Step 1: Choose the Entity and Register the Business

A security agency can legally be a sole proprietorship, a partnership or LLP, or a private limited company. The choice matters more here than in most service businesses because the PSARA licence is issued to the entity and its named principals, and because clients such as banks, IT parks and housing federations increasingly ask for a company or LLP before they will sign a contract. A proprietorship is quickest to start and hardest to scale; a private limited company costs more to maintain but is what most corporate procurement teams expect.

Whatever you choose, get the PAN, open the current account and register the trade name before you apply for anything else. The PSARA application asks for the entity's registration proof, the principal place of business, and the identity and address of every director or partner, and inconsistencies between these documents are the most common reason an application is returned. Use one spelling of the name and one address across every registration from day one.

If you intend to operate in more than one state, remember that PSARA licences are issued state by state (or for districts within a state). Register the entity once, but plan the licence applications for each state in which you will actually deploy guards, and time them so that the first licence is in hand before you quote to a client in that state.

• Proprietorship for a single-city start; LLP or Pvt Ltd if you want corporate clients or investors
• One consistent name, address and signatory across PAN, bank, GST and PSARA documents
• Directors and partners will be police-verified; brief them before you file
• Plan one PSARA application per state of deployment, not one for the whole country

Step 2: The PSARA Licence — What the Controlling Authority Checks

The Private Security Agencies (Regulation) Act 2005 makes it an offence to run a security agency without a licence from the state Controlling Authority. The licence is valid for five years and renewable, must be displayed at the principal place of business, and comes with a duty to maintain a register of guards, supervisors, management and clients under section 15 of the Act. The PSARA glossary entry summarises the Act; the application process is what trips up new owners.

The Controlling Authority (usually a senior police officer or home department official designated by the state) will verify the antecedents of every director or partner through the police, check that the agency has a training arrangement (either its own recognised training centre or a memorandum with a recognised institute), and look at the proposed uniform, the office premises and the standing of the applicant. Fees and the exact document list are set by each state's PSARA rules and change from time to time, so download the current list from the state home department or police website rather than relying on a consultant's memory.

Processing takes weeks, sometimes months, because the police verification of principals is done by the local station and forwarded through the district. Apply before you hire, not after. Deploying guards while the application is pending exposes both you and the client, and clients with any compliance function will ask for the licence number before the first invoice is paid. Once issued, put the licence number on every quotation, deployment letter and invoice.

• Licence per state or district, valid 5 years, renewable, displayed at the office
• Police verification of every director or partner is part of the application
• A training tie-up with a recognised institute is a condition, not an option
• Fees and forms are state-specific; use the current list from the state authority
• Do not deploy a single guard until the licence is in hand

Step 3: Statutory Registrations Before the First Deployment

Security services attract GST, and most clients will not process an invoice without a GSTIN, so GST registration comes immediately after the entity. Note that for many client relationships GST on security services is paid by the client under reverse charge when a registered body corporate hires a non-body-corporate agency; confirm your position with your chartered accountant because it changes how you invoice and how you manage working capital.

EPF and ESIC registration follow. PSARA expressly requires agencies to comply with EPF, ESIC and minimum wage law, and the Controlling Authority and every serious client will ask for your EPF and ESIC code numbers. EPF applies on basic plus DA with the wage ceiling now at ₹25,000 per month (effective 17 September 2026); ESIC applies to establishments with 10 or more employees (20 in some states) in implemented areas, on gross wages up to ₹21,000 per month. Both have monthly returns due by the 15th of the following month, and a missed month in your first quarter is a stain that shows up in every future client audit.

Complete the Shops and Establishments registration for the office under your state's Act, register for professional tax where your state levies it (Haryana, Delhi and Uttar Pradesh do not; Maharashtra, Karnataka, Telangana and West Bengal do), and check whether your state's Labour Welfare Fund applies. When you cross the contract-labour thresholds (50 contract workers under the OSH Code), the contractor licence requirement also applies to you as the contractor. Keep a single folder, physical and digital, with every certificate; you will be asked for it repeatedly.

• GST: register before the first quote; clarify forward versus reverse charge with your CA
• EPF and ESIC: code numbers are conditions of PSARA compliance and of most client contracts
• Shops and Establishments registration for the office; professional tax and LWF where the state levies them
• Contract-labour licence once your deployed headcount crosses the OSH Code threshold
• Keep a compliance folder with every certificate and return acknowledgement

Step 4: Recruit, Verify and Train the First Guards

Your first twenty guards will decide your reputation. PSARA requires that every guard has verified character and antecedents, meets the eligibility conditions in the Act, and has completed training in line with the Private Security Agencies Central Model Rules 2020, which prescribe a minimum of 100 hours of classroom and 60 hours of field training for fresh guards (ex-servicemen and ex-police personnel may qualify for shorter courses under the rules). Collect Aadhaar, address proof, photographs, previous employer details and references at joining, and start police verification the same week. The full process is in security guard background and police verification.

Build the section 15 register from the first hire rather than reconstructing it before an inspection. It must carry each guard's name, address, photograph and salary along with management details and the client list. An employee database with a digital ID card per guard, which is what security agency manpower management software provides, means the register is a report rather than a separate document someone forgets to update.

Issue uniforms and photo ID cards before deployment, and keep a signed uniform and equipment issue record per guard. Clients notice uniform discipline before they notice anything else, and a guard without an ID card at a client gate is the kind of complaint that reaches the client's management on day one.

• Joining kit: Aadhaar, address proof, photographs, previous employer, two references
• Police verification initiated in the first week; do not deploy on a pending verification for sensitive sites
• Training per the Model Rules 2020: 100 hours classroom plus 60 hours field for fresh guards
• Section 15 register maintained from the first hire, with photographs and salaries
• Uniform and ID card issued and acknowledged in writing before the first shift

Step 5: Build the Rate Card and Sign the First Contract

New agencies lose money by quoting a round number per guard per month. Build the rate from the bottom up instead. Start with the state minimum wage for the guard's category (unarmed guards are usually semi-skilled; armed guards and supervisors are skilled), including the current VDA. Add the employer's statutory cost: EPF at 12% of basic plus DA up to the ceiling (plus EDLI and admin charges), ESIC at 3.25% of gross, statutory bonus at the minimum 8.33%, and a provision for gratuity and earned leave. Add reliever cost, because a 24×7 post needs more than the guards physically standing on it, then uniform and supervision cost, then your service charge, then GST.

The security guard minimum wages guide explains where to find the current notification and how the twice-yearly VDA revision works; the security guard billing calculator lets you model the rate for 8-hour and 12-hour posts. Write a wage-revision pass-through clause into the contract so that when the state revises the minimum wage in April or October, the rate moves with it. Agencies that quote a fixed rate for a year absorb the revision from their margin.

Get the contract to specify the site, each post, the manning hours, the number of guards and relievers, the billing model (per guard per month, per shift or per man-hour), the attendance record that will be treated as proof of deployment, and the payment terms. How security agencies bill clients for guard man-hours sets out the invoice structure that avoids month-end disputes.

• Rate = minimum wage (basic + VDA) + employer PF, ESI, bonus, gratuity provision + reliever + uniform and supervision + service charge + GST
• Price 12-hour posts with 4 hours of overtime at double rate, not as a cheap two-guard post
• Include a minimum-wage revision pass-through clause with a defined effective date
• Name the attendance record that will be the basis of billing in the contract itself
• Negotiate payment terms in writing; 30 days is achievable, 60 days will break a new agency

Step 6: Set Up Operations Before the First Guard Reports

Operations for a security agency come down to five linked records: the deployment plan (which guard, which site, which post, which shift), the duty roster, the attendance register, the patrol or duty report, and the invoice. When these are five separate documents kept by five different people, the agency spends the last week of every month reconciling them. When they are one connected system, the invoice falls out of the attendance record.

Start with the deployment plan and the roster; how to make a duty roster for security guards covers the guard-count maths for 8-hour and 12-hour posts. Then decide how attendance will be captured at the client site. Paper registers are the baseline and are still what many inspectors expect to see, but GPS and selfie attendance from the guard's phone, verified against a geofence around the site, gives you a timestamped record that both you and the client can trust. How to choose attendance software for a security agency walks through the selection criteria.

Attend Mitra was built for exactly this shape of business: site-wise guard deployment and post assignment, guard attendance with GPS and selfie, patrol monitoring with NFC and QR checkpoints, incident reports and SOS from the app, supervisor site-visit check-ins, and site-wise man-hour exports that go straight into client billing. Whatever you choose, make sure the attendance record is site-wise from day one, because that is how clients will want it invoiced and how inspectors will want it produced.

• One deployment plan per client, versioned, matching the contract post by post
• Roster built from the plan with relievers included, published to guards and client
• Site-wise attendance with a timestamp the client cannot dispute
• Patrol rounds and duty reports as evidence of service, not just presence
• Monthly man-hour export per site feeding the invoice without manual re-entry

Month-One Checklist and Why New Agencies Fail

The first month is a cash-flow test. You will pay wages by the 7th of the month following deployment, deposit PF and ESIC by the 15th, and, if your client pays on 45- or 60-day terms, receive your first payment roughly two months after your first payroll. A twenty-guard deployment therefore needs working capital for at least two full months of wages and statutory contributions before a rupee comes in. Agencies that do not plan for this borrow at high cost, delay wages, or delay PF, and each of those ends the business within a year.

The second failure pattern is under-pricing. An owner who quotes below the statutory cost to win the first contract either pays guards below minimum wage (an offence, and grounds for PSARA licence cancellation) or subsidises the client from personal funds. The third is record-keeping: an agency that cannot produce the section 15 register, the attendance register and the wage register on demand will fail its first inspection and its first client audit, regardless of how good the guards are.

Use the PSARA compliance checklist for security agencies as a monthly routine from the first month. Run the checks below before the first deployment and again at the end of month one.

• Licence displayed; licence number on quotation, deployment letter and invoice
• GST, EPF, ESIC, Shops and Establishments and professional tax registrations complete and filed
• Every deployed guard verified, trained, in uniform, with ID card, and entered in the section 15 register
• Signed contract naming posts, hours, rate, revision clause, attendance basis and payment terms
• Working capital for two months of wages plus statutory contributions in the bank
• Wages paid by the 7th, PF and ESIC deposited by the 15th, first invoice raised with attendance annexure