The South African Business Compliance Checklist: every obligation, in the order it becomes yours

South African business compliance is not one list. It is a sequence of obligations, each switched on by something you do: registering a company, taking your first payment, hiring your first employee, holding somebody's personal information, or bidding for someone else's budget. This page maps every obligation to the event that creates it.

Almost every compliance checklist you will find is organised by the body that administers it. One page for SARS, one for CIPC, one for the Department of Employment and Labour. Each is correct, and each stops at its own boundary. None of them tells you the thing you actually need to know, which is what you have already triggered.

So this one is arranged the other way round. Six stages, in the order a business passes through them. Under each stage, the obligations that switch on at that moment and stay on afterwards.

Why the order matters more than the list

Because these obligations are not independent, and the dependencies run in one direction.

An unfiled annual return does not usually produce a prosecution. It produces a company that cannot get a compliance letter, which produces a supplier record that quietly fails verification, which produces an invoice that a corporate customer cannot recognise on its procurement scorecard. Nobody sends you a notice at any point in that chain. You simply stop being eligible for things, and the reason sits three steps upstream of where the symptom shows up.

That is why a checklist sorted alphabetically or by department is close to useless in practice. What you want to know is which of these you have already switched on, and what each one is holding up.

Stage 1: the moment you register

Incorporating a company is one action that creates at least four continuing obligations, none of which announce themselves again after the registration confirmation lands.

1. Income tax registration. A company is registered for income tax as part of incorporation, and it becomes a provisional taxpayer from that point.
2. A public officer, within one month. The Tax Administration Act requires every company carrying on business in South Africa to be represented at all times by an individual residing in the country. If you never appoint one, SARS designates one from among your own officers, and the role carries personal exposure for the company's defaults. Our full guide to the public officer of a company reads the provisions out of the Act itself.
3. An address for service, in the same window. A separate appointment, of a place rather than a person, and it is not satisfied by having appointed a public officer.
4. Annual returns to CIPC, every year. Due within 30 business days of the anniversary of the date of incorporation, which means every company has a different due date and none of them is a calendar year end. Beneficial ownership information has to be filed alongside it. See CIPC annual returns for the mechanics.

Note that the appointment of a public officer is not made by resolving to make it. Under section 249(1) of the Tax Administration Act, no appointment is deemed to have been made until notice specifying the name and an address for service has reached SARS, and changes have to be notified within 21 business days of taking effect.

Stage 2: the moment you take money

Invoicing switches on the record keeping obligations, and one threshold that has just moved a long way.

Your invoices have to say specific things

Most South African small businesses are not VAT registered, and that changes what your document is allowed to be called and what it must contain. A tax invoice and an invoice are different documents with different requirements. We cover the general case in invoicing for small business and the VAT specific case in tax invoice requirements.

The VAT threshold more than doubled in April 2026

This is the item most checklists currently have wrong, including pages that are otherwise carefully written, because the figure sat unchanged for years.

SARS states that it is compulsory to register for VAT if the value of taxable supplies made or to be made is in excess of R2.3 million in any consecutive 12 month period, and that an application for compulsory registration must be made within 21 business days from the date the R2.3 million is or will be exceeded. Voluntary registration is available where taxable supplies are under R2.3 million but have exceeded R120 000 in the past 12 months.

SARS's Budget 2026 material confirms both figures took effect from 1 April 2026, increased from R1 million and R50 000 respectively.

Two practical consequences. If you have been watching for R1 million, you have been watching the wrong line. And if you crossed the old threshold recently and had not yet registered, the position you are in is not the one a 2024 checklist would tell you it is.

Provisional tax

SARS states that the first provisional payment is due within six months of the start of the year of assessment, and that for years of assessment starting in March this will be 31 August, or the last business day before that if the date falls on a weekend or public holiday. The second is due no later than the last business day of the year of assessment.

Behind all of it sits the evidence. Tracking business expenses for SARS is upstream of every return you will ever file, because a return is only as defensible as the records behind it.

Stage 3: the moment you employ someone

This is the single largest jump in obligations a small business makes, and it happens on the day one person starts.

Obligation	What switches it on	What it costs or requires
Written particulars of employment	Employing anyone	Supplied to the employee, under the Basic Conditions of Employment Act
UIF	An employee working 24 hours a month or more	2% in total, 1% from the employee and 1% from the employer
PAYE	Paying remuneration above the tax threshold	Monthly deduction and declaration
Skills Development Levy	Total salaries expected to exceed R500 000 over the next 12 months	1% of the total amount paid in salaries
COIDA	Employing one or more employees	Registration with the Compensation Fund and an annual Return of Earnings
Employment equity reporting	More than 50 employees	Annual reporting as a designated employer

Three of those deserve a note.

The UIF exclusion is by hours, not by title. SARS puts the line at employment for less than 24 hours a month. Part time, casual and occasional staff are inside the system far more often than owners expect.

The employment equity threshold changed on 1 January 2025. A designated employer used to be an employer with more than 50 employees or one over a sector turnover threshold. The Employment Equity Amendment Act 4 of 2022 deleted the turnover schedule entirely, so the headcount test is now the only one. A high turnover business with a small team that used to be designated is no longer designated. The reporting season and the sector targets are covered separately, and this year is the first assessment against those targets.

Hours worked is the evidence base for most of this. Which is the unglamorous reason a time tracking record matters well beyond payroll.

Stage 4: the moment you hold somebody's information

There is no threshold on this one, which is what makes it the most commonly missed stage on the list. POPIA applies to a responsible party processing personal information. There is no small business exemption, no headcount trigger and no turnover trigger. If you have a customer list, you are in.

• The POPIA compliance checklist sets out the eight conditions and what each one asks of a small operation.
• Direct marketing has its own consent rules, which apply to WhatsApp and email campaigns as much as to calls.
• Any supplier that touches your customer data on your behalf is an operator, and that relationship is supposed to be governed by a written agreement.
• If you have put an AI tool anywhere near customer information, the same conditions still apply. An AI policy is how most small businesses close that gap without stopping work.

Stage 5: the moment you sign electronically

Almost every small business now signs and is signed to electronically, usually without ever checking whether the thing they signed is valid that way.

Most of it is. Electronic signatures are legal in South Africa under the Electronic Communications and Transactions Act, and for ordinary commercial agreements an ordinary electronic signature does the job. The exceptions are narrow, specific and absolute: there is a short list of documents that cannot be signed electronically at all, and signing one of those in a browser does not produce a weaker agreement, it produces nothing.

Selling online adds a separate disclosure obligation about who you are and how a customer reaches you, which is a website requirement rather than a signature one.

Stage 6: the moment you want someone else's budget

Everything above is about being allowed to operate. This stage is about being allowed to be paid by a large customer or by government, and it is where the dependency chain gets its teeth.

1. Tax compliance status. No longer a certificate you hold. It is a live query anybody with your PIN can run, and it answers with your position today rather than your position on the day a document was issued.
2. Supplier registration. Government procurement runs through the Central Supplier Database, which verifies your tax position automatically and continuously.
3. B-BBEE status. Under the Amended Codes of Good Practice, an Exempted Micro Enterprise is a business with annual total revenue under R10 million, and a Qualifying Small Enterprise sits from R10 million to under R50 million. An EME proves its status by sworn affidavit rather than by a verification certificate.
4. Sector licences. Some industries add their own layer on top of all of the above. Property practitioners, for example, carry FICA obligations and a fidelity fund requirement that no general checklist covers.

The whole map on one screen

Stage	Trigger	Obligation
1. Register	Incorporation	Income tax registration, public officer within one month, address for service, CIPC annual return within 30 business days of the incorporation anniversary
2. Take money	First invoice	Invoice content rules, expense records, provisional tax, VAT once taxable supplies exceed R2.3 million in any 12 months
3. Employ	First employee	Written particulars, UIF at 24 hours a month, PAYE, SDL over R500 000 payroll, COIDA, employment equity over 50 employees
4. Hold data	Any personal information	POPIA conditions, direct marketing consent, operator agreements, AI use policy
5. Sign	First electronic signature	ECTA validity, the excluded document list, website disclosure
6. Get paid by others	First tender or corporate customer	Tax compliance status, supplier database registration, B-BBEE affidavit or certificate, sector licences

What to do with this in August

Two dates make this month a natural moment to work through the map rather than a later one.

• 31 August closes the first provisional tax period for taxpayers whose year of assessment started in March, per SARS's own stated rule.
• September opens the employment equity reporting season, and published analysis of the 2025 regulations flags this cycle as the first measured against the sector targets. That only affects employers over 50 people, but it is the stage 3 item with the longest lead time.

If you only do one thing: work out which stages you have already entered. Most owners discover they are three stages in and have only ever been told about one of them.

Frequently Asked Questions

What compliance is legally required for a small business in South Africa?

It depends entirely on what you have done. Registering a company triggers income tax, a public officer and CIPC annual returns. Invoicing triggers record keeping. Employing triggers UIF, PAYE and COIDA. Holding personal information triggers POPIA regardless of size.

Is there a small business exemption from POPIA?

No. POPIA applies to any responsible party that processes personal information, with no headcount or turnover threshold. A one person business with a customer list is a responsible party in exactly the same way a large company is.

What is the VAT registration threshold in South Africa now?

SARS puts compulsory registration at taxable supplies in excess of R2.3 million in any consecutive 12 month period, with the application due within 21 business days of the date that is or will be exceeded. Voluntary registration starts above R120 000.

When are CIPC annual returns due?

Within 30 business days of the anniversary of the company's date of incorporation, so every company has its own date rather than a shared national deadline. Beneficial ownership information must be filed alongside the return.

Which businesses have to report on employment equity?

Designated employers, which since 1 January 2025 means employers with more than 50 employees. The Employment Equity Amendment Act 4 of 2022 removed the sector turnover threshold, so a high turnover business with a small team is no longer designated on turnover alone.

What happens if you ignore one of these obligations?

Usually nothing visible, at first. The common outcome is not a fine but lost eligibility: a compliance status that answers badly, a supplier record that fails verification, a tender you cannot enter. The symptom appears well downstream of the cause.

Sources

• South African Revenue Service, Register for VAT, sars.gov.za, for the R2.3 million compulsory threshold, the 21 business day application window and the R120 000 voluntary threshold
• South African Revenue Service, Budget 2026 Frequently Asked Questions, sars.gov.za, for the confirmation that both thresholds took effect from 1 April 2026, increased from R1 million and R50 000
• South African Revenue Service, Provisional Tax, sars.gov.za, for the first payment falling within six months of the start of the year of assessment and the 31 August date for years of assessment starting in March
• South African Revenue Service, Skills Development Levy, sars.gov.za, for the R500 000 payroll liability trigger and the 1% rate
• South African Revenue Service, Unemployment Insurance Fund, sars.gov.za, for the 2% total contribution split 1% employee and 1% employer, and the exclusion of employment under 24 hours a month
• Tax Administration Act 28 of 2011, sections 246, 247 and 249, for the public officer appointment, the one month window, the address for service, the notification requirement and the 21 business day change notification
• Employment Equity Amendment Act 4 of 2022, commenced 1 January 2025, for the deletion of the turnover threshold and the resulting headcount only test for a designated employer, per published analysis by Bowmans
• Amended Codes of Good Practice, for the Exempted Micro Enterprise and Qualifying Small Enterprise turnover bands
• Companies and Intellectual Property Commission, annual returns information guide, for the 30 business day filing window from the anniversary of incorporation

Sources were consulted on 1 August 2026. This is general information about how these obligations are structured, not legal, tax or accounting advice on a specific business. Thresholds move, and the VAT figure on this page is a recent example of exactly that.

If reading this produced the feeling that you are probably behind on something but could not say which one, that is a records problem before it is a compliance problem. A Business Autopsy maps where the admin actually goes and what is quietly holding up what, or book a discovery call and talk it through first.