Contract Labour Compliance: Principal Employer Guide

Most Indian companies discover the true cost of weak contract labour compliance at the worst possible moment: an inspector's visit, a client audit, a due-diligence questionnaire before a funding round, or a group of housekeeping workers standing outside the gate because their contractor did not pay them. In every one of those moments, the question is the same — who is actually responsible? And the answer, uncomfortably often, is you. Not the vendor whose name is on the invoice, but the company whose premises the work was performed on.

This guide is written for HR, compliance, procurement and finance leaders in India who engage people through staffing vendors, manpower contractors, housekeeping and security agencies, facility management firms and third-party payroll providers. It is a practical playbook, not a legal opinion. Statutory thresholds, forms and procedures differ across states and are actively changing as India moves toward consolidated labour codes, so treat everything here as a framework for thinking — and verify the specifics with official state and central sources or your legal counsel before you act.

Why Contract Labour Compliance Is Suddenly Everyone's Problem

Ten years ago, contract labour was largely a factory conversation. Today it is a whole-economy conversation. A software company in Bengaluru runs its office through a facilities vendor. A GCC in Hyderabad has more badge-holders from vendors than from its own payroll. A D2C brand runs warehouses on seasonal manpower. A hospital chain outsources housekeeping, security, laundry, catering and patient transport.

Three forces have made this a board-level risk rather than an admin chore.

First, enforcement has become data-driven. Provident fund and state insurance contributions leave digital footprints. A mismatch between the headcount a vendor bills you for and the headcount appearing in their monthly returns is now trivially visible.

Second, client and investor scrutiny has hardened. Global customers ask Indian suppliers for evidence of contractor wage payments and social security remittances. Acquirers price contingent labour liabilities into deal terms. A messy contract-labour estate becomes a discount on your valuation.

Third, the regulatory architecture itself is in transition. India consolidated a large number of central labour statutes into four codes covering wages, industrial relations, social security, and occupational safety, health and working conditions. The contract labour subject matter sits mainly within the occupational safety and working conditions framework, with wages and social security handled by their respective codes. Implementation timing and state rules have moved in stages, so the practical rule for any compliance team is simple: confirm which regime applies to your establishment, in your state, right now.

The single sentence that should worry you

If your contractor fails to pay wages or deposit statutory dues for workers deployed at your premises, the law in India has long placed a backstop obligation on the principal employer to make good the shortfall — and then recover it from the contractor.

That backstop is the heart of contract labour compliance. Everything else in this guide is machinery designed to make sure you never have to rely on it.

Who Is a Principal Employer and Who Is a Contractor?

The terms are used loosely in commercial conversation and precisely in law. Getting them right is the foundation of principal employer obligations.

The principal employer is, broadly, the company or establishment that engages contract labour for its work — in a factory, typically the occupier or manager; in other establishments, the person responsible for supervision and control of the establishment. If workers are performing work of your establishment, on or in connection with your premises, through an intermediary, you are in principal employer territory.

A contractor is a person or entity that undertakes to produce a result for the establishment through contract labour, or who supplies contract labour for any work of the establishment. This includes a sub-contractor. Note the two limbs: producing a result (outcome-based services) and supplying labour (headcount-based staffing). Both are covered.

Contract labour means a worker hired in or in connection with the work of an establishment by or through a contractor, with or without the knowledge of the principal employer. That last phrase matters. Ignorance of a sub-contractor's existence is not a defence.

The four-party reality on the ground

In practice you will encounter a chain, not a pair:

• You — the principal employer
• The prime vendor — the agency you signed and pay
• Sub-contractors — the vendor's own suppliers of specialised labour
• The workers — who may not know any of the above names

Liability tends to flow upward through that chain. A sub-contractor's default becomes the prime vendor's problem, and the prime vendor's default becomes yours. This is why sub-contracting restrictions and disclosure obligations belong in every services agreement.

Where liability actually lands when a vendor defaults

Consider a realistic scenario. A mid-sized IT services firm in Pune engages a facilities agency for 46 housekeeping and pantry staff. The agency bills monthly, the invoices are paid on time, and nobody in HR has looked at a wage register in two years. In month 19, the agency's owner runs into a cash crunch, pays workers in cash at below the notified minimum wage, and stops depositing provident fund.

What happens next is predictable:

1. Workers complain — to the client's HR, to a union, or to the labour office.
2. An inspection follows, focused on the premises where the work happened: yours.
3. Records are demanded — wage registers, attendance, payment proof, remittance challans.
4. The vendor cannot produce clean records, or produces records inconsistent with their returns.
5. The principal employer is asked to make good unpaid wages and, in the social security context, faces exposure for contributions relating to workers engaged through the contractor.
6. Your recovery right against the vendor exists on paper. Whether the vendor still has money is a different question.

The commercial lesson is blunt: your indemnity clause is only as good as your vendor's balance sheet. Prevention beats recovery every time.

The reputational layer

Financial exposure is recoverable. Reputational exposure often is not. Wage disputes involving contract workers at a well-known employer's site travel fast on social media and in local press. Clients with supplier codes of conduct may treat it as a breach. Employees notice how the people who clean their desks are treated. Contract labour compliance is, increasingly, an employer brand issue.

Registration and Licensing: The Conceptual Map

This is the area where generic internet advice does the most damage, because numbers vary by state and have been revised over time. So let us stay at the level of mechanism, and be explicit about what you must verify.

Principal employer registration

The classic structure works like this. An establishment that engages contract labour at or above a specified number of workers, on any day in the preceding twelve months, is required to obtain a registration certificate from the appropriate labour authority. The application typically identifies the establishment, the nature of work, the contractors engaged, and the number of contract workers.

Key practical points:

• The trigger is usually a count of contract workers, aggregated across contractors, measured on any day in a look-back period — not an average.
• The applicable threshold number varies by state, and several states have revised theirs. Some states have moved the number upward; some have retained lower numbers. Never assume the figure someone quoted you from another state applies to yours.
• Registration is usually per establishment or per premises, not per company. A company with four offices in three states may need multiple registrations.
• The certificate typically records the maximum number of contract workers you may engage. Exceeding it without amendment is a common audit finding.
• Adding new contractors or increasing headcount usually requires an amendment, not silence.

Contractor licence

A contractor engaging contract labour at or above a specified number is generally required to hold a licence, and the licence is typically tied to the specific principal employer and workplace. The principal employer issues a form of certificate confirming the engagement, which the contractor submits with the licence application.

Three things trip companies up repeatedly:

• The contractor licence is establishment-specific in most regimes. A vendor showing you a licence issued for a different client site has shown you nothing relevant.
• Licences have validity periods and renewal cycles. An expired licence discovered during an inspection is an easy finding.
• The licence records a maximum worker count. If the vendor deploys 90 workers on a licence permitting 50, both parties have a problem.

Why "verify current thresholds" is not a disclaimer, it is the advice

Thresholds for both registration and licensing have been amended by multiple state governments, and the consolidated labour codes framework contemplates its own thresholds and its own registration and licensing architecture, including moves toward centralised electronic registration and combined licences covering multiple establishments.

Because of this, the only defensible process is:

1. Identify every state and premises where you engage contract labour.
2. For each, determine which regime currently governs — the older statute-based regime or the code-based regime as notified in that state.
3. Confirm the current threshold, forms, fees and renewal cycle from the state labour department's own notification or portal.
4. Document the determination, with the source and date, in your compliance file.
5. Re-verify at a fixed cadence — at least annually, and whenever you open a new site.

That documented determination is itself valuable evidence of good faith if a position is later questioned.

Special cases worth flagging

• Shared or co-working premises. If you occupy a managed office, the facilities workers may be engaged by the building operator, not by you. The analysis of who is the principal employer depends on whose work is being done and who controls the premises. Get this assessed rather than assumed.
• Client sites. If your employees work at a customer's premises, your customer may be the principal employer for that engagement and may impose compliance obligations on you as their contractor. The roles reverse.
• Project and construction work. Building and construction activity carries its own registration, cess and welfare board machinery in addition to contract labour requirements. Treat it as a separate workstream.
• Core versus non-core activity. The framework has long contemplated restrictions on engaging contract labour in the core activity of an establishment, with defined exceptions. Whether and how this applies to you is a genuinely fact-specific question and one of the better uses of paid legal advice.

The Vendor Lifecycle: Six Stages of Staffing Vendor Management in India

Good staffing vendor management in India is a lifecycle, not a contract. Here is the shape of a programme that actually holds up.

Stage 1: Due diligence and onboarding

Before a single worker walks through the gate, you should hold a documented file. Minimum contents:

• Entity proof: incorporation or registration documents, PAN, GST registration
• Statutory registrations: PF establishment code, ESI code (where applicable), professional tax registration where applicable
• Contract labour licence for your site — or documented evidence of why one is not required
• Shops and establishments or factory registration for the vendor's own premises
• Last three to six months of PF and ESI remittance evidence for the vendor's existing workforce
• Bank details verified independently, not just from an email
• Insurance: workmen's compensation or equivalent, public liability where relevant
• POSH policy and internal committee constitution details
• Financial health signals: audited financials or at least turnover declaration, and an honest read on whether they can fund a payroll cycle if you are late paying them
• References from two current clients, ideally with similar headcount

A useful diligence question that reveals a lot: "Show me the wage register and PF ECR for one of your existing sites for last month." Vendors with real systems produce it in a day. Vendors without will negotiate.

Stage 2: Contracting

The agreement is where you convert intentions into leverage. A detailed clause checklist appears later in this guide. The critical structural decisions at this stage are:

• Is this an outcome-based service contract or a headcount supply arrangement? Say which, and behave consistently with it.
• Is sub-contracting permitted? If yes, under what disclosure and flow-down conditions?
• What is the payment trigger — invoice submission, or invoice plus verified compliance evidence?
• What is the notice and transition mechanism if you need to exit?

Stage 3: Monthly compliance collection

This is the operational heartbeat. Every month, for every vendor, for every site, you collect a defined document pack, review it against your own attendance and headcount data, and record the result. The pack is described in the next section.

The single most important design choice here: collect it before you pay, not after.

Stage 4: Payment release gating

Accounts payable becomes the enforcement mechanism. No verified pack, no invoice release. Details below — this is the section most worth implementing first.

Stage 5: Periodic audits

Document collection catches paperwork failures. Audits catch reality failures — ghost workers, cash top-ups, underpayment against notified rates, safety gaps, workers who have never seen an ID card. Run them at a defined frequency, mix announced and unannounced, and include worker interviews.

Stage 6: Offboarding and transition

Vendor exits are where liabilities crystallise. Build a transition protocol:

• Final settlement of all worker dues, with evidence
• Return of company assets, access cards, uniforms
• Deactivation of all system and physical access on the last working day
• Final PF and ESI remittances covering the last month of service, verified after the due date has passed
• A holdback or retention released only after the final compliance evidence lands
• Documented handover of any statutory registers you are entitled to
• Clarity on whether workers are transitioning to the incoming vendor and, if so, on what terms regarding continuity of service

Retention amounts held against final compliance are one of the few mechanisms that reliably produce documents from a departing vendor.

The Monthly Vendor Compliance Document Checklist

This table is the working core of a vendor compliance audit programme. Adapt the list to your sector, and confirm applicable forms and formats for your state and regime.

The three-way reconciliation that finds most problems

If you only do one analytical thing each month, do this. Compare:

1. Billed headcount — from the vendor invoice
2. Deployed headcount — from your own gate, biometric or access-control data
3. Statutory headcount — from the PF ECR and ESI statement

They should agree, allowing for defined exceptions like workers below or above coverage thresholds, exempted categories, or mid-month joiners. Persistent unexplained gaps mean one of three things: you are being billed for people who do not exist, people are working without statutory coverage, or your data is broken. All three need fixing.

An illustrative case: a retail chain reconciled 312 billed store housekeeping staff against 287 in the vendor's PF ECR. Investigation showed 25 workers had been rotated in as "temporary reliefs" and never enrolled. The correction cost money, but far less than discovering it through an inspection three years later with interest and damages attached.

Building a Compliance Gate into Accounts Payable

Here is the uncomfortable truth about vendor compliance: HR can ask for documents forever and get nothing. Finance can ask once and get everything. The difference is the payment.

A compliance gate makes document submission a condition precedent to invoice processing. Structurally it looks like this.

The gating design, step by step

1. Define the pack per vendor category. A security agency's pack differs from a specialist engineering contractor's. Write it into the contract as an annexure so it is not negotiable later.

1. Set a submission window. For example: compliance pack for month M due by a fixed date in month M+1, alongside the invoice. Documents that can only exist after a statutory due date (like remittance challans) are submitted in the following cycle — build that lag into the design rather than pretending it does not exist.

1. Create a single submission channel. One portal, one shared drive folder structure, or one HRMS vendor module. Email attachments across four people's inboxes is how programmes die.

1. Assign a verifier. Someone reviews the pack against a checklist and marks it Complete, Incomplete or Disputed. This should take minutes per vendor if the pack is structured, not hours.

1. Wire the status into AP. The invoice cannot move to payment approval unless the compliance status for the relevant period is Complete. In most ERP or AP tools this is a custom field or an approval step. In smaller companies it is a mandatory checkbox on the payment approval, backed by a monthly report.

1. Define the withholding rule precisely. Common approaches: withhold the full invoice; withhold a defined percentage; or release the service fee and withhold the statutory-cost component. Whichever you choose, the contract must expressly permit it, and it must be applied consistently.

1. Define an escalation path. Two consecutive incomplete months triggers a vendor review meeting. Three triggers a formal notice. Persistent failure triggers termination and transition.

1. Handle the worker-protection paradox. Withholding payment can hurt the very workers you are trying to protect if the vendor uses your payment to fund their payroll. Mitigate by requiring evidence of wage payment early in the cycle and gating on the previous month's statutory remittances, so that current wages are never the hostage.

A worked example of the cycle

A GCC with 400 contract workers across three vendors runs this rhythm:

• Day 1-3 of each month: vendors upload the previous month's attendance, wage register and bank payment proof, plus the month-before-last's PF and ESI challans.
• Day 4-6: compliance analyst runs the three-way reconciliation and marks statuses.
• Day 7: compliance dashboard published to procurement and finance.
• Day 8 onward: AP processes invoices only for vendors marked Complete.
• Day 10: escalation calls for anyone Incomplete.
• Quarterly: one vendor selected for a deep audit including worker interviews.

The cycle takes roughly three person-days a month. The exposure it prevents is measured in multiples of that.

Retention and holdbacks

For higher-risk vendors — small agencies, high headcount, thin margins — consider a modest retention held for a defined period after each quarter, released against verified compliance. It creates a fund to make good defaults and a strong incentive to submit documents. Ensure the mechanism is contractual, disclosed, and does not itself cause the vendor to fail.

Wages: Minimum Rates, the New Wage Definition and Equal Pay

Wage compliance is where the money is, and where the new labour codes framework has the largest structural implications for contract workers.

Minimum wages

Contract workers must be paid at least the applicable minimum wage. The applicable rate depends on several variables:

• The state in which work is performed
• The scheduled employment category into which the work falls
• The skill classification — unskilled, semi-skilled, skilled, highly skilled
• The geographic zone or area class within the state, in states that use zoning
• The effective date of the current notification, since rates are revised periodically and often include a variable dearness allowance component

Practical failure modes: applying last year's rate; applying an unskilled rate to work that is genuinely semi-skilled; applying the wrong zone for a peripheral location; or the vendor quoting you a commercial rate card that quietly assumes a lower classification than the work requires.

Build a wage floor matrix — state, category, skill, zone, current rate, notification reference, next expected revision — and review it on a set cadence. Verify each entry against the state's own notification, not against a vendor's assertion or a third-party summary.

The wage definition and the fifty percent concept

The consolidated wages framework introduces a harmonised definition of "wages" for computing statutory benefits. In broad terms, the definition includes basic pay, dearness allowance and retaining allowance, excludes a specified list of components such as certain allowances and bonuses, and then contains a balancing mechanism: if the excluded components exceed a specified proportion of total remuneration, the excess is added back into wages for computation purposes.

This is popularly summarised as the "fifty percent rule" — the idea that basic-type components should constitute roughly half of total remuneration for statutory computation. Do not treat that summary as a precise legal statement; the actual mechanics, the treatment of specific components, the position on employer contributions and gratuity computation, and the applicable date all need to be confirmed against the operative text and rules for your situation.

Why it matters for contract labour specifically:

• Many contractor wage structures are deliberately basic-light and allowance-heavy to reduce PF and gratuity cost. Under a harmonised definition, that arbitrage compresses.
• Compression usually means higher statutory cost per worker, which means higher vendor rate cards.
• If your vendor contracts are multi-year and priced without a change-in-law clause, that cost lands somewhere — often as a quiet reduction in what workers actually receive, which is precisely the risk you are trying to avoid.

Action: ensure every vendor agreement has a change-in-law clause requiring transparent repricing, and ask vendors for a cost breakup showing the statutory components separately from their margin. Then verify that repricing actually reaches workers.

Overtime

Overtime for contract workers should be recorded, paid at the statutory premium rate, and kept within permitted limits. Common findings during a vendor compliance audit:

• Overtime worked but recorded as normal hours to stay within limits
• Overtime paid in cash outside the wage register
• Security and housekeeping rosters built on twelve-hour shifts with no overtime recognition at all
• Attendance data in your own access-control system contradicting the vendor's muster

That last one is worth emphasising. Your gate data is often the strongest evidence about what actually happened — and it can work either for you or against you. Better to reconcile it yourself, monthly, than to have someone else reconcile it during an inspection.

Equal pay for equal work

Where contract workers perform work that is the same as or substantially similar to work performed by your own employees, questions of comparable treatment arise. The legal position is nuanced and fact-dependent, involving comparisons of duties, responsibility, qualifications and conditions.

The practical guidance is narrower and safer: if you find yourself with contract workers doing a job identical to permanent employees, sitting in the same team, under the same supervisor, with the same targets, you have a design problem well beyond pay parity. Address the design, not just the rate.

Statutory Benefits Pass-Through: Who Actually Pays

Contractor PF ESI compliance is the area where principal employer backstop duties bite hardest, because these are contribution-based systems with digital trails.

What "backstop duty" means operationally

The mechanism, in general terms, is that where a contractor fails to pay wages or fails to remit contributions in respect of workers engaged for the principal employer's work, the principal employer may be called upon to make the payment and then recover it from amounts payable to the contractor, or as a debt.

Three operational consequences follow:

1. Always hold something back. Recovery from money you still owe is easy. Recovery from a vendor you have fully paid is litigation.
2. Verify remittance, not intention. A generated challan is not a paid challan. Check the payment confirmation and, where the vendor's registration permits, cross-check on the relevant portal.
3. Keep evidence of your own diligence. A documented monthly verification trail is the difference between a systemic finding and an isolated one.

The gratuity trap

A worker deployed at your site through a vendor for six or seven continuous years — often through two or three vendor changes with the same person doing the same job — creates a live question about continuity of service and who bears gratuity liability. If the vendor changed but the worker did not, the argument that service was continuous with the establishment becomes easier to make.

Mitigations: track tenure at the person level, not just the vendor level; require the outgoing vendor to settle terminal dues at transition with evidence; and periodically review roles where the same individuals have been present for many years, because long unbroken tenure is also a deemed-employment red flag (see below).

Welfare and Facilities Obligations

Under the occupational safety, health and working conditions framework and the earlier statutes it consolidates, establishments engaging contract labour have obligations regarding basic welfare amenities. Requirements are typically scaled to headcount and to the nature of the work, and they differ between factories, construction sites and commercial establishments. Verify the specifics for your establishment type and state.

Conceptually, the amenities to plan for include:

• Drinking water — sufficient, accessible, and maintained
• Toilets and washing facilities — adequate in number, separated by gender, cleaned and stocked
• Rest rooms or shelters — particularly for workers on long shifts, night shifts, or outdoor duty
• Canteen facilities — typically where headcount crosses a specified threshold
• First aid — stocked boxes at defined ratios, trained first-aiders, and a clear route to medical care
• Creche facilities — where thresholds relating to women workers or total workers are met
• Personal protective equipment — supplied, correctly sized, replaced when worn
• Safe access, lighting and emergency egress
• Health checks — where the work involves defined hazards

The provision-versus-default structure

A pattern worth understanding: in the traditional framework, the contractor is generally obliged to provide certain amenities to their workers, and if the contractor fails to do so within a prescribed period, the principal employer must provide them and may recover the cost.

Practically, for anything located on your premises, you should simply provide it yourself and stop pretending otherwise. Nobody benefits from a contract that says the housekeeping agency must supply drinking water inside your building.

The dignity test

Beyond legal minimums, apply a simple internal standard: would you be comfortable if a journalist photographed where your contract workers eat, rest and change? Separate, inferior facilities for contract staff are a compliance risk, an employee-relations risk and a brand risk simultaneously. Many organisations have moved to shared amenities for all workers on site regardless of employer of record — it is simpler to administer and easier to defend.

Sham Contracting and Deemed Employment Risk

This is the risk that keeps general counsel awake. The concern is that an arrangement labelled as contracting is, in substance, direct employment — and that a tribunal or authority may look past the paperwork to the reality.

Red flags that suggest the relationship is really employment

• Direct supervision. Your manager assigns daily tasks, sets priorities and corrects performance directly, rather than the vendor supervisor doing so against an agreed scope.
• Integration into the org structure. The contract worker appears on your org chart, in your team distribution lists, in your all-hands, with your email domain and designation.
• Performance management by you. You run their appraisal, set their goals, decide their increment, or approve their promotion.
• Selection and rejection control. You interview and personally select each individual, and instruct the vendor to remove people you dislike.
• Long unbroken tenure on core roles. The same individual, same seat, same work, for many years, doing work central to your business rather than a discrete outsourced service.
• Employer-supplied tools and infrastructure with no commercial recognition — laptop, workstation, software licences, phone, vehicle — combined with all of the above.
• Leave and attendance approvals by you. Your manager approves their leave in your system.
• Payment structured as headcount pass-through plus a thin margin, with you effectively dictating the worker's take-home.
• Absence of a real vendor: no independent business, no other clients, no supervisory presence at site, a "vendor" that exists only to route your payroll.

No single factor is decisive. It is the accumulation that creates risk, and courts and authorities in India have historically applied multi-factor tests looking at control, supervision, integration and economic reality rather than at contract labels alone.

How to design an engagement that stays clean

For outcome-based services (housekeeping, security, facilities, catering, logistics, specialist maintenance):

• Contract for deliverables and service levels, not for bodies. "Maintain these areas to this standard, measured this way" rather than "supply eight housekeepers."
• Require the vendor to provide on-site supervision. Your team talks to the vendor supervisor; the supervisor manages the workers.
• Let the vendor choose and rotate personnel within agreed competency standards. You can specify skills and require replacement for cause; you should not be running the selection.
• Price on output or scope, not purely on headcount-plus-margin, where commercially feasible.
• Keep contract workers out of your performance management, appraisal and internal reward systems.
• Use distinct identification — different badge colour, distinct email conventions or no company email, clear designation as vendor personnel.
• Maintain separate communication channels for work instructions, routed through the vendor.

For genuine augmentation of technical capacity (IT contractors, project specialists):

• Accept that this is closer to the line and manage it deliberately.
• Use defined project scopes and durations with real end dates.
• Avoid indefinite renewals of the same individual for many years on core work.
• Keep them outside internal HR processes, benefits and appraisal cycles.
• Consider whether the role is genuinely temporary or project-based; if it has been permanent for five years, the honest answer may be to hire directly.

The conversion conversation

Sometimes the right answer is not better contracting but direct hiring. If a role is core, permanent, continuously staffed and supervised by you, converting the incumbent to your own payroll removes the risk entirely and often costs less than the eventual dispute. Run a periodic review flagging any contract position that has existed continuously for more than a defined period, and force a conscious decision: convert, restructure, or genuinely outsource.

Contract Clause Checklist for Vendor Agreements

A services agreement is your primary control instrument. Have counsel draft and adapt these; the list below is a coverage checklist, not model language.

Scope and structure - Precise description of services, deliverables and service levels - Statement that the vendor is an independent contractor and the sole employer of its personnel - Express denial of any employment relationship between your company and vendor personnel - Restrictions on sub-contracting, with prior written consent and flow-down of all obligations - Obligation to provide on-site supervision at defined ratios

Compliance and warranties - Warranty of compliance with all applicable labour, social security, tax and safety laws - Obligation to hold and maintain all required registrations and licences, including site-specific contractor licence - Undertaking to pay wages at or above notified minimum wages by a specified date each month, through banking channels - Obligation to enrol all eligible workers for PF and ESI and to remit within statutory timelines - Monthly compliance document pack as a contractual annexure, with a defined submission deadline - Right to require self-certification signed by an authorised signatory

Money and enforcement - Right to withhold or set off payment against non-submission or non-compliance - Retention or holdback mechanism with defined release conditions - Right to make direct payment of wages or statutory dues on the vendor's default and recover it - Indemnity covering claims, demands, penalties, interest and legal costs arising from vendor non-compliance - Requirement to maintain insurance with defined minimum cover and to provide policy evidence - Change-in-law clause governing repricing when statutory costs change

Audit and access - Right to audit records, accounts, registers and premises on reasonable notice - Right to conduct unannounced site inspections and to interview workers - Obligation to preserve records for a defined retention period and to provide them on request - Right to appoint a third-party auditor at the vendor's cost where material non-compliance is found

People and conduct - Background verification standards, with defined checks by role category - Induction, safety training and refresher training obligations - Mandatory photo ID cards issued by the vendor, worn on site - POSH obligations: policy, internal committee, awareness for deployed workers, cooperation with your committee for incidents on your premises, reporting obligations - Code of conduct, anti-bribery, and prohibition of child and forced labour - Right to require removal and replacement of any individual, with a defined replacement timeline - Non-solicitation terms, drafted carefully so they do not restrain workers' livelihoods unreasonably

Data and confidentiality - Confidentiality obligations extending to vendor personnel - Data protection obligations aligned to India's personal data protection framework and any client contractual requirements - Restrictions on access to systems, devices and physical areas - Obligation to return or destroy data and assets on exit

Term and exit - Term, renewal mechanics and notice periods - Termination for cause including compliance breach, with a short cure period - Transition assistance obligations at exit - Survival of indemnity, confidentiality and record-retention obligations - Final settlement and compliance evidence as a condition for release of retention

Attendance, Access Control and Headcount Visibility

You cannot manage what you cannot count. Most contract labour failures start as data failures.

Build a contract worker master

Maintain a single record of every non-employee working on your premises, containing at minimum:

• Full name, photo, and a unique internal ID
• Vendor name and sub-contractor name if any
• Site, department and reporting vendor supervisor
• Role category and skill classification
• Start date and, once known, end date
• ID card number and validity
• Background verification status and date
• Induction and safety training completion dates
• PF UAN and ESI IP number where applicable
• Access rights granted, physical and digital
• Documents on file with expiry dates

This master is the spine of everything else — reconciliation, audits, access revocation, and inspection response.

Attendance capture

Options, roughly in order of reliability:

1. Biometric or facial recognition at the gate, integrated with the contract worker master. Strongest evidence, cleanest reconciliation. Be mindful of consent and data protection requirements when handling biometric data.
2. Access card swipe tied to the same master. Good, though card sharing is a known weakness.
3. Mobile app with geofenced check-in for distributed sites and field roles.
4. Vendor-maintained muster countersigned by your site supervisor. Weakest, but better than nothing, and often the only option at small remote sites.

Whichever you use, the point is to have your own independent record rather than relying solely on the vendor's.

Access control hygiene

• Access expires automatically on the recorded end date; renewal requires positive action
• Weekly report of active access holders reconciled against the contract worker master
• Immediate revocation on separation, triggered by the vendor's exit notification and verified by you
• Distinct badge design so anyone on site can tell employee from vendor personnel
• Zone-based access rather than blanket building access
• Quarterly access recertification signed off by the site owner

The classic finding in a security audit is a set of active badges belonging to people who left months ago. It is also the easiest thing on this list to fix.

Headcount visibility for leadership

Give the executive team a monthly one-pager: total contract headcount by vendor, site and function; movement in the month; compliance status by vendor; open findings; and cost. When contract headcount is invisible, it grows unmanaged. When it is on a dashboard, someone owns it.

POSH, Safety Induction, ID Cards and Grievance Mechanisms

POSH

The prevention of sexual harassment framework in India covers women at a workplace regardless of whether they are on your payroll. A contract worker deployed at your premises is, in practical terms, working at your workplace.

Sensible practice:

• Your internal committee should be prepared to receive and handle complaints involving incidents at your premises, including those involving contract workers, in coordination with the vendor as appropriate
• Contract workers should be told, at induction, how to raise a complaint and to whom — in a language they read
• Display committee contact details in common areas, in local languages
• Require vendors to have their own compliant policy and committee
• Include POSH obligations, cooperation duties and reporting timelines in the contract
• Conduct awareness sessions that actually reach housekeeping and security staff, not just office workers

Safety induction

Every contract worker should complete a site induction before first deployment, covering emergency exits and assembly points, fire response, incident reporting, prohibited areas, PPE requirements and role-specific hazards. Keep dated attendance records. Refresh annually and after any significant incident or site change.

For higher-hazard work — electrical, working at height, confined spaces, hot work — add a permit-to-work system and competency verification. Do not accept a vendor's assertion of competence for hazardous work; verify it.

ID cards

Simple, cheap, and disproportionately valuable. Every contract worker should carry a photo ID issued by the vendor, displaying the vendor name, the worker's name, an ID number and validity. It supports access control, incident response, inspection readiness and basic worker dignity.

Grievance mechanisms

Contract workers frequently have no safe route to raise a problem, because the only channel available is their own supervisor — often the source of the problem.

Provide:

• A physical suggestion or complaint box at the worker area, cleared by your HR team, not by the vendor
• A helpline number or WhatsApp channel displayed in local languages
• Periodic skip-level conversations during audits, without the vendor supervisor present
• A documented escalation and response protocol with timelines
• A non-retaliation commitment, and enforcement of it

An illustrative pattern worth watching for: wage complaints that surface only after a worker leaves. That usually means the grievance channel is not trusted. If your contract worker grievance log has been empty for a year across 300 workers, the mechanism is broken, not the workforce.

Inspection and Audit Readiness

What inspectors typically look for

While specific powers and procedures vary by regime and state, the practical focus areas are consistent:

• Whether the principal employer holds valid registration and whether the number of contract workers exceeds what it permits
• Whether each contractor holds a valid, site-specific licence within its headcount limit
• Wage registers and payment evidence — is the notified minimum wage being paid, and is payment reaching bank accounts?
• Attendance and overtime records, and whether they are internally consistent
• PF and ESI enrolment and remittance for all eligible workers
• Welfare amenities actually present on site
• Safety arrangements, PPE and training records
• Display of notices and abstracts as required
• Register and record maintenance in prescribed formats, and whether electronic records are permitted and properly maintained in your state

The evidence bundle

Maintain a standing bundle, per site, that can be produced within a day:

1. Establishment registration certificate and any amendments
2. Vendor register with contact details, contract dates and licence status
3. Copies of all current contractor licences
4. Last twelve months of compliance packs, by vendor
5. Contract worker master with current headcount
6. Attendance data extract for the requested period
7. Wage register copies and bank payment evidence
8. PF and ESI challans and returns for the period
9. Welfare amenities evidence — photographs, maintenance logs, canteen and first-aid records
10. Induction and safety training records
11. Insurance policies
12. Incident register and closure evidence
13. Audit reports and corrective action logs
14. Notices displayed, with photographs and dates
15. Your internal compliance policy and SOP documents

Digital, indexed, searchable and current. A well-organised bundle changes the tone of an inspection immediately: it signals a managed programme rather than a neglected one.

Common findings and how to prevent them

A Vendor Scorecard for Contract Labour Compliance

Scorecards convert a subjective vendor relationship into a governed one. Score quarterly, share the result with the vendor, and use it in renewal decisions.

Suggested banding: 4.5 and above = preferred, eligible for volume growth. 3.5 to 4.4 = acceptable, with an improvement plan for weak criteria. 2.5 to 3.4 = watch list, no new volume, formal review. Below 2.5 = exit planning.

Two rules make scorecards work. First, weight statutory items heavily enough that a vendor cannot compensate for wage or remittance failures with good uniforms and a friendly account manager. Second, share the score with the vendor's leadership, not just the site coordinator.

A 90-Day Programme to Fix a Messy Contract Labour Estate

If you are starting from a poor baseline — no central register, no document collection, unknown vendor count — here is a sequenced plan.

Days 1-30: See the estate

1. Build the vendor inventory. Pull every vendor paid for manpower, facilities, security, housekeeping, catering, logistics or staffing from the AP ledger for the last 24 months. Finance data is more complete than HR's memory.
2. Build the site inventory. Every premises, in every state, with headcount and activity type.
3. Build the contract worker master. Reconcile gate data, vendor musters and invoices into one list of names. Expect surprises.
4. Collect existing contracts. Note expiry dates, and whether they contain compliance, audit, withholding and indemnity provisions.
5. Determine the regulatory position per site. Which regime applies, what registration you hold or need, what licences vendors hold or need. Document sources and dates. Involve counsel for anything ambiguous.
6. Run a rapid risk triage. Rank sites and vendors by headcount, hazard, tenure and the strength of existing controls.
7. Name an owner. One accountable person for the programme, with a named backup at each site.

Deliverable: a baseline risk register and a one-page picture for leadership. Expect it to be uncomfortable. That is the point.

Days 31-60: Build the machinery

1. Design the monthly compliance pack by vendor category and get it approved by HR, legal, procurement and finance.
2. Set up the submission channel — an HRMS vendor module, a portal or a structured drive with strict naming conventions.
3. Draft the contract addendum covering compliance warranties, document submission, audit rights, withholding, indemnity, insurance, POSH, data protection and sub-contracting controls. Issue it to all vendors.
4. Build the wage floor matrix for every state, category and skill level you use, sourced from official notifications.
5. Fix the registrations and licences. File applications, amendments and renewals identified in the triage. Track them to closure.
6. Design the AP gate. Agree the workflow with finance, configure the system field or approval step, and set the go-live date.
7. Clean up access control. Revoke stale badges, align badge validity to contract end dates, and set up automated expiry alerts.
8. Run the first document collection cycle in parallel, without gating, so vendors learn the format before money is at stake.

Deliverable: contracts amended, pack defined, first cycle collected, registrations in flight.

Days 61-90: Operate and prove it

1. Go live with payment gating. Communicate the date clearly and hold the line the first month — that is the month that determines whether the programme is real.
2. Run the three-way reconciliation for every vendor and site, and open findings for every variance.
3. Conduct two on-site audits, including worker interviews without vendor supervisors present, for your highest-risk vendors.
4. Launch grievance channels and POSH awareness sessions for contract workers, in local languages.
5. Complete welfare amenity checks at every site with a photographic record and a corrective action list.
6. Build the evidence bundle structure and populate it for the last twelve months where records exist.
7. Publish the first vendor scorecard and hold review meetings with each vendor's leadership.
8. Present to leadership — baseline versus current, open risks, cost implications of statutory correction, and the ongoing operating model.
9. Lock the calendar. Monthly cycle, quarterly scorecard and audit, annual wage matrix refresh and regulatory re-verification.

At the end of 90 days you will not be perfect. You will have visibility, a working control, and a documented trail — which is a fundamentally different position from where you started.

Common Mistakes in Contract Labour Compliance

Treating the vendor's word as evidence. A vendor's monthly email saying "all compliances done" is not a compliance record. Documents are. Verified documents are better.

Collecting documents but never reading them. Many companies have three years of PDFs nobody opened. Storage is not assurance. Build the reconciliation step or skip the collection.

Paying first and asking later. Once the money has left, your leverage has left with it.

Assuming one state's rules apply everywhere. Thresholds, notified wage rates, forms, registers and inspection practice differ across states. Multi-state estates need per-state determinations.

Ignoring sub-contractors. The chain matters. A monthly nil-declaration requirement costs nothing and closes a real gap.

Managing contract workers as if they were employees. Direct supervision, appraisals and leave approvals in your system are the fastest route to deemed-employment arguments.

Letting tenure run indefinitely. The same individual in the same seat for many years on core work is a risk that compounds silently.

Underpricing the contract. If a vendor's rate cannot cover minimum wages plus statutory contributions plus a reasonable margin, the shortfall is coming out of workers' pockets — and eventually out of yours. Ask for a cost breakup and sanity-check it against the wage floor matrix.

Forgetting document expiry. Licences, insurance policies, registrations and background checks all expire. Manual tracking fails at scale.

Excluding contract workers from POSH and safety programmes. They are on your premises. Reach them.

No single owner. When contract labour compliance is split between HR, admin, procurement and finance with nobody accountable, it falls between the chairs. Name an owner.

Building a paper programme. Policies without site visits, worker conversations and real audits produce documents, not compliance. Go and look.

How CozyHR Helps with Contract Labour Compliance

Most of what this guide describes is achievable with discipline and spreadsheets — until you have four sites, nine vendors and 600 contract workers, at which point spreadsheets quietly stop reflecting reality.

CozyHR is built for Indian HR and payroll operations, and the contract workforce features are designed around the control points described above:

• Contract worker master — a single record for every non-employee on your premises, with vendor mapping, site, role, skill classification, tenure, UAN and IP numbers, and lifecycle dates.
• Attendance for contract staff — biometric, mobile and geofenced capture for contract workers alongside employees, so you hold your own independent attendance record rather than depending on vendor musters.
• Document repository with expiry tracking — contractor licences, insurance policies, registrations, background checks and training records stored per vendor and per worker, with automated alerts before expiry rather than after.
• Monthly vendor compliance collection — a defined document pack per vendor, structured upload, and status tracking so you can see at a glance who has submitted, what is missing and what is overdue.
• Vendor compliance dashboards — headcount by vendor and site, submission status, open findings and scorecard inputs in one view for HR, procurement and finance.
• Headcount reconciliation reports — deployed headcount from attendance data compared against vendor-declared numbers, so variances surface monthly instead of during an inspection.
• Audit-ready exports — registers, attendance extracts and document bundles exportable per site and period for inspections, client audits and due diligence.
• Access and onboarding workflows — induction, ID issuance and background verification tracked as gates before deployment, not as retrospective paperwork.

The aim is not to replace your legal advisor or your judgement. It is to remove the manual chasing, reconciliation and expiry-tracking work that causes most programmes to decay in month four.

Frequently Asked Questions

Am I liable if my contractor does not pay wages to workers at my site?

In broad terms, yes — Indian labour law has long placed a backstop obligation on the principal employer where a contractor fails to pay wages to workers engaged for the principal employer's work, with a corresponding right to recover the amount from the contractor. The practical implication is to hold back payment until wage payment is evidenced, and to verify bank credits rather than accept assurances. Confirm the exact position applicable to your establishment and state with your legal advisor.

Do I need a principal employer registration if I only have a few housekeeping staff?

It depends on the applicable threshold in your state and under the regime currently in force there, and the count is typically aggregated across all contractors and measured against a look-back period rather than an average. Because thresholds have been revised by several states and the consolidated labour codes framework contemplates its own numbers, verify the current position for each state and premises from the official notification rather than relying on a number quoted for another state.

Whose responsibility is contractor PF ESI compliance — mine or the vendor's?

The contractor is the employer of record and carries primary responsibility for enrolment and remittance. However, the social security framework contemplates principal employer exposure where the immediate employer defaults in respect of workers engaged for the principal employer's work. That is why monthly collection of ECR files, contribution statements and paid challans, plus reconciliation against your own deployed headcount, is the standard control.

What is the difference between a contractor licence and my registration?

Your registration is obtained by you as the principal employer for your establishment and typically records the maximum number of contract workers you may engage. The contractor licence is obtained by your vendor and is usually specific to the workplace and to you as the principal employer, recording the number of workers the vendor may deploy there. A vendor's licence issued for another client's site does not cover your engagement. Verify the current forms, thresholds and procedure applicable in your state.

How do I avoid contract workers being treated as my employees?

Design the engagement around outcomes rather than headcount, insist on genuine vendor supervision at site, keep contract workers out of your appraisal, leave-approval and internal reward systems, avoid indefinite tenure of the same individual on core roles, and maintain visible distinction in identification and communication. The assessment in India is multi-factor and looks at control, supervision, integration and economic reality rather than at contract labels, so the substance of day-to-day management matters more than the wording of the agreement.

What should I do if a vendor refuses to share wage registers or PF challans?

Treat it as a material red flag. Ensure the contract gives you an express audit right and an express right to withhold payment against non-submission, then use it. If a vendor will not evidence wage payment and statutory remittance for workers deployed at your premises, you are carrying an unquantified liability. Escalate to the vendor's leadership, put the relationship on a formal improvement plan, and begin transition planning if it does not resolve quickly.

How does the labour codes contract labour framework change what I need to do?

The consolidated codes reorganise contract labour, wages, social security and safety obligations into a smaller set of instruments, and contemplate changes including revised thresholds, electronic registration and licensing, a harmonised definition of wages for computing benefits, and provisions relating to fixed-term employment. Implementation has proceeded in stages and depends significantly on state rules. The practical answer is that the control framework in this guide — registration, licensing, wage floors, remittance verification, welfare, safety and audit trails — remains applicable in substance, while the specific thresholds, forms and dates must be confirmed for your state and establishment from official sources.

How often should I audit my staffing vendors?

A workable rhythm for most mid-sized organisations is monthly document verification with three-way reconciliation for every vendor, a quarterly scorecard review, at least one on-site audit per high-risk vendor each year including worker interviews, and an annual refresh of the wage floor matrix and regulatory position. Increase the frequency for vendors with large headcount, hazardous work, thin margins, or a history of findings.

Conclusion: Compliance Is a System, Not a File

Contract labour compliance fails for the same reason most compliance fails — it is treated as a document-collection exercise rather than a system with feedback loops. The organisations that get it right share a small number of habits: they know exactly who is on their premises and for whom those people work; they verify wage payment and statutory remittance every month rather than trusting assurances; they gate money on evidence; they go and look at the site; and they re-verify the rules instead of assuming last year's answer still holds.

None of that requires heroics. It requires a named owner, a defined monthly cycle, a contract that gives you leverage, and a system that tracks expiries and reconciles headcount without anyone remembering to. Start with the three-way reconciliation and the accounts payable gate — those two controls alone will surface most of what is wrong.

And do the boring verification work. Thresholds vary by state, wage notifications change, and the labour codes framework continues to reshape the details. Nothing in this guide substitutes for confirming the current position with official state and central sources or with your legal advisors.

If the manual side of this — chasing vendor documents, tracking licence and insurance expiry, reconciling contract worker headcount against invoices and statutory returns — is where your programme keeps stalling, that is exactly the work CozyHR is designed to take off your team's plate. Explore CozyHR to see how a contract worker master, attendance capture, document expiry tracking and vendor compliance dashboards can turn your contract labour estate from a recurring worry into a routine monthly review.