Legal Compliance in Indian Companies: From Penal Deterrence to Effective Compliance Programmes under the Companies Act, 2013

Keywords: Legal Compliance; Corporate Governance; Decriminalisation; Companies Act, 2013; Corporate Criminal Liability; Regulatory Design

1. Introduction

In April 2026 Parliament passed the Jan Vishwas (Amendment of Provisions) Bill, 2026, which seeks to decriminalise more than seven hundred provisions across dozens of Central Acts. The reform answers a long-standing complaint that Indian business law relies too heavily on the threat of prison. A 2022 study counted 69,233 compliances that regulate doing business in India, of which 26,134 carried imprisonment clauses. For a company, legal compliance has therefore meant managing a very large list of obligations, many of them backed by criminal penalties on individual officers.

Decriminalisation lowers that burden, but it leaves a harder question open. Compliance is not simply the absence of violations. It is the set of systems, incentives and habits through which a firm learns what the law requires and acts on it. A statute can reduce penalties and still fail to encourage firms to invest in such systems. A law can also demand detailed procedures and still produce paper compliance that satisfies auditors but changes little in practice.

This paper examines whether Indian company law, as reformed, encourages effective legal compliance or only reduces the cost of non-compliance. The research question is whether the present Indian framework gives companies and their officers adequate legal incentives to build effective compliance programmes. The paper has three objectives. First, it maps the main compliance duties that the Companies Act, 2013 and the securities listing regulations place on companies, directors and officers. Second, it evaluates how the Supreme Court has allocated criminal responsibility between companies and individuals. Third, it compares the Indian position with the approaches of the United States and the United Kingdom and proposes reforms.

The argument is that India has moved from a penal model toward a lighter regime without yet building the incentive structure that makes compliance programmes worthwhile. Part 2 reviews the literature. Part 3 explains the methodology. Part 4 analyses the Indian framework, the case law and the comparative models. Part 5 discusses policy implications and recommendations, and Part 6 concludes. The paper is confined to company and securities law and does not examine labour, tax or environmental compliance in detail.

2. Literature Review

Scholarship on compliance begins with the question of why people and firms obey the law. Tom Tyler's empirical work argues that obedience depends heavily on whether people regard legal authorities as legitimate and their procedures as fair, and not only on fear of punishment. Ayres and Braithwaite developed the idea of responsive regulation, in which regulators begin with persuasion and escalate to sanctions only when cooperation fails. Baldwin, Cave and Lodge survey the strategies regulators use and stress that no single tool works in every setting. Together these works suggest that a penal threat is one instrument among several and that its effect depends on how it is designed.

A second body of work examines compliance inside the firm. Griffith describes compliance as the new corporate governance and observes that, unlike traditional governance structures, it is imposed on firms from outside by enforcement agencies. Krawiec warns that United States law, by reducing liability for organisations that show an effective compliance structure, risks under-deterrence and the spread of costly but ineffective internal programmes, a pattern she calls cosmetic compliance. Baer examines how legal rules and enforcement choices shape the content of corporate compliance programmes. Langevoort adds that culture is central, and that organisations develop shared scripts that normalise rule-breaking, which makes a genuine culture of compliance hard to achieve.

Indian sources approach compliance mainly through the lens of regulatory burden. The Irani Committee, whose 2005 report preceded the Companies Act, 2013, proposed a simpler and more compact company law. A recent study by the Observer Research Foundation catalogued the volume of compliances and imprisonment clauses in business laws and urged restraint in the use of criminal penalties. The Company Law Committee of 2019 recommended further decriminalisation of the Companies Act, 2013, proposing that many defaults be handled through in-house adjudication, that some offences be omitted and that others carry only fines. Parliament has since pursued the same direction through the Jan Vishwas legislation.

Judicial sources address the question of who is liable. The Supreme Court has held that a company may be prosecuted even where the statute prescribes mandatory imprisonment, that a company can be liable for offences requiring a guilty mind through its controlling individuals, and that the acts of those individuals are attributed to the company but not the other way round.

The Indian material shows a clear gap. It concentrates on reducing penalties and on personal liability, while the comparative literature concentrates on whether the law rewards effective programmes. The sources reviewed for this paper rarely connect the two by asking whether decriminalisation, standing alone, encourages companies to invest in compliance systems. This paper addresses that gap by testing the Indian framework against the incentive-based models developed in the United States and the United Kingdom.

3. Methodology

This paper uses doctrinal and comparative legal research. The doctrinal component analyses primary Indian sources: the Companies Act, 2013, the Companies (Adjudication of Penalties) Rules, 2014, the securities listing regulations, the Jan Vishwas statutes and the leading decisions of the Supreme Court on corporate criminal liability. The aim is to identify what the law requires of companies and officers, how it is enforced and where its incentives point. Doctrinal analysis suits this aim because the research question concerns the content and structure of legal rules and not patterns of behaviour.

The comparative component examines the United States and the United Kingdom. Two reasons support the choice. First, both jurisdictions have developed the clearest legal models for requiring or rewarding compliance programmes: the Delaware oversight doctrine and the federal Sentencing Guidelines in the United States, and the adequate or reasonable procedures defences in the United Kingdom. Second, India shares a common-law inheritance with the United Kingdom, which makes comparison with its statutory models practical. The comparison is used to test Indian law against alternative designs and not to suggest that foreign rules can be transplanted unchanged.

The study relies on secondary sources for context and theory, namely journal articles, committee reports and policy papers. Statutes, cases and legislative developments were checked against official or reputable publicly available versions, and the law is stated as at 10 October 2026.

The method has limits. It is not empirical, so it cannot measure whether companies comply better after decriminalisation. The figures on compliance burden come from a single think-tank study whose counting method this paper has not independently verified. Descriptions of the Jan Vishwas Bill, 2026 rely on a legislative research service and not on the final text of the Act. The conclusions therefore concern legal design and incentives and not measured outcomes. Future empirical work, such as surveys of compliance officers, could test the propositions advanced here.

4. Analysis

4.1 The Indian Compliance Architecture

The Companies Act, 2013 places compliance duties at several levels. At board level, the directors' responsibility statement must state that the directors have devised proper systems to ensure compliance with all applicable laws and that those systems are adequate and operating effectively. Each director must exercise duties with due and reasonable care, skill and diligence. At officer level, the company secretary must report to the Board on compliance with the Act, its rules and other laws applicable to the company. Listed companies and certain other classes must obtain a secretarial audit, and listed and prescribed companies must establish a vigil mechanism through which directors and employees can report genuine concerns.

The securities listing regulations add a further layer. The board of a listed entity must periodically review compliance reports on all applicable laws and the steps taken to correct non-compliance, and the entity must file a secretarial compliance report each year. These provisions show that Indian law treats compliance as a board-level responsibility and expects documented systems.

Two features deserve attention. First, the central standard, that systems be adequate and operating effectively, is stated at a high level of generality, and neither the Act nor the rules supply criteria for judging adequacy. Second, enforcement works mainly through sanctions for specific breaches and not through an assessment of whether a company's overall system was reasonable. The law therefore tells companies to build systems but says little about how the quality of those systems will matter when something goes wrong.

4.2 Enforcement and Decriminalisation

The Companies Act, 2013 is enforced through three main routes: adjudication of penalties by adjudicating officers, compounding of offences, and prosecution before special courts. For several years after enactment, many procedural defaults carried criminal fines, which burdened courts and companies alike. The Companies (Amendment) Act, 2019 converted sixteen offences into civil defaults that adjudicating officers could penalise. The Company Law Committee then recommended re-categorising twenty-three compoundable offences for in-house adjudication, omitting seven, limiting eleven to fines without imprisonment, and dealing with five under alternative frameworks. The Companies (Amendment) Act, 2020 enacted this further round of reform.

The Jan Vishwas (Amendment of Provisions) Act, 2023 widened the approach, decriminalising 183 provisions in 42 Central Acts, and the 2026 Bill, which Parliament passed in April 2026, extends it to a far larger number of statutes. These reforms change the type of sanction. A default that once meant criminal prosecution now usually means a civil penalty after notice and hearing. That is a rational response to over-criminalisation, and it brings the sanction closer to the seriousness of the default.

The reforms do not, however, change the duty to build compliance systems, and they do not reward companies that do so. The factors that guide an adjudicating officer in fixing a penalty are the size of the company, the nature of its business, injury to the public interest, the nature of the default and its repetition. None concerns whether the company had a sound system to prevent the default. A company that invested heavily in compliance and a company that ignored it can, in principle, receive the same penalty for the same first-time default.

4.3 Corporate and Individual Responsibility in the Courts

Where offences remain criminal, the question is who is responsible. In Standard Chartered Bank v. Directorate of Enforcement, the Supreme Court held that a company can be prosecuted even where the statute prescribes imprisonment as mandatory, and that a fine may be imposed in such a case. In Iridium India Telecom Ltd. v. Motorola Inc., the Court held that a company can be prosecuted for offences requiring a guilty mind, because the intent of those who control the company, its alter ego, is attributed to it. In Sunil Bharti Mittal v. CBI, the Court explained that this attribution runs from the controlling individual to the company and not the other way. A director is therefore not automatically liable for the company's offence unless a statute creates vicarious liability or the director's own role is shown.

The Companies Act identifies liable individuals through the concept of an officer in default. It also limits the liability of independent and non-executive directors to acts that occurred with their knowledge, attributable through board processes, with their consent or connivance, or where they did not act diligently.

Two points follow. First, the attribution doctrine looks for a directing mind with a guilty state of mind. It gives no weight to the company's efforts to prevent wrongdoing, so a company with a strong programme and a company without one are treated alike if a senior figure acts with intent. Second, the diligence standard in the Act shows that Parliament knows how to link liability to diligence for individual directors, yet this paper found no equivalent link for the company's own organisational liability. The asymmetry may push senior officers toward avoiding knowledge of risky practices, since knowledge is what attaches personal liability. Langevoort's analysis of compliance culture suggests how organisations can rationalise such avoidance.

4.4 Comparative Models

In the United States, Delaware courts have built an oversight doctrine. In In re Caremark International Inc. Derivative Litigation, the court recognised that directors can breach their duty by failing to make a good-faith effort to put a reporting system in place. In Marchand v. Barnhill, the Delaware Supreme Court allowed a claim to proceed where the board had no committee or process to monitor food safety, which was central to the company's business. The Court of Chancery has since held that corporate officers owe a similar oversight duty. Separately, the federal Sentencing Guidelines lower an organisation's culpability score where it had an effective compliance and ethics programme, subject to conditions.

These models link compliance systems to legal consequences. Failing to build a system exposes directors, and building an effective one reduces sanctions. Krawiec's critique shows the risk in this design: when credit is available, firms may buy the appearance of compliance instead of its substance.

The United Kingdom attaches the incentive to the organisation. Under section 7 of the Bribery Act 2010, a commercial organisation commits an offence if a person associated with it bribes another to obtain or retain business for it, but it has a defence if it had adequate procedures designed to prevent such conduct. The Economic Crime and Corporate Transparency Act 2023 applies a similar model to fraud. Since 1 September 2025, large organisations can be liable for failing to prevent fraud by associated persons unless they show that they had reasonable prevention procedures, or that it was not reasonable to expect any. Official guidance built around six principles explains what reasonable procedures involve.

Measured against these models, India has the duty without the incentive. Section 134(5)(f) resembles the oversight duty in Caremark, but Indian law does not spell out the consequences of failing to build a system, and it offers no statutory defence or mitigation for companies that build a good one. UK law supplies both a standard and a reward, at the cost of requiring companies to prove their procedures.

5. Discussion

The analysis shows a framework that is strong on duties and weak on incentives. This section considers its strengths and weaknesses and then sets out recommendations.

On the positive side, Indian law gives compliance a clear place in the structure of the company. Directors must state that they have devised systems, the company secretary reports on compliance, listed entities must review compliance reports and secretarial audit provides some external check. Decriminalisation also corrects a real imbalance. A system in which nearly two of every five compliances carried a prison term treats technical lapses as crimes and diverts enforcement from serious wrongdoing. Civil penalties after notice and hearing are more proportionate and quicker.

The weaknesses are about incentives. The framework does not reward prevention. The penalty factors ignore compliance systems, the attribution doctrine ignores them and the statutory standard of adequacy is undefined. Decriminalisation compounds the problem. When the penalty for a procedural default falls, a company may rationally spend less to prevent it unless the law gives some other reason to invest. There is also a risk of paper compliance. A compliance load of the size the Observer Research Foundation describes encourages checklists and calendars, which satisfy form but may not change conduct.

Four reforms follow. First, the Companies (Adjudication of Penalties) Rules should add the existence and operation of an effective compliance system as a factor in setting a penalty, so that companies that invest receive lower penalties for isolated, non-fraudulent defaults. Second, Parliament should consider a narrow statutory defence, modelled on the UK reasonable procedures test, for regulatory offences committed by employees without the knowledge of senior management. The defence should exclude fraud and offences involving the company's directing mind, and the company should carry the burden of proof.

Third, the Ministry of Corporate Affairs and the securities regulator should issue guidance explaining what adequate and operating effectively means in section 134(5)(f), drawing on principles such as top-level commitment, risk assessment, proportionality, training and monitoring. Fourth, the law on officer liability should be clarified so that officers who act in good faith on a documented compliance system are not treated as in default for breaches they could not reasonably have prevented.

Safeguards against cosmetic compliance should accompany these reforms. Credit should depend on evidence that the system operates, such as audit trails, use of reporting channels under the vigil mechanism and board minutes, and regulators should be able to withdraw credit where a programme proves hollow. The proposals are limited to regulatory defaults. They do not weaken the criminal law against fraud.

6. Conclusion

This paper asked whether Indian company law, after decriminalisation, gives companies and officers adequate legal incentives to build effective compliance programmes. The answer is that it does so only in part. The Companies Act, 2013 and the listing regulations place detailed compliance duties on boards, company secretaries and listed entities, and recent reforms have replaced many criminal sanctions with civil penalties. These changes respond to a genuine problem of over-criminalisation and deserve support.

The paper has shown, however, that the framework does not connect the quality of a company's compliance system to the legal consequences of a breach. Penalty factors do not consider it, the Supreme Court's attribution doctrine does not consider it, and the statutory standard for adequate systems remains undefined. The comparison with the United States and the United Kingdom shows that other systems attach consequences to compliance systems, through oversight duties, sentencing credit or procedure-based defences. That comparison also shows the risk of cosmetic compliance, which any reform must address.

The significance of the study lies in shifting attention from how much the law punishes to what the law encourages. A lighter penalty regime is not the same as a stronger compliance culture. The paper recommends a graduated, evidence-based mitigation framework, a narrow procedures defence for regulatory offences, clearer guidance on adequacy and clearer rules on officer liability. India has already shown the political will to reform penalties. The next step is to ensure that reform also rewards the companies that take compliance seriously, so that the law supports the habit of compliance and not merely the reduction of its cost.

References

Cases

In re Caremark Int'l Inc. Derivative Litig., 698 A.2d 959 (Del. Ch. 1996).

In re McDonald's Corp. Stockholder Derivative Litig., 289 A.3d 343 (Del. Ch. 2023).

Iridium India Telecom Ltd. v. Motorola Inc., (2011) 1 SCC 74 (India).

Marchand v. Barnhill, 212 A.3d 805 (Del. 2019).

Standard Chartered Bank v. Directorate of Enforcement, (2005) 4 SCC 530 (India).

Sunil Bharti Mittal v. CBI, (2015) 4 SCC 609 (India).

Statutes, Rules and Regulations

Bribery Act 2010, c. 23 (UK).

Companies Act, 2013 (India).

Companies (Adjudication of Penalties) Rules, 2014 (India).

Companies (Amendment) Act, 2019 (India).

Companies (Amendment) Act, 2020 (India).

Economic Crime and Corporate Transparency Act 2023, c. 56 (UK).

Jan Vishwas (Amendment of Provisions) Act, 2023, No. 18 of 2023 (India).

Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015 (India).

U.S. Sent'g Guidelines Manual (U.S. Sent'g Comm'n 2024).

Books

Ian Ayres & John Braithwaite, Responsive Regulation: Transcending the Deregulation Debate (1992).

Robert Baldwin, Martin Cave & Martin Lodge, Understanding Regulation: Theory, Strategy, and Practice (2d ed. 2012).

Tom R. Tyler, Why People Obey the Law (1990).

Journal Articles

Miriam Hechler Baer, “Governing Corporate Compliance,” 50 B.C. L. Rev. 949 (2009).

Sean J. Griffith, “Corporate Governance in an Era of Compliance,” 57 Wm. & Mary L. Rev. 2075 (2016).

Kimberly D. Krawiec, “Cosmetic Compliance and the Failure of Negotiated Governance,” 81 Wash. U. L.Q. 487 (2003).

Donald C. Langevoort, “Cultures of Compliance,” 54 Am. Crim. L. Rev. 933 (2017).

Reports and Online Sources

Gautam Chikermane & Rishi Agrawal, “Jailed for Doing Business: The 26,134 Imprisonment Clauses in India's Business Laws” (Observer Research Foundation, Feb. 2022), https://orfonline.org/jailed-for-doing-business (accessed Oct. 10, 2026).

Ministry of Corporate Affairs, Government of India, Report of the Expert Committee on Company Law (2005).

PRS Legislative Research, “The Jan Vishwas (Amendment of Provisions) Bill, 2026,” https://prsindia.org/billtrack/the-jan-vishwas-amendment-of-provisions-bill-2026 (accessed Oct. 10, 2026).

“In Rajya Sabha Today: De-criminalisation of Penalties for Companies Law Breaches,” SCC Online Blog (Feb. 4, 2020), https://www.scconline.com/blog/post/2020/02/04/in-rajya-sabha-today-de-criminalisation-of-penalties-for-companies-law-breaches/ (accessed Oct. 10, 2026).

“The New Failure to Prevent Fraud Offence: What Do Organisations Need to Do Now?” (Brodies LLP), https://brodies.com/insights/corporate-crime-and-investigations/the-new-failure-to-prevent-fraud-offence-what-do-organisations-need-to-do-now/ (accessed Oct. 10, 2026).

Editorial and academic note: This sample is provided for educational and writing-reference purposes. Please independently verify authorities, citations, dates and current law before relying on or citing any proposition. Submission does not guarantee publication.