Principal employer PF liability for unregistered contractors under EPF Scheme 2026

What changed

The Employees' Provident Funds Scheme, 2026, notified as G.S.R. 525(E) on 29 June 2026, replaced the 1952 Scheme. Among the changes that matter for anyone using contractors, two paragraphs stand out.

Paragraph 20 says the employer shall, in the first instance, pay both the employer's and the employee's contribution for an employee "directly employed by him or through a contractor", where the contractor's establishment is not registered independently, within fifteen days of the close of the month. The contractor recovers the employee's share and pays it to the principal employer with an equal employer share. And then the sentence that matters: notwithstanding anything in the Scheme, the principal employer "shall remain responsible to pay contributions and administrative charges" for employees employed through a contractor.

Paragraph 27 gives the mechanics. The principal employer registers the establishment and declares every contractor on the portal in Form X. The contractor is jointly and severally liable with the principal employer for the contributions. Within ten days of the month end, the contractor must send the principal employer a Form XI statement of each contract worker's name, UAN, wages and contributions. Within twenty days, the principal employer sends the Commissioner a Form XII abstract of recoveries and employer contributions for those workers. Where EPFO's portal captures the same data, the compliance is deemed made.

The idea is not new. The Act has always treated workers employed through a contractor as employees of the establishment, and assessments against principal employers happened under the old Scheme too. What is new is that the 2026 Scheme says it plainly and gives it forms and dates, which removes the argument that "the contractor is a separate establishment, go after them".

If you run a security agency or a manpower business, read this as your clients will read it: they are going to ask for proof, every month, and a letter on your letterhead will not be enough.

Who is affected

Principal employers. Any business with guards, housekeeping staff, drivers, loaders or production workers supplied by a contractor. If the contractor's establishment is not independently registered, the contributions are yours to pay in the first instance. If it is registered but does not remit for your site, you remain responsible, and the contributions can be assessed against you with interest under section 127 of the Code (section 7Q of the old Act) and damages at paragraph 23's rate of 0.25% to 1% of the arrears per month added.

Contractors. Security agencies, manpower suppliers, facility-management firms. Your clients' exposure is now your sales problem. The contractor who can hand over a clean monthly pack keeps the contract; the one who cannot gets payment held.

The workers themselves. They are the reason the rule exists. A guard whose PF was deducted but never deposited ends up on my employee-side page about PF deducted but not deposited, and the complaint names both the agency and the site.

What to do

Once: register and declare every contractor in Form X on the portal, and update it within fifteen days of any change.

Every month, before you release the contractor's invoice:

1. Confirm the contractor is registered. Ask for the PF establishment code and check it on the EPFO employer portal's establishment search. If the contractor's establishment is not independently registered, paragraph 20 puts the contributions on you in the first instance.
2. Collect the contractor's Form XI by the 10th. It is the contractor's own statement of each worker's UAN, wages and contributions for the month, and the scheme makes it the contractor's duty to send it.
3. Get the ECR and TRRN for the wage month. The ECR is the return; the TRRN is the transaction number that ties it to a payment.
4. Get the paid challan. A TRRN without a paid challan is a return without money.
5. Match the workers. Take the attendance for your site and the contractor's wage register for the same month. Every UAN on your site should appear in the ECR with wages that match the register.
6. Check the wage base. Contributions should be on the PF wages under the current rules, not on a token basic. The principal employer contractor risk check walks through these questions and tells you what to collect.
7. File your Form XII abstract by the 20th and keep the set: one folder per contractor per month. If an inquiry under section 125 comes three years later, this folder and your Form XII trail are your reply.

The next contribution cut-off is 15 November 2026 for the October wage month (paragraph 20: within fifteen days of the close of the month), with Form XII due by 20 November, but the point is that this is a monthly routine, not a one-time check.

What a compliance certificate does not prove

A compliance certificate says the contractor has complied. It does not show:

Treat a certificate as a cover note for the documents behind it. If the documents are not attached, the certificate is a promise, and promises are not evidence in a 7A hearing.

What a security agency should hand its clients

If you are the contractor, the fastest way to stop the question is to answer it before it is asked. Each month, for each client site:

• Your PF establishment code and registration certificate (once, then on change).
• The ECR for the month and its TRRN.
• The paid challan.
• A site-wise list of deployed staff with UANs and days worked.
• The wage register for that site, showing the PF wage base.

Agencies that send this pack with the invoice get paid faster. That is the practical reason to build it, before the legal one.

What this does not change

• The contractor's own liability. The principal employer being liable does not release the contractor. Both can be assessed.
• The due date. Contributions within fifteen days of the close of the month, for everyone.
• The contract between you. Indemnity clauses help you recover money from the contractor later. They do not stop EPFO assessing you first.

What you can do yourself for free

When specialist help may be useful

• You have several contractors and no month in the last two years where the documents are complete.
• A contractor has closed or disappeared and workers are asking about their PF.
• A 7A notice has arrived naming your establishment for a contractor's dues.
• You want the monthly verification run as a routine with payment-hold rules agreed with procurement. That is the contractor compliance work I do, contractor by contractor.

Need a contractor-by-contractor view of your exposure?

The gap I see most often is a principal employer holding a neat folder of monthly compliance certificates and no challans, and a contractor who files one ECR for all its clients with no way to show which workers were on which site.

I set up the document set to collect from each contractor, verify it monthly against deployed headcount, and rank the exposure by contractor so procurement knows what to hold payment on. For contractors, I prepare the client-facing pack so the question stops coming. Written scope and fee first; EPFO decides any assessment.

Book a 15-min call Call +91 98397 17791

WhatsApp meBook a consultation — ₹499

I never ask for your OTP, UAN password or bank login.

Fee, scope and timeline in writing before any work. No guaranteed-outcome promises.

WhatsApp meBook a consultation — ₹499

I never ask for your OTP, UAN password or bank login.