The Startup Legal Hub
The Startup Compliance Calendar
Every recurring obligation a Pakistani startup owes — to the SECP, the FBR, the provincial revenue authorities, EOBI, and social security — organised by regulator and by rhythm, so a founder can run it as a calendar instead of discovering it in diligence.
Most compliance failures in young Pakistani companies have the same cause. It is not defiance, and it is rarely cost. It is that nobody wrote the obligations down in one place, gave each one a date and an owner, and read the list every month. This article is that list, organised the way the obligations actually arrive: by regulator first, then by rhythm. It reflects the law as it stands in July 2026; the deadlines, forms, and thresholds below move with SECP regulations and with each Finance Act, so anything bracketed must be confirmed before you rely on it.
The calendar assumes a private limited company under the Companies Act, 2017 with employees and revenue. Strip out what does not apply to you. Do not strip out what merely has not applied yet — most of these obligations attach silently when a threshold is crossed, and the crossing is never announced.
The SECP layer
The Companies Act, 2017 puts a permanent filing relationship between the company and the registrar, operated through the SECP's eZfile portal. The recurring items are three. The annual return, filed every year whether or not anything changed [FILING WINDOW — TO BE VERIFIED BY REVIEWING LAWYER]. The financial statements, audited unless the company sits below the audit-exemption threshold for private companies [THRESHOLD — TO BE VERIFIED BY REVIEWING LAWYER], prepared and filed on the statutory timetable. And the AGM or, where the law allows, the members' resolutions that stand in for it, held within the prescribed period after the financial year end [PERIOD UNDER SECTION 132 — TO BE VERIFIED BY REVIEWING LAWYER].
The larger SECP burden is event-driven. A director joins or resigns; shares are allotted or transferred; the registered office moves; the company gives security over its assets. Each of these triggers a filing inside a fixed statutory window — for charges, missing the window puts the lender's security at risk against a liquidator [WINDOWS AND FORMS — TO BE VERIFIED BY REVIEWING LAWYER]. Alongside the filings sit the registers: members, directors and officers, minute books, and the ultimate-beneficial-ownership record under section 123A, which must be refreshed whenever ownership or control changes. The SECP layer punishes neglect mechanically — additional-fee schedules escalate with delay, and prolonged default can end in the company being marked inactive or struck off.
The federal tax layer
The company acquires its National Tax Number at incorporation and lives thereafter on the FBR's IRIS portal in two capacities at once.
As a taxpayer, it files an annual return of income under the Income Tax Ordinance, 2001, on a due date keyed to its year end [CURRENT DUE DATES — TO BE VERIFIED BY REVIEWING LAWYER]; it pays advance tax quarterly under section 147 against an estimate of the current year; and it can owe minimum tax under section 113 on turnover even in a loss year — a structural feature that surprises founders annually. Filing on time keeps the company on the Active Taxpayers List; falling off it raises the withholding rates applied to the company's own receipts, which is the rare compliance failure with a same-month cash cost.
As a collector, the company is a withholding agent from its first salary run. Tax withheld on salaries, services, rent, and other prescribed payments must be deposited within the prescribed time and reported in the statements filed under section 165 on the current statutory cycle [CYCLE AND DUE DATES — TO BE VERIFIED BY REVIEWING LAWYER]. Withholding failures are the quiet balance-sheet exposure of Pakistani startups: the company becomes liable for tax it should have deducted from someone else, plus default surcharge, discovered years later in an audit or a diligence.
Sales tax: one name, several authorities
Sales tax registration is a decision, not a default, and the decision starts with what you sell. Goods are taxed federally under the Sales Tax Act, 1990, with registration and monthly returns through the FBR. Services are provincial: the Punjab Sales Tax on Services Act, 2012 administered by the Punjab Revenue Authority, the Sindh Sales Tax on Services Act, 2011 administered by the Sindh Revenue Board, the KPRA and BRA regimes in Khyber Pakhtunkhwa and Balochistan, and the ICT (Tax on Services) Ordinance, 2001 for Islamabad.
A software or services startup with customers in three provinces can face three registrations and three monthly returns, because the provincial statutes do not resolve consistently whether the tax follows where the service is rendered or where it is received — an unresolved conflict as of mid-2026. Register with the correct authority before the first invoice, file monthly including nil months, and take advice before assuming one registration covers the country, because the authorities do not assume that.
The employer layer
People-related obligations attach by headcount, and they attach whether or not anyone told you.
EOBI. Registration under the Employees' Old-Age Benefits Act, 1976 and monthly contributions linked to the minimum wage, once the establishment crosses the statutory headcount [THRESHOLD AND CURRENT RATES — TO BE VERIFIED BY REVIEWING LAWYER]. EOBI arrears are found in startup diligence more often than any other single defect, because the obligation starts small and compounds silently.
Provincial social security. Registration and monthly contributions under the Provincial Employees' Social Security Ordinance, 1965, administered by PESSI in Punjab, SESSI in Sindh, and their counterparts, for employees within the wage ceiling [HEADCOUNT TRIGGER, CEILING, AND RATES — TO BE VERIFIED BY REVIEWING LAWYER].
The establishment itself. Registration under the applicable shops and establishments law — the Punjab Shops and Establishments Ordinance, 1969, the Sindh Shops and Commercial Establishments Act, 2015, and their counterparts — which also carries working-hours and record-keeping rules.
Profit-linked schemes. Once the company has real profits and real headcount, the workers' participation and welfare regimes — the Companies Profits (Workers' Participation) Act, 1968 and the workers' welfare fund legislation, now partly provincial after devolution — can attach [APPLICABILITY AND THRESHOLDS — TO BE VERIFIED BY REVIEWING LAWYER].
One caution across all of these: the thresholds count people who work like employees. Labelling the team consultants does not move the count if the facts say otherwise.
The rhythm
Reassembled by frequency, the calendar looks like this.
Monthly: deposit withheld tax; file the sales tax return with the FBR and each provincial authority where registered; pay EOBI and social security contributions.
Quarterly: pay advance tax under section 147; file withholding statements if the current cycle is quarterly; reconcile the calendar against IRIS and the eZfile record — what the portals show is what a regulator or an investor will see.
Annually: close the financial year; complete the audit where required; hold the AGM or pass the resolutions; file the financial statements and the annual return with the SECP; file the income tax return; renew PSEB registration and every sectoral licence; refresh the section 123A record.
On events: every allotment, transfer, director change, registered-office change, and charge — filed within its window, minuted, and entered in the registers the same week it happens.
Making the calendar survive
A compliance calendar fails at handover. The person who built it leaves, and the company discovers a year later that nothing was filed since. Three habits prevent that. Put the calendar in a system, not in someone's head — a shared document with dates, owners, and a named backup for every line. Reconcile quarterly against the two portals rather than against memory. And put the list in front of the board twice a year, because obligations with board visibility get done. None of this is legal sophistication. It is the discipline of a list, which is precisely why it is the cheapest legal protection a startup can buy.
The Checklist
The startup compliance calendar
The recurring and event-driven obligations of a Pakistani private company, as one checklist with owners and dates.
- Diarise the company's financial year end and work every annual deadline backwards from it.
- File the SECP annual return through eZfile every year, including years in which nothing changed.
- Hold the AGM or pass the equivalent members' resolutions on the statutory timetable, and minute them properly.
- Appoint the auditor if paid-up capital exceeds the audit-exemption threshold, and diarise the reappointment.
- Report every director change, allotment, share transfer, and registered-office change to the SECP within its statutory window.
- Register any charge over company assets with the registrar immediately after the facility is signed.
- Keep the register of members, the register of directors and officers, and the minute books written up as events occur.
- Refresh the ultimate-beneficial-ownership record under section 123A whenever the shareholding or control changes.
- Deposit withheld tax on salaries, services, and rent within the prescribed time, and file the withholding statements on the current statutory cycle.
- Pay quarterly advance tax under section 147 against a live estimate of the current year, not last year's number.
- File the company's income tax return by the statutory date and confirm the company appears on the Active Taxpayers List.
- Register for sales tax with the correct authority before invoicing — the FBR for goods, the provincial authority for services.
- File the monthly sales tax return in every jurisdiction where the company is registered, even for nil months.
- Register with EOBI and the provincial social security institution once headcount crosses the thresholds, and pay the monthly contributions.
- Register the establishment under the applicable shops and establishments law of the province.
- Renew PSEB registration and every sectoral licence before expiry, not after.
- Reconcile the calendar against the SECP record and the FBR's IRIS portal every quarter.
- Give every line of the calendar a named owner and a named backup, and report the whole list to the board twice a year.
Questions, Answered
What clients ask most.
The annual return under the Companies Act, 2017 is filed each year, keyed to the company's AGM or, where no AGM is held, to the prescribed calendar date [EXACT TRIGGER AND FILING WINDOW — TO BE VERIFIED BY REVIEWING LAWYER]. The practical rule for a new company: diarise it in the first year, file it through eZfile even if nothing has changed, and treat the first filing as the template for every later one.
Not always. The Act exempts private companies below a paid-up capital threshold from the audit requirement [THRESHOLD, HISTORICALLY RS 1 MILLION — TO BE VERIFIED BY REVIEWING LAWYER]. Most startups cross it at or before their first priced round, and investors usually require audited accounts by contract regardless. Appoint the auditor properly when the threshold is crossed — a late appointment is itself a default.
It follows what you sell. Goods are federal, under the Sales Tax Act, 1990, administered by the FBR. Services are provincial: the PRA in Punjab, the SRB in Sindh, the KPRA and BRA in Khyber Pakhtunkhwa and Balochistan, and the ICT (Tax on Services) Ordinance, 2001 for Islamabad. A services business with customers in more than one province may need more than one registration, because the provinces do not agree on whether origin or destination decides — a live conflict as of mid-2026.
Both are threshold-triggered. EOBI registration under the Employees' Old-Age Benefits Act, 1976 attaches once the establishment reaches the statutory headcount [CURRENT THRESHOLD AND CONTRIBUTION RATES — TO BE VERIFIED BY REVIEWING LAWYER]; provincial social security under the Provincial Employees' Social Security Ordinance, 1965 attaches by reference to headcount and wage levels. Calling the team contractors does not move the threshold if they work like employees. Register when you cross it — arrears with penalties are found in almost every startup diligence.
Counterparties withholding tax on payments to you apply the higher non-ATL rates, so the cost lands on your own receipts immediately, not at year end [CONSEQUENCES UNDER SECTION 182A — TO BE VERIFIED BY REVIEWING LAWYER]. Reinstatement follows filing the overdue return and paying the surcharge. Of every item on the calendar, this is the one with the fastest cash consequence.
It adds to it rather than replacing it. PSEB registration is the gateway to the concessional tax treatment of IT and IT-enabled export income, and it renews on its own cycle [CURRENT REGIME AND RENEWAL REQUIREMENTS — TO BE VERIFIED BY REVIEWING LAWYER]. The company still files with the SECP, still withholds, still files the income tax return, and still handles provincial sales tax where it has local services revenue. Exporters add one more line: repatriate export proceeds through the banking channel and keep the bank's record of each realisation.
Prepared by The First Counsel · As of 2026-07-12 · Pending professional review — statements flagged in the text are being verified
This publication is provided for general information only. It is not legal advice, and neither reading it nor corresponding with the firm about it creates a lawyer–client relationship. The position stated must be verified against current law before it is relied upon.