Background Verification for LLP in India: A Single Package

Starting a background-verification business in India puts you at the intersection of three regulatory regimes simultaneously: the LLP Act 2008, the Income Tax Act 1961 (and now the Income Tax Act 2025 for Tax Year 2026-27), and the Digital Personal Data Protection Act 2023 (DPDP Act) with its Rules notified in November 2025. Each has its own deadlines, penalties, and documentation requirements. Getting one wrong creates liability in the others. Industry data from background-verification firms operating in India consistently shows that roughly 1 in 5 resumes carries a material discrepancy, from inflated job titles to fabricated degrees. That number makes background verification a commercially strong sector to build in, and a regulatory minefield if the compliance infrastructure is assembled in the wrong sequence. This guide covers every component in the order a background-verification LLP needs to address it, with the sector-specific depth that generic LLP compliance guides skip.

What compliance does a background-verification LLP carry from the day it is incorporated?

A background-verification LLP must complete FiLLiP and Form 3 with the MCA, obtain PAN and TAN, register for GST (recommended from Day 1 for corporate clients), put a DPDP Act-compliant data-processing policy and consent workflow in place before the first candidate check, and execute a Data Processing Agreement with every sub-vendor before sharing any personal data. These are not sequential tasks. The DPDP Act’s consent obligation starts with the first data point collected, not with the first revenue received.

Is LLP the right structure for a background-verification business?

For a verification business at the pre-revenue to roughly ₹3 crore annual turnover stage, the LLP is the correct starting structure. Four concrete reasons drive this.

The LLP is a separate legal entity under Section 3 of the LLP Act 2008. Client contracts, data-processing agreements, and regulatory registrations sit in the entity, not with founders personally. In a business that processes sensitive personal data of thousands of candidates, that separation matters.

Audit is conditional under the LLP Act. Statutory audit is required only if annual turnover exceeds ₹40 lakh or total partner contribution exceeds ₹25 lakh (Rule 24, LLP Act 2008). A verification startup in its first 18 months typically stays below both thresholds, avoiding ₹40,000 to ₹80,000 in annual audit costs.

Profit distribution to partners is exempt under Section 10(2A) of the Income Tax Act 1961. The LLP pays tax at 30% flat on net profit, and the distributed amount is not taxed again in partners’ hands. For a two-partner verification business that extracts most profit, this is often more tax-efficient than a Private Limited Company, which pays 25.17% under Section 115BAA but then distributes dividends taxed at individual slab rates.

The annual MCA compliance burden for an LLP is Form 8 (due 30 October) and Form 11 (due 30 May), significantly lighter than a Private Limited Company’s additional AGM, Form AOC-4, Form MGT-7, and board resolution requirements.

Where an LLP falls short for a verification business: SEBI-registered Alternate Investment Funds (AIFs) cannot invest in LLPs, only in equity instruments. ESOPs to retain senior analysts are not available in an LLP. Plan the conversion timeline to a Private Limited Company before either of these inflection points.

For a full comparison of LLP and Private Limited Company across 18 parameters, see Treelife’s LLP vs Private Limited Company guide.

LLP vs Private Limited Company: summary for verification businesses

Parameter	LLP	Private Limited Company
Governing law	LLP Act 2008	Companies Act 2013
Statutory audit	Only if turnover > ₹40 lakh or contribution > ₹25 lakh	Mandatory regardless of size
Annual MCA forms	Form 8, Form 11, ITR-5	AOC-4, MGT-7, ITR-6, AGM
Entity tax rate FY 2026-27	30% + surcharge + 4% cess (effective ~31.2%)	25.17% (Section 115BAA)
Profit distribution tax	Exempt in partners’ hands (Section 10(2A))	Dividend taxed at slab rate in shareholders’ hands
Equity fundraising	Not possible	Full VC/AIF eligible
ESOP capability	Not available	Available
Approximate annual compliance cost	₹25,000 to ₹60,000	₹80,000 to ₹1.5 lakh

What to get right at FiLLiP

Incorporation happens through Form FiLLiP (Form for Incorporation of LLP) on the MCA V3 portal. A clean filing with Aadhaar-linked DSCs typically receives the Certificate of Incorporation within 3 to 7 working days. Three decisions at this stage are specific to verification businesses and are missed in generic guides.

NIC code selection. FiLLiP requires a National Industrial Classification code. The MCA V3 portal uses NIC-2008. The correct code for a background-verification business is NIC 74909: “Other professional, scientific and technical activities n.e.c.” This is the same category used for other investigation, intelligence research, and employment screening businesses. Selecting an incorrect code does not block incorporation but creates friction during Udyam registration, government tender eligibility checks, and sector-specific regulatory queries later.

Name restrictions for verification businesses. Names containing “Investigation”, “Intelligence”, or “Detective” require a no-objection from the Home Ministry under Rule 18 of the LLP Rules 2009 before the MCA will process the FiLLiP filing. “National” or “India” in the name requires prior government approval. A verification business that includes any of these words without the prior clearance will face a FiLLiP rejection after 3 to 7 days of processing time. Clear the name with the MCA RUN (Reserve Unique Name) tool before filing FiLLiP.

First financial year planning. If the LLP is incorporated after 30 September of a given year, it may opt to extend its first financial year to 31 March of the following year, giving a first financial year of up to 18 months (Section 2(1)(l), LLP Act 2008). This affects when the first Form 8 and Form 11 are due. A verification LLP incorporated in November 2026 that exercises this option has its first Form 8 due 30 October 2028 and its first Form 11 due 30 May 2028. Founders who assume a standard 12-month first year file on the wrong dates.

For the full post-incorporation mechanical checklist (DIN, DSC, bank account, PAN, TAN), see Treelife’s post-incorporation formalities guide.

What must go into the LLP Agreement for a verification business?

The LLP Agreement must be filed with the MCA in Form 3 within 30 days of incorporation. A delay attracts ₹100 per day with no cap. For a background-verification LLP, three provisions that generic templates omit should be in the Agreement before it is executed.

One, explicitly allocate DPDP Act compliance ownership. The DPDP Act 2023 designates the entity as the data fiduciary, but internal responsibility must be assigned. Name which designated partner holds data fiduciary responsibilities: consent framework maintenance, sub-vendor DPA execution, data-retention policy updates, and Data Protection Board correspondence.

Two, set partner remuneration within Section 40(b) limits. For FY 2025-26 (AY 2026-27) under the Finance Act 2024 revised limits, the maximum allowable remuneration to working partners is ₹3,00,000 or 90% of the first ₹6,00,000 of book profit (whichever is higher), plus 60% of book profit beyond ₹6,00,000. Amounts above this are disallowed as a deduction at the LLP level.

Three, define data-access boundaries between partners. If one partner manages client relationships and another manages the verification platform, document who can access what categories of candidate data. Enterprise clients in BFSI, IT/ITeS, and healthcare increasingly audit their verification vendors’ governance documents, including the LLP Agreement, as part of their own RBI/SEBI and DPDP compliance reviews. An Agreement that is silent on data access gives a client’s auditor nothing to work with and can stall vendor onboarding.

What registrations must a background-verification LLP complete after incorporation?

GST registration. Background-verification services are classified under SAC 998399 (“Other professional, technical and business services”) and attract GST at 18% (Schedule II, Notification No. 11/2017-CT(Rate)). GST registration is mandatory once aggregate turnover crosses ₹20 lakh in a financial year (₹10 lakh in specified special category states). Voluntary registration from Day 1 is strongly recommended for any verification business targeting corporate clients: clients cannot claim Input Tax Credit on invoices from an unregistered vendor, and the absence of a GSTIN is a practical bar to enterprise sales. Under GST 2.0 (effective November 2025), Aadhaar-authenticated applicants who pass automated risk checks receive GST approval within 3 working days.

Professional Tax. Maharashtra, Karnataka, and Tamil Nadu require Professional Tax registration for LLPs with employees within 30 days of commencing business. The annual Professional Tax liability for the LLP entity in Maharashtra is ₹2,500. This is separate from GST and is a state-level obligation that many founders overlook when GST and MCA registrations are the focus.

Shops and Establishment Act registration. Required in most states within 30 days of commencing business at the registered office, including in states where the office has only partners and no employees. The administering authority and fee vary by state.

Udyam Registration. A verification business with turnover below ₹50 crore qualifies as a Small Enterprise under the MSME Development Act. Udyam registration is not mandatory but opens access to government contracts requiring MSME credentials, priority-sector lending, and some state-level procurement preferences. NIC 74909 is the code to use here as well.

What does the DPDP Act 2023 require from a background-verification LLP?

This is the regulatory layer that no generic LLP compliance guide addresses, and it is the one creating the most significant new liability for verification businesses. The Digital Personal Data Protection Act 2023, with its Rules notified in November 2025, is in phased enforcement. The Data Protection Board of India (DPBI) is now operational, and full enforcement is mandated from May 2027.

Under the DPDP Act, a background-verification LLP is a data fiduciary. Every check it initiates, whether identity, employment history, education, criminal records, or address, is a personal data processing activity within the Act’s scope. This applies from the first check conducted, regardless of whether revenue has been received.

Consent management. The consent notice must be specific, separate, and unambiguous. A single line in an employment offer letter authorising background checks no longer meets the standard. The notice must name each category of data being collected, the stated purpose, and the retention period. E-signed or OTP-verified digital consent forms with audit logs are the operational standard.

Data minimisation. Section 6 of the DPDP Act requires collecting only data that is necessary for the stated purpose. A verification business cannot collect health records or biometric data beyond identity confirmation without a role-specific justification. Financial records should not be accessed for roles that do not handle money. The internal test: can you justify each data point in one sentence tied to the specific role? If not, do not collect it.

Retention and deletion. Rejected candidate data must be deleted within 180 days of the purpose being fulfilled, unless a specific regulatory requirement mandates longer retention. BFSI-sector clients often require their own retention periods of 5 years or more for RBI compliance. Define retention periods in a documented data-retention policy before the first verification is completed, and align them with client contract terms.

Sub-vendor Data Processing Agreements (DPAs). When a verification LLP engages sub-vendors including court record retrieval services, field address-verification agents, or education database providers, those vendors are data processors under the DPDP Act. A signed DPA must be in place before any personal data is shared with them. Operating without a DPA exposes the LLP as the data fiduciary to penalties for the processor’s acts or omissions.

Client-side implications. Corporate clients in BFSI, IT/ITeS, and healthcare now require verification vendors to provide proof of DPDP compliance as part of vendor due diligence: consent framework documentation, a Data Processing Agreement template, and a data-retention policy. This is not a nice-to-have. Treelife has seen enterprise onboarding delayed 60 to 90 days because a verification LLP had not built this infrastructure before chasing its first major account.

Penalties. The DPBI can impose penalties up to ₹250 crore for significant personal data breaches or violations of consent requirements. Penalties are assessed per data principal (per candidate), not per incident. A verification business with 500 active checks and a non-compliant consent form is not one violation; it is 500.

How should a background-verification LLP maintain its accounts?

The LLP Act 2008 mandates books of accounts on an accrual basis using the double-entry system (Rule 24, LLP Rules 2009). Cash-basis accounting is not permitted. Books must be maintained for each financial year ending 31 March and preserved for 8 years.

Revenue recognition for verification businesses. Verification fees should be recognised on service completion: when the report is delivered to the client, not on invoice date or cash receipt. This matters because corporate clients typically contract for bundled monthly checks on a retainer basis. An annual ₹12 lakh retainer billed on 1 April is deferred revenue, recognised at ₹1 lakh per month. A verification LLP that recognises the full ₹12 lakh as April income overstates revenue in Form 8, may cross the audit threshold ahead of schedule, and creates a GST payment liability before the cash has been earned. The correct treatment is also critical for the audit trail if the DPBI ever cross-references data-deletion timelines against revenue cycles.

The LLP Act audit vs the Income Tax Act tax audit: not the same thing. This is the most expensive confusion in LLP accounting. They are two separate requirements with different triggers, different output forms, and different filing deadlines.

Criterion	LLP Act audit	Income Tax Act tax audit
Governing provision	Section 34(4), LLP Act 2008 / Rule 24(8), LLP Rules 2009	Section 44AB, Income Tax Act 1961
Trigger: turnover	Above ₹40 lakh	Above ₹1 crore (₹10 crore for digital-heavy LLPs with 95%+ digital receipts and payments)
Trigger: contribution	Contribution above ₹25 lakh	Professional gross receipts above ₹50 lakh
Output form	Form 8 filed with MCA	Form 3CA/3CB + 3CD filed with Income Tax Department
Filing deadline	30 October	31 October (or 30 November if Form 3CEB applies)

A verification LLP with ₹60 lakh turnover and ₹15 lakh contribution needs the LLP Act audit but not the Income Tax Act tax audit. A larger LLP crossing ₹1 crore turnover needs both simultaneously. The auditor should be appointed at least 30 days before the financial year-end to avoid rushed filings. For the complete annual filings checklist including Form 11, DIR-3 KYC, advance tax, and TDS returns, see Treelife’s full LLP compliance guide.

Section 194T: TDS on partner remuneration from 1 April 2025. The Finance Act 2024 introduced Section 194T, effective 1 April 2025. Any LLP paying salary, remuneration, commission, bonus, or interest on capital to a partner must deduct TDS at 10% if aggregate payments to that partner exceed ₹20,000 in a financial year. Deposit by the 7th of the following month and report in quarterly Form 26Q. Non-deduction attracts interest under Section 201 and disallowance risk on the remuneration amount.

What GST and TDS treatment applies to verification service revenues?

GST. As noted above, SAC 998399 applies at 18%. If the LLP invoices across states (for example, a Mumbai-registered LLP serving a Bengaluru-headquartered client where the candidate is in Delhi), the place of supply is the recipient’s location under Section 12(2) of the CGST Act 2017 (the general B2B rule). IGST at 18% applies on interstate supplies. Multi-state verification businesses need the GSTIN of each client’s registered office and each supply state where relevant.

TDS on verification service invoices. Corporate clients who pay the LLP for verification services will deduct TDS. The applicable section depends on how the service is characterised. Background verification is typically classified as “technical services” under Section 194J of the Income Tax Act 1961, attracting TDS at 2% (the Section 194JA rate for technical services, applicable once aggregate payments exceed ₹30,000 in the financial year).

Some clients may attempt to apply Section 194C (contract for work) at 1%, arguing that verification is a routine outsourced process rather than a technical service. This classification is unfavourable for two reasons. First, 194J TDS generates a 2% credit in the LLP’s Annual Information Statement, and if clients deduct at 1% under 194C, the mismatch between the credit on record and the amount the LLP claims triggers a demand notice requiring reconciliation. Second, 194C is appropriate for labour-supply or works contracts; background verification is analytical and report-based, which most tax authorities treat as technical services.

Specify “professional and technical background screening services under Section 194J” on every invoice. Include the applicable TDS section in the master services agreement with each client. This two-line addition prevents months of reconciliation notices.

TDS the LLP must deduct on its own payments. Sub-vendor payments for court-record retrieval, field verification, or database access that are structured as professional or technical service engagements attract Section 194J (2% for technical services, 10% for professional services). Sub-vendor payments structured as labour-supply or sub-contractor arrangements may fall under Section 194C at 1% to 2%. Document the rationale for each classification in the vendor agreement.

What does annual MCA compliance look like, and what is the one consequence most founders miss?

The annual compliance calendar for a background-verification LLP is Form 8 (30 October), Form 11 (30 May), ITR-5 (31 July for non-audit LLPs, 31 October for audit LLPs), and DIR-3 KYC for each designated partner (30 September). GST returns and TDS returns run on their own monthly and quarterly cycles. For the complete compliance calendar with penalty amounts for every form, see Treelife’s LLP compliance guide.

The one operational consequence most verification LLP founders discover too late: pending annual filings block all event-based MCA filings. If Form 11 or Form 8 is overdue, the LLP cannot file forms for partner changes, registered office changes, or LLP Agreement amendments. The MCA system rejects event-based forms until all outstanding annual returns are cleared, with all accumulated daily penalties paid. An LLP trying to admit a strategic investor or change its registered office is locked out until it has cleared the compliance backlog. The compliance debt compounds operationally, not just financially.

Common mistakes that block client onboarding or attract penalties

Treating DPDP compliance as a future obligation. The DPDP Rules were notified in November 2025 and are enforceable now. A verification LLP that begins operations without a consent management workflow and a data-retention policy is already non-compliant. The DPBI’s penalty ceiling of ₹250 crore is per category of violation, per data principal.

Using the wrong name in FiLLiP. Names containing “Investigation”, “Intelligence”, or “Detective” require Home Ministry clearance before MCA will process the filing. The FiLLiP is rejected after the standard processing time, meaning the founders lose 3 to 7 days and must refile. Verify the name through RUN before FiLLiP.

Skipping voluntary GST registration. Enterprise clients cannot claim Input Tax Credit on invoices from an unregistered vendor. The absence of a GSTIN is a practical bar on corporate sales. Register from Day 1, not after the first client requests an invoice.

Filing Form 3 late. The LLP Agreement must be filed within 30 days of incorporation. Founders who spend the first month negotiating agreement terms after receiving the Certificate of Incorporation are already accumulating ₹100 per day. Execute and file the Agreement in the same week as incorporation.

Allowing sub-vendor data transfers without a DPA. Sharing candidate personal data with a court-record service or field agent without a signed Data Processing Agreement is a DPDP Act violation from the first transfer. Sub-vendor DPAs are not a pre-enterprise-client requirement; they are a Day 1 operational requirement.

Wrong TDS classification from clients. If clients deduct at 1% under Section 194C instead of 2% under Section 194J, the LLP’s Annual Information Statement shows a 1% credit. Filing ITR-5 and claiming 2% triggers a mismatch notice. Specify 194J on every invoice and in every MSA.

Conflating LLP Act audit and Income Tax Act tax audit. Partners who cross the ₹40 lakh turnover threshold and have their CA engaged only on the income tax side end up filing Form 8 without the required LLP Act audit. These are non-compliant filings that surface during investor due diligence. Appoint the auditor for both purposes, or clarify in writing which audit the CA engagement covers.

Missing Section 194T from 1 April 2025. Partner remuneration above ₹20,000 per year now attracts 10% TDS at the LLP level under Section 194T. Most founders setting up LLPs in 2025 and 2026 are unaware because the provision was introduced by the Finance Act 2024. Non-deduction creates a disallowance risk on the remuneration and attracts interest under Section 201.

Case study

Situation: Pune-based background-verification LLP, two designated partners, incorporated in Q3 FY 2025-26 targeting mid-market IT and BFSI employers.

Challenge: First enterprise client (a RBI-regulated NBFC) requested a vendor compliance certificate, Data Processing Agreement, and proof of DPDP-compliant consent workflow before signing the MSA. The LLP had none of these. Form 3 had also not been filed despite 45 days elapsed from incorporation, generating ₹4,500 in penalties. No GST registration existed. The NBFC required the correct SAC code and 18% GST treatment on invoices before proceeding.

What Treelife did: Filed Form 3 immediately and cleared the accumulated penalty. Registered for GST under SAC 998399 within 5 working days. Drafted a DPDP-compliant consent framework and sub-vendor DPA template. Prepared the vendor compliance package the NBFC required.

Outcome: NBFC onboarding completed 18 days after Treelife engagement. The LLP signed a ₹18 lakh per year MSA. Total cost of the delayed compliance: ₹4,500 in MCA penalties plus approximately 6 weeks of lost revenue. Total cost of setting it right: 18 days.

Frequently asked questions

Q: Can a background-verification business register as an LLP if one partner is an NRI?
A: Yes. An NRI can be a partner in an Indian LLP, but at least one designated partner must be an Indian resident (Section 7, LLP Act 2008). Capital contribution by the NRI partner remitted from abroad must follow the FEMA 1999 automatic route for LLPs, with a FEMA reporting obligation in Form FC-LLP within 30 days of capital receipt.

Q: Is GST registration compulsory for a background-verification LLP from Day 1?
A: Not mandatory below ₹20 lakh annual turnover (₹10 lakh in specified special category states). Voluntary registration from Day 1 is strongly recommended for any verification business targeting corporate clients, because clients need a GSTIN to claim Input Tax Credit on verification fees.

Q: What SAC code applies to background-verification services?
A: SAC 998399 (“Other professional, technical and business services”) at 18% GST. This covers employment screening, education verification, criminal record checks, and identity verification services.

Q: What TDS does a corporate client deduct on verification invoices?
A: Section 194J (technical services) at 2% (Section 194JA rate), applicable once aggregate payments exceed ₹30,000 in the financial year. Specify this section on every invoice and in every MSA to prevent clients from applying the Section 194C rate of 1%.

Q: How does the DPDP Act affect the LLP’s sub-vendor relationships?
A: Sub-vendors who access or process candidate data (court-record services, field agents, education database providers) are data processors under the DPDP Act 2023. A signed Data Processing Agreement is mandatory before sharing any personal data with them. Operating without a DPA exposes the LLP to penalties as the data fiduciary, since the LLP remains responsible for the processor’s compliance.

Q: Is a statutory audit mandatory for a background-verification LLP?
A: Conditional. LLP Act audit is mandatory only if annual turnover exceeds ₹40 lakh or partner contribution exceeds ₹25 lakh (Rule 24, LLP Act 2008). Income Tax Act tax audit is separately mandatory if turnover exceeds ₹1 crore (or ₹10 crore for LLPs where both cash receipts and cash payments are each below 5% of total). Both can apply simultaneously. Appoint the auditor at least 30 days before financial year-end.

Q: When does a background-verification LLP’s compliance clock start?
A: From the date of issue of the Certificate of Incorporation. There is no dormancy window. Even a zero-revenue LLP must file NIL Form 11 by 30 May and NIL Form 8 by 30 October of each year, and NIL ITR-5 by the applicable deadline. Missing these attracts ₹100 per day per form with no ceiling under the LLP Act.

Q: Does the DPDP Act apply if the LLP is not yet generating revenue?
A: Yes. The obligation is triggered by the processing of personal data, not by revenue. An LLP conducting trial verifications before billing is already processing personal data and must have consent workflows in place.

Q: What is the income tax rate for an LLP in FY 2026-27?
A: 30% flat on net taxable income, plus surcharge at 12.5% if income exceeds ₹1 crore, plus 4% Health and Education Cess. The effective rate for income below ₹1 crore is 31.2%. Alternate Minimum Tax under Section 206 of the Income Tax Act 2025 (formerly Section 115JC of the 1961 Act) applies at 18.5% of adjusted total income if the LLP claims specified deductions.

Q: When should a background-verification LLP convert to a Private Limited Company?
A: The practical triggers are: a formal term sheet from a VC or AIF (neither can invest in LLPs), a need to issue ESOPs to retain senior analysts, or turnover crossing ₹3 to ₹5 crore where the 25.17% corporate rate under Section 115BAA produces material tax savings even after dividend tax. Conversion is possible under Section 366 of the Companies Act 2013. The earlier it happens, the simpler the stamp duty and asset-transfer mechanics.

Q: What is Section 194T and how does it affect partner remuneration planning?
A: Section 194T (Finance Act 2024, effective 1 April 2025) requires the LLP to deduct TDS at 10% on any salary, remuneration, commission, bonus, or interest on capital paid to a partner where aggregate payments exceed ₹20,000 in the financial year. Deposit by the 7th of the following month. Report in quarterly Form 26Q. Without a valid PAN or Aadhaar from the partner, the rate rises to 20% under Section 206AA.

Q: Can a background-verification LLP claim the Section 80-IAC startup tax exemption?
A: Yes, if DPIIT recognition is obtained. Requirements: incorporated after 1 April 2016, annual turnover below ₹100 crore, working toward innovation in products or services, not formed by splitting or reconstructing an existing business. The Section 80-IAC exemption gives 100% deduction on profits for 3 consecutive years out of the first 10 years from incorporation.

Q: What happens if Form 11 or Form 8 is overdue when the LLP needs to add a new partner?
A: The MCA system blocks all event-based filings while annual returns are outstanding. The LLP cannot file the partner addition form until Form 11 and Form 8 arrears are cleared and all accumulated daily penalties are paid. Commercial deals that require a governance change are delayed until the compliance backlog is resolved.

Regulatory references:

• LLP Act 2008: Sections 2(1)(l), 3, 7, 21, 34, 35
• LLP Rules 2009: Rules 18 (name restrictions), 24 (audit threshold, books of accounts)
• LLP (Second Amendment) Rules 2022
• Income Tax Act 1961: Sections 10(2A), 40(b), 44AB, 80-IAC, 115JC, 194C, 194J, 194T, 201, 208
• Income Tax Act 2025: Section 206 (AMT for non-corporates, Tax Year 2026-27 onwards)