Corporate Compliance Calendar Philippines: SEC, BIR, DOLE and NPC Deadlines

A Philippine corporation answers to several regulators at once, and each has its own trigger for compliance. The Securities and Exchange Commission governs corporate existence and reportorial filings under the Revised Corporation Code. The Bureau of Internal Revenue governs registration, invoicing, and record-keeping under the Tax Code, as amended by the Ease of Paying Taxes Act. The Department of Labor and Employment governs labor and occupational safety reporting. The National Privacy Commission governs personal data processing under the Data Privacy Act of 2012. This article maps the recurring obligations of each and explains what triggers them.

The SEC: corporate existence and reportorial compliance

The corporation begins to exist on the date the SEC issues its certificate of incorporation under its official seal (Section 18, Revised Corporation Code). From that point, the Code imposes continuing obligations.

A corporation that does not formally organize and commence business within five (5) years from incorporation has its certificate of incorporation deemed revoked as of the day following the end of that period (Section 21). A corporation that has commenced business but becomes inoperative for at least five (5) consecutive years may be placed under delinquent status after due notice and hearing. It then has two (2) years to resume operations and comply with SEC requirements; failure to do so causes revocation of its certificate of incorporation.

Changes to the articles of incorporation require board approval and the vote or written assent of stockholders representing at least two-thirds (2/3) of the outstanding capital stock, and take effect upon approval by the SEC or from filing if not acted upon within six (6) months for a cause not attributable to the corporation (Section 15). Directors serve one-year terms and must continue to own at least one share; a director who ceases to own at least one share ceases to be a director (Section 22).

Corporations vested with public interest — including those covered by Section 17.2 of the Securities Regulation Code, banks and quasi-banks, and similar entities — must have independent directors constituting at least twenty percent (20%) of the board (Section 22).

The BIR: registration, invoicing, and records

Registration with the BIR is triggered by the commencement of business. Under Revenue Regulations No. 7-2024, self-employed individuals, estates, trusts, corporations, and their branches must register on or before the commencement of business, reckoned from the day the first sale transaction occurred or upon the lapse of thirty (30) calendar days from issuance of the Mayor's Permit, Professional Tax Receipt, or Occupational Tax Receipt by the LGU, or the SEC Certificate of Registration, whichever comes first.

The same regulations repealed the Five Hundred Peso (P500.00) Annual Registration Fee for every separate or distinct establishment, effective January 22, 2024. A Thirty Peso (P30.00) Documentary Stamp Tax is paid upon issuance of the BIR Certificate of Registration.

On invoicing, VAT-registered persons must issue a duly registered VAT Invoice for every sale, barter, exchange, or lease of goods or properties and every sale, barter, or exchange of services, regardless of amount. The invoice must state that the seller is VAT-registered, followed by the TIN and branch code, and must show the total amount with the indication that it includes VAT.

Books of accounts and other accounting records must be preserved for five (5) years reckoned from the day following the deadline for filing the return, or from the date of filing if filed after the deadline. If a taxpayer has a pending protest or claim for tax credit or refund and the records are material to the case, they must be preserved until the case is finally resolved.

The DOLE: labor and workplace reporting

The Department of Labor and Employment administers labor standards, occupational safety and health, and workplace reporting obligations. Compliance here is event-driven rather than calendar-driven: establishments register with the DOLE, report workplace accidents and occupational illnesses, and maintain safety and health records. Because the specific forms and frequencies depend on the establishment's industry, size, and risk classification, covered employers should confirm their current obligations with the DOLE or counsel rather than rely on a generic schedule.

The NPC: data privacy compliance

The National Privacy Commission administers the Data Privacy Act of 2012 and its Implementing Rules and Regulations. The Rules require personal information controllers to implement organizational, physical, and technical security measures appropriate to the nature of the data, the risks of processing, the size of the organization, and current data privacy best practices.

The IRR also provides for registration of data processing systems and notification for automated processing operations. Personal data breach notification is a separate, event-triggered duty: a personal data breach is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. Government contracts involving access to sensitive personal information of at least one thousand (1,000) individuals are among the processing systems the Commission manages registration for.

Frequently asked questions

When must a new corporation register with the BIR? On or before the commencement of business — reckoned from the first sale transaction, or thirty (30) calendar days from issuance of the Mayor's Permit, PTR, or SEC Certificate of Registration, whichever comes first.

How long must a corporation keep its books of accounts? Five (5) years from the day following the return filing deadline, or from the actual filing date if filed late. If a protest or refund claim is pending and the records are material, keep them until the case is resolved.

What happens if a corporation stops operating? If it never commenced business within five (5) years of incorporation, its certificate is deemed revoked. If it operated and then became inoperative for at least five (5) consecutive years, the SEC may place it under delinquent status, with two (2) years to resume operations.

Practical takeaways

• Calendar the SEC triggers: five (5) years to commence business, five (5) consecutive years of inoperation for delinquent status, and two (2) years to resume once delinquent.
• Register with the BIR on time: thirty (30) calendar days from the LGU permit or SEC registration, or from the first sale, whichever comes first.
• Issue the correct invoice: VAT-registered sellers issue a VAT Invoice for every sale regardless of amount; the P500.00 threshold applies to non-VAT sellers.
• Retain records for five (5) years — and longer if a tax protest or refund claim is pending.
• Treat data privacy as ongoing: security measures, registration of processing systems, and breach notification are continuing duties under the NPC IRR.

Primary sources

The rules discussed above are drawn from the following primary sources. Where the firm's library holds the document as a PDF it is embedded here in full; the rest are cited by title.

RR No. 7-2024 — Implements Section 113, 235, 236, 237, 238, 242, 243 of the Tax Code of 1997, as amended by RA No. 11976 (Ease of Paying Taxes Act), on the registration procedures and invoicing requirements (Date Posted: April 12, 2024)Open in Law LibraryDownload PDF

• REPUBLIC ACT NO. 11232 - AN ACT PROVIDING FOR THE REVISED CORPORATION CODE OF THE PHILIPPINES

• NPC IRR OF REPUBLIC ACT NO. 10173, August 24, 2016

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.