Payroll Compliance: Which Rules Actually Apply to You
A thresholds matrix showing which payroll laws apply at your headcount, a compliance calendar, the penalty math, and what to do if you are already behind.
Payroll Compliance
Which laws apply at your headcount, when everything is due, and what it costs to miss
Every article on payroll compliance gives you the same thing: a list of federal laws. FLSA, FICA, FUTA, ACA, FMLA, Equal Pay Act, Davis-Bacon. It is a competent list and it is close to useless, because it does not tell you the only thing you actually need to know.
Which of these apply to me?
The answer, for a business with eight employees, is that most of them do not. FMLA does not apply to you. The ACA employer mandate does not apply to you. But a rule you have almost certainly never heard of does, and it is going to make you file your W-2s electronically whether you want to or not.
So this guide is built around thresholds and deadlines rather than a law list. Which obligations switch on at your headcount, the two "50 employee" rules that are not the same rule, the calendar of what is due when, real penalty math, and what to do if you are already behind.
What Is Payroll Compliance?
The operative phrase in that definition is "different points." Compliance is not a wall you hit. It is a series of doors you walk through as you hire, and nobody tells you when you have gone through one.
Which Laws Actually Apply to You
Two observations that matter more than the individual rows.
First, the 1+ block is where most small business exposure actually lives. Wage and hour violations, misclassification, and missed deposits do not wait for you to hire your fiftieth employee. They are available to you from day one, and they are the ones that generate claims.
Second, state law routinely sets lower thresholds. The EEOC sets the federal anti-discrimination floor at 15 employees, but several states apply their own equivalents from a single employee. State paid leave and retirement mandates have their own triggers too. Federal compliance is a floor, and treating it as the answer is how multi-state employers get caught.
State Payroll Legislation Sets Its Own Thresholds
Federal law tells you when a federal obligation begins and nothing else. The state layer usually arrives earlier and reaches more employers, and it is where a business that looks fully compliant on the federal side still gets a claim filed against it.
Seven categories are worth checking with your own state labor department, each separately: minimum wage above the federal floor, pay frequency, pay stub content, final paycheck timing after a termination, paid sick leave, state-run retirement program mandates, and pay transparency in job postings. Every one of them is its own statute with its own trigger.
Run the list against the state where your employees actually work rather than where the company is registered, and run it again the first time you hire outside that state. None of it surfaces in the federal thresholds above, and no payroll platform will raise its hand about it.
The Two Different Fifties
The ACA and the FMLA both trigger at "50 employees." They do not mean the same thing by it, and almost every compliance article flattens this into a single number.
Per the IRS, ALE status is determined by averaging your full-time employees plus full-time equivalents across the prior calendar year. So you can become an ALE for this year based on a headcount you no longer have, and you will not find out from anyone.
The FMLA, meanwhile, adds the 20-workweek duration test and the 75-mile radius test. A distributed company with 60 employees spread across the country may have no worksite with 50 within 75 miles, and therefore no FMLA coverage.
The E-File Rule That Catches Almost Everyone
This is the obligation nobody knows about, and it reaches businesses far smaller than they expect.
Per IRS Topic 801, if you file 10 or more information returns in a calendar year, you must file them electronically. The old threshold was 250 per form type. The current threshold is 10 in aggregate, across almost all form types combined.
| Your situation | Total returns | Must you e-file? |
|---|---|---|
| 9 employees, no contractors | 9 W-2s | No. You may still file on paper. |
| 5 employees, 4 contractors paid $600+ | 5 W-2s + 4 1099-NECs = 9 | No. Just under the line. |
| 5 employees, 5 contractors paid $600+ | 5 W-2s + 5 1099-NECs = 10 | YES. Mandatory electronic filing. |
| 6 employees, 5 contractors paid $600+ | 6 W-2s + 5 1099-NECs = 11 | YES. And most owners in this position have no idea. |
A six-person business that uses a handful of contractors is over the line. Failing to e-file when required can result in the IRS treating your paper filings as not filed at all, which is a considerably worse problem than the one you were trying to avoid.
All three of these tests are arithmetic you can do in an afternoon in December, and none of them will be done for you. The workbook below gives each one its own tab with the counting rule written into the row labels, so the answer you write down is the answer to the right question. The ACA tab records the average and the file it came from rather than reworking it, because that twelve-month calculation runs on its own divisor and is set out step by step in the ACA compliance guide. Run the workbook once a year and keep the completed file, because the useful part is being able to show what you counted and when.
| A | B | C | |
|---|---|---|---|
| 1 | Field | Entry | Note |
| 2 | Calendar year measured | Always the prior year, never the current one | |
| 3 | Average full-time employees including equivalents | One number, already averaged across the twelve months | |
| 4 | File the average was calculated in | The twelve-month worksheet, not this tab | |
| 5 | Date the count was run, and by whom | Do it in December, while the year is still reconstructable | |
| 6 | 50 or more? ALE for the current year | Yes means the coverage mandate and the annual information returns | |
| 7 | Distance from the line | Anything from 45 up is worth watching monthly | |
| 8 | Do not rework the arithmetic here | Full time at 30 hours a week, everyone else's monthly hours capped at 120 each and divided by 120, averaged over twelve months. That calculation is set out step by step in the ACA compliance guide | |
| 9 | Does the FMLA test give the same answer? | Usually not, and that is the point. Run the next tab separately rather than assuming one fifty answers the other |
The Compliance Calendar
Compliance is not a checklist you complete once. It is a cycle. Here is the whole thing, organized by timing rather than by statute, which is how you actually need it.
The deposit block is the dangerous one, and it is dangerous precisely because nobody is waiting on it. Your employees notice immediately if their pay is wrong. The IRS notices your missed deposit months later, by which time the penalty has escalated and the trust fund exposure has compounded.
Payroll Updates: What Changes Every Year
The calendar above stays fixed. The numbers inside it do not. A set of payroll figures resets between October and January for the year ahead, and the first pay run in January is where the old ones quietly survive if nobody replaced them.
Four of those resets matter for a small payroll. The SSA announces the Social Security wage base in October. The IRS issues the standard mileage rate in December. Your federal deposit schedule for the new year comes from the lookback period, and Publication 15 makes redetermining it before January your job, not something the IRS calculates for you. Your state sets its own minimum wage, and many of those move on January 1.
The document worth reading rather than skimming is Publication 15, the IRS employer tax guide, which is revised every year. An hour in December spent loading the new figures, confirming the state rate, and rerunning the threshold tests above costs less than a corrected filing in April.
What Non-Compliance Actually Costs
| Failure | Penalty | Note |
|---|---|---|
| Late tax deposit, 1 to 5 days | 2% of the deposit | Applies to the whole deposit, not the overage. |
| Late tax deposit, 6 to 15 days | 5% of the deposit | Not progressive tiers. Seven days late means 5% on the entire amount. |
| Late tax deposit, 16+ days | 10% of the deposit | |
| Unpaid 10+ days after IRS notice | 15% of the deposit | The ceiling, and entirely avoidable. |
| Withheld taxes never remitted | Trust Fund Recovery Penalty: 100%, personally | Pierces your LLC. Generally survives bankruptcy. This is the one that ends businesses. |
| Wage and hour violation | Back wages plus liquidated damages | Liquidated damages often equal the back pay, effectively doubling it, plus attorney fees. |
| Worker misclassification | Back taxes, penalties, interest | Plus the wage and hour exposure for overtime never paid to someone who should have been non-exempt. |
Classification: The Biggest Single Risk
If you fix one thing after reading this, fix your classifications. Two of them, and both are commonly wrong.
Employee or contractor. The IRS looks at behavioral control, financial control, and the type of relationship. If you set their hours, direct how the work is done, provide the tools, and the work is ongoing and central to your business, they are an employee. Being short on cash is not a defense and never has been.
Exempt or non-exempt. An employee is exempt from overtime only if they pass all three tests: salary basis, salary level (currently $684 per week federally), and the duties test. The duties test is the one most often failed, and a job title satisfies nothing. Calling someone an office manager does not exempt them if their actual work is non-exempt.
These are judgment calls, and judgment calls are exactly what payroll software cannot make for you. The software will faithfully process whatever classification you enter. It has no opinion about whether the classification is correct.
Because it is a judgment call, the defensible version is a written one. Record the answer, the facts it rests on, and the date when the person is hired, and again whenever the role changes, the pay changes, or they move to another state. Keep it with the contract. The employee type guide carries a worksheet that walks the control factors and the three exemption tests one prompt at a time, which is the version worth filling in rather than reconstructing. A decision you reasoned through and recorded is a different conversation with an auditor than a decision nobody can account for two years later.
Multi-State and Remote Workers
One remote hire in a new state is not an incremental change. It is a step change, and it is the most common way a small business quietly becomes non-compliant.
| What you now have to do | Why it catches people |
|---|---|
| Register with that state's tax agency | You cannot withhold state income tax you are not registered to remit. |
| Register for state unemployment insurance | A separate registration from income tax, with its own account and its own rate. |
| Withhold that state's income tax | Generally based on where the employee physically works, not where you are headquartered. |
| Comply with that state's wage and hour law | Daily overtime, pay stub content, final paycheck timing, and pay frequency rules all vary. |
| Meet that state's new hire reporting deadline | A separate filing, in a separate system, on a separate clock. |
| Post that state's required notices | Even for a fully remote employee. Several states require electronic delivery. |
The trigger is usually where the employee works, not where you are. Hiring one person in another state means you now have obligations in two states, and the second set does not announce itself. Sort this before the first payroll, not after.
How Long to Keep What
| Record type | Minimum retention | Under which rule |
|---|---|---|
| Payroll records (wages, hours, deductions) | 3 years | FLSA |
| Records used to compute wages (time cards, schedules) | 2 years | FLSA |
| Employment tax records | At least 4 years after the tax is due or paid | IRS |
| Form I-9 | 3 years after hire, or 1 year after termination, whichever is later | USCIS |
| Records relating to age | 3 years | ADEA |
The practical answer for a small business: keep everything for at least four years, and keep I-9s separately from the personnel file so an audit of one does not become an audit of everything. Storage is cheap. Not having the record when someone asks is not.
What If You Are Already Behind?
Almost no compliance guide addresses this, which is strange, because a meaningful share of the people reading one are reading it because something has already gone wrong.
What to actually do, in order:
Deposit whatever you can, immediately. Penalties are calculated on the unpaid amount, so a partial deposit reduces the penalty base today.
Talk to a tax professional this week. Not your bookkeeper. Someone who handles IRS collections. There are installment options, and the earlier you engage, the more of them exist.
Do not stop filing. Failure to file is a separate penalty from failure to pay. File the return even if you cannot pay the liability, because the two failures compound.
Fix the classification errors too. If you found a misclassification, the exposure grows every pay period you leave it in place.
Running a Self-Audit
Once a year, and it takes an afternoon.
| Check | What you are looking for |
|---|---|
| Pull your headcount and run the thresholds | Did you cross 10 information returns? 15 employees? 50 FTEs? These change your obligations and nobody will tell you. |
| Verify every federal deposit reached the IRS | In your IRS business tax account. Do this yourself, whoever runs your payroll. |
| Re-test every exempt classification against the duties test | Not the title. The actual work. This is where the money is. |
| Re-test every contractor against the IRS control tests | Especially anyone who has been with you over a year doing ongoing work. |
| Confirm you are registered everywhere you have employees | One remote hire in a new state creates a full set of new registrations. |
| Check that overtime uses the correct regular rate | Nondiscretionary bonuses and shift differentials must be folded in. Base pay alone underpays. |
| Spot-check that pay stubs meet your state's content rules | State-specific and commonly wrong. It is a cheap fix and an easy claim. |
Where this falls apart at a small company is not the audit. It is that the classification decision was never written down, the handbook acknowledgment is unsigned, and the I-9 is in a drawer somewhere. When someone asks you to produce it, you cannot.
That is the gap FirstHR closes: employee records that hold the classification decision as a recorded event rather than an assumption, document management with e-signature so the I-9, the W-4, and the handbook acknowledgment are captured before day one and findable afterward. It does not run your payroll or calculate your taxes. It holds the evidence that you did this correctly, which is what compliance actually consists of when someone comes asking.
Common Payroll Compliance Mistakes
| Mistake | What Happens | The Fix |
|---|---|---|
| Assuming small businesses are exempt from most of this | FLSA, payroll taxes, I-9, and new hire reporting all apply from your first employee. There is no small-employer carve-out from the things that generate claims. | Work the thresholds. Most exposure lives in the 1+ block, not at 50 employees. |
| Missing the 10-return e-file threshold | It aggregates W-2s and 1099s together. Six employees plus five contractors is 11 returns. Paper filings may be treated as not filed. | Add your W-2s and 1099s together. If the sum is 10 or more, you must e-file. |
| Treating the ACA and FMLA thresholds as the same rule | ACA counts FTEs; FMLA counts headcount plus a 20-week and 75-mile test. You can be covered by one and not the other. | Run each test separately. They share a number and nothing else. |
| Not realizing ALE status is retrospective | It is determined by the prior calendar year's average. You can be an ALE for a year you did not know about until it is over. | If you are near 45 FTEs, calculate in December. Do not discover it in March. |
| Assuming payroll software makes you compliant | It makes you accurate. It has no opinion on whether your classification is correct or whether you registered in the right state. | Software solves the calculation. The judgment calls remain yours, and that is where the failures are. |
| Believing a bookkeeper absorbs the liability | Delegating the task does not delegate the Trust Fund Recovery Penalty. The IRS bills you. | Verify federal deposits reached the IRS yourself, every quarter. It takes minutes. |
| Hiring in a new state without registering | You cannot legally withhold state tax you are not registered to remit, and unemployment is a separate registration again. | Register before the first payroll in that state, not after. |
| Waiting to fix a missed deposit | Penalties escalate by tier and trust fund exposure compounds. Paying other creditors first is what creates personal liability. | Deposit what you can today. Call a tax professional this week. |
Frequently Asked Questions
What is payroll compliance?
Payroll compliance is adherence to every federal, state, and local law governing how you pay, tax, and record your employees. It covers wage and hour rules under the FLSA, tax withholding and deposit obligations, worker classification, required filings such as Forms 941, 940, and W-2, recordkeeping, and any headcount-triggered obligations such as the ACA employer mandate. It is not one law. It is a set of obligations that switch on at different points as your business grows.
Which payroll laws apply to a small business?
From your first employee: the FLSA (minimum wage and overtime), FICA and FUTA taxes, income tax withholding, Form I-9 verification, state new hire reporting, and in most states workers compensation. At 10 total information returns you must e-file. At 15 employees, Title VII and the ADA. At 20, COBRA and the ADEA. At 50, the ACA employer mandate and FMLA. State law frequently sets lower thresholds than federal law, so federal compliance alone is not enough.
At what number of employees does the ACA apply?
The ACA employer mandate applies to Applicable Large Employers, meaning employers who averaged at least 50 full-time employees including full-time equivalents during the prior calendar year. The critical detail is that part-time hours aggregate: you combine all part-time employees' monthly hours (capped at 120 per employee) and divide by 120 to get your FTE count. A business with 40 full-time employees and 20 part-timers working 60 hours a month has 50 FTEs and is an ALE, even though it never felt like a 50-person company.
Is the FMLA threshold the same as the ACA threshold?
Both say 50, and they are entirely different tests. The ACA counts full-time equivalents, aggregating part-time hours. The FMLA counts headcount, where every employee is one person regardless of hours, but adds two more conditions: you must have had 50 or more employees for 20 or more workweeks in the current or prior year, and the employee must work at a site with 50 employees within a 75-mile radius. You can be an ALE without being FMLA-covered, and the reverse.
Do I have to file W-2s electronically?
If you file 10 or more information returns in total, yes. The threshold is aggregate across form types, which is what catches people. Six W-2s plus five 1099-NECs is 11 returns and triggers mandatory electronic filing, even though neither figure alone approaches 10. This replaced the old 250-return-per-type threshold and now reaches businesses with only a handful of employees plus a few contractors.
What are the penalties for payroll non-compliance?
They stack. Failure-to-deposit penalties run 2 percent (1 to 5 days late), 5 percent (6 to 15 days), 10 percent (16 or more days), and 15 percent if unpaid more than 10 days after an IRS notice. Failure to file carries its own penalty. Wage and hour violations carry back pay plus liquidated damages, often doubling the exposure. And the Trust Fund Recovery Penalty allows the IRS to assess 100 percent of unpaid withheld taxes against you personally, piercing your LLC.
Who is responsible for payroll compliance?
You are, as the employer, regardless of who performs the work. Hiring a bookkeeper or a payroll service delegates the task, not the liability. The IRS is explicit that responsibility sits with the responsible parties within the common law employer. If your provider fails to make a deposit, the IRS bills you. This is why verifying that deposits actually reached the IRS, personally, every quarter, is worth the few minutes it takes.
How long do I have to keep payroll records?
The general rules: the FLSA requires payroll records for three years and the records used to compute wages for two. The IRS requires employment tax records for at least four years after the tax is due or paid. The ADEA requires three years. The safe practical answer for a small business is to keep everything for at least four years, and I-9s for three years after hire or one year after termination, whichever is later. Keeping too much is cheap. Keeping too little is not.
What should I do if I have already missed payroll tax deposits?
Act this week, not next quarter. Penalties escalate by tier and the trust fund exposure grows every period it goes unaddressed. Deposit what you can immediately, because penalties are calculated on the unpaid amount. Then talk to a tax professional about your specific situation, including whether an installment arrangement is appropriate. What you must not do is keep running payroll while paying other creditors ahead of the tax deposit, because that is the fact pattern that produces personal liability.
Does payroll software make me compliant?
It makes you accurate, which is not the same thing. Software calculates withholding, makes deposits, and files returns correctly based on the data you give it. What it cannot do is tell you that the person you classified as a contractor is legally an employee, that you never registered in the state where your remote employee lives, or that you crossed an ACA threshold last year. The calculation is solved. The judgment calls are not, and those are where the expensive failures live.