When you incorporate through the MCA's SPICe+ form, you already receive up to 11 linked services, including PAN, TAN, EPFO and ESIC registration. The tech work starts after that: a domain and email that land in inboxes, GST registration once you cross ₹20 lakh in service turnover, accounting software that keeps an audit trail, and a data protection setup that fits the DPDP Rules notified in November 2025.
What SPICe+ has already done for you
Since 23 February 2020, every new company in India is incorporated through SPICe+, which the Ministry of Corporate Affairs now describes as 11 services from three central ministries and two state governments. Part A reserves the name and Part B covers incorporation, DIN, PAN, TAN, EPFO, ESIC and a bank account through the linked AGILE-PRO-S form.
GSTIN is only allotted if you asked for it, so many founders finish incorporation without one. Check your certificate of incorporation and the AGILE-PRO-S acknowledgement before you register anything twice. Keep the PAN, TAN and CIN in one shared document, because every later system, from payment gateways to accounting software, asks for them.
| SPICe+ service | Status | Note |
|---|---|---|
| Name reservation and incorporation | Mandatory | Part A and Part B of the form |
| DIN, PAN and TAN | Mandatory | Issued with the incorporation |
| EPFO and ESIC registration | Mandatory | Linked through AGILE-PRO-S |
| Company bank account | Mandatory | Opened through AGILE-PRO-S |
| GSTIN | Optional | Only if applied for in the form |
| Profession tax | State specific | Maharashtra, Karnataka and West Bengal |
| Shops and establishment | State specific | Delhi companies, from 7 June 2021 |
Domain and website: own them in the company's name
Register the domain in the company's legal name, using a role address such as admin@ rather than a founder's personal Gmail. Open the registrar account under the company, turn on two-factor login, and store the recovery details where at least two people can reach them. Many small firms lose weeks when a freelancer or departing co-founder holds the only login.
Point DNS to a provider you control, even if an agency builds the website. A one-page site with your registered name, CIN, address and a contact route is enough at first. Payment gateways, banks and enterprise buyers check that the domain, the website and the incorporation details match before they approve accounts.
- Domain registered to the company, not an individual
- Two-factor login on registrar and DNS accounts
- Website footer shows legal name, CIN and registered address
- Privacy policy and terms published before you collect any data
Business email that actually reaches inboxes
Pick one business email provider and create role mailboxes such as accounts@, support@ and hello@ from day one. Then set up authentication. Google's sender guidelines require every sender to Gmail to use SPF or DKIM, valid forward and reverse DNS, and TLS, and to keep the spam rate reported in Postmaster Tools below 0.3%.
Once you send more than 5,000 messages a day to Gmail accounts, all three of SPF, DKIM and DMARC become mandatory, the From domain must align, and marketing mail needs one-click unsubscribe. Google recommends 2048-bit DKIM keys where your provider supports them. Setting this up on day one costs nothing and saves you from rebuilding sender reputation later.
| Requirement | All senders to Gmail | Bulk senders (5,000+ a day) |
|---|---|---|
| SPF or DKIM | One of them | Both, plus DMARC |
| Spam rate in Postmaster Tools | Below 0.3% | Below 0.3%, aim for under 0.1% |
| TLS and valid PTR records | Required | Required |
| One-click unsubscribe | Not required | Required for marketing mail |
GST registration and e-invoicing
GST registration depends on aggregate turnover. Service providers must register above ₹20 lakh in most states and ₹10 lakh in special category states such as Sikkim, Tripura and Uttarakhand. Suppliers of goods in states that opted for the higher limit can wait until ₹40 lakh. These thresholds have applied since 1 April 2019.
Some businesses must register from the first rupee. That includes e-commerce sellers, most inter-state suppliers of goods, businesses liable under reverse charge, and anyone supplying online services into India from abroad. Later, e-invoicing applies once turnover passes ₹5 crore, a threshold in force since 1 August 2023, and taxpayers at ₹10 crore or more must report invoices to the IRP within 30 days.
| Business type | Normal states | Special category states |
|---|---|---|
| Services | ₹20 lakh | ₹10 lakh |
| Goods (where the state opted in) | ₹40 lakh | ₹20 lakh |
| E-commerce sellers and most inter-state goods suppliers | Register regardless of turnover | Register regardless of turnover |
Accounting software and the audit trail rule
Choose accounting software before the first invoice, not after the first quarter. Since 1 April 2023, Rule 3(1) of the Companies (Accounts) Rules, 2014 requires every company that keeps books electronically to use software with an audit trail that records each change, who made it and when. The feature must stay on and cannot be disabled.
Books and the edit log must be kept for at least eight years under Section 128(5), and companies must take a daily backup of electronic books, even when the software is hosted outside India. Penalties for the company run from ₹50,000 to ₹5 lakh, with separate fines for responsible officers. Ask any vendor to show you the audit log before you sign up.
Customer data and the DPDP Rules, 2025
The Digital Personal Data Protection Rules were notified on 14 November 2025, with an 18-month phase-in for organisations to adjust their systems. If your product or website collects names, phone numbers or emails, plan for clear consent notices that state the purpose, a published contact for data queries, and a way to handle access, correction and erasure requests within 90 days.
The penalties are large enough to matter for a startup. The Act allows up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for not reporting a breach or for violations involving children, and up to ₹50 crore for other breaches. Build consent capture, access controls and logging into your first release rather than adding them later.
Startup India recognition, if you qualify
If you are building something new, apply for DPIIT recognition once the company exists. Applications now go through the National Single Window System at nsws.gov.in, and the Ministry charges no fee. A private limited company, LLP, registered partnership or cooperative society qualifies for up to 10 years from incorporation if turnover has stayed below ₹200 crore in every year.
Recognition opens the Section 80-IAC tax holiday, self-certification under several labour and environmental laws and rebates on patent filing. Startup India warns that it has appointed no agents or franchises for certificates, so file the application yourself or through your own chartered accountant.
A 30-day order of work
Most of this list can be done in a month without hiring anyone. The order matters because each step feeds the next: the domain feeds email, email feeds payment gateway approval, and the accounting setup decides how clean your first GST return will be. XDQ Labs builds the web apps, integrations and data controls that sit on top of this base once it is in place.
- Week 1: confirm SPICe+ outputs, register domain, set up DNS
- Week 1: create role mailboxes and publish SPF, DKIM and DMARC
- Week 2: choose accounting software with a working audit trail
- Week 2: check whether you must register for GST now
- Week 3: publish privacy policy, consent notices and a data contact
- Week 4: apply for DPIIT recognition on NSWS if you qualify
Frequently asked questions
Do I need GST registration immediately after registering a company in India?
Not always. A service company must register once aggregate turnover crosses ₹20 lakh, or ₹10 lakh in special category states. Goods suppliers in states that opted in can wait until ₹40 lakh. E-commerce sellers, most inter-state goods suppliers and reverse charge cases must register regardless of turnover.
Does SPICe+ give my company a GST number?
Only if you applied for it. SPICe+ bundles incorporation, DIN, PAN, TAN, EPFO, ESIC and a bank account, but the Ministry of Corporate Affairs lists GSTIN as allotted only when requested in the form. Check your AGILE-PRO-S acknowledgement before filing a separate GST application.
Is audit trail mandatory in accounting software for private limited companies?
Yes. Since 1 April 2023, every company keeping books electronically must use software that records an edit log of each change, with the user and time, and the trail cannot be disabled. Records must be kept for at least eight years, and fines run from ₹50,000 to ₹5 lakh.
Do small startups need to set up DMARC for email?
It is strongly advisable. Gmail requires SPF or DKIM from every sender, and SPF, DKIM and DMARC together once you send more than 5,000 messages a day. Setting up all three on day one is free and protects your domain from spoofing and your mail from the spam folder.
Sources
- Ease of Doing Business: SPICe+, Ministry of Corporate Affairs, 2026
- MCA inaugurates SPICe+ web form for company incorporation, Press Information Bureau, Ministry of Corporate Affairs, 2020
- GST Registration Limit in India: Goods and Services Threshold Explained, Tally Solutions, 2026
- Understanding the Current E-Invoicing Turnover Limit in India, Tally Solutions, 2026
- India Mandates Audit Trail Compliance for All Companies, India Briefing (Dezan Shira & Associates), 2025
- Email sender guidelines, Google (Gmail Help), 2026
- Digital Personal Data Protection Rules, 2025: Backgrounder, Press Information Bureau, MeitY, 2025
- Startup Recognition and Tax Exemption, Startup India, DPIIT, 2026
