FEMA (Foreign Exchange Management Act, 1999) governs how money flows into and out of India – from FDI, loans and overseas investments to many cross-border payments and receipts. FEMA compliance in India is therefore part of the broader regulatory framework for companies, alongside company law, income tax, GST and SEBI/RBI rules.
For businesses, FEMA mainly regulates two sets of transactions: current account transactions (like imports, exports, consultancy payments, royalty, etc.) and capital account transactions (FDI, overseas direct investment, external commercial borrowings and certain guarantees). If your company deals with foreign shareholders, foreign loans or overseas subsidiaries, FEMA compliance is part of your core risk and governance agenda, not an optional extra.
How FEMA impacts foreign transactions?
Whenever you receive or send money in foreign currency, your authorised dealer (AD) bank must ensure the transaction is permitted and correctly reported under FEMA and RBI Master Directions. That is why so many FEMA compliance requirements are linked to specific RBI forms (FC-GPR, FC-TRS, FLA, ECB-2, ODI, etc.) and strict timelines.
Missing these timelines or using the wrong route (for example, taking FDI under automatic route when government approval was required) is treated as a FEMA contravention and can invite heavy late fees, compounding and even reversal of the transaction in serious cases.
FEMA compliance checklist for startups and companies
A practical FEMA compliance checklist for Indian companies typically includes:
- FDI reporting: File Form FC-GPR within 30 days of share allotment once foreign investment is received and shares issued through RBI’s FIRMS portal.
- Transfer of shares with non‑residents: Use Form FC-TRS for reporting transfer between resident and non‑resident shareholders.
- Annual FLA return: File the Foreign Liabilities and Assets (FLA) return by 15 July every year if you have received FDI or made overseas investment in any year, even if there was no fresh transaction in the current year.
- ECB compliance: If you have External Commercial Borrowings, file ECB‑2 returns periodically and comply with end‑use, all‑in‑cost, and reporting norms.
- ODI compliance: For overseas direct investment, file the relevant ODI/FC forms and Annual Performance Report (APR) for foreign subsidiaries or JV investments.
These are the day‑to‑day answers to “what are companies’ FEMA compliance norms?” – a mix of event‑based filings (triggered by a transaction) and annual filings that must be tracked systematically.
Reporting requirements under FEMA
FEMA reporting today largely runs through RBI’s online systems such as FIRMS, FETERS, CIMS and XBRL, depending on the transaction type. For foreign investment in equity instruments, the key forms are Advance Reporting (through SMF/FIRMS), FC‑GPR for allotment, FC‑TRS for transfer, and the annual FLA return for outstanding foreign assets and liabilities.
For external borrowings, companies must obtain a Loan Registration Number (LRN) and file periodic ECB‑2 returns, while ODI transactions require initial reporting and annual APRs until the overseas investment is fully exited. Missing any of these returns is one of the most common FEMA violations seen in practice.
Penalties and consequences of FEMA violations
Under section 13 of FEMA, penalties can go up to three times the amount involved in the contravention when the amount is quantifiable, or up to around INR 2 lakh where it is not directly quantifiable. For continuing violations, an additional fine of up to INR 5,000 per day may be imposed after the first day, which can multiply your cost quickly if the issue is ignored.
In serious or sensitive cases, the RBI may also reverse the transaction (for example, require refund of investment or unwind a structure) or restrict the company from raising further foreign capital for some time. The good news is that most routine FEMA defaults can be regularised through compounding, where the company voluntarily admits the contravention and pays a one‑time compounding fee instead of going through litigation.
FEMA rules for foreign direct investment (FDI)
For FDI, RBI’s FEMA regulations lay down who can invest, in which sectors, under what route (automatic or government approval), what pricing guidelines apply, and what timelines must be followed for allotment and reporting. When a non‑resident subscribes to shares or CCPS/CCD of an Indian company, the Indian investee must allot shares within 60 days of receipt and file FC‑GPR within 30 days of allotment through the FIRMS portal.
FDI received in sectors requiring government approval, or at a price not meeting valuation/pricing guidelines, is treated as a direct FEMA breach and often comes up during due diligence or RBI scrutiny. For startups and SMEs, this is why a clear FEMA compliance checklist before raising foreign rounds is critical.
Common FEMA mistakes in foreign investment and cross‑border deals
Real‑life FEMA lapses by companies often look like this:
- Delay in filing FC‑GPR / FC‑TRS despite receiving or transferring shares involving non‑residents.
- Receiving FDI under the automatic route when government approval was actually required for that sector or investor.
- Not issuing shares within 60 days of receiving foreign remittance, causing the amount to be treated like an ECB or contravention.
- Taking loans from foreign group entities without following ECB norms, LRN registration or ECB‑2 filings.
- Making overseas direct investment (ODI) without proper valuation or without filing the ODI/FC forms and APRs.
Even current account transactions like consultancy payments, royalties or imports can trigger FEMA issues if limits, documentation or approval conditions are not respected.
How businesses can avoid FEMA penalties?
For most founders and CFOs asking “what are the FEMA compliances we should worry about?”, the answer is: map every foreign inflow/outflow to a FEMA rule, a form, a due date and a responsible person. Build a simple FEMA compliance tracker that captures each FDI, ECB, ODI or significant cross‑border payment, and lists the corresponding form (FC‑GPR, FC‑TRS, FLA, ECB‑2, APR, etc.) with its due date.
Conduct an internal FEMA health‑check at least once a year to identify missed filings, mismatches with bank records, or transactions routed incorrectly under FEMA. If you discover an old lapse, consider voluntary compounding early instead of waiting for an RBI notice – compounding is usually cheaper and limits reputational damage.
Internal controls and best practices
Some practical internal controls to prevent FEMA violations:
- Route all foreign exchange transactions through a single “primary” AD bank wherever possible to maintain a clear trail.
- Involve a FEMA/RBI specialist before finalising deal structures for FDI, FPI, ODI or ECB instead of seeking advice after money has already come in or gone out.
- Align your FEMA compliance is part of your board‑level risk and governance discussions, especially if you are a funded startup, exporter, or multi‑country group.
Document every valuation report, board resolution, share allotment and filing acknowledgement (for FC‑GPR, FLA, ECB‑2, APR, etc.) in a central compliance folder so you can respond quickly to any query or due diligence.
What to do if you receive a FEMA notice?
If your business receives a FEMA notice from RBI or the enforcement directorate:
- Collect all documents: bank advices, share allotment records, valuation reports, filings and emails related to the transaction.
- Get a specialist review: engage a FEMA expert or law firm experienced in compounding and adjudication to analyse the alleged contravention and your options.
- Consider compounding: where eligible, apply for compounding to settle the matter by paying a compounding fee rather than facing prolonged proceedings.
Acting early often reduces the financial and reputational impact compared to ignoring the notice or responding casually.
FEMA vs FERA and RBI’s role
FERA (Foreign Exchange Regulation Act) was the older, more criminal‑style law focused on strict control, whereas FEMA is a civil, management‑oriented framework designed to facilitate trade and payments while still regulating forex flows. Under FEMA, contraventions generally attract monetary penalties and compounding, not criminal prosecution, except in severe or linked cases.
The Reserve Bank of India is the primary regulator for FEMA compliance – issuing Master Directions, prescribing forms, administering reporting systems and handling most compounding of contraventions. This is why almost every FEMA compliance checklist starts with understanding RBI circulars and master directions relevant to your business model.
FEMA compliance for importers and exporters
Importers and exporters face FEMA compliance requirements beyond customs and GST, such as proper realisation and repatriation of export proceeds within prescribed timelines and correct purpose codes and documentation for payments and receipts. Large value imports for capital goods, royalty or technical services must align with sectoral caps, pricing norms and, in some cases, prior approvals under FEMA.
Many export‑oriented and SaaS businesses fall into trouble when overseas receipts are booked incorrectly, invoices do not match bank records, or export advances are not adjusted or refunded within time. Regular reconciliation between your books, AD bank statements and RBI reporting is therefore critical.
Meet the FEMA expert – your business partner
Most FEMA violations happen because “nobody was looking at FEMA”, everyone assumed the CA or CS is already handling it, or the team copied a structure from another startup without checking its regulatory fit. Treating FEMA compliance India‑wide as a strategic function – with an expert partner, internal tracker and periodic audits – turns it from a fear factor into a simple, repeatable process.
If your company is planning foreign funding, overseas expansion or cross‑border loans, partnering early with a FEMA specialist can save you from penalties, delays in funding, and red flags during investor due diligence.
FAQs on FEMA compliance for businesses
1. What are the FEMA compliances for Indian companies?
FEMA compliances include timely reporting of FDI (FC‑GPR, FC‑TRS), annual FLA returns, ECB‑2 for external borrowings, ODI/FC forms and APR for overseas investments, and proper documentation and limits for current account transactions like imports, exports and service payments. Each company’s FEMA compliance checklist will vary based on whether it has foreign shareholders, overseas subsidiaries or foreign loans.
2. What are companies’ FEMA compliance norms if they receive FDI?
Companies receiving FDI must ensure sector and route eligibility, comply with pricing/valuation guidelines, allot shares within 60 days of receipt, and file FC‑GPR within 30 days of allotment through FIRMS. Transfers involving non‑residents must be reported in FC‑TRS, and the company must continue to file FLA returns annually while foreign investment remains outstanding.
3. Is FEMA compliance part of company law?
FEMA compliance is part of India’s wider regulatory ecosystem but is separate from the Companies Act – it focuses specifically on foreign exchange and cross‑border transactions under RBI’s framework. However, in practice, board approvals, share allotments and filings under company law and FEMA are closely linked and should be coordinated.
4. What happens if FEMA compliances are missed?
Missed or wrong FEMA compliances can attract penalties up to three times the amount involved or around INR 2 lakh where the amount is not quantifiable, plus up to INR 5,000 per day for continuing defaults. Many routine cases can be settled through compounding, but sensitive or large violations may invite stricter action or require unwinding of the transaction.
5. How can a startup build a simple FEMA compliance checklist?
Startups should list every foreign transaction type (equity, CCD/CCPS, SAFE‑like instruments, ESOPs to non‑residents, ECB, ODI, export revenues) and map it to the relevant FEMA form, due date and responsible person. Reviewing this tracker monthly with your CA/CS or FEMA consultant ensures nothing slips through and that FEMA compliance requirements are met proactively rather than reactively.
