A captive needs company, labour, data and FEMA filings before go-live
None of the registrations below is a sector licence. They are the general company, foreign-exchange, labour, trade, immigration and data-protection filings that any foreign-owned services entity makes, plus the state registration that unlocks GCC incentives.
| Approval or registration | Authority and portal | When it is needed |
|---|---|---|
| Company incorporation with GST, EPFO and ESIC registration | Ministry of Corporate Affairs: SPICe+ with AGILE-PRO-S | At incorporation; GSTIN, EPFO and ESIC registrations are applied for through the same integrated filing. |
| FC-GPR (reporting shares issued to the foreign parent) | RBI, through the authorised dealer bank on the FIRMS portal | Within 30 days of issuing shares against the foreign remittance. |
| STPI or SEZ unit approval (optional) | STPI or SEZ authorities | Before operations start, if the centre will work from an STPI or SEZ; several state GCC policies tie stamp duty relief to IT parks, SEZs and STPIs. |
| Shops and Establishments, professional tax and labour-code registrations | State labour and tax departments; EPFO | Before staff join. The EPF Scheme, 2026 was notified on 29 June 2026 under the Code on Social Security. |
| Importer-Exporter Code (IEC) | Directorate General of Foreign Trade | Before importing IT equipment or other goods. |
| Employment visas for expatriate leaders | Ministry of Home Affairs; Indian missions | Before travel. Employment visas are for highly skilled professionals and not for routine or ordinary jobs. |
| Personal-data compliance (DPDP Act 2023) | MeitY; Data Protection Board of India | DPDP Rules notified 13 November 2025: Consent Managers register from 13 November 2026; notice, consent and breach-reporting duties apply from 13 May 2027. |
| State GCC policy registration | State IT or industries department (Maharashtra: Commissionerate of Services) | Before claiming incentives. Maharashtra issues a Registration Certificate and requires units to stay operational for at least 10 years. |
Timelines the sources fix
| Step | Rule-fixed time | Authority |
|---|---|---|
| Allot shares after receiving capital | Within 60 days of receipt, priced at not less than fair value | Authorised dealer bank; board |
| Report the share issue (FC-GPR) | Within 30 days of issue | RBI FIRMS portal |
| Declare commencement of business | Within 180 days of incorporation | MCA |
| GST registration (if not obtained through AGILE) | Low-risk applicants can opt for automated registration within three working days | GST portal |
| File the LLP agreement (if an LLP is used) | Within 30 days | MCA |
| Consent Managers register | From 13 November 2026 | Data Protection Board of India |
| DPDP notice, consent and breach-reporting duties | From 13 May 2027 | MeitY; Data Protection Board of India |
State registrations depend on location and activity and the sources do not fix a time for them.
Notes on each registration
Incorporation. One integrated SPICe+ filing covers incorporation, director identification numbers, PAN and TAN; the linked AGILE-PRO-S form can also obtain GST, EPFO and ESIC registrations. The ten-step incorporation sequence is on the set-up roadmap page.
FEMA reporting. The parent’s share subscription is foreign direct investment and must be reported on Form FC-GPR through the authorised dealer bank on the RBI’s FIRMS portal within 30 days of issue. The general reporting cycle is on the FEMA compliance calendar.
STPI and SEZ. Registering as an STPI or SEZ unit is optional for a services centre, but several state GCC policies tie stamp duty relief to IT parks, SEZs and STPIs, so the decision belongs with the office choice and before the lease is signed.
Labour. Shops and Establishments and professional tax registrations sit with the state; EPFO registration is central. The Labour Codes apply from 21 November 2025, and the EPF Scheme, 2026 was notified on 29 June 2026 under the Code on Social Security. See Labour Codes and social security.
Visas. Employment visas are for highly skilled professionals and not for routine or ordinary jobs; leadership transfers need to be planned early. See visas and expatriates.
Data protection. The Data Protection Board operates immediately under the DPDP Rules; Consent Managers register from 13 November 2026; the core notice, consent and breach-reporting duties apply from 13 May 2027. Failing to take reasonable security safeguards can attract a penalty of up to ₹250 crore.
State GCC registration. Where a state policy requires registration before investment, apply before or alongside committing the money. Maharashtra’s Commissionerate of Services issues a Registration Certificate and expects at least 10 years of operation. Details are on the state incentives page.
What to check next
- Confirm that GST, EPFO and ESIC were obtained through AGILE-PRO-S at incorporation; if not, apply separately before staff join.
- Diarise the 60-day allotment and 30-day FC-GPR deadlines against the date the parent’s remittance lands.
- Decide on STPI or SEZ status before signing the lease, since state stamp duty relief may depend on it.
- Put the DPDP milestones of 13 November 2026 and 13 May 2027 into the compliance calendar now.
- Check whether the chosen state requires GCC registration before the investment is made.