The whole quarter: Form 29 discipline

Every change among the company's officers — a director appointed or resigned, a chief executive named, a company secretary or auditor engaged — must be reported to the registrar on the prescribed particulars-of-officers form, universally called Form 29, within the statutory window [fifteen days under the Companies Act 2017 and the Companies (General Provisions and Forms) Regulations — TO BE VERIFIED BY REVIEWING LAWYER]. First-quarter companies generate these events constantly and file them rarely. The register the SECP shows the world is built from these filings; banks, investors and counterparties rely on it, and a stale record either blocks a transaction or, worse, leaves a departed director publicly answerable for a company he left. The discipline is simple: any board minute that changes an officer triggers a filing task the same day.

When the first employee arrives: EOBI, social security and labour registrations

Hiring converts the company into an employer, and two contribution regimes attach. The Employees' Old-Age Benefits Act 1976 requires registration of the establishment and its employees with EOBI, with monthly employer and employee contributions, once the Act's coverage threshold is met [current headcount threshold and contribution basis — TO BE VERIFIED BY REVIEWING LAWYER]. Provincial social security — SESSI in Sindh, PESSI in Punjab, and their counterparts — attaches under the Provincial Employees' Social Security Ordinance 1965 for employees within its wage ceiling [thresholds and ceilings — TO BE VERIFIED BY REVIEWING LAWYER]. Office premises typically also require registration under the provincial shops and establishments law — in Punjab, the Punjab Shops and Establishments Ordinance 1969 [provincial equivalents — TO BE VERIFIED BY REVIEWING LAWYER]. These registrations are cheap and quick when done at the first hire, and painful when reconstructed at the tenth.

Day ninety: the first auditor

The board must appoint the company's first auditor within ninety days of incorporation under section 246 of the Companies Act 2017 [TO BE VERIFIED BY REVIEWING LAWYER] — the one obligation that gives this briefing its title. Small private companies below the audit exemption threshold are relieved of audit itself [threshold and its interaction with the appointment duty — TO BE VERIFIED BY REVIEWING LAWYER], but the ninety-day date should sit in the calendar from day one, because an auditor engaged in week twelve will also be the professional who certifies the subscription-money receipt and anchors the first financial statements.

The 90-day checklist

• Registered office functioning and notified to the registrar (Companies Act 2017) — days 1–15 [timing TO BE VERIFIED]
• First board resolutions: CEO, bank signatories, registration authorities — days 1–15
• Statutory registers opened, including UBO register (s 123A, Companies Act 2017) — days 1–15
• Bank account opened; subscription money deposited within 30 days (s 17, Companies Act 2017 [TO BE VERIFIED]); verification filed in the further window
• IRIS credentials secured; NTN particulars verified (s 181, Income Tax Ordinance 2001); withholding calendar started
• Sales tax registration assessed — Sales Tax Act 1990 for goods; SRB/PRA/KPRA/BRA statutes for services — before first invoice
• Form 29 filed within the statutory window for every officer change, as it happens [15 days — TO BE VERIFIED]
• On first hire: EOBI registration (EOB Act 1976); SESSI/PESSI registration (Provincial Employees' Social Security Ordinance 1965); shops and establishments registration
• By day 90: first auditor appointed by the board (s 246, Companies Act 2017 [TO BE VERIFIED])
• Diary forward: first AGM and first annual return deadlines noted for the year ahead [16-month first-AGM window — TO BE VERIFIED]

What this means for you

Run the first quarter off a dated checklist, not off memory, and put the three hard dates — subscription money, its verification filing, and the ninety-day auditor appointment — in the calendar the day the certificate arrives. Open the bank account in week one because everything in month one queues behind it. Decide the sales tax question before the first invoice leaves the building. File Form 29 the day the board minute is signed, every time. And if no one on the founding team owns this list, give it to someone who does it professionally — post-incorporation compliance is part of the firm's SECP incorporation service, and keeping young companies in good standing is routine work for our corporate law practice. The companies that raise cleanly at month eighteen are the ones whose first ninety days left no gaps for a diligence team to find.