Payroll Compliance: Which Rules Actually Apply to You

Every article on payroll compliance gives you the same list of federal laws: FLSA, FICA, FUTA, ACA, FMLA, Equal Pay Act, Davis-Bacon. It is competent and close to useless, because it skips the one question that actually matters to you. I run a small company and build HR software for others like it, so this guide answers that question first.

Which of these apply to me?

The answer, for a business with eight employees, is that several of them do not. FMLA does not apply to you. The ACA employer mandate does not apply to you. But a rule you have almost certainly never heard of may already reach you, and it decides whether you are allowed to file your W-2s on paper at all.

That is why this guide is built around thresholds and deadlines rather than a law list. It covers which obligations switch on at your headcount, the two "50 employee" rules that are not the same rule, the calendar of what is due when, real penalty math, and what to do if you are already behind.

What Is Payroll Compliance?

The operative phrase in that definition is "different points." Compliance is not a wall you hit. It is a series of doors you walk through as you hire, and nobody tells you when you have gone through one.

Which Laws Actually Apply to You

Which laws apply to you depends almost entirely on one number: how many people you employ. Federal obligations attach in blocks rather than all at once, and the matrix below shows which block you are standing in and what switches on at the next one.

Two observations matter more than the individual rows.

First, the 1+ block is where most small business exposure actually lives. Wage and hour violations, misclassification, and missed deposits do not wait for you to hire your fiftieth employee. They are available to you from day one, and they are the ones that generate claims.

Second, state law routinely sets lower thresholds. According to the EEOC, Title VII, the ADA, and the Genetic Information Nondiscrimination Act (GINA) reach employers with 15 or more employees, and the ADEA reaches 20 or more. Several states, though, apply their own equivalents from a single employee. State paid leave and retirement mandates have their own triggers too.

New hire reporting shows how fast the state layer bites. The federal outside deadline is 20 days, but the federal matrix of state programs shows nine jurisdictions running a shorter clock, down to seven days in Alabama and Maine. Federal compliance is a floor, and treating it as the answer is how multi-state employers get caught.

State Payroll Legislation Sets Its Own Thresholds

Federal law tells you when a federal obligation begins and nothing else. The state layer usually arrives earlier and reaches more employers, and it is where a business that looks fully compliant on the federal side still gets a claim filed against it.

Seven categories are worth checking with your own state labor department, each separately: minimum wage above the federal floor, pay frequency, pay stub content, final paycheck timing after a termination, paid sick leave, state-run retirement program mandates, and pay transparency in job postings. Every one of them is its own statute with its own trigger.

Workers compensation belongs on the same list and sits outside payroll software entirely. Some states require coverage from your first employee, others set a small-employer threshold, and according to the Texas Department of Insurance, private employers in Texas may decline it in most cases. Confirm your own rule before the first payroll.

Run the list against the state where your employees actually work rather than where the company is registered, and run it again the first time you hire outside that state. None of it surfaces in the federal thresholds above, and no payroll platform will raise its hand about it.

The Two Different Fifties

The ACA and the Family and Medical Leave Act (FMLA) both trigger at "50 employees." They do not mean the same thing by it: the ACA counts full-time equivalents (FTEs), the FMLA counts heads, and almost every compliance article flattens the two into a single number.

Per the IRS, Applicable Large Employer (ALE) status is determined by averaging your full-time employees plus full-time equivalents across the prior calendar year. So you can become an ALE for this year based on a headcount you no longer have, and you will not find out from anyone.

The FMLA, meanwhile, covers a private employer that had 50 or more employees in 20 or more workweeks in the current or prior calendar year. The 75-mile radius sits one layer below coverage: a distributed company with 60 employees is covered, but an employee at a site with fewer than 50 staff within 75 miles is not eligible to take the leave.

The E-File Rule That Catches Almost Everyone

Per IRS Topic 801, if you file 10 or more information returns in a calendar year, you must file them electronically. The old threshold was 250 per form type. The current threshold is 10 in aggregate, across almost all form types combined.

This e-file rule is the obligation nobody knows about, and it reaches businesses far smaller than their owners expect.

The 1099-NEC reporting threshold itself moved. According to the IRS instructions for Forms 1099-MISC and 1099-NEC, you file a 1099-NEC for a nonemployee paid $2,000 or more in a calendar year, for payments made on or after January 1, 2026, with the figure indexed for inflation after that. A state may still apply a lower one.

A six-person business that uses a handful of contractors is over the line. Filing those returns on paper is a failure to file in the required manner under 26 CFR 301.6721-1, and the information return penalty then applies to the forms above the 10-return threshold rather than to the whole batch.

The amounts are per form. According to IRS Revenue Procedure 2025-32, for returns due in 2027 the penalty runs $60 for a form corrected within 30 days, $130 through August 1, and $340 after that or if the form is never filed.

Intentional disregard costs more: for those same returns, the greater of $690 or 10 percent of the amount required to be reported, with no annual cap.

The ACA, FMLA, and e-file tests are all arithmetic you can do in an afternoon in December, and none of them will be done for you. The workbook below gives each one its own tab with the counting rule written into the row labels, so the answer you write down is the answer to the right question.

The ACA tab records the average and the file it came from rather than reworking it, because that twelve-month calculation runs on its own divisor and is set out in the ACA compliance guide. Run the workbook once a year and keep the completed file, because the useful part is being able to show what you counted and when.

The Compliance Calendar

Compliance is not a checklist you complete once. It is a cycle. Here is the whole thing, organized by timing rather than by statute, which is how you actually need it.

The deposit block is the dangerous one, and it is dangerous precisely because nobody is waiting on it. Your employees notice immediately if their pay is wrong. The IRS notices your missed deposit months later, by which time the penalty has escalated and the trust fund exposure has compounded.

Payroll Updates: What Changes Every Year

The calendar above stays fixed. The numbers inside it do not. A set of payroll figures resets between October and January for the year ahead, and the first pay run in January is where the old ones quietly survive if nobody replaced them.

Four of those resets matter for a small payroll. The first is the Social Security wage base: the SSA announces it in October, and IRS Publication 15 carries it into the following year. According to the SSA, the 2027 wage base is $192,300.

The second is the standard mileage rate, which the IRS issues in December. The third is your state minimum wage, and many states move theirs on January 1.

Your deposit schedule is the fourth. Publication 15 sets it from the lookback period, the four quarters ending June 30 of the prior year, and redetermining it before January is your job rather than something the IRS calculates for you.

The document worth reading rather than skimming is Publication 15, the IRS employer tax guide, which is revised every year. An hour in December spent loading the new figures, confirming the state rate, and rerunning the threshold tests above costs less than a corrected filing in April.

What Non-Compliance Actually Costs

According to the IRS, the failure-to-deposit penalty runs on a four-step ladder rather than a daily accrual, and the tiers do not add together: one rate applies to the whole late deposit. Under 29 U.S.C. 216(b), a minimum wage or overtime violation costs the unpaid wages plus an equal amount as liquidated damages, plus attorney fees.

The trust fund row is the one that reaches you personally. According to the IRS, the penalty equals the unpaid withheld income tax plus the employee share of FICA, and it can be assessed against any responsible person who willfully failed to pay it over.

Trust fund taxes are also excepted from bankruptcy discharge under 11 U.S.C. 523(a)(1)(A), so a bankruptcy filing does not wipe them out.

Classification: The Biggest Single Risk

If you fix one thing after reading this, fix your classifications. Two of them, and both are commonly wrong.

Employee or contractor. The IRS looks at behavioral control, financial control, and the type of relationship. If you set their hours, direct how the work is done, provide the tools, and the work is ongoing and central to your business, they are an employee. Being short on cash is not a defense and never has been.

Exempt or non-exempt. An employee is exempt from overtime only if they pass all three tests: salary basis, salary level, and the duties test. The duties test is the one most often failed, and a job title satisfies nothing. Calling someone an office manager does not exempt them if their actual work is non-exempt.

The salary level is the only one of the three with a number attached. According to DOL Fact Sheet 17A, the federal threshold is $684 a week, or $35,568 a year. Clearing it proves nothing on its own, because the duties test still has to be satisfied, and state thresholds run separately.

These are judgment calls, and judgment calls are exactly what payroll software cannot make for you. The software will faithfully process whatever classification you enter. It has no opinion about whether the classification is correct.

Because it is a judgment call, the defensible version is a written one. Record the answer, the facts it rests on, and the date when the person is hired, and again whenever the role changes, the pay changes, or they move to another state. Keep it with the contract.

The employee type guide carries a worksheet that walks the control factors and the three exemption tests one prompt at a time, which is the version worth filling in rather than reconstructing. A decision you reasoned through and recorded is a different conversation with an auditor than a decision nobody can account for two years later.

Multi-State and Remote Workers

One remote hire in a new state is not an incremental change. It is a step change, and it is the most common way a small business quietly becomes non-compliant.

The trigger is usually where the employee works, not where you are. Hiring one person in another state means you now have obligations in two states, and the second set does not announce itself. Sort this before the first payroll, not after.

How Long to Keep What

The answer depends on which of four rules covers the record, and they do not all start counting from the same event. The FLSA measures its three years from the last date of entry under 29 CFR 516.5, the IRS counts four years from the filing of that year's fourth-quarter return, and the I-9 clock starts at hire.

DOL Fact Sheet 21 sets the FLSA periods, IRS recordkeeping guidance sets the employment tax period, and 8 CFR 274a.2 sets the I-9 rule. Where two periods overlap, the longer one governs what you actually keep.

The practical answer for a small business: keep everything for at least four years, and keep I-9s separately from the personnel file so an audit of one does not become an audit of everything. Separate storage is a USCIS recommendation rather than a rule, and a sensible one. Storage is cheap; not having the record is not.

What If You Are Already Behind?

If you are already behind, deposit what you can, bring in a tax professional, and keep filing. Almost no compliance guide addresses this, which is strange: a meaningful share of the people reading one are doing so because something has already gone wrong.

What to actually do, in order:

Deposit whatever you can, immediately. Penalties are calculated on the unpaid amount, so a partial deposit reduces the penalty base today.

Talk to a tax professional this week. Not your bookkeeper. Someone who handles IRS collections. There are installment options, and the earlier you engage, the more of them exist.

Do not stop filing. Failure to file is a separate penalty from failure to pay. File the return even if you cannot pay the liability, because the two failures compound.

Fix the classification errors too. If you found a misclassification, the exposure grows every pay period you leave it in place.

Running a Self-Audit

Run a self-audit once a year; it takes an afternoon. The one check nobody else will run for you is the deposit verification, because according to the IRS the employer stays the responsible party even when a third party makes the deposits.

Where this falls apart at a small company is not the audit. It is that the classification decision was never written down, the handbook acknowledgment is unsigned, and the I-9 is in a drawer somewhere. When someone asks you to produce them, you cannot.

That is the gap FirstHR closes: employee records that keep the written classification decision on file rather than in memory, and document management with e-signature, so the handbook acknowledgment is captured before day one and findable afterward.

Form I-9 and W-4 go on the new hire's first-day list as tasks, and completed forms are kept in their employee file. The forms themselves are completed outside the platform. It does not run your payroll or calculate your taxes. It holds the evidence that you did this correctly, which is what compliance actually consists of when someone comes asking.

Common Payroll Compliance Mistakes

The mistakes below are mostly wrong assumptions rather than wrong arithmetic: about which rules apply, how the thresholds are counted, and who carries the liability.

Find the row that describes your business today and make that fix first. The rest belong on your yearly self-audit, so each one gets checked before it turns into a claim.

Frequently Asked Questions