Statutory vs Regulatory Compliance: Difference and Examples

Updated 26 October 2026

Statutory compliance means obeying laws passed by the legislature, such as the Code on Wages and the Code on Social Security, which now cover minimum wages, PF and ESI. Regulatory compliance means following rules issued by regulators like EPFO, SEBI or RBI. Contractual compliance means honouring obligations agreed in private contracts. In short, statutory and regulatory duties come from law, contractual duties come from agreements.

Statutory obligation meaning: a statutory obligation is any duty a law places on you directly, such as paying at least the minimum wage or depositing PF on time. You cannot contract out of it.

Three words get used interchangeably in Indian business, and they mean different things with different consequences: statutory, regulatory and contractual compliance.

The distinction is not academic. It decides who can penalise you, how much, and whether you can negotiate your way out of it. One of the three you can renegotiate. The other two you cannot.

Quick comparison: statutory vs regulatory vs contractual

Aspect	Statutory	Regulatory	Contractual
Source	Acts of Parliament / state laws	Rules & circulars from regulators	Agreements you sign
Examples	Code on Wages, Code on Social Security (PF, ESI), state Shops Acts	EPFO circulars, RBI/SEBI directions	Employment contracts, NDAs, client SLAs
Consequence of breach	Interest, damages, penalties, prosecution	Fines, orders, licence action	Civil claims, damages, termination
Can you opt out?	No: applies by law	No: applies if regulated	Yes: negotiable before signing

Statutory compliance

Obligations created by an Act of Parliament or a state legislature. They apply because the law says so, and nobody signed anything to opt in.

For an Indian employer, the main ones now sit in the four Labour Codes, which came into force on 21 November 2025 and replaced twenty-nine older central Acts. Central rules followed on 8 May 2026, and state rules are still being notified.

Code on Wages, 2019 covers minimum wages, timely payment and bonus. It absorbed the Minimum Wages Act 1948, the Payment of Wages Act 1936, the Payment of Bonus Act 1965 and the Equal Remuneration Act 1976. Wages are due by the 7th of the following month, deductions are capped at 50%, and final settlement is due within two working days of an exit.
Code on Social Security, 2020 covers PF, ESI, gratuity and maternity benefit.
Industrial Relations Code, 2020 covers standing orders, discipline, retrenchment and disputes.
OSH and Working Conditions Code, 2020 covers hours, safety and contract labour.

Alongside them sit statutes the Codes did not touch: POSH 2013, the Rights of Persons with Disabilities Act 2016, and your state’s Shops and Establishments Act.

If your handbook still cites the Payment of Wages Act or the Factories Act as live obligations, it is quoting law that no longer exists.

What changed recently (as of October 2026)

PF wage ceiling: raised from ₹15,000 to ₹25,000 a month from 17 September 2026 (S.O. 5109(E)). Read what it means for your payroll.
EPFO extension: an EPFO circular dated 13 October 2026 moved the September 2026 PF return and payment date from 15 October to 31 October 2026, for that month only. It is a good example of a regulator’s rule sitting on top of the law.
DPDP Rules: notified on 14 November 2025, with an 18-month phase-in for most duties. DPDP checklist for employers.
Minimum wages: most states revise them every April and October. October 2026 revision.

Regulatory compliance

Rules made by a sector regulator rather than by the legislature. They bind you only if you operate in that sector, and they change far more often than statute does.

RBI directions for NBFCs, banks and payment companies
SEBI regulations for listed companies and market intermediaries
IRDAI rules for insurers and brokers
FSSAI for anything involving food

Data protection straddles the line. The Digital Personal Data Protection Act, 2023 and its Rules are statutory, so they apply to every employer that holds employee data. The Data Protection Board of India enforces them and can impose penalties, which is the regulatory side. GDPR matters only if you have an office in the EU, or offer goods or services to, or monitor, people in the EU. That is worth knowing because a lot of Indian HR content quotes GDPR by reflex.

Contractual compliance

Promises you made voluntarily. A client MSA, a vendor SLA, an employment contract, a lease.

This is the only one of the three you can renegotiate, and the one most likely to be breached without anyone noticing until a renewal. Common examples: a data-handling clause in a client contract that is stricter than the law requires, a notice period in an employment contract that nobody enforces consistently, or an uptime commitment nobody is measuring.

How they differ in practice

Statutory obligations apply to every employer within their scope (minimum wages from the first employee, ESI from 10, PF from 20) and carry penalties set by law, sometimes personal liability for directors. Regulatory obligations apply only to your sector but change frequently and can cost you a licence. Contractual obligations apply only to the party you promised, and the remedy is usually damages or termination rather than a fine.

One practical consequence: you can be fully statutorily compliant and still lose a client for breaching a contract clause you never read.

Where companies get confused

Two patterns, both common.

A startup treats statutory as the whole picture and misses a sector rule that turns out to gate a licence. Or a larger company runs tight regulatory reporting and quietly under-files PF for a group of workers everyone treats as consultants, which is one of the most common statutory gaps we see.

The other trap is state law. Professional tax, minimum wages and Shops and Establishments rules follow where the employee actually works, not where you are registered.

Keeping on top of all three

Keep one list, split into the three categories, with an owner and a date against each line. Statutory items are mostly monthly and annual. Regulatory items are whatever your regulator publishes. Contractual items should be pulled out of your contracts once and reviewed at renewal.

Review the statutory section annually at minimum. State rules under the Codes are still landing, and thresholds have already moved: standing orders and prior permission to retrench both went from 100 to 300 workers.

Which one to worry about first

Statutory, because it applies to you whatever you do and the penalties are not negotiable. Then whichever regulator can take your licence away. Contractual last, unless a big client renewal is coming.

Want this handled for your team? See what is covered, or send us your headcount and locations.

Managing Compliance Is Complex: We Make It Simple

HRTailor takes care of the statutory layer for small businesses: PF, ESI, PT, LWF, Shops Act registrations and Labour Code filings, every month.

See statutory compliance services →

Frequently asked questions

What is the difference between statutory and regulatory compliance?

Statutory compliance comes directly from laws passed by Parliament or state legislatures (such as the Code on Wages or the Code on Social Security), while regulatory compliance comes from rules issued by regulators and government bodies (such as EPFO circulars, RBI or SEBI directions) under the authority of those laws.

What is contractual compliance in HR?

Contractual compliance means honouring obligations a company voluntarily agreed to: employment contracts, offer letters, client agreements, NDAs and vendor contracts. Breach leads to civil claims and damages rather than statutory penalties.

Which type of compliance carries the highest risk?

Statutory non-compliance is usually the most serious for employers. It can attract interest, damages, penalties and even prosecution. Regulatory breaches bring fines and orders from the regulator, while contractual breaches lead to disputes and damages.

Do the new Labour Codes change statutory compliance?

Yes. The four Labour Codes consolidate and replace many earlier central labour laws, and states notify their own rules under them, so employers must track both the Codes and their state’s rules.

Who is responsible for compliance in a company?

The employer is legally responsible. In practice, responsibility is shared between HR, finance and leadership, or delegated to a compliance partner, but liability stays with the establishment and its officers.

Is an EPFO circular statutory or regulatory?

Regulatory. The duty to pay PF comes from the Code on Social Security, which is statutory. EPFO circulars set how and when you file, like the October 2026 circular that extended the September return to 31 October.