Statutory Registers Every Private Company Must Maintain

Ask a founder whether their company is ROC compliant, and most will point to AOC-4 and MGT-7 filed on time, DIR-3 KYC done every year, and maybe a board resolution or two on file. All of that can be true, and the company can still be sitting on a real compliance gap that nobody notices until someone specifically goes looking for it: the statutory registers. A private company is required to maintain a defined set of registers at its registered office, or another location the board has approved and notified, and these are a genuinely different obligation from anything filed with the Registrar of Companies. A filing is a periodic submission, a snapshot handed to the ROC once a year or whenever a specific event triggers it. A register is a continuous internal record that's supposed to be updated the moment something changes, a share allotted, a director resigning, a charge created, and to stay accurate at all times, not just on the date it happens to be checked. Because registers don't carry the same visible external deadline a filing does, nobody sends a reminder when one falls out of date. That's exactly why so many private companies, especially ones that started out informally, only discover the gap at the worst possible time.

Statutory Registers vs ROC Filings: Two Different Obligations

It helps to be precise about what each of these actually is. A filing, AOC-4 for financial statements, MGT-7 or MGT-7A for the annual return, ADT-1 for auditor appointment, DIR-3 KYC for director details, is a document the company prepares and submits to the Registrar, usually tied to the financial year or to a specific event like an AGM or a director's appointment. Once it's filed and accepted, that particular obligation is discharged for the period it covers. A statutory register works differently. It is a document the company itself creates and keeps, at its registered office or another location the board has approved and notified, and updates on an ongoing basis as events actually happen inside the company, not on a fixed annual cycle.

Nobody at the ROC checks whether a company's internal registers are up to date unless there's a specific reason to look: an inspection, a scrutiny, a complaint, or a due diligence request that surfaces the gap indirectly. That absence of routine checking is not the same as the requirement not mattering. It means the consequence of letting a register lapse tends to show up later, and somewhere else entirely, rather than as a rejected filing or a late fee ticking up on the MCA portal. This is also exactly why a company can be entirely current on its ROC filings and still be non-compliant on register maintenance. The two obligations run on separate tracks. A company that's diligent about hitting every AGM and filing deadline can still have a register of members that hasn't been updated since a share transfer eighteen months ago, or a register of directors that still lists someone who resigned last year, simply because nothing in the filing calendar ever forced anyone to open that register and fix it.

The Registers a Private Company Typically Needs to Maintain

Company law sets out a defined list of registers a company is expected to maintain, and the exact set can extend further depending on what the company has actually done: issued debentures, accepted deposits, bought back shares, granted ESOPs, or a few other situations that trigger an additional register beyond the core set. What follows is the core group most private companies need to maintain regardless of size, described by common name and purpose rather than by section number, since some of the specific provisions have been renumbered or amended over the years and it's worth confirming the current citation with a practising CA or company secretary rather than relying on an older reference.

Beyond this core set, several other registers apply only in specific situations: a register of debenture-holders or other security holders where the company has issued debentures, a register of deposits where it has accepted deposits from the public or its members, a register of renewed and duplicate share certificates, and registers tied to ESOP grants or a share buyback where the company has done either. Whether a particular register applies to your company depends on what that company has actually done over its life, so treat this as a starting point to work through with a professional rather than a complete list that covers every situation.

Why Each of These Registers Actually Matters

The register of members is the company's own authoritative internal record of who actually owns it. The MCA's public records, built from whatever's been filed in the annual return or a share transfer filing, are a snapshot rather than a live ledger, and they can lag behind what's actually happened by months. When a due diligence team, an investor, an acquirer, or a lender's counsel sits down to confirm the cap table, or when two co-founders end up disputing exactly how much of the company each of them holds, the register of members is the document that's supposed to settle the question. A company that can't produce a clean, current one is effectively asking everyone else to take its cap table on faith, which is not a position an investor or an acquirer is willing to accept.

The register of charges does a different job: it's the company's own internal cross-check against what's actually been filed with the ROC. Every secured loan the company has taken on should appear in both places, the ROC's public record of registered charges and the company's own register, and the two should match. When they don't, that mismatch is exactly the kind of thing worth catching early: a charge that was created but never registered, or one that was repaid but never marked satisfied. Reconciling the two periodically, rather than only when a new loan is being negotiated, is what catches a gap while it's still cheap to fix, well before it turns into the kind of insolvency-stage problem where an unregistered charge simply cannot be enforced against a liquidator.

The register of contracts or arrangements in which directors are interested is what actually operationalises related-party disclosure day to day, rather than only at the moment a transaction is approved. Board or shareholder approval under the related-party rules happens once, when a particular deal is struck. The register is the ongoing record of every such arrangement the company has entered into, and it's often the first thing an auditor asks to see when testing related-party disclosures, precisely because it's supposed to already contain the answer rather than requiring it to be reconstructed transaction by transaction from the accounting entries.

The register of directors and KMP matters for a more basic reason: it's the reference point for who currently has authority to act for the company on the company's own books, alongside their own shareholding. A bank, a co-investor, or an auditor confirming who's actually authorised to sign for the company shouldn't need to cross-check three different documents to get an answer that's supposed to live in one place and stay current.

Where Companies Actually Get Caught Out

A register is supposed to be a live document. It gets a new line the same week a share is allotted, the same day a director resigns, the same week a charge is created, not months later when someone happens to ask for it. In practice, plenty of companies, especially ones that started out informally, a couple of co-founders, no company secretarial function yet, minimal outside capital, never properly set these up in the first place. Early on, nobody is asking to see a register of members, so nobody notices it was never opened, and the gap just sits there quietly for as long as no one looks.

The gap almost always surfaces at the worst possible moment: during investor due diligence ahead of a funding round, while a lender's counsel is reviewing security documentation before a large facility, or during a regulatory inspection. By then, the company isn't just filling in a blank register, it's trying to reconstruct years of share allotments, transfers, director changes, and charges from whatever scattered evidence still exists: old resolution drafts, bank statements, email threads, and whoever's memory is longest. Reconstructing a clean historical register this way is far harder, and far less convincing to whoever's reviewing it, than simply maintaining one continuously would have been. A register with a suspiciously tidy set of entries all dated the same week, right before a data room goes live, tends to read to an experienced reviewer exactly the way it looks: assembled after the fact rather than kept as things actually happened.

A Practical Register-Maintenance Checklist

None of this needs to be complicated. A private company, even a small one without a dedicated company secretary, can stay on top of its registers with a short list of habits built into whatever process already triggers the underlying event.

• Set up the core registers, members, directors and KMP, charges, and contracts in which directors are interested, at incorporation, even if there's nothing to enter yet. An empty register that already exists is far easier to keep current than one that has to be created from scratch later.
• Update the register of members the same week any share allotment, transfer, or transmission is actually approved, not at year-end while the annual return is being prepared.
• Update the register of directors and KMP the moment an appointment, resignation, or removal takes effect, alongside whatever DIN-related or ROC filing that same event separately triggers.
• Log a charge in the company's own register as soon as it's created, and periodically reconcile that register against the ROC's public record of charges, not only when a new loan is being negotiated.
• Add an entry to the register of contracts in which directors are interested at the same time a related-party arrangement is approved, rather than leaving it to be filled in whenever an auditor asks during fieldwork.
• Keep the registers at the registered office, or wherever else the board has formally approved and notified, and make sure whoever handles company secretarial work knows exactly where they are and has current access to update them.
• Review all the registers together at least once a year, ideally before the AGM, as a check on whether anything that happened during the year failed to make it into the record it belonged in.
• Treat a due diligence request or an auditor's request to see the registers as a test the company should already be able to pass, not a prompt to start reconstructing them.