GCC operational playbook: Mitigating regulatory and compliance risks in India

Over the last decade, global capability centres (‘GCCs’) have become one of India's most visible commercial success stories. What started as a way for multinational companies to cut costs has evolved into something far more strategic - dedicated centres of technology, research, analytics and customer experience sitting at the heart of global operating models.

India hosts more than 2,000 GCCs and the number keeps growing. For most multinational companies, the question is no longer whether India makes sense for a GCC, the focus has shifted to how to get the legal and regulatory architecture right.

The difficulty is almost never any single law in isolation - company law, foreign exchange control, tax, labour, intellectual property and data protection often intersect, so that a decision in one area quietly constrains choices in another.

Set out below are some of the key legal issues that foreign investors commonly encounter when establishing and operating GCCs in India, together with practical considerations for navigating them.

Choosing the right entity structure

The first real decision a foreign investor has to make is choosing the right legal vehicle. Foreign investors typically consider a wholly owned subsidiary (‘WOS’), a limited liability partnership (‘LLP’), or, in limited cases, a branch office. While all 3 (three) structures are viable in the right circumstances, they differ significantly in terms of regulatory flexibility, funding options, tax treatment, governance requirements, and ease of exit, and this is not a decision to defer, since unwinding the wrong structure a few years in is expensive and complex.

Branch offices remain workable for narrow, defined activities, but for GCCs expected to hire significant talent, own intellectual property or operate on a long-term scale, foreign investors prefer a private limited company structured as a wholly owned subsidiary. It offers the clearest governance framework, greater operational flexibility, straightforward access to foreign investment under the automatic route (in most sectors), and a stronger footing for addressing transfer pricing and intercompany service arrangements. The decision should be made after determining whether the GCC will remain a cost centre, or is expected to evolve to have a larger role in the group's global operations.

Corporate governance

Once incorporated as a WOS, a GCC is subject to the corporate governance framework under the Companies Act, 2013. This is an area where foreign investors often encounter avoidable compliance issues because they are easy to overlook in the pressure of commencing operations. While the obligations are mostly procedural and administrative, they still require consistent attention.

For example, a resident director must be appointed and remain actively involved in the company's affairs, share certificates must be issued within 2 (two) months of incorporation, board meetings must be conducted at least 4 (four) times a year, and annual filings and statutory records must be maintained accurately and on time. A lapse in these routine compliances can complicate future transactions and invite regulatory scrutiny during fundraising, group restructuring, due diligence or exits. This issue can be mitigated simply by compliance discipline and a properly resourced company secretarial function.

FEMA and cross-border funding

Since most GCCs are funded entirely by their foreign parent entity, foreign exchange compliance becomes part of routine operations rather than a one-time exercise. The Foreign Exchange Management Act, 1999 (‘FEMA’) and the regulations issued under it govern how capital enters India, and how it is reported, utilised, and monitored throughout the life of the business. Foreign exchange compliance processes in India are highly regulated and timebound. Capital infusions must be followed by timely share allotments, prescribed filings must be made through the Reserve Bank of India (‘RBI’)'s reporting system, and annual foreign liability and asset disclosures are required irrespective of the volume of activity during the year. Fortunately, most compliance lapses are manageable and do not, by themselves, threaten the viability of the business. However, delays can result in additional costs, remedial filings, and, in some cases, the need to seek regularisation from the RBI. The easiest way for GCCs to avoid these issues (and avoidable conversations with the regulators) is to treat FEMA compliance as an intrinsic part of their operations, rather than an ancillary or separate legal compliance, with a real-time capital ledger, a digital deadline tracker and an annual health check.

Transfer pricing and inter-company transactions

Transfer pricing remains one of the most significant tax considerations for GCCs in India, particularly where the centre operates as a captive service provider and is remunerated by its overseas parent or group entities on a cost-plus basis. Although this model is well established, it continues to attract close scrutiny from Indian tax authorities, who focus not only on the mark-up applied but also on whether the transfer pricing methodology accurately reflects the functions performed, assets employed and risks assumed by the GCC.

In practice, one of the most common issues is that a GCC's transfer pricing model does not evolve alongside its business. Many GCCs begin as providers of routine support services but, over time, assume more complex and value-added functions such as technology development, engineering design, research and development, data analytics, product support or strategic business operations. In situations where the transfer pricing framework continues to treat the entity as a low-risk back-office service provider despite this shift in functional profile, the resulting disconnect can create significant transfer pricing exposure.

Labour law and employment compliance

For most GCCs, people are the business. As a result, employment and labour law compliance is often one of the most important and most closely scrutinised aspects of operating in India. The compliance landscape is also undergoing a transition with the introduction of four labour codes—the Code on Wages, 2019, the Industrial Relations Code, 2020, the Occupational Safety, Health and Working Conditions Code, 2020 and the Code on Social Security, 2020— layered with state-specific Shops and Establishments requirements. GCCs should be mindful that the new framework is expected to have a significant impact on areas such as wage structures, social security contributions, working hours, leave policies, employment documentation, and contract labour engagement models. Businesses establishing a GCC today would be well advised to align their employment practices with the direction of the labour codes to minimise future compliance issues.

As GCCs mature, employment arrangements often become more complex. Foreign secondments, expatriate employees, cross-border payroll arrangements, employee stock option plans, flexible working models, and independent contractor engagements all introduce additional regulatory considerations from an employment perspective. None of this is inherently difficult, but it needs systematic, well-documented governance rather than ad-hoc handling, because the consequences of getting it wrong (litigation, inspections, reputational exposure that reaches the parent's headquarters) tend to be disproportionate to the effort it would have taken to avoid them.

GCCs should adopt a structured compliance framework from the outset, such as a centralised compliance matrix with quarterly reconciliation, robust employment documentation, compliant policies on workplace conduct and employee benefits, and clearly documented arrangements for secondments, expatriate employees and cross-border payroll.

Data protection under the DPDP Act

Data protection is becoming an increasingly important consideration for GCCs, many of which process large volumes of employee, customer and business data as part of their day-to-day operations. With the Digital Personal Data Protection Act, 2023 (‘DPDP Act’) and the subsequent rules now being rolled out, privacy compliance has evolved from a contractual obligation into a statutory requirement under Indian law.

For GCCs, the key obligations include providing appropriate privacy notices, managing consent where required, implementing reasonable security safeguards, responding to data principal requests, maintaining data retention and deletion processes, and ensuring timely reporting of personal data breaches. Businesses also need to consider the implications of cross-border data transfers, vendor management arrangements and intra-group data sharing structures. Regulated sectors such as banking, healthcare and financial services may be subject to additional requirements.

While implementation is being phased in, GCCs should not view this transition period as a reason to defer compliance efforts. A proactive approach beginning with data mapping, contract reviews, privacy governance frameworks and incident-response procedures will place organisations in a stronger position to meet future compliance obligations and minimise regulatory risk.

Intellectual property (‘IP’) protection

A GCC will, almost by definition, create or use intellectual property on the parent's behalf — software, source code, proprietary processes, sometimes patentable innovation. Without clear contractual ownership from the outset, disputes over who actually owns that work product are entirely foreseeable and considerably harder to resolve at a later stage. This is a higher risk in build-operate-transfer arrangements, where a third-party service provider builds the GCC before eventually transferring it, and questions of who owned what during the build phase can complicate the transfer itself. Employment and vendor agreements should expressly assign IP rights to the GCC or the parent entity, define the scope of any licence granted, address ownership of future improvements, and be backed by robust confidentiality and non-compete provisions.

Dispute resolution and contractual safeguards

Disputes in the GCC context typically arise around 2 (two) things: transfers of undertaking, and the allocation of liability between the parties to a service arrangement. Where employees transfer as part of a business transfer, continuity of service and comparable employment terms should be ensured for employees designated as ‘workers’ under Indian laws, failing which retrenchment compensation becomes payable. This point is often missed in the rush to close a transaction. Contracts with service providers or vendors should have appropriate and adequate indemnities and risk allocation. For cross-border disputes, institutional arbitration (under the rules of Singapore International Arbitration Centre or the London Court of International Arbitration) would be the preferred route.

Closing thoughts

India's regulatory landscape is undoubtedly complex, but it is also predictable if businesses approach it with appropriate planning and foresight. This approach allows GCCs to focus on creating long-term strategic value.

The GCCs that succeed over the long term are rarely those that treat legal and compliance issues as a reactive exercise. Rather, they are the ones that embed governance, compliance and risk management into their operating model from the outset. Establishing the right legal structure, maintaining disciplined corporate governance, and implementing robust frameworks for employment, data protection and intellectual property can significantly reduce regulatory risk and avoid costly course corrections later.

[The authors are Partner and Senior Associate, respectively, in Corporate and M&A practice at Lakshmikumaran & Sridharan Attorneys, New Delhi]