Compliance Requirements Checklist 2026: Federal, State, and Entity-Level Starter Pack
How to Use This Checklist
Compliance fails in gaps between owners. Use this as the single starter pack that points to deep guides for each workstream: Tax Filing Deadlines, Payroll Tax, SALT Planning, Internal Controls, and Month-End Close.
1. Entity and License (Annual + Event-Driven)
- Good standing in domicile + foreign qualification where doing business — see Startup Entity Selection and Delaware vs Wyoming.
- EIN, state tax IDs, business licenses current.
- BOI / beneficial ownership status reviewed for 2026 rule changes with counsel.
- Cap table and minutes current — see Cap Table Management.
2. Income Tax (Federal + State)
- Federal return calendar set: 1120, 1120-S, or 1065 plus extensions.
- State returns for every nexus state; track Corporate Tax Systems.
- Quarterly estimates paid; provision tied to GL.
- R&D Credits and QSBS documentation filed contemporaneously.
- Transfer-pricing memo if cross-border — see Transfer Pricing.
3. Payroll and Contractor (Monthly + Quarterly)
- Withholding, 941, 940, W-2/W-3, state returns on calendar.
- Multi-state registration where employees work — see International Payroll.
- 1099 vs W-2 review under current DOL test; contracts updated.
- Payroll clearing reconciled monthly; tie to Financial Statement Analysis.
4. Sales Tax and VAT (Monthly Monitoring)
- Nexus tracker by state: sales, transactions, physical presence.
- Registration before collection; exemption certificates on file.
- SaaS and digital rules mapped — see SaaS Sales Tax and VAT Thresholds.
- Returns reconciled to revenue in ASC 606 workpapers.
5. Financial Reporting Controls (Monthly)
- Locked close calendar per Month-End Close.
- Bank recs, AR/AP agings, payroll tie-out signed.
- Audit log review per QuickBooks vs Xero Controls.
- Bookkeeping Software roles: enter vs approve vs release separated.
- SOX-lite testing for pre-IPO — see SOX 404 Walkthrough.
6. Data Privacy and Security (Quarterly)
- GDPR/CCPA notices, DSAR workflow, retention schedule — see GDPR Guide and CCPA Guide.
- SOC 2 scope confirmed if enterprise deals require it — see SOC 2 for Startups.
- Access reviews for finance systems; MFA enforced.
7. Governance (Quarterly)
- Board minutes, Board of Directors independence, Audit Committee oversight.
- Insider Trading blackouts if applicable.
- Fraud Prevention and Whistleblower channels tested.
Operating Rhythm
| Cadence | Review | Owner |
|---|---|---|
| Monthly | Close, payroll tie, sales-tax tracker | Controller |
| Quarterly | Nexus, licenses, privacy, access | CFO + counsel |
| Annually | Entity, tax strategy, control design | CFO + CPA |
| Event-driven | New state, hire, product, funding, M&A | Controller + counsel |
FAQ
What triggers most penalties?
Late payroll returns, unregistered sales-tax collection, and missed state qualifications. All three are calendar problems, not technical problems.
Where should startups start?
Entity, EIN, payroll, one operating state sales-tax review, monthly close with locks, and privacy notice if collecting emails. Add the rest as nexus expands.
Next Steps
- Assign one owner per section above with due dates.
- Put deadlines in a shared calendar linked to Tax Filing Deadlines.
- Report open items to leadership monthly until green.
