Virtual CFO Payroll & TDS Compliance: Scope, Filing Controls

Virtual CFO payroll and TDS compliance covers the full cycle, from salary structuring to the last salary TDS certificate handed to an employee. In India that cycle now runs under two Acts: the Income-tax Act, 1961 for tax years up to 2025-26 and the Income-tax Act, 2025 from 01/04/2026, alongside the labour codes in force since 21/11/2025. A missed deposit on the 7th or a mismatched challan costs interest, late fees and a disallowed expense. This article sets out the scope, the responsibility split and the filing controls that prevent those outcomes.

What does a virtual CFO do for payroll and TDS compliance in India?

A virtual CFO owns payroll and TDS as a controlled finance process, not a vendor task. That covers salary and perquisite computation, deduction of tax under section 392 and section 393 of the Income-tax Act, 2025, deposit by the 7th of the next month, quarterly returns, certificates, and reconciliation of the books to Form 26AS and the Annual Information Statement (AIS) before every filing.

Why do payroll and TDS errors compound as a company grows?

Payroll errors compound because every pay run feeds four downstream records: the salary TDS return, the provident fund return, the Employees’ State Insurance (ESI) return and the books. A wrong figure in month one carries into every later month and surfaces only when an employee’s tax statement or a quarterly return disagrees with the register. Finance ownership catches the error at source instead of at notice stage.

The break usually comes between 25 and 150 employees. A founder who ran payroll from a spreadsheet at 10 people now has a payroll vendor, a CA and an HR executive, each holding one piece of the cycle. Nobody owns the tie out between the payroll register, the challan and the return. Three patterns recur in the engagements we see:

• Salary changes (new hires, increments, ESOP exercises) reach the payroll vendor but not the tax computation.
• TDS on contractor and professional payments is handled by the accounts payable team on a different calendar from salary TDS, so one challan is deposited late.
• Regime choices and investment declarations (Form 122 and Form 124 under the Income-tax Rules, 2026) are collected in April and never refreshed, so the February and March deductions are wrong.

For many SaaS and services businesses, employee cost is the largest operating line, which makes the TDS and provident fund liabilities attached to it the largest recurring statutory cash calls. That is a finance question before it is an HR one. Our virtual CFO payroll service is built around that view.

What is in scope for virtual CFO payroll processing?

The scope runs from salary structuring and input control through the pay run, payslips, statutory deductions, bank payment file and journal posting, to full and final settlement on exit. The virtual CFO signs off the payroll register before money moves, not after. The payroll vendor or in-house HR keeps data entry and payslip distribution.

Payroll scope by stage

Stage	What the virtual CFO does	Output
Salary structuring	Splits CTC into components, tests it against the wages definition in the labour codes, models employer provident fund and gratuity cost	Approved structure sheet
Input control	Collects joiners, leavers, increments, loss of pay, reimbursements, loans and perquisite data with written approvals	Locked input file
Gross to net	Computes earnings, provident fund, ESI, professional tax, labour welfare fund and income tax on salary	Draft payroll register
Review and release	Reviews variance against the prior month, signs off, approves the bank payment file	Approved register and payment file
Posting	Books salary, statutory liabilities and reimbursements	Month end payroll journal
Exits	Settles dues, gratuity, leave encashment, notice recovery and the final TDS true up	Full and final statement

Salary structuring sits at the front of this cycle because the new tax regime and the 50% wages floor change both take-home pay and employer cost. The structure itself, including NPS, allowances and reimbursements, is covered in Treelife’s guide to salary structuring and TDS. The virtual CFO’s job here is narrower: cost the rebuild for the company, show the take-home effect side by side, and freeze the approved structure so payroll cannot drift from it.

The review step needs a written standard. Variance review means comparing headcount, gross pay, deductions and net pay to the prior month and explaining every line that moves beyond an agreed tolerance. Without a tolerance, the review becomes a glance.

How do master data controls stop ghost employees and payroll fraud?

Master data is the cheapest place to stop payroll fraud. Test every new employee, bank detail change and exit before the pay run, not after payment, and keep the exception report as evidence. The same data also drives TDS, because a wrong PAN or a missing exit date flows straight into the deduction and the return.

Payroll master data tests

Test	Risk it catches	Evidence kept	When run
New employee matched to the signed joining pack, PAN and bank proof	Ghost employee	Joining checklist with approver	Before the first pay run
Duplicate bank account or PAN across employees	Fictitious or duplicate payee	Exception report	Every pay run
Bank detail changed inside an agreed freeze window before payroll	Salary diversion	Change request confirmed by the employee	Every pay run
Payroll headcount matched to HR headcount and attendance or access records	Absent or exited employees paid	Three-way headcount match	Monthly
Exit processed in the month of the last working day	Salary continuing after exit	Exit checklist with settlement status	On every exit
Manual overrides, overtime and variable pay	Inflated pay	Override log approved by someone other than the preparer	Every pay run

Two links to TDS are worth stating. A missing or inoperative PAN attracts a higher deduction rate (section 206AA of the 1961 Act, covered in Treelife’s TDS and TCS guide), and the employee’s credit then fails to show in the annual tax statement. Payroll master data is also personal data, so access, retention and vendor terms matter; the data protection angle of handing payroll to a third party is covered in payroll outsourcing for startups.

Which TDS streams does a virtual CFO own, and what feeds each one?

A virtual CFO owns six TDS streams: salary, perquisites and ESOPs, vendors and professionals, rent and commission, foreign payments, and year-end provisions. Each has a feeder system, a trigger and a named owner. Rates, thresholds and section codes for each are in Treelife’s TDS and TCS compliance guide and are not repeated here.

TDS streams under virtual CFO ownership

Stream	Feeder	Trigger to watch	Control the virtual CFO runs
Salary	Payroll register, regime and investment declarations	Mid-year joiners, regime switch, previous employer income	Monthly computation review, refresh before Q3, true up in Q4
Perquisites and ESOPs	Cap table, ESOP ledger	Exercise or vesting event	Same day trigger from the cap table to payroll, with a tax funding plan
Vendors and professionals	Accounts payable, vendor master	Credit or payment of the invoice, whichever is earlier	PAN, nature of payment and section assigned before the first payment
Rent and commission	Lease and agent agreements	Monthly credit to the party	Rent roll and commission ledger tied to the TDS ledger
Foreign payments	Remittance requests	Payment or credit to a non-resident	Rate and treaty check and remittance certification before release
Year-end provisions	Month 12 close	Provision booked on 31/03	Provision list reviewed for TDS due by 30/04

Salary TDS and the ESOP handoff

Salary TDS (section 392 of the Income-tax Act, 2025, earlier section 192) is estimated on the declared regime and spread over the remaining months. Three inputs decide whether the number is right: the regime declaration (Form 122), the investment declaration (Form 124) and income from a previous employer in the year. The virtual CFO fixes cut off dates for all three and trues up in the last quarter.

ESOP exercises are the stream most often missed, because the event is created on the cap table and not in payroll. Tax on the perquisite must be deducted even though no cash has moved, so the exercise should trigger a payroll entry and a tax funding arrangement on the same day.

How do PF, ESI, professional tax and gratuity fit the same monthly close?

Provident fund, ESI, professional tax, labour welfare fund and gratuity each run on their own calendar and wage definition, and the labour codes in force from 21/11/2025 changed the wage base for several of them. The virtual CFO closes all of them in the monthly cycle off one payroll register, applying the rules set out in Treelife’s guides to PF compliance, ESI compliance and professional tax compliance.

The wage definition is where these obligations meet the books. If allowances above 50% of total remuneration are added back to wages, the PF and ESI base, the gratuity provision and the cost per head all move together. The mechanics are in the PF guide and in Treelife’s note on the new labour codes. The finance task is to rebuild the structure once and push the change through all three places in the same month.

Two accounting consequences follow. First, the gratuity provision needs re-measurement on the new base, which for companies reporting under Ind AS 19 or AS 15 is an actuarial exercise with a catch up entry. Second, the 21/11/2025 start date means the provision gap is already running for months, and an audit in March 2027 will ask when it was recognised.

Who is responsible for what: founder, virtual CFO, HR and external CA?

The virtual CFO owns computation, deposit, filing and reconciliation. The founder owns approvals and the statutory signature, HR owns the accuracy of employee data, and the external CA or auditor owns attestation. Liability for non-deduction and non-deposit stays with the company and its responsible person, and no engagement letter moves it.

Responsibility matrix for payroll and TDS

Task	Founder or director	Virtual CFO	HR	External CA or auditor
Salary structure and policy	Approves	Designs and costs	Communicates	Advises on tax position
Regime and investment declarations	None	Sets cut off dates, checks	Collects	None
Monthly inputs (joiners, exits, LOP)	None	Locks and reviews	Supplies	None
Payroll register and payment file	Releases payment	Computes and signs off	Reviews payslips	None
Salary TDS deduction and deposit	None	Owns	Supplies data	None
Vendor and professional TDS	Approves large contracts	Owns	None	Reviews sample
Quarterly returns and certificates	Authorises signatory	Prepares and files	Distributes certificates	Reviews on request
Reconciliation to Form 26AS and AIS	None	Owns	None	Relies on it
Notices and rectification	Approves response	Drafts and tracks	Supplies employee data	Represents where needed
Tax audit clause on TDS	Signs accounts	Prepares data	None	Reports under tax audit

Two points sit outside the matrix. Under section 204 of the 1961 Act the person responsible for paying is the company, acting through its principal officer, and prosecution for failure to deposit deducted tax is under section 276B of that Act (confirm the equivalent provisions in the 2025 Act). The company, not the virtual CFO firm, should therefore hold the TRACES login, the digital signature certificate and the Tax Deduction Account Number (TAN) records, with the virtual CFO using delegated access. If an engagement ends, the company keeps its filing history.

How far ahead of the statutory dates should internal deadlines sit?

Internal deadlines should sit two to five days ahead of every statutory date, so a bank failure, a portal outage or a rejected file does not turn into a default. The statutory dates themselves are in Treelife’s TDS and TCS guide and the compliance calendar for 2026. As on 13/10/2026, the 07/10 deposit for September has passed and the Q2 statements are due on 31/10/2026, which puts the internal target at 26/10/2026.

Statutory dates and internal targets

Obligation	Statutory date	Internal target	Owner
TDS deposit, all months except March	7th of the following month	5th	Virtual CFO prepares, company approves release
TDS deposit for March	30/04	25/04	Virtual CFO prepares, company approves release
Quarterly TDS statements (salary, resident non-salary, non-resident)	31/07, 31/10, 31/01, 31/05	Five working days earlier	Virtual CFO files, authorised signatory signs
Salary TDS certificate	15/06 after the tax year	First week of June, each matched to the filed statement	Virtual CFO prepares, HR distributes
PF contribution and return	15th of the following month	10th	Virtual CFO
ESI contribution	15th of the following month	10th	Virtual CFO
Professional tax and labour welfare fund	As notified by each state	Five days earlier	Virtual CFO

A dated working calendar, assigned to a named owner for each line and reviewed on the first working day of the month, is the simplest control in this article. It costs nothing and is the one most companies lack.

Which filing controls keep payroll and TDS clean?

Seven controls do most of the work: maker-checker on every pay run, a three-way tie out of register, ledger and challan, challan mapping before filing, reconciliation of the return to Form 26AS and AIS, a vendor master gate, declaration cut offs and segregated access. Each produces evidence a reviewer or auditor can open without asking anyone.

Payroll and TDS control set

Control	What it tests	Evidence kept
Maker-checker on the payroll register	Preparer and approver are different people, variance explained against the prior month	Signed register with variance note
Three-way tie out	TDS in the payroll register equals the TDS payable ledger equals the challan paid	Monthly reconciliation sheet
Challan mapping before filing	Each challan (BSR code, date, serial number) is matched to the deductee rows in the return	Mapping file per quarter
Return to Form 26AS and AIS	After processing, tax credit shown against each employee and vendor equals the return	Deductee-wise difference report
Vendor master gate	PAN present and operative, nature of payment recorded, section and rate assigned before first payment	Master change log
Declaration cut offs	Regime and investment declarations frozen on a set date, refreshed before Q3, trued up in Q4	Declaration tracker
Segregated access	Payroll preparation, bank release and return signing sit with different people	Access matrix, DSC custody record

The challan mapping and the 26AS check catch the defects that otherwise reach the company as notices. TRACES issues a justification report listing short deduction, late deduction and late deposit defaults after a return is processed, and the virtual CFO should pull it every quarter rather than wait for an intimation. A challan deposited under the wrong section code or the wrong assessment year is the commonest cause of a short payment default, and it is fixed by a correction statement, which is slower and costlier than a correct challan.

Three timing rules complete the set:

1. Close the month’s TDS payable ledger to zero by the 7th, after the deposit.
2. File the quarterly return at least five working days before the due date, so a rejected file can be repaired inside the deadline.
3. Pull Form 26AS and AIS for the quarter within 30 days of filing and clear every difference in writing.

How does payroll tie out from the register to the annual tax statement?

Payroll is clean when six records agree: the payroll register, the general ledger, the bank file, the challans, the quarterly statement and the annual tax statement. Each link has an owner and a frequency, and a break at any link is visible before it reaches an employee or a notice.

The payroll reconciliation chain

Link	What must agree	Frequency	Typical break
Register to ledger	Gross pay, deductions and net pay equal the payroll journal	Monthly	Manual journal edits, reimbursements booked elsewhere
Ledger to bank	Net pay equals the bank file and the bank debit	Monthly	Returned payments, unpaid exits
Ledger to challans	TDS, PF, ESI and professional tax payables clear to zero on deposit	Monthly	Part payments, wrong section code
Challans to quarterly statement	Each challan is mapped to deductee rows	Quarterly	PAN errors, unmapped challans
Statement to annual tax statement	Credit per employee and vendor equals the statement (Form 26AS under the 1961 Act)	Quarterly, after processing	PAN mismatch, unmatched challan
Annual tax statement to salary certificate	Tax on the certificate equals tax in the filed statement	Annual	Corrections made after filing not carried to the certificate

The accounting entries behind the first three links are simple, which is why departures from them are easy to spot:

• On booking payroll: debit salary expense and employer contributions; credit salary payable, TDS payable, PF payable, ESI payable and professional tax payable.
• On paying salary: debit salary payable; credit bank.
• On each statutory deposit: debit the relevant payable; credit bank.

A payable that does not clear to zero after its deposit date is the first sign of a missed or short payment, and it shows up in the ledger weeks before it shows up in a notice.

What happens when TRACES shows a default or an employee reports a missing credit?

Treat it as a ticket with an owner and a closing date. Classify the default, fix it at source, then close it with the employee or vendor in writing. The sequence below keeps the fix, the cost and the explanation in one record.

1. Pull the justification report from TRACES and classify the default: short deduction, late deduction, late deposit, unmatched challan or PAN error.
2. Fix the cause: pay any tax shortfall and interest, correct the challan mapping or PAN through a correction statement, and pay any late filing fee.
3. Re-test after processing: confirm the credit in the annual tax statement and reissue the salary certificate if the correction changes it.
4. Reply to the employee or vendor in writing with the corrected credit, and log the root cause in the exceptions log.

The charges attached to each default type are set out in the penalties section of Treelife’s TDS and TCS guide. A root cause logged three times in a year is a control to redesign, not a ticket to close again.

Where do payroll and TDS controls fail in practice?

Five failures account for most of the interest, fees and notices we see: late deposit after deduction, non-deduction on vendor invoices, late returns, stale declarations with unreported ESOP perquisites, and an unrevised wage base. Each is a control gap, not a knowledge gap. The interest, fee and penalty provisions for each default are set out in the penalties section of Treelife’s TDS and TCS guide.

Mistake 1: depositing late after deducting

It happens because the deduction is booked in the ledger and the deposit waits on a bank approval or a month end rush. The cost is 1.5% per month or part of a month, and the interest is not deductible as an expense. Fix it with an internal deposit deadline of the 5th and a challan approval that sits with a person other than the preparer.

Mistake 2: not deducting on vendor invoices

It happens because accounts payable books invoices without a section assigned, or classifies a professional as a contractor to apply a lower rate. The cost is 1% per month, a short deduction demand, and a 30% disallowance of the expense. Fix it at the vendor master: no payment to a vendor without a PAN and a section.

Mistake 3: filing the quarterly return on the due date

It happens because the deductee file is built from payroll and ledger exports at the last minute. A rejected file or a challan mismatch then lands after the deadline and the fee of ₹200 per day starts. Fix it with the five working day buffer in the timing rules above.

Mistake 4: stale declarations and unreported ESOP perquisites

It happens because declarations are collected once in April and ESOP exercises are treated as a cap table event, not a payroll event. The cost is a short deduction in the final quarter and a demand on the employee. Fix it with a refresh before Q3 and an ESOP exercise trigger that flows to payroll the same day.

Mistake 5: ignoring the revised wage base

It happens because the payroll vendor’s template still follows the old basic and allowance split. The cost is a provident fund and gratuity shortfall running from 21/11/2025, with interest and damages on the provident fund side. Fix it with a structure review against the wages definition and a catch up computation.

How should payroll and TDS controls be retested after the move to the 2025 Act?

The Income-tax Act, 2025 replaced the 1961 Act from 01/04/2026, and the move changed section codes and form numbers more than rates. The retest is therefore operational: challans, deductee files, certificates and reconciliations must each carry the right period and the right code. The section and form mapping is in Treelife’s TDS and TCS guide and is not repeated here.

1. Test one challan end to end under the section 392 and section 393 codes before each month’s deposit run.
2. Keep two tracks by tax year. Periods up to tax year 2025-26 stay on the 1961 Act and the old forms. From 2026-27 the new forms apply: Form 138 for salary, Form 140 for resident non-salary and Form 144 for non-resident payments. Never merge deductee files across the cut off.
3. File the Q2 statements early as a test of the new utilities, and read the TRACES justification report before the Q3 filing.
4. Rebuild salary structures against the wages definition and re-measure the gratuity provision, as set out earlier in this article.
5. Match every salary certificate (Form 130) to the filed statement before issue.

Three points remain unsettled in the sources reviewed:

• Publishers differ on the form number of the annual tax statement under the 2026 Rules. Check the portal before quoting it to employees.
• The 2025 Act equivalents of section 40(a)(ia) and section 276B of the 1961 Act were not verified.
• State rules under the labour codes are still being notified, and the central rules should be read on the Ministry of Labour and Employment portal.

What does a monthly payroll and TDS close checklist look like?

A monthly close runs in four blocks: lock inputs before the pay run, release and book payroll, deposit statutory dues ahead of the 7th and the 15th, then reconcile and report. The dates below are internal targets that sit two to five days ahead of the statutory dates, so a bank failure or a portal outage does not turn into a default.

Before the pay run (by the 22nd)

• Lock joiner, leaver, increment and loss of pay inputs with written approval
• Apply regime and investment declaration changes
• Post ESOP exercises and other perquisites to payroll
• Run the draft register and complete the variance review against the prior month

Release and booking (by the last working day)

• Maker-checker sign off on the register
• Approve the bank payment file and release salary
• Book the payroll journal and the statutory liabilities

Statutory deposits (by the 5th and the 10th)

• Deposit salary TDS and vendor TDS challans by the 5th
• Deposit provident fund and ESI by the 10th
• Pay professional tax and labour welfare fund where due

Reconciliation and reporting (by the 12th)

• Complete the three-way tie out of register, TDS payable ledger and challan
• Update the deductee-wise TDS tracker that feeds the quarterly return
• Publish the payroll MIS pack and the exceptions log

The MIS pack is what makes the process visible to the founder. It should carry five items: headcount and payroll cost by department against budget, statutory dues paid against dues payable, TDS payable ageing, count and value of exceptions raised and cleared, and the next 30 days of filing dates. Anything longer than two pages stops being read. Our MIS and financial budgeting service uses the same pack format, so payroll cost sits next to the budget it is measured against.

Year-end additions (January to June)

• January: refresh regime and investment declarations before the final quarter
• February: run the true up computation for every employee and show employees the expected March deduction
• March: review year-end provisions and accruals for TDS that falls due by 30/04
• April: deposit March TDS by 30/04 and clear the payables to zero
• May: file the Q4 statements by 31/05 and close all quarterly reconciliations
• June: issue salary certificates by 15/06, each matched to the filed statement

Evidence pack for auditors and investors

The evidence pack is built every month, not at the audit. It holds the signed payroll registers, challans with their payment references, quarterly statements with acknowledgements, TRACES justification reports, the reconciliation chain, certificates issued, correction statements and the exceptions log. Statutory auditors test TDS payable, TDS returns reconciled to the books and defaults on TRACES, and investors ask for the same items in diligence.

Treelife’s TDS guide notes that the tax audit report under the 2025 Act asks for counts and amounts of TDS transactions not reported. Confirm the form and clause numbers before relying on that, but keep deductee-level records either way.

What changes when the employer is the Indian subsidiary of a foreign parent?

The Indian subsidiary stays the employer for tax deduction even when pay, equity or reporting lines sit abroad. Four items need a written owner: parent equity awards, secondees, cost reimbursements to the parent and dual reporting.

• Parent equity awards: RSUs or options of the foreign parent are generally taxed in India as perquisites at vesting or exercise, and the Indian entity needs the vest data from the parent on the day and a way to fund the tax. See Treelife’s note on foreign parent company ESOPs and confirm the treatment for each plan.
• Secondees and expatriates: residential status and the treaty position decide whether salary is taxed in India and whether the Indian entity deducts tax. Keep a day count for each person.
• Cost reimbursements to the parent: recharges of salary cost can attract withholding under section 195 of the 1961 Act depending on the treaty and the nature of the payment. Check before remittance.
• Dual reporting: reconcile payroll cost between the Indian statutory books and the parent’s reporting format every month.

Frequently asked questions

Q: What is the difference between a payroll vendor and a virtual CFO for payroll and TDS?

A: The vendor processes the pay run. The virtual CFO reviews it, reconciles it to the books, deposits the tax and files the statements. Most companies keep the vendor for data entry and add the virtual CFO as the independent reviewer, which is the hybrid model.

Q: Who is liable if a TDS deposit is missed under a virtual CFO engagement?

A: The company. Under section 204 of the 1961 Act the person responsible for paying is the company, acting through its principal officer. An engagement letter can add an indemnity but cannot move the statutory liability. Confirm the 2025 Act equivalent before quoting this to a client.

Q: Which TDS streams should sit under the virtual CFO?

A: Salary, ESOP perquisites, vendor and professional payments, rent and commission, foreign payments and year-end provisions. Each needs a named feeder system and owner, as in the ownership map earlier in this article.

Q: How long does it take to move payroll and TDS to a virtual CFO?

A: Plan for one parallel payroll cycle and one full quarter before the first statement under the new process. The exact plan depends on the state mix, the payroll vendor and the number of open periods, and is fixed at scoping.

Q: Which documents does a virtual CFO need to start?

A: The TAN and TRACES access, PAN, digital signature certificate, the last 12 months of registers and challans, filed statements and certificates, the salary structure, the ESOP plan and exercise records, the vendor list with PAN and sections, and the PF and ESI registrations.

Q: How are periods under the 1961 Act and the 2025 Act kept separate?

A: By tax year. Periods up to tax year 2025-26 stay on the old forms and provisions, and 2026-27 onward uses the new ones. Deductee files, challan sets and certificates are held in two tracks, and corrections to old periods are filed in the old forms.

Q: What should the founder see every month?

A: A two page pack: payroll cost against budget, statutory dues paid against due, TDS payable ageing, exceptions raised and cleared, and the filing dates for the next 30 days. The reconciliation chain is attached, not summarised away.

Q: What happens if TRACES shows a default after a statement is processed?

A: The virtual CFO classifies it from the justification report, pays any shortfall and interest, files a correction statement where the data was wrong, and replies to the affected employee or vendor in writing. The charges for each default type are in Treelife’s TDS and TCS guide.

Q: How are ESOP exercises handled in payroll?

A: The exercise triggers a payroll entry on the same day, with the perquisite valued and the tax funded by the employee or through an agreed mechanism. The cap table owner and the payroll owner confirm the figures.

Q: Does the virtual CFO also run PF, ESI and professional tax?

A: Yes, in the same monthly close and off one register. State registrations stay in the company’s name.

Q: How do investors test payroll and TDS compliance in diligence?

A: They ask for deposit dates, filed statements, TRACES defaults and PF returns. A monthly evidence pack and a clean justification report answer most of those requests directly. Open defaults and demands become findings and can lead to specific indemnities.

Q: Can the company keep its existing payroll software or vendor?

A: Yes. The vendor continues data entry and payslips, and the virtual CFO adds the maker-checker, the reconciliations, the deposits and the filings. A switch to a new system is a separate project with its own parallel run.

Q: What does an exit from a virtual CFO engagement look like?

A: Clean, if the company owns the TRACES login, the digital signature certificate and the filing history. The handover pack carries the evidence pack, the calendar, open exceptions and any pending correction statements.