Payroll Compliance: Which Rules Actually Apply to You
A thresholds matrix showing which payroll laws apply at your headcount, a compliance calendar, the penalty math, and what to do if you are already behind.
Payroll Compliance
Which laws apply at your headcount, when everything is due, and what it costs to miss
Every article on payroll compliance gives you the same thing: a list of federal laws. FLSA, FICA, FUTA, ACA, FMLA, Equal Pay Act, Davis-Bacon. It is a competent list and it is close to useless, because it does not tell you the only thing you actually need to know.
Which of these apply to me?
The answer, for a business with eight employees, is that most of them do not. FMLA does not apply to you. The ACA employer mandate does not apply to you. But a rule you have almost certainly never heard of does, and it is going to make you file your W-2s electronically whether you want to or not.
So this guide is built around thresholds and deadlines rather than a law list. Which obligations switch on at your headcount, the two "50 employee" rules that are not the same rule, the calendar of what is due when, real penalty math, and what to do if you are already behind.
What Is Payroll Compliance?
The operative word in that definition is different points. Compliance is not a wall you hit. It is a series of doors you walk through as you hire, and nobody tells you when you have gone through one.
Which Laws Actually Apply to You
Two observations that matter more than the individual rows.
First, the 1+ block is where most small business exposure actually lives. Wage and hour violations, misclassification, and missed deposits do not wait for you to hire your fiftieth employee. They are available to you from day one, and they are the ones that generate claims.
Second, state law routinely sets lower thresholds. The EEOC sets the federal anti-discrimination floor at 15 employees, but several states apply their own equivalents from a single employee. State paid leave and retirement mandates have their own triggers too. Federal compliance is a floor, and treating it as the answer is how multi-state employers get caught.
The Two Different Fifties
The ACA and the FMLA both trigger at "50 employees." They do not mean the same thing by it, and almost every compliance article flattens this into a single number.
Per the IRS, ALE status is determined by averaging your full-time employees plus full-time equivalents across the prior calendar year. So you can become an ALE for this year based on a headcount you no longer have, and you will not find out from anyone.
The FMLA, meanwhile, adds the 20-workweek duration test and the 75-mile radius test. A distributed company with 60 employees spread across the country may have no worksite with 50 within 75 miles, and therefore no FMLA coverage.
The E-File Rule That Catches Almost Everyone
This is the obligation nobody knows about, and it reaches businesses far smaller than they expect.
Per IRS Topic 801, if you file 10 or more information returns in a calendar year, you must file them electronically. The old threshold was 250 per form type. The current threshold is 10 in aggregate, across almost all form types combined.
| Your situation | Total returns | Must you e-file? |
|---|---|---|
| 9 employees, no contractors | 9 W-2s | No. You may still file on paper. |
| 5 employees, 4 contractors paid $600+ | 5 W-2s + 4 1099-NECs = 9 | No. Just under the line. |
| 5 employees, 5 contractors paid $600+ | 5 W-2s + 5 1099-NECs = 10 | YES. Mandatory electronic filing. |
| 6 employees, 5 contractors paid $600+ | 6 W-2s + 5 1099-NECs = 11 | YES. And most owners in this position have no idea. |
A six-person business that uses a handful of contractors is over the line. Failing to e-file when required can result in the IRS treating your paper filings as not filed at all, which is a considerably worse problem than the one you were trying to avoid.
The Compliance Calendar
Compliance is not a checklist you complete once. It is a cycle. Here is the whole thing, organized by when rather than by which law, which is how you actually need it.
The deposit block is the dangerous one, and it is dangerous precisely because nobody is waiting on it. Your employees notice immediately if their pay is wrong. The IRS notices your missed deposit months later, by which time the penalty has escalated and the trust fund exposure has compounded. The learn payroll guide covers that personal liability in detail.
What Non-Compliance Actually Costs
| Failure | Penalty | Note |
|---|---|---|
| Late tax deposit, 1 to 5 days | 2% of the deposit | Applies to the whole deposit, not the overage. |
| Late tax deposit, 6 to 15 days | 5% of the deposit | Not progressive tiers. Seven days late means 5% on the entire amount. |
| Late tax deposit, 16+ days | 10% of the deposit | |
| Unpaid 10+ days after IRS notice | 15% of the deposit | The ceiling, and entirely avoidable. |
| Withheld taxes never remitted | Trust Fund Recovery Penalty: 100%, personally | Pierces your LLC. Generally survives bankruptcy. This is the one that ends businesses. |
| Wage and hour violation | Back wages plus liquidated damages | Liquidated damages often equal the back pay, effectively doubling it, plus attorney fees. |
| Worker misclassification | Back taxes, penalties, interest | Plus the wage and hour exposure for overtime never paid to someone who should have been non-exempt. |
Classification: The Biggest Single Risk
If you fix one thing after reading this, fix your classifications. Two of them, and both are commonly wrong.
Employee or contractor. The IRS looks at behavioral control, financial control, and the type of relationship. If you set their hours, direct how the work is done, provide the tools, and the work is ongoing and central to your business, they are an employee. Being short on cash is not a defense and never has been. The employee vs contractor guide covers the tests.
Exempt or non-exempt. An employee is exempt from overtime only if they pass all three tests: salary basis, salary level (currently $684 per week federally), and the duties test. The duties test is the one most often failed, and a job title satisfies nothing. Calling someone an office manager does not exempt them if their actual work is non-exempt. The exempt vs non-exempt guide covers all three.
These are judgment calls, and judgment calls are exactly what payroll software cannot make for you. The software will faithfully process whatever classification you enter. It has no opinion about whether the classification is correct.
Multi-State and Remote Workers
One remote hire in a new state is not an incremental change. It is a step change, and it is the most common way a small business quietly becomes non-compliant.
| What you now have to do | Why it catches people |
|---|---|
| Register with that state's tax agency | You cannot withhold state income tax you are not registered to remit. |
| Register for state unemployment insurance | A separate registration from income tax, with its own account and its own rate. |
| Withhold that state's income tax | Generally based on where the employee physically works, not where you are headquartered. |
| Comply with that state's wage and hour law | Daily overtime, pay stub content, final paycheck timing, and pay frequency rules all vary. |
| Meet that state's new hire reporting deadline | A separate filing, in a separate system, on a separate clock. |
| Post that state's required notices | Even for a fully remote employee. Several states require electronic delivery. |
The trigger is usually where the employee works, not where you are. Hiring one person in another state means you now have obligations in two states, and the second set does not announce itself. Sort this before the first payroll, not after.
How Long to Keep What
| Record type | Minimum retention | Under which rule |
|---|---|---|
| Payroll records (wages, hours, deductions) | 3 years | FLSA |
| Records used to compute wages (time cards, schedules) | 2 years | FLSA |
| Employment tax records | At least 4 years after the tax is due or paid | IRS |
| Form I-9 | 3 years after hire, or 1 year after termination, whichever is later | USCIS |
| Records relating to age | 3 years | ADEA |
The practical answer for a small business: keep everything for at least four years, and keep I-9s separately from the personnel file so an audit of one does not become an audit of everything. Storage is cheap. Not having the record when someone asks is not. The records retention guide covers the full schedule.
What If You Are Already Behind?
Almost no compliance guide addresses this, which is strange, because a meaningful share of the people reading one are reading it because something has already gone wrong.
What to actually do, in order:
Deposit whatever you can, immediately. Penalties are calculated on the unpaid amount, so a partial deposit reduces the penalty base today.
Talk to a tax professional this week. Not your bookkeeper. Someone who handles IRS collections. There are installment options, and the earlier you engage, the more of them exist.
Do not stop filing. Failure to file is a separate penalty from failure to pay. File the return even if you cannot pay the liability, because the two failures compound.
Fix the classification errors too. If you found a misclassification, the exposure grows every pay period you leave it in place.
Running a Self-Audit
Once a year, and it takes an afternoon.
| Check | What you are looking for |
|---|---|
| Pull your headcount and run the thresholds | Did you cross 10 information returns? 15 employees? 50 FTEs? These change your obligations and nobody will tell you. |
| Verify every federal deposit reached the IRS | In your IRS business tax account. Do this yourself, whoever runs your payroll. |
| Re-test every exempt classification against the duties test | Not the title. The actual work. This is where the money is. |
| Re-test every contractor against the IRS control tests | Especially anyone who has been with you over a year doing ongoing work. |
| Confirm you are registered everywhere you have employees | One remote hire in a new state creates a full set of new registrations. |
| Check that overtime uses the correct regular rate | Nondiscretionary bonuses and shift differentials must be folded in. Base pay alone underpays. |
| Spot-check that pay stubs meet your state's content rules | State-specific and commonly wrong. It is a cheap fix and an easy claim. |
Where this falls apart at a small company is not the audit. It is that the classification decision was never written down, the handbook acknowledgment is unsigned, and the I-9 is in a drawer somewhere. When someone asks you to produce it, you cannot.
That is the gap FirstHR closes: employee records that hold the classification decision as a recorded event rather than an assumption, document management with e-signature so the I-9, the W-4, and the handbook acknowledgment are captured before day one and findable afterward. It does not run your payroll or calculate your taxes. It holds the evidence that you did this correctly, which is what compliance actually consists of when someone comes asking. The HR document management guide covers what else belongs there.
Common Payroll Compliance Mistakes
| Mistake | What Happens | The Fix |
|---|---|---|
| Assuming small businesses are exempt from most of this | FLSA, payroll taxes, I-9, and new hire reporting all apply from your first employee. There is no small-employer carve-out from the things that generate claims. | Work the thresholds. Most exposure lives in the 1+ block, not at 50 employees. |
| Missing the 10-return e-file threshold | It aggregates W-2s and 1099s together. Six employees plus five contractors is 11 returns. Paper filings may be treated as not filed. | Add your W-2s and 1099s together. If the sum is 10 or more, you must e-file. |
| Treating the ACA and FMLA thresholds as the same rule | ACA counts FTEs; FMLA counts headcount plus a 20-week and 75-mile test. You can be covered by one and not the other. | Run each test separately. They share a number and nothing else. |
| Not realizing ALE status is retrospective | It is determined by the prior calendar year's average. You can be an ALE for a year you did not know about until it is over. | If you are near 45 FTEs, calculate in December. Do not discover it in March. |
| Assuming payroll software makes you compliant | It makes you accurate. It has no opinion on whether your classification is correct or whether you registered in the right state. | Software solves the calculation. The judgment calls remain yours, and that is where the failures are. |
| Believing a bookkeeper absorbs the liability | Delegating the task does not delegate the Trust Fund Recovery Penalty. The IRS bills you. | Verify federal deposits reached the IRS yourself, every quarter. It takes minutes. |
| Hiring in a new state without registering | You cannot legally withhold state tax you are not registered to remit, and unemployment is a separate registration again. | Register before the first payroll in that state, not after. |
| Waiting to fix a missed deposit | Penalties escalate by tier and trust fund exposure compounds. Paying other creditors first is what creates personal liability. | Deposit what you can today. Call a tax professional this week. |
Frequently Asked Questions
What is payroll compliance?
Payroll compliance is adherence to every federal, state, and local law governing how you pay, tax, and record your employees. It covers wage and hour rules under the FLSA, tax withholding and deposit obligations, worker classification, required filings such as Forms 941, 940, and W-2, recordkeeping, and any headcount-triggered obligations such as the ACA employer mandate. It is not one law. It is a set of obligations that switch on at different points as your business grows.
Which payroll laws apply to a small business?
From your first employee: the FLSA (minimum wage and overtime), FICA and FUTA taxes, income tax withholding, Form I-9 verification, state new hire reporting, and in most states workers compensation. At 10 total information returns you must e-file. At 15 employees, Title VII and the ADA. At 20, COBRA and the ADEA. At 50, the ACA employer mandate and FMLA. State law frequently sets lower thresholds than federal law, so federal compliance alone is not enough.
At what number of employees does the ACA apply?
The ACA employer mandate applies to Applicable Large Employers, meaning employers who averaged at least 50 full-time employees including full-time equivalents during the prior calendar year. The critical detail is that part-time hours aggregate: you combine all part-time employees' monthly hours (capped at 120 per employee) and divide by 120 to get your FTE count. A business with 40 full-time employees and 20 part-timers working 60 hours a month has 50 FTEs and is an ALE, even though it never felt like a 50-person company.
Is the FMLA threshold the same as the ACA threshold?
Both say 50, and they are entirely different tests. The ACA counts full-time equivalents, aggregating part-time hours. The FMLA counts headcount, where every employee is one person regardless of hours, but adds two more conditions: you must have had 50 or more employees for 20 or more workweeks in the current or prior year, and the employee must work at a site with 50 employees within a 75-mile radius. You can be an ALE without being FMLA-covered, and the reverse.
Do I have to file W-2s electronically?
If you file 10 or more information returns in total, yes. The threshold is aggregate across form types, which is what catches people. Six W-2s plus five 1099-NECs is 11 returns and triggers mandatory electronic filing, even though neither figure alone approaches 10. This replaced the old 250-return-per-type threshold and now reaches businesses with only a handful of employees plus a few contractors.
What are the penalties for payroll non-compliance?
They stack. Failure-to-deposit penalties run 2 percent (1 to 5 days late), 5 percent (6 to 15 days), 10 percent (16 or more days), and 15 percent if unpaid more than 10 days after an IRS notice. Failure to file carries its own penalty. Wage and hour violations carry back pay plus liquidated damages, often doubling the exposure. And the Trust Fund Recovery Penalty allows the IRS to assess 100 percent of unpaid withheld taxes against you personally, piercing your LLC.
Who is responsible for payroll compliance?
You are, as the employer, regardless of who performs the work. Hiring a bookkeeper or a payroll service delegates the task, not the liability. The IRS is explicit that responsibility sits with the responsible parties within the common law employer. If your provider fails to make a deposit, the IRS bills you. This is why verifying that deposits actually reached the IRS, personally, every quarter, is worth the few minutes it takes.
How long do I have to keep payroll records?
The general rules: the FLSA requires payroll records for three years and the records used to compute wages for two. The IRS requires employment tax records for at least four years after the tax is due or paid. The ADEA requires three years. The safe practical answer for a small business is to keep everything for at least four years, and I-9s for three years after hire or one year after termination, whichever is later. Keeping too much is cheap. Keeping too little is not.
What should I do if I have already missed payroll tax deposits?
Act this week, not next quarter. Penalties escalate by tier and the trust fund exposure grows every period it goes unaddressed. Deposit what you can immediately, because penalties are calculated on the unpaid amount. Then talk to a tax professional about your specific situation, including whether an installment arrangement is appropriate. What you must not do is keep running payroll while paying other creditors ahead of the tax deposit, because that is the fact pattern that produces personal liability.
Does payroll software make me compliant?
It makes you accurate, which is not the same thing. Software calculates withholding, makes deposits, and files returns correctly based on the data you give it. What it cannot do is tell you that the person you classified as a contractor is legally an employee, that you never registered in the state where your remote employee lives, or that you crossed an ACA threshold last year. The calculation is solved. The judgment calls are not, and those are where the expensive failures live.