Vendor Compliance Checklist for New Contractors

Most contractor problems start before the contract is signed.

A vendor gets shortlisted on price and references. Procurement raises a purchase order. Nobody asks for an EPF code, a license copy or a wage register. Months later an inspector, an auditor or a worker’s complaint asks for exactly those documents, and the person being asked is you, not the vendor.

A vendor compliance check fixes that. It takes a few hours per vendor and moves the discovery of problems from after an inspection to before the contract. This guide covers what to verify, which documents to collect and what to write into the agreement so the checks continue after the first invoice.

Why a Vendor’s Compliance Becomes Your Problem

Your contract probably makes the contractor responsible for all statutory compliance. The law makes you responsible too.

Since the four labour codes came into force on 21 November 2025, contract labour has been regulated under the OSH Code. The Code and the central OSH Rules, notified in May 2026, put several duties on the principal employer:

• If a contractor who needed a license doesn’t have one, the Code treats the engagement as a contravention by you as well
• If a contractor hasn’t paid wages within seven days of the wage period ending, you must pay the workers within 15 days and recover the amount from the contractor
• At your premises, you are responsible for toilets, drinking water, washrooms, first aid and a canteen for contract workers
• Contract workers must be covered under PF and ESIC where applicable, and a contractor’s default can fall back on you

Tax works the same way. Input tax credit on a vendor’s invoice is at risk if the vendor doesn’t file returns or deposit the GST. Our guide to contract labour compliance after the OSH Code covers the liability side in more detail.

Which Vendors Need Which Checks

Not every vendor needs every check.

• Vendors who deploy people at your premises (housekeeping, security, facility management, manpower supply, construction, transport) need all seven checks below
• Vendors who work from their own offices (software, consulting, design, marketing) need the identity, tax and contract checks, plus the labour checks if their staff will work on your site regularly

1. Confirm Who You Are Contracting With

Start with identity. Every later check depends on it.

• Certificate of incorporation, LLP agreement, partnership deed or proprietorship proof, matched to the name on the contract
• PAN of the entity (without a PAN, TDS applies at a higher rate)
• MCA master data for companies and LLPs, showing the entity is active and not struck off
• Registered and operating addresses, confirmed by a site visit or video call for new vendors
• Authority letter or board resolution for the person signing

2. Check Tax and Commercial Registrations

• GSTIN with active status, and the return filing history on the GST portal for the last six months. Late or missing GSTR-1 and GSTR-3B filings put your input credit at risk
• Udyam registration if the vendor claims MSME status. It affects your payment terms, because payments to micro and small enterprises have a 45-day outer limit

Keep a dated screenshot of each portal check in the vendor file.

3. Verify Labour Law Registrations and Licenses

This is the section most vendor checklists skip. Many older ones also still use the CLRA threshold of 20 workers. The OSH Code replaced that Act, and its contract labour provisions, including contractor licensing, apply at 50 or more contract workers. A contractor below that line needs no contractor license but still owes PF, ESIC, minimum wages and safety compliance.

For vendors who deploy workers, collect:

• The contractor license, if the vendor deploys 50 or more contract workers. A single license can cover several states, so check its validity dates and the worker cap against the headcount you expect on site
• Proof that your work order has been intimated on the Shram Suvidha Portal (the central rules set a 15-day window)
• EPF establishment code and ESIC code. If the contractor has neither, the workers on your site still need coverage, and the cost can land with you
• Professional tax and Labour Welfare Fund registrations for the state where the work happens
• Shops and Establishments registration, where the state requires it, for office-based vendors
• For construction vendors, building worker registration and welfare cess proof. For vendors who bring workers from other states, compliance with the inter-state migrant worker provisions

The central OSH Rules apply where the central government is the appropriate authority. For most private establishments the state rules apply, and some states may still be finalising theirs under the four labour codes. Check the position in each state where the vendor will work.

4. Check the Work, Not Just the Vendor

The OSH Code bars contract labour in the core activities of an establishment, with three exceptions:

• The activity is ordinarily done through contractors in that kind of establishment
• The activity doesn’t need full-time workers for most of the day
• There is a sudden increase in the volume of work

Before onboarding, decide whether the work falls into your core activities and, if it does, which exception you rely on. Record the reasoning in the vendor file. The label in the service agreement doesn’t decide this. The actual work does.

Check one more thing. Under the central OSH Rules, contract workers doing the same or similar work as your own employees must get the same hours of work, holidays and other conditions of service.

5. Ask for Proof That Wages and Contributions Are Paid

Registrations show that a vendor exists. Payment records show whether it pays.

• Three to six months of PF challans and ECR, plus ESIC contribution challans. Compare the headcount on the ECR with the workers actually on your site
• Wage registers, muster rolls and bank transfer records for a sample month. The central rules expect bank or electronic payment, and payment by the seventh day after the wage period
• Wage rates checked against the state minimum wage schedule for each worker category and zone
• UAN and ESIC numbers for a sample of deployed workers
• Appointment letters for the workers deployed to your site

Our guide to EPF registration covers registration and filing deadlines.

6. Confirm Safety, Welfare and PoSH Arrangements

Workers on your site are your day-to-day responsibility, whoever signs their payslip.

• Welfare: confirm who provides which facilities, and write the split into the agreement
• Safety induction, protective equipment and an accident register for high-risk work
• Insurance: ESIC covers employment injury for covered workers. For workers outside ESIC, ask for an employee compensation policy, and for general liability cover on high-risk work
• A PoSH policy and Internal Committee at the vendor if it has ten or more employees, plus a clear route for its staff on your site to reach your own committee

7. Put the Checks Into the Agreement

A checklist only works if the contract lets you keep running it. Include:

• A compliance warranty that the vendor holds every required license and registration and will keep them valid for the term
• Monthly proof with each invoice: PF and ESIC challans, a wage register extract and bank statements
• Audit rights, so you can inspect records and visit sites on notice
• Recovery rights, so you can deduct from invoices or a security deposit any wages, contributions or penalties you pay on the vendor’s behalf
• A ban on sub-contracting without written approval, with the same compliance terms passed down
• A duty to report any inspection, notice or license lapse promptly, and a right to terminate if a license or registration lapses

After Onboarding: Keep Checking

Good contractor compliance management is mostly routine:

• Monthly: proof attached to every invoice. No proof, no payment
• Quarterly: license validity and worker cap against current headcount, with renewal dates on a shared calendar
• Annually: a vendor compliance audit of records and site conditions, or sooner if a vendor’s headcount or scope changes sharply

Your own filings depend on this data. Under the central OSH Rules, the principal employer files an annual return, generally by the end of February, covering contractor details, wage bills and statutory payments.

Red Flags to Act On Before You Sign

• A quote that doesn’t cover minimum wages plus employer PF (12%) and ESIC (3.25%) contributions. Where both apply, those contributions alone add more than 15% to wages
• Wages paid in cash or to the contractor’s personal account
• Workers already on your site without UANs or ESIC numbers, or an ECR headcount well below your site headcount
• A license that has expired or caps the workforce below the number deployed
• Reluctance to share challans, registers or licenses
• Unnamed sub-contractors

None of this needs a large team. It needs a standard onboarding form, a document tracker and the discipline to hold payment until proof arrives. If your vendor base is large or spread across states, statutory compliance services can run the verification, tracking and audits for you.

Let Transparian Simplify Your Vendor and Contractor Compliance

From managing PF and ESIC filings to ensuring PoSH and state-specific statutory obligations are never missed, Transparian provides expert Labour Law Compliance support for HR teams and business owners. Through reliable compliance services and experienced statutory compliance consultants, Transparian helps growing businesses stay audit-ready, penalty-free, and fully aligned with every regulatory requirement.

FAQ’s