EPF and ETF record-keeping compliance in Sri Lanka

Last verified against the primary sources on 15 October 2026.

Employers usually think EPF and ETF compliance is mainly about paying on time. The harder question is whether the business can prove how each amount was calculated, who it related to, which file was submitted, and what changed when a correction was made.

Weak records cause more pain than one late payment. When files are incomplete, payroll teams spend days rebuilding history, employee balances stay unresolved, and inspections turn into document hunts.

Quick answer: keep one employer standing file, one file per employee, one monthly contribution evidence pack, and one correction register. If those four are current, most EPF and ETF reviews are manageable.

1) Treat records as part of the contribution process

A bank slip or online receipt does not prove full compliance on its own. Reviewers and employees may still ask:

• how the contribution base was worked out
• whether the correct member number and NIC were used
• whether the Form C, e-return, R1 or R4 matched the payroll register
• whether the amount paid matched the amount deducted and accrued
• whether a correction trail exists where an earlier file was wrong

So EPF and ETF records belong in the payroll close, not stored afterwards by whoever has time.

2) Keep four record sets, separately

Employer standing file

• the employer registration number and Labour Department correspondence
• EPF online services setup records
• ETF temporary-number correspondence, where relevant. ETF has no registration of its own and uses the EPF number [1]
• the authorised signatory list for payroll and payment files
• the bank setup used for payments
• contact details for the EPF, ETF, payroll and finance owners

Employee file

• appointment letter or employment contract
• NIC or passport copy
• the member number assigned
• notes on the contribution base where allowances affect it
• joiner, transfer, unpaid leave and resignation records
• re-registration or NIC correction records

Assign member numbers in numerical order and never give a used number to a new employee [2]. A reused number creates reconciliation problems that are painful to unwind.

Monthly contribution evidence pack

• approved payroll register
• employee-level contribution calculation
• EPF Form C copy or electronic return file
• ETF remittance form copy or file and supporting schedule
• payment receipt, bank acknowledgement or online reference
• reviewer sign-off and payment approval

Keep a pack for every wage month, even with no correction.

Correction and inspection file

• underpayment or overpayment analysis
• surcharge notices
• amended member details
• letters to the EPF Department or the ETF Board
• internal approval for revised submissions
• evidence that the corrected file was accepted

Give corrections their own register and link each back to the original month.

3) Build a consistent monthly pack

The best monthly packs look the same every month. Each should show:

1. final approved payroll figures
2. employee and employer contributions by employee
3. the file actually submitted to EPF or ETF
4. payment proof
5. reviewer sign-off
6. where the final pack is archived

If you file on paper, keep the exact Form C or remittance form used that month. If you file electronically, keep the exported data file, the upload reference and the payment confirmation together. Employers with 50 or more employees must file EPF returns electronically [2], and employers with 15 or more must pay ETF and file ETF returns electronically from July 2026 contributions [3].

4) Record lifecycle events straight away

Most payroll mismatches start when joiners, leavers, unpaid leave or NIC changes are recorded late. Update the records the same week:

• new joiners: assign the member number, capture the NIC, record the first contribution month. A new employee goes on the Form C for the month of recruitment, with details as on the NIC [2]
• resignations or terminations: record the final wage month and final contribution
• unpaid leave or suspension: note why the contribution base changed
• NIC or name corrections: keep the before and after record and the submission evidence
• internal transfers: confirm the employee file and cost-centre coding still match the payment data

The EPF Department is re-registering all members using their NIC details [4]. When a detail changes, keep the correction request and the confirmed update, not only the final clean record.

5) Set a retention policy

We found no retention period stated for EPF or ETF records in the sources we checked. Set an internal policy and write it down. A defensible model:

• employer standing file: for as long as the entity is active
• employee files: through employment and for a defined period after exit
• monthly contribution packs: a complete month-by-month archive for at least seven years, as an internal policy rather than a legal rule
• correction and inspection files: until the issue is fully closed, even beyond the normal period

Do not destroy any file still connected to an employee dispute, surcharge notice or unresolved member balance. EPF dues are not subject to the Prescription Ordinance (EPF Act s.17(3)), so old months can still be raised [5].

Digital records. Scanned payrolls and digital Form C files are easier to defend if they are dated, signed by the responsible officer and readable in their original format. Prefer locked PDFs over editable files, and back up to at least two locations.

6) Prepare for an inspection before one is announced

Run a quarterly readiness review and confirm:

• every wage month has a complete pack
• payroll totals agree to payment totals
• member numbers were not reused or miskeyed
• NIC corrections were documented and resubmitted where needed
• correction items have owners and due dates
• payment references can be matched to the filed month within minutes

What to have ready when the Labour Department asks:

• monthly payroll registers
• the Form C or electronic return for each payroll month
• payment receipts matching each Form C
• an employee register with joining date, NIC and status
• for leavers: the date of the last contribution and proof it was paid in full
• proof of contributions for new joiners from their first month

Gaps that recur:

1. A missing Form C for a month, even where payment was on time
2. A Form C employee count that differs from the payroll register for the same month
3. Allowances that are really part of pay left out of the EPF base
4. Probationers left out of EPF for their first months. EPF covers a person employed "in any capacity" [5], and an employer with even one employee must contribute [4]

Late contributions found at inspection carry the statutory surcharge, from 5 percent up to 50 percent depending on how late each month is (EPF s.16, ETF s.27) [5] [6]. Complete records are the best way to show what was paid and when.

7) What a good record set looks like

In the first 15 minutes of a review you should be able to show:

• the employer standing file
• the latest three monthly packs
• one employee file for a joiner
• one employee file for a leaver
• the correction register, if any month was amended

8) Five failures that repeat

• spreadsheets shared by email with no version control
• revised files with no dated approval trail
• no link between payroll totals and payment references
• member-number or NIC corrections handled verbally instead of in writing
• monthly packs in personal drives rather than a controlled archive

These are governance problems. Fix them with ownership, naming standards and fixed archive rules.

PDPA and EPF and ETF employee data

EPF and ETF records hold NIC numbers, salaries and bank details, which are personal data under the Personal Data Protection Act No. 9 of 2022. The core duties have not started yet. The start date of 18 March 2025 was withdrawn by Gazette 2427/34 [7], and Gazette 2498/16 of 22 July 2026 brings Part I (processing of personal data) and Part III (controllers and processors) into force on 1 January 2027 [8]. The Personal Data Protection (Amendment) Act No. 22 of 2025 requires controllers to answer data subject requests within one month, extendable to three, free of charge, once Part II of the Act is in operation (no date has been appointed yet), and allows a Data Protection Officer to be an outside party [9].

Before 1 January 2027:

• keep EPF and ETF records in access-controlled systems, with write access limited to payroll and finance staff and access logged
• set the retention policy above and delete records securely when it ends and no dispute is open
• if a payroll provider handles your staff data, put a processor contract in place that covers retention and deletion
• prepare to answer an employee's access request within one month, once Part II of the Act is in operation

Our PDPA checklist for employers covers the wider obligations.

9) Clean records make month-end easier

Good records are the difference between a short review and a three-day document hunt. Use the EPF calculator to check the contribution base before the next close. For payment timing and submission flow, see the EPF and ETF monthly payment procedures guide. If you are building your first payroll, add the payroll setup checklist for new employers, and the labour law guide for employers so the labour file and payroll file do not diverge.

Talk to us. If you want your EPF and ETF records checked before an inspection or before the PDPA start date, our payroll team can go through them with you; book a consultation at our contact page.

This guide is general information on the law as at 15 October 2026 and is not advice on your specific situation.

References

1. Employees' Trust Fund Board. Payment of contributions web page. https://etfb.lk/payment-of-contributions/ . Primary. Accessed 15 October 2026.

1. EPF Department, Central Bank of Sri Lanka. Remitting contributions web page: Form C, e-returns, member numbers. https://epf.lk/?p=171 . Primary. Accessed 15 October 2026.

1. Employees' Trust Fund Board. Notice: mandatory electronic payment of contributions (April 2026), citing Gazette 2311/39. https://etfb.lk/wp-content/uploads/2026/04/NOTICE-Mandatory-Electronic-Payment-English.pdf . Primary. Accessed 15 October 2026.

1. EPF Department, Central Bank of Sri Lanka. Employer registration and member re-registration web page. https://epf.lk/?p=163 . Primary. Accessed 15 October 2026.

1. Central Bank of Sri Lanka. Employees' Provident Fund Act, No. 15 of 1958 (reprint), ss.16, 17(3) and 47. https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/acts/en/epf_act.pdf . Primary. Accessed 15 October 2026.

1. Employees' Trust Fund Board. Employees' Trust Fund Act, No. 46 of 1980, s.27. https://etfb.lk/wp-content/uploads/2021/03/ETF-Act.pdf . Primary. Accessed 15 October 2026.

1. Department of Government Printing. Gazette Extraordinary No. 2427/34 of 14 March 2025, PDPA commencement order. https://documents.gov.lk/view/extra-gazettes/2025/3/2427-34_E.pdf . Primary. Accessed 15 October 2026.

1. Department of Government Printing. Gazette Extraordinary No. 2498/16 of 22 July 2026, appointing 1 January 2027 for PDPA ss.2 and 3 and Parts I and III. https://documents.gov.lk/view/egz/2026/7/2498-16_E.pdf . Primary. Accessed 15 October 2026.

1. Parliament of Sri Lanka. Personal Data Protection (Amendment) Act, No. 22 of 2025. https://dpa.gov.lk/acts/22-2025_E_251104_201549.pdf . Primary. Accessed 15 October 2026.