Key Takeaways

• CSR compliance is mandatory, not voluntary, for any company that crosses one of the three Section 135 thresholds in the immediately preceding financial year.
• The obligation is 2% of average net profit computed under Section 198 of the three immediately preceding financial years.
• CSR money can only fund activities listed in Schedule VII; normal business activity and employee-only benefits do not count.
• A CSR Committee is required only when the CSR obligation is ₹50 lakh or more; below that, the Board performs its functions.
• Implementing partners must hold CSR-1 registration with the MCA before a company routes CSR funds through them.
• Unspent funds have hard deadlines: ongoing-project money moves to an Unspent CSR Account within 30 days (spend within 3 years); other unspent money goes to a Schedule VII fund within six months.
• Penalties are civil, not criminal; the 2020 amendment removed imprisonment; a defaulting company pays twice the untransferred amount or ₹1 crore, whichever is less.
• Impact assessment becomes mandatory for companies with an average CSR obligation of ₹10 crore or more, for projects of ₹1 crore or more completed at least a year earlier.

CSR compliance in India means meeting the corporate social responsibility duties set out in Section 135 of the Companies Act, 2013 and the Companies (Corporate Social Responsibility Policy) Rules, 2014. In short: a company that crosses any one of three financial thresholds must spend at least 2% of its average net profit on activities permitted under Schedule VII, govern that spending through a CSR Committee or its Board, deal correctly with any unspent amount, and disclose everything through its Board report and Form CSR-2.

That sentence outlines the whole obligation. The reason this guide runs longer is that each of those words carries a rule, a deadline, or a calculation that companies routinely get wrong: the definition of "net profit," the ₹50 lakh line for the CSR Committee, the CSR-1 check on partners, the 30-day and six-month transfer windows for unspent funds, and the point at which impact assessment stops being optional. Compliance today is a chain: calculate → govern → spend on eligible activities → handle unspent funds → document → report → measure impact. Miss one link and a company that spent its full 2% can still be in default.

This guide is written for the people who own that chain: CSR heads, Company Secretaries, CFOs, compliance and ESG teams, and every legal point below has been checked against the Act, the CSR Rules, and Ministry of Corporate Affairs (MCA) guidance current as of September 2026.

What Is CSR Compliance in India?

CSR compliance in India is the set of legal duties a qualifying company owes under Section 135 of the Companies Act, 2013 and the CSR Rules, determining its CSR obligation, spending it on eligible Schedule VII activities, dealing correctly with any unspent amount, maintaining the required governance and documentation, and making the prescribed disclosures.

The key distinction from philanthropy is what to hold onto. Philanthropy is voluntary and answers to no one. CSR under Section 135 is fixed by formula, restricted by Schedule VII, governed by the Act, and filed with the Registrar of Companies. A cheque a promoter writes personally is philanthropy. The same money, routed through a covered company against its 2% obligation and reported in Form CSR-2, is compliance.

India was the first country to make CSR spending a legal obligation when Section 135 took effect on 1 April 2014. What has changed since is the standard companies are held to. The early years were about whether the 2% was spent at all. The current expectation from boards, investors, and the Business Responsibility and Sustainability Reporting (BRSR) framework alike is evidence of what the spending achieved. The sections below follow that full arc, from the threshold test to impact measurement.

Section 135 of the Companies Act, 2013 Explained

Section 135, read with the CSR Rules, sets out every core obligation. Here is the whole framework in one view before we take each part in turn.

Everything below expands these rows into practical guidance.

Who Is Required to Comply with CSR Rules?

CSR applies to any company, private, public, listed, unlisted, holding, subsidiary, Section 8, or a foreign company with an Indian presence that meets any one of these thresholds during the immediately preceding financial year.

Three points that catch companies out:

Any one threshold is enough. These are independent triggers, not cumulative tests. A company with a modest balance sheet but ₹5 crore of net profit is covered.

The test looks at the preceding year. Applicability for a given financial year is decided on the previous year's numbers, not the current one's.

Exit has a lag. If a company falls below all three thresholds, the CSR provisions cease to apply once it has been below the limits for the relevant period. But any obligation and disclosure duty from years when it was covered, including unspent amounts, still stands. Dropping below the line does not erase a prior year's liability.

A foreign company with a branch or project office in India is tested the same way and must include at least one India-resident person in its CSR arrangements.

How Does the 2% CSR Calculation Work?

The CSR obligation is 2% of the company's average net profit over the three immediately preceding financial years, where "net profit" is the figure computed under Section 198 of the Companies Act, not the profit-after-tax shown in the published accounts.

This is the single most misread number in CSR compliance, so precision matters.

"Net profit" is a defined term. It starts from the company's profit and applies the specific add-backs and deductions in Section 198. In practice, two exclusions matter most: profits from any overseas branch are excluded, and dividends received from other Indian companies that are themselves Section 135-compliant are excluded (so the same rupee of profit doesn't generate a CSR obligation twice).

The base is a three-year average, which smooths out a single unusually strong or weak year.

Worked example

Say a company's Section 198 net profits for the three preceding financial years were:

• FY 2022-23: ₹40 crore
• FY 2023-24: ₹50 crore
• FY 2024-25: ₹60 crore

Average net profit = (40 + 50 + 60) ÷ 3 = ₹50 crore

CSR obligation for FY 2025-26 = 2% × ₹50 crore = ₹1 crore

Companies incorporated less than three years ago use the average of the profits for as many preceding financial years as exist since incorporation.

Document the working: Keep the Section 198 computation for each year, the exclusions applied, the average, and the resulting 2% figure, all tagged to the financial year. This is the first thing an auditor and the CSR-2 form will ask for. 

The CSR Committee: Composition, Roles & Responsibilities

A CSR Committee of the Board is required only when the company's CSR obligation for the year is ₹50 lakh or more. Below that figure, the Board itself discharges the Committee's functions (Section 135(9)).

Composition

Functions

The Committee formulates and recommends the CSR Policy and the Annual Action Plan to the Board, recommends the expenditure, and monitors implementation. The Board approves the plan, ensures the money is actually spent, and remains accountable in its report for any shortfall. The Committee recommends; the Board carries the compliance liability.

CSR Committee compliance checklist

• Committee constituted, or Board discharging its functions where the obligation is under ₹50 lakh.
• Composition correct for the company type
• Composition disclosed in the Board's report
• CSR Policy formulated and Board-approved
• Annual Action Plan approved: focus areas, projects, budgets, implementation mode, monitoring, and the impact-assessment plan.
• Minutes of every CSR Committee / Board meeting on file
• Policy and projects published on the company website

The CSR Policy: What Companies Need to Include

Having a CSR Policy on file and running a compliant CSR programme are two different things, and auditors increasingly look for the link between them. The policy is the governing document; the programme is what happens on the ground.

A workable CSR Policy sets out the company's focus areas (mapped to Schedule VII), its approach to geography, how it selects projects, which implementing partners it uses and how it vets them, its monitoring approach, when and how it runs impact assessment, its reporting duties, and its governance and review mechanisms. A policy specific enough that a reader can predict what the company will and won't fund is doing its job. A generic policy that could belong to any company is a red flag in an audit.

Schedule VII: Where CSR Money Can Be Spent

Schedule VII lists the permitted categories of CSR activity. Spending outside these categories does not count toward the 2% obligation, however worthy the cause.

What does NOT qualify

• Activities in the normal course of business
• Activities benefiting only employees and their families
• Contributions to political parties
• Sponsorships for marketing or brand-building
• Activities outside India (with narrow exceptions, such as training Indian sports personnel)

Reclassifying a marketing sponsorship or an employee-welfare scheme as CSR is one of the most common and most avoidable failures. For the full category-by-category breakdown with worked examples, see Relific's guide to the complete Schedule VII activities list with examples.

CSR-1: Implementing Agency Registration

Form CSR-1 is the MCA registration that an implementing agency must hold before a company can route CSR funds through it. Since the 2021 amendment, a company cannot simply hand money to any NGO; the partner must be registered and carry a CSR Registration Number.

Eligible implementing agencies broadly include a Section 8 company, a registered public trust, or a registered society set up by the company (alone or with others); such entities with an established track record of at least three years; or entities established under an Act of Parliament or a State legislature. At a minimum, the company should obtain and keep the partner's CSR Registration Number, its registration and tax documents, its governing deed, and evidence of its track record. The purpose of CSR-1 is traceability; it lets the regulator follow the money from the company to the entity that actually delivered the work.

How to Choose a CSR Implementing Partner

Registration is the floor, not the assessment. A practical due-diligence framework for a CSR manager:

• CSR-1 registration: verified CSR Registration Number on the MCA portal
• Legal documentation: registration certificate, PAN, 12A/80G where relevant, governing deed
• Financial records: audited financials, clean utilisation history
• Governance: a functioning board, documented policies, conflict-of-interest handling
• Track record: completed projects of comparable scale and type
• Geographic presence: genuine reach in the districts you intend to fund
• Beneficiary reach: credible, verifiable beneficiary data
• Monitoring capability: field teams, an MIS, a reporting cadence
• Impact measurement: the ability to report outcomes, not just outputs
• Reporting quality: timely, structured, audit-ready documentation
• Risk indicators: over-reliance on one funder, unexplained cost ratios, thin records

The CSR Project & Compliance Workflow

A compliant programme runs through a repeatable sequence. Treating it as a year-round cycle, rather than a March scramble, is what separates audit-ready companies from the rest.

Eligibility check → Need assessment → Project selection → Partner due diligence (CSR-1) → Board/Committee approval (Annual Action Plan) → Budget allocation → Implementation → Monitoring → Impact measurement → Board reporting → CSR-2 disclosure → Review.

Every stage generates documentation. Create the paper trail as you go, and CSR-2 and the annual audit become a matter of assembly rather than reconstruction.

Unspent CSR Funds: Rules, Timelines & Compliance

Unspent CSR money is treated differently depending on whether it was committed to an ongoing project. Getting this split wrong is the most common trigger for a penalty.

Two things worth stating plainly. First, the Board must still explain any shortfall in its report; making the transfer does not discharge the explanation duty. Second, the transfer is a consequence of not spending, not an alternative to it; a company cannot treat "park it in the fund" as a compliance strategy. Keep the Board resolution, the account details, the transfer evidence, and the project status for each tranche.

Surplus and Excess Spend: Two Rules Companies Miss

Two adjacent rules are worth separating because they pull in opposite directions.

Surplus arising from CSR activities, for example, interest or income generated by a CSR project does not count as business profit. It must be ploughed back into the same project, or transferred to the Unspent CSR Account and spent per the CSR policy, or transferred to a Schedule VII fund.

Excess CSR spend where a company spends more than its 2% obligation in a year may be set off against the obligation of the three immediately succeeding financial years, provided the Board passes a resolution to that effect, and the excess does not include any CSR surplus. This set-off has applied prospectively since 22 January 2021, so excess spent in earlier years cannot be carried forward.

Capital assets created or acquired out of CSR funds must be held by the company, a beneficiary section of society, or an eligible entity, in the manner the Rules prescribe. CSR money cannot be used to build an asset the company simply keeps for itself.

Form CSR-2: Annual Reporting

Form CSR-2 is the MCA e-form in which a covered company reports its CSR activities, spend, committee composition, and unspent amounts for the financial year. It is filed with the Registrar of Companies in connection with Form AOC-4.

Here is the current position, because it has changed and most summaries online are out of date: from FY 2024-25 onward, on the MCA V3 portal, CSR-2 is filed as a linked form with AOC-4, effectively within 30 days of the AGM rather than as a separate, later filing. The separate deadlines that companies remember (31 December 2024 for FY 2023-24, and the extensions before it) were transitional arrangements for FY 2020-21 through FY 2023-24 on the earlier V2 portal. For the current year, treat CSR-2 as part of the AOC-4 filing and confirm the exact AOC-4 due date for your AGM cycle on the MCA portal.

The single most common CSR-2 problem is a mismatch between the CSR figures in AOC-4 and those in CSR-2, entirely avoidable if the underlying records are maintained through the year rather than reconstructed at filing time.

CSR-2 readiness checklist: AOC-4 prepared · Section 198 calculation on file · project-wise spend reconciled · committee details current · unspent-fund treatment documented · every figure matched to the audited accounts.

CSR Impact Assessment

Impact assessment measures whether CSR money produced real change, not just whether it was spent. It is where the compliance story meets the strategic one.

Start with the three things companies routinely conflate:

• Output: what was delivered (500 school kits, 20 toilets).
• Outcome: the change that followed (attendance rose, sanitation-linked illness fell).
• Impact: the lasting, attributable difference the intervention made.

A useful way to hold the whole chain in view: Input → Activity → Output → Outcome → Long-term Impact. Most CSR reporting stops at Output. Assessment is what carries it to Outcome and Impact. Relific's field guide to proving what actually changed and its explainer on outputs vs outcomes vs impact go deeper on the method.

When is impact assessment mandatory? Under Rule 8(3) of the CSR Rules, a company must commission an independent impact assessment when all of the following are true:

• Its average CSR obligation is ₹10 crore or more across the three immediately preceding financial years, and
• The project has an outlay of ₹1 crore or more, and
• The project was completed at least one year before the assessment.

The assessment must be done by an independent agency, its report placed before the Board and annexed to the annual CSR report, and its cost may be booked as CSR expenditure up to 5% of total CSR spend or ₹50 lakh, whichever is less. Because all three conditions must be met, a company above ₹10 crore whose individual projects are each under ₹1 crore is not formally required to assess, though doing so is sound practice, and increasingly what boards and BRSR readers expect regardless of the threshold.

CSR vs ESG vs BRSR: What's the Difference?

These three are related but distinct, and conflating them causes real reporting errors. CSR is a statutory spending obligation; ESG is a performance and risk lens; BRSR is a disclosure format.

The accurate way to state the relationship: CSR data feeds into the Social dimension of ESG, and BRSR is where much of that data becomes publicly visible. CSR is not "the S in ESG"; it is one statutory input into a much broader assessment. The Business Responsibility and Sustainability Reporting (BRSR) framework, introduced by the Securities and Exchange Board of India (SEBI), is the bridge that forces CSR spending and ESG performance into the same disclosed, comparable frame.

Beyond the 2% Rule: Compliance Is the Floor, Not the Ceiling.

This is where the original argument of this guide still holds. India has proved it can mobilise CSR capital at scale: ₹34,908.75 crore across 27,188 companies in FY 2023-24, per the National CSR Portal (csr.gov.in). What it has not solved is distribution and depth.

The concentration is stark. In FY 2023-24, Maharashtra alone received about 17% of all CSR funds (₹6,065.95 crore), followed by Gujarat (₹2,707.54 crore) and Karnataka (₹2,254.88 crore). The aspirational districts the law was partly meant to serve receive a small fraction. This is not a legal failure; the "local area preference" in the Act is a preference, not a mandate. A Mumbai-headquartered company is entirely within the law to spend its whole budget in an aspirational district in Odisha. The imbalance is a matter of corporate choice and convenience, not a legal barrier.

Moving from compliance to strategy means a few concrete shifts: targeting underserved geographies rather than defaulting to the operational backyard; funding for outcomes with baseline data and third-party evaluation rather than counting outputs; aligning projects with material social and environmental risk and with the Sustainable Development Goals; treating environmental resilience as core rather than a rounding error; and building long-term, community-designed programmes instead of one-off, year-end disbursements. Compliance keeps you out of trouble. Strategy is what makes the 2% worth more than 2%.

CSR Reporting & Documentation Checklist

Keep all of the following on file, refreshed through the year:

• CSR Policy (Board-approved, published)
• CSR Committee / Board resolutions and minutes
• Annual Action Plan
• Section 198 net-profit calculation and the 2% working
• Project proposals and approved budgets
• Implementing-agency CSR-1 registrations and agreements
• Invoices, fund-transfer records, utilisation certificates
• Monitoring reports and beneficiary data
• Impact-assessment reports (where applicable)
• On-ground evidence (photographs, field notes)
• Board-report CSR disclosure
• CSR-2 filing and its supporting data
• Unspent-fund transfer records and account statements

Relific's breakdown of why CSR reports fail, and the ESG data pitfalls to fix, is a useful companion here.

CSR Compliance Calendar

Deadlines depend on the financial year and the type of amount, so treat this as a template to map onto your own FY, and confirm the year's filing dates on the MCA portal.

• Start of FY Board approves the Annual Action Plan; confirm the year's 2% obligation.
• Through the year, implement, monitor, and document projects; keep the paper trail current.
• Within 30 days of FY-end, transfer any unspent ongoing project amount to the Unspent CSR Account.
• Within 6 months of FY-end, transfer any other unspent amount to a Schedule VII fund.
• AOC-4 / AGM cycle: file AOC-4 within 30 days of the AGM; CSR-2 is now linked to that AOC-4 filing on the V3 portal.
• Within 3 years, spend Unspent CSR Account balances on their projects; failing that, transfer to a Schedule VII fund within 30 days of the third year-end.

There is no single universal CSR deadline; the trigger date differs by amount type and by filing, so map each obligation separately.

CSR Penalties & Non-Compliance

As per the current law, CSR default carries civil monetary penalties only. The Companies (Amendment) Act, 2020 removed the earlier imprisonment provision.

Where a company defaults on the obligation to transfer unspent amounts (under Section 135(5) or (6)):

• The company pays a penalty of twice the amount required to be transferred to the Schedule VII fund or the Unspent CSR Account, or ₹1 crore, whichever is less.
• Each officer in default pays one-tenth of that amount, or ₹2 lakh, whichever is less.

Because the provision is capped by "whichever is less," the actual penalty is fixed through adjudication under the Companies (Adjudication of Penalties) Rules. Separately, the Board must still explain any shortfall in CSR spend in its report that the duty is not discharged by paying the penalty. Reporting and filing failures, such as not filing CSR-2, attract their own consequences under the relevant rules.

Any claim that officers face imprisonment for CSR default is out of date; do not rely on it.

Common CSR Compliance Mistakes

• Treating CSR as a year-end exercise: Rushing spend in March produces weak projects and thin documentation.
• Miscalculating the obligation: Using accounting profit-after-tax instead of the Section 198 net profit, or forgetting the exclusions.
• Funding an ineligible activity: Marketing sponsorships, employee-only benefits, or normal-course business dressed up as CSR.
• Weak partner due diligence: Skipping the CSR-1 check or the track-record review.
• Poor documentation: No utilisation certificates, no beneficiary data, no monitoring reports.
• Ignoring the unspent-fund rules: Missing the 30-day or six-month window, or confusing the two.
• Reporting outputs as impact: Counting kits distributed and calling it change.
• Inadequate monitoring during implementation.
• Poor CSR-2 data preparation, leading to AOC-4 / CSR-2 mismatches.
• A disconnect between CSR data and ESG/BRSR reporting, so the same activity is described inconsistently across filings.

CSR Audit Readiness

An audit-ready CSR function maintains, continuously rather than retrospectively: 

• Documentation (policy, plans, resolutions, agreements)
• Governance (committee and board records, disclosures) 
• Financial trail (obligation calculation, budgets, transfers, utilisation)
• Project evidence (proposals, monitoring, beneficiary data, photos)
• Impact evidence (assessments where required)
• Reporting consistency (the same figures across the Board report, AOC-4 and CSR-2).

If those six are current at any point in the year, an audit is a review rather than a fire drill.

How Technology Simplifies CSR Compliance

The operational reality of CSR compliance is that the data lives everywhere except in one place. Project details sit in one spreadsheet, partner documents in an email thread, monitoring reports in a shared drive, impact data in a consultant's PDF, and the CSR-2 numbers get reconstructed from all of it in a rush before filing. That fragmentation is where the errors, missed deadlines, and AOC-4/CSR-2 mismatches come from.

A CSR management platform is meant to close that gap by holding the whole cycle in one system: obligation calculation, project and partner management, compliance tracking, documentation, monitoring, impact measurement, reporting, and an audit trail. The value isn't software for its own sake; it's that the paper trail is created as the work happens, so reporting becomes assembly rather than reconstruction.

This is the problem ProGran, Relific's programme and compliance platform, is built for. On the compliance side specifically, it calculates the 2% obligation from three-year average net profit, tracks unspent amounts separately for ongoing projects and Schedule VII transfers, flags balances under the 3+1 year aging rule, handles set-off accounting for overspend, and auto-populates all 13 sections of the CSR-2 form with multi-company support so group subsidiaries can each close independently. For a CSR team that currently runs this across spreadsheets, the shift is from reconstructing the year at filing time to having it already reconciled.

How to Choose CSR Compliance Software

If you're evaluating platforms, this buyer's checklist maps directly onto the obligations in this guide:

• Section 135 support obligation calculation, thresholds, committee records
• Schedule VII mapping activities tagged to permitted categories
• Partner management: CSR-1 status, documents, due diligence
• Project tracking budgets, milestones, spend
• Documentation centralised, versioned, audit-ready
• Impact measurement: outcomes and impact data, not just outputs
• CSR reporting: Board report and disclosure support
• CSR-2 readiness data structured for the linked filing
• Dashboards: real-time visibility for the committee and board
• Audit trail: who did what, and when
• Role-based access, security, integrations, scalability

For a category overview, see Relific's explainer on what CSR software is and why it matters, and for a market comparison, the Top 10 CSR software in India (2026).

The Future of CSR Compliance in India

The trajectory is clear enough to name without hyperbole: spending → compliance → governance → impact measurement → ESG/BRSR integration → evidence-based social investment. Each stage adds a demand the last one didn't make. Spending asked for money. Compliance asked for process. Governance asked for accountability. Measurement asks for proof. Integration asks for consistency across every disclosure a company makes.

For companies covered by Section 135, the practical implication is that the compliance function and the impact function are converging. Teams that treat the 2% as a filing exercise will keep passing audits and keep producing forgettable programmes. Teams that build the documentation, the partner discipline and the impact evidence into how they work will find that compliance and strategy stop being separate projects. That is the shift this guide is written to support.