A founder doing ₹18 crore in revenue tells his investor that finance is "handled" — a senior accountant, a part-time CA for filings, and himself on the bank account. Three months later his statutory auditor flags a Section 143(3) qualification on internal financial controls, his GSTR-9C reconciliation throws a ₹41 lakh unexplained difference, and the term sheet stalls at diligence. Nobody was negligent. There was simply nobody in the company whose job it was to own the numbers.
This is the single most common finance-function failure in Indian private limited companies, and it is worth separating into two distinct questions. The first is a legal question: when does the Companies Act 2013 force you to formally appoint a Chief Financial Officer? The second is a commercial one: at what stage does a virtual CFO stop being adequate? Founders routinely conflate the two, and the conflation costs them.
What the law actually requires
Section 203 of the Companies Act 2013 governs the appointment of Key Managerial Personnel (KMP). Read with Rule 8 of the Companies (Appointment and Remuneration of Managerial Personnel) Rules, 2014, the mandatory whole-time KMP requirement — Managing Director or CEO or manager (and in their absence, a whole-time director), Company Secretary, and Chief Financial Officer — applies to every listed company and every other public company having a paid-up share capital of ₹10 crore or more.
Note the wording carefully. Section 203 KMP appointment is a public company obligation. A private limited company, whatever its turnover, is not required under Section 203 to appoint a CFO. This is the point most founders get right by accident and most advisors explain badly.
But three adjacent provisions do bite a private company, and they are where the real exposure sits:
Section 2(19) read with Section 2(51) defines "Chief Financial Officer" as a person appointed as such by a company. The definition matters because once you do appoint someone with that designation — including on a LinkedIn profile, a term sheet, or a board resolution — that person becomes KMP, becomes an "officer in default" under Section 2(60), and inherits personal liability for defaults in financial reporting. Designating your senior accountant "CFO" to look impressive in an investor deck is not a free upgrade. It is a transfer of statutory liability onto a person who may not be equipped to carry it.
Section 134(5)(e) requires the Directors' Responsibility Statement in the Board's Report — for listed companies — to confirm that internal financial controls are adequate and operating effectively. For private companies the clause is not mandatory, but Section 143(3)(i) read with Rule 10A of the Companies (Audit and Auditors) Rules, 2014 requires the statutory auditor to report on the adequacy and operating effectiveness of internal financial controls over financial reporting. The exemption under MCA Notification dated 13 June 2017 relieves a private company from that auditor reporting requirement only if it is a one-person company or small company, or if it has turnover below ₹50 crore and aggregate borrowings from banks, financial institutions or any body corporate below ₹25 crore at any point during the financial year. Cross either threshold and your auditor must form and report an opinion on your controls — which means somebody inside the company has to have designed them.
Section 138 read with Rule 13 separately mandates an internal auditor for a private company with turnover of ₹200 crore or more, or outstanding borrowings from banks or public financial institutions of ₹100 crore or more, at any point during the preceding financial year.
Section 134(1) requires the financial statements to be signed by the chairperson or two directors, and — where the company has appointed them — the CEO, CFO and Company Secretary. Again, conditional on appointment. But an unappointed CFO function does not make the financial statements someone else's problem; it concentrates the liability on the directors who sign.
Practical implications
The consequences of getting this wrong split into penalties and commercial damage.
Section 203(5) prescribes that a company in default of the KMP requirement is liable to a penalty of ₹5 lakh, and every director and KMP in default is liable to a penalty of ₹50,000, with a further ₹1,000 per day for continuing default, subject to a maximum of ₹5 lakh. This applies to public companies crossing the ₹10 crore paid-up capital line — a threshold private companies hit the moment they convert to public status ahead of an IPO, and frequently forget to action.
Section 447 (fraud) and Section 448 (false statements) attach to KMP personally. A CFO who signs financial statements containing a material misstatement faces imprisonment of six months to ten years and a fine of up to three times the amount involved where the fraud involves public interest.
Section 92(5) penalises annual return defaults at ₹10,000 plus ₹100 per day of continuing default, capped at ₹2 lakh for the company and ₹50,000 for each officer in default. Section 137(3) penalises failure to file financial statements in AOC-4 at ₹10,000 plus ₹100 per day, capped at ₹2 lakh for the company and ₹50,000 for the officer in default.
On MCA21 v3, the practical exposure is sharper than the penalty schedule suggests. V3 is now mandatory across all live e-forms with V2 permanently retired, and the platform runs real-time validation against pre-filled ROC data. A mismatch between the paid-up capital declared in your AOC-4 and the figures in your SH-7 and PAS-3 history no longer sits undiscovered until an inspection — it fails at submission or gets flagged against the company's master data. The v3 dashboard also makes repeat late filings, DIN deactivations, and signatory inconsistencies visible as a pattern rather than as isolated events. Companies with no one owning the filing calendar accumulate exactly that pattern.
The immediate one worth naming: every DIN holder must file DIR-3 KYC annually by 30 September. Miss it and the DIN is deactivated, reactivation requires a ₹5,000 fee under Rule 12B of the Companies (Appointment and Qualification of Directors) Rules, 2014, and until it is reactivated that director cannot sign any MCA form — which means the company cannot file anything requiring their signature. In a five-person board with two directors lapsed, an AOC-4 deadline becomes unmeetable through no fault of the finance team. That is a CFO-function failure, not an accountant failure.
The commercial damage is usually larger than the penalties. A Section 143(3)(i) adverse or qualified opinion on internal financial controls is the single fastest way to lose a term sheet, because it tells an acquirer or investor that the numbers in the data room cannot be relied upon without independent verification. Re-auditing three years of restated financials before a fundraise costs more than four years of a virtual CFO retainer.
Step-by-step: what to do
- Determine whether Section 203 applies to you. If you are a private limited company, it does not — regardless of revenue. If you are a public company, check paid-up share capital against the ₹10 crore threshold in Rule 8 as of the last balance sheet date. If you are planning a conversion to public company status, action the KMP appointments in the same board cycle as the conversion, not afterwards.
- Run the Rule 10A exemption test for the current financial year. Take turnover for the last audited financial year and peak aggregate borrowings from banks, financial institutions and body corporates at any point during the year. If turnover is ₹50 crore or above, or peak borrowings are ₹25 crore or above, your statutory auditor must report on internal financial controls. Tell your auditor which side of the line you fall on before the audit starts, not during.
- Check the Section 138 internal audit trigger separately. Turnover of ₹200 crore or more, or outstanding bank or PFI borrowings of ₹100 crore or more, in the preceding financial year. The internal auditor is appointed by board resolution and the appointment is reported in MGT-14 where applicable.
- Decide the engagement model against complexity, not revenue alone. A virtual CFO engagement is genuinely sufficient where the company has a single legal entity, domestic revenue only, no debt covenants, and a predictable monthly close. Full-time becomes necessary where any two of the following are true: multiple entities or a foreign subsidiary requiring consolidation and Form 3CEB transfer pricing documentation under Section 92E; bank facilities with covenants requiring monthly or quarterly CMA-format reporting; Ind AS applicability under the ₹250 crore net worth threshold; an active fundraise or IPO track; or a headcount above roughly 150 where payroll, PF, ESI and state professional tax compliance becomes a standing operational load.
- Define the scope in writing, whichever model you pick. A virtual CFO engagement letter should explicitly allocate: monthly close and MIS by a stated date; GST return preparation and the GSTR-1 to GSTR-3B to GSTR-2B reconciliation; TDS computation and quarterly return filing; advance tax instalment computation against the Section 211 schedule; the ROC filing calendar including AOC-4, MGT-7A, DIR-3 KYC and DPT-3; cash flow forecasting horizon; and board-pack preparation. Anything not listed is the founder's job by default.
- Fix the designation question. If nobody in the company is formally appointed CFO, do not let the title appear in decks, contracts or on the company website. If someone is going to carry the title, appoint them properly by board resolution, file Form DIR-12 within 30 days under Section 170(2), and make sure they understand they are now an officer in default under Section 2(60).
- Build the compliance calendar before you build the team. Most of what a founder thinks they need a CFO for is actually a calendar problem. Map every recurring obligation with its statutory deadline and its owner. Where a virtual CFO is engaged, that calendar is the deliverable that justifies the retainer.
FAQ
Is a private limited company legally required to appoint a CFO?
No. Section 203 read with Rule 8 mandates whole-time KMP — including a CFO — only for listed companies and other public companies with paid-up share capital of ₹10 crore or more. A private company of any size is outside that requirement.
If we call our finance head "CFO" without a board resolution, is that a problem?
Yes, in both directions. Using the title without formal appointment creates ambiguity about who is an officer in default under Section 2(60), and in practice the directors carry the liability. Using the title with appointment transfers real statutory exposure — including Section 447 and 448 liability — onto that individual. Pick one and document it.
At what point does a virtual CFO stop being enough?
When the finance function stops being periodic and becomes continuous. The practical markers are a foreign subsidiary requiring consolidation and Section 92E transfer pricing documentation, bank covenants requiring monthly CMA reporting, Ind AS transition at ₹250 crore net worth, or an active fundraise. Revenue alone is a poor proxy — a ₹40 crore single-entity domestic business is often simpler than a ₹12 crore business with a Delaware parent.
Does the internal financial controls audit requirement apply to us?
Only if you fail the Rule 10A exemption test. A private company is exempt from the Section 143(3)(i) auditor reporting requirement where it is a one-person or small company, or where turnover is below ₹50 crore and aggregate borrowings from banks, financial institutions and body corporates stayed below ₹25 crore at every point during the financial year. Cross either figure and the requirement applies for that year.
---
For a compliance audit of your company, visit pvtltd.co
---
See Also
- AGM Deadline Is 30 September 2026: AOC-4, MGT-7 and DIR-3 KYC — Your 14-Day Checklist
- "The machine came in duty-free, so it was free": What an EPCG licence actually obligates your company to do
- "We'll just open a liaison office first": What the Companies Act and FEMA actually require when a foreign company enters India
Ready to incorporate or sort your compliance?
Our team handles every filing. You focus on building.