Running a Portuguese Lda: the complete compliance checklist

This guide serves small Ldas on organized accounting, including single-member Ldas (Unipessoais por Quotas). It does not replace the specific analysis of a certified accountant or a lawyer; it exists to give the overall view that rarely fits in a single conversation.

1. Corporate

The core of what defines the company: articles of association, corporate bodies, members, management, registrations.

• Articles of association current and versioned (versioning is best practice; having the in-force version is mandatory). The founding contract. Every amendment must be approved by the members (with the majority the articles and the CSC require), reduced to writing and registered at the Commercial Registry. The consolidated in-force version can be obtained via the specific Certidão Permanente modality that covers the updated articles of association (see official modalities and costs); the plain “registration certificate” modality does not include them. See the articles-of-association guide for structure and amendments.
• Minutes book up to date. Members’ resolutions have to be recorded in minutes (or an equivalent document, such as a unanimous written resolution under article 54 of the CSC). Missing minutes at a sensitive moment (share transfer, investor entry, articles amendment) can create blockers. The annual accounts-approval resolution is the minimum each year; article 263(2) of the CSC waives the standalone resolution when every member is also a manager and all of them sign, without reservations, the management report, the accounts and the profit-allocation proposal (subject to the statutory-audit exceptions).
• Certidão Permanente available when needed. An IRN product that serves as public proof of the company’s official data (name, NIF, registered office, share capital, management) and, in the appropriate modality, of the consolidated in-force articles of association. There are separate certificate products (registration certificate, registration with documents, updated articles) and subscription periods of 1 to 4 years (see the official guidance). (Useful operational practice, not an unconditional ongoing compliance duty): keeping an active Certidão Permanente saves friction when a bank, a client or the accountant asks for the company’s official data. See the Certidão Permanente guide for modalities and costs.
• RCBE declared or kept up to date. The Central Beneficial-Owner Register has to be declared and kept up to date. Under the Portuguese Justice Portal’s official rule: (i) changes to the beneficial owner must be declared within 30 days; (ii) the annual confirmation is due by 31 December, except where the entity has already updated the RCBE during the same calendar year (in which case the standalone annual confirmation is waived), and can also be handled together with the IES when there is nothing to report. See the RCBE guide for the procedure and the RCBE deadlines and fines guide for the penalty regime.
• Management formally designated. The managers have to be identified in the Certidão Permanente, with their designation reflected in minutes (or in the articles themselves). The binding form (single signature, joint, with limits) has to be clear. See the guide on capital, members and management for the detail.

Practical signal that this domain is in order: you can answer, in seconds and with the document in hand, “what is the current version of the articles?”, “who are the managers and how do they sign?”, “when was the last set of minutes?”, “is the RCBE up to date?“.

2. Tax

What the Portuguese tax authority (AT) expects from a Portuguese Lda on organized accounting, on the IRC, VAT and Tributação Autónoma sides.

• Certified Accountant (Contabilista Certificado, CC) appointed. A Portuguese Lda on organized accounting must have a certified accountant responsible for the bookkeeping, under articles 9 and 10 of the EOCC and article 123 of the CIRC. The CC signs the tax filings that legally require their intervention (Modelo 22, IES, among others) and is technically accountable for the bookkeeping. Not optional.
• Modelo 22 (annual IRC return) filed each year. The statutory deadline is the end of May; the Modelo 22 for the 2025 accounting period (filed in 2026) benefited from an extension to 30 June 2026 published by the AT (see the AT 2026 declarative calendar); extensions in future years depend on the AT’s own dispatch. Late filing triggers its own fine for the declarative infraction (and may cause compensatory interest on the tax if it delays the assessment, under LGT article 35); late payment of the assessed tax triggers late-payment interest (juros de mora) under LGT article 44 and a separate fine for non-payment. See the Modelo 22 and IES guide for the detail.
• IRC payments on account (PPC). As a rule, three: in July, September and December, computed on the previous year’s IRC. Under article 107 of the CIRC, the third PPC can be omitted or reduced when the taxpayer verifies that the amount already paid equals or exceeds the tax that will be due; if that verification turns out to be wrong there are consequences (compensatory interest on the difference, and a fine if the difference exceeds a specified threshold). The decision belongs to the company, with technical support from the CC.
• IES filed annually. Standard deadline 15 July. Consolidates tax, accounting, statistical and Commercial Registry filings into a single submission.
• Correct VAT regime and returns filed. Under article 41 of the CIVA: monthly regime is mandatory for turnover greater than or equal to €650,000 in the previous civil year; quarterly regime applies by default for turnover below that threshold, with an opt-in to monthly filing available to the taxpayer. Each regime has its own deadlines. See the VAT monthly vs quarterly guide for the detail.
• Tributação Autónoma anticipated. Passenger vehicles, entertainment expenses, per diems, certain bonuses, payments to offshore jurisdictions: article 88 of the CIRC provides for specific autonomous taxations, paid with the Modelo 22. See the deductible expenses and Tributação Autónoma guide for the full map, with the 2026 rates.
• Certified invoicing. Invoices issued by the company (documenting operations carried out for its clients) must be produced by AT-certified invoicing software, under article 4 of Decree-Law 28/2019 for taxpayers on organized accounting. Moloni is one certified program; Limitada surfaces Moloni invoicing inside the same interface, and has its own system in development with certification in progress.

Practical signal: the accountant closes each month without stacks of missing documents, and the tax calendar is being met without surprises.

3. Labour and social security

A Portuguese Lda has Social Security and AT obligations whenever it pays remuneration, whether to employees or to the partner-manager. A Portuguese Lda paying no remuneration has, in most cases, reduced obligations here, but specific situations still need to be checked.

• Partner-manager’s Social Security regime. A partner-manager who exercises remunerated activity in the company is generally covered by the MOE regime (Members of Corporate Bodies) of Social Security, with a minimum contribution base (indexed to the IAS). The classification follows the law (nature of the activity and of the remuneration), not free choice. A non-remunerated partner-manager can fall outside the MOE regime in specific cases, for example when they simultaneously work as an employee elsewhere with employment income greater than 1 IAS (under article 64(1)(a) of the Contributory Code), or under the separate rule for pensioners. The verification depends on the concrete facts and should be made with the accountant (see the official MOE guide from Social Security). See also the guide on capital, members and management for the detail.
• DMR-AT (Monthly Remuneration Return to the AT). Under article 119 of the CIRS and the official DMR-AT instructions, the DMR-AT reports Category A income (employment income) paid or made available to Portuguese tax residents, including where it is exempt, not taxable, or not actually subject to withholding. It is monthly, due by day 10 of the following month. Employment income paid to non-residents does not go in the DMR-AT: it is reported on Modelo 30, by the end of the second month following the payment or availability, even where no withholding applies. Other income with withholding (for example, professional fees, rents) has its own reporting channel, typically annual, and does not go through the DMR-AT. The DMR-AT reports the income paid and the withholding done; it is not itself the remittance of the withheld tax. Paying the IRS withholding into the State’s coffers has its own deadline (as a rule, day 20 of the month following the withholding).
• Social Security remuneration declaration. When there is remuneration, a monthly declaration is filed with Social Security, with its own deadlines and content (separate from the DMR-AT). The payment of contributions follows its own deadline.
• Employees registered where applicable. Prior admission notice to Social Security, workplace-accident insurance, admission medical exam where required, work schedules and holiday charts, ACT notification where applicable. On written form: article 110 of the Labour Code only requires a written contract for certain types (fixed-term, part-time, telework, contracts with foreign workers, among others); other employment contracts can, in principle, be concluded without written form, though reducing them to writing is best practice for evidentiary purposes.
• Complaints book in both formats where the sector requires it (retail, services to the public). Covered suppliers and service providers must keep the physical book at each public-facing establishment and, in addition, the electronic format; the electronic format alone is only enough for operators with no physical public-facing establishment.

Practical signal: the monthly payroll closes without surprises, and the DMR-AT and the Social Security declaration go out within their respective deadlines.

4. GDPR and data protection

Applicable to even the smallest Portuguese Lda, provided it processes personal data (of members, employees, clients, suppliers, website visitors). The framework is Regulation (EU) 2016/679 (GDPR) and Law 58/2019, which implements it in Portugal. Important upfront: the GDPR distinguishes controller from processor, and that classification depends on the actual role the entity plays, not on the mere fact that it receives data (see the EDPB guidelines on controller/processor).

• Clear lawful basis for each processing activity. Consent, contract performance, legal obligation, legitimate interest: each personal-data processing has to rest on one of the article 6 GDPR bases.
• Information provided to data subjects at the appropriate time. Articles 13 and 14 of the GDPR require the controller to inform subjects at the moment of collection (or as soon as possible, for indirect collection). A published website privacy policy is the most common way to meet the duty for website-originated processing, but compliance can take different forms (notice inside a form, email communication, clause inside an employment contract) depending on the collection source. (Best practice, with nuance): keeping a public, current privacy policy remains the most efficient route for website-originated processing.
• Record of processing activities (ROPA). Article 30(5) of the GDPR provides an exemption for controllers with fewer than 250 employees, but with exceptions that are broad in practice (where the processing is likely to result in a risk to rights and freedoms, where it is not occasional, or where it involves special-category data or data on criminal convictions). A Portuguese Lda with employees and routine processing (HR, clients, suppliers) is typically subject to the obligation. The ROPA documents purposes, data categories, recipients, retention periods; it does not need to be published, but has to be ready for the CNPD.
• Data Protection Officer (DPO) where required. Not mandatory for every company. Under article 37(1) GDPR, designation is required where the core activity of the controller or processor consists, in the alternative, of: (i) processing operations which require regular and systematic monitoring of data subjects on a large scale; or (ii) large-scale processing of special categories of data (art. 9) or of data relating to criminal convictions (art. 10). These are two independent branches: the second does not require regular and systematic monitoring. The mere existence of monitoring systems (office cameras, for example) is not, in itself, enough to trigger the first branch. Confirm case by case.
• Contracts with processors in place where applicable. Where third parties process personal data on the company’s behalf and under its instructions (article 4(8) GDPR definition), there is a processor relationship and article 28 requires a written contract with the minimum content set out there. Not every email, hosting, invoicing or CRM provider is automatically a processor: the classification depends on the factual role (for example, an email provider may be a processor for corporate mailboxes but an independent controller for its own functions such as spam filtering). Review contract by contract.
• Breach documentation and notification thresholds. All personal-data breaches must be documented internally, regardless of severity (art. 33(5)). Notification to the CNPD is required when the breach is likely to result in a risk to the rights and freedoms of subjects; it must be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach (art. 33(1)). A later notification must be accompanied by reasons for the delay. Notification to the subjects is only required when the breach is likely to result in a high risk (art. 34). Having a written procedure helps to decide and act in time.
• Retention limited to what is necessary. Former employees’ records, inactive clients, rejected CVs: each category has a reasonable retention period, beyond which the data should be deleted or anonymized.

Practical signal: clear information reaches subjects at the right moment, contracts with suppliers that actually act as processors include an article 28 clause, and the ROPA exists as a file whenever the company is not exempt.

5. Contracts and record-keeping

What the company signs and what it keeps.

• Essential contracts formalized in writing. Employment contracts, services agreements, leases, supply, NDAs: each type has its own form rules. A purely verbal contract is possible in some categories but makes proof harder.
• Signatures collected and organized. Corporate documents (resolutions, management minutes, contracts between members and the company) sometimes require signatures from all managers or all members. Chasing signatures by email and attaching PDFs to a folder is fragile; a dedicated flow inside a tool that stores the signed version as a new version of the document saves hours during audits. See Limitada’s signature-collection feature.
• Statutory retention periods respected. Accounting records and supporting documents, invoices: the general rule is 10 years, drawn from article 40 of the Portuguese Commercial Code (in the wording given by article 8 of Decree-Law 76-A/2006), article 52 of the CIVA and the mirrored obligations in the CIRC and in Decree-Law 28/2019. Contracts with multi-year effects should be kept for the duration of those effects and the applicable limitation period. For the specific requirements of the invoice archive (integrity, index, backups, EU location) and the comparison between email, a shared folder and a dedicated app, see the guide on where to keep your company invoices.
• Versioning of corporate documents (best practice). Articles of association, minutes, RCBE: each amendment is a new version. Keeping only the current version is not itself illegal, but it is not enough to reconstruct the corporate history in a dispute or due diligence.
• Physical and digital archive coordinated (best practice). Certain items (contracts with seals, powers of attorney, notarial deeds) exist on paper; others were born digital. An integrated archive (with cross-references between the two) avoids hunting for items across three different places.

Practical signal (best practice): you can produce the current version of contract X, with all its amendments and signatures, in under five minutes.

6. Banking

The most frequent point of contact between the company and the institutional “outside world”.

• Bank account in the company’s name, separate from personal finances. Beyond the principle of the Lda’s asset autonomy, article 63-C of the LGT expressly requires IRC taxpayers to maintain at least one bank account used exclusively for receipts and payments related to the business activity (including shareholder loans and other member inflows or outflows). Mixing personal and company movements in this account creates accounting, tax and, ultimately, partner-manager liability problems.
• Beneficial owner disclosed to the bank. Under the Anti-Money-Laundering Law (Law 83/2017), the bank has to identify the beneficial owner of the corporate client. Changes must be communicated when they occur.
• Company documentation available for the bank on request. Certidão Permanente, RCBE code, articles of association, management-designation minutes, manager identification documents: the bank may request these in periodic KYC updates.
• Bank movements reconciled with the accounting (best practice). Every bank movement should have a documentary counterpart (invoice, receipt, justification). Monthly reconciliation reduces the risk of “undocumented movements” surfacing at year-end.
• Cards and access with minimum controls (best practice). Debit or credit cards issued in the company’s name, restricted to business expenses, statements reviewed. Personal use of a company card (or the reverse) is a sign of a poorly defined boundary between spheres.

Practical signal: the boundaries between “company money” and “personal money” are clear; the bank has everything it needs not to block requests over overdue KYC.

7. Accounting and software

The legal, accounting and tax requirements that apply to organized accounting (SNC, EOCC, Commercial Code, obligations set by the AT).

• Organized accounting with a certified accountant on record. Already flagged in the tax section. The obligation and the CC’s responsibilities sit in articles 9 and 10 of the Portuguese Certified Accountants Statute (EOCC) and in article 123 of the CIRC.
• AT-certified invoicing software. Invoices issued by the company produced by certified software under article 4 of Decree-Law 28/2019; the certificate number appears on the invoice.
• Monthly communication of invoice data to the AT. The data of invoices issued each month has to be communicated to the AT, as a rule by day 5 of the following month. The transmission can be done through several AT-accepted mechanisms (SAF-T (PT) invoicing file, webservice, manual entry on the portal, among others); the SAF-T invoicing file is one of them, not the only one. See the AT’s official FAQ on invoice communication.
• Accounting SAF-T (PT): only from 2027 periods onwards. Submitting the accounting SAF-T with the IES is not yet a 2026 obligation; the new regime applies to accounting periods starting on or after 1 January 2027 (for submission in 2028). See the OCC guidance for the 2026 IES.
• Accounting records organized under the SNC. Decree-Law 76-A/2006 abolished the previously mandatory books (journal, ledger, inventory, balances, copier). What organized accounting requires today is the systematic recording of operations in the accounting system (SNC), with the ability to produce the trial balances, tables and financial statements the law requires. See Decree-Law 76-A/2006.
• Supporting-document archive. Purchase and sales invoices, receipts, contracts: kept for the statutory retention period of 10 years (article 40 of the Commercial Code in the wording given by article 8 of Decree-Law 76-A/2006, article 52 of the CIVA and the mirrored obligations in the CIRC), with fast lookup during audits. Digital retention of paper originals is admissible provided the digitisation, authenticity, integrity and readability requirements set out in Decree-Law 28/2019 are met; in that case the paper originals can be destroyed (with narrow exceptions listed in the decree).
• Disciplined monthly close (best practice, not a legal obligation). Closing the accounting month by mid-following-month, with every document categorized, VAT separated by rate and bank reconciliation done, is the habit that prevents discovering problems six months later. Tools like Limitada’s expenses feature extract the data from receipts and invoices and reconcile with the bank statement, cutting the time of that monthly close.

Practical signal: the month closes by mid-following-month, with no “missing documents” pending for more than 30 days.

How to use this checklist

Three practical ways:

1. Once a year, in the week before the annual accounts approval. Walking through the seven domains serves as preparation for the annual members’ meeting and as a sanity check before the IES.
2. When a new member, accountant or investor comes in. Producing the list serves to answer due diligence without surprises.
3. As onboarding, when setting up a new Lda. In the first three months, marking each item as “in order” builds a solid baseline.

For the calendar side (what to do each month of the year), the guide on the 2026 calendar of obligations for a Portuguese Lda is the natural complement to this checklist. This guide answers “what has to be in order at all times”; the other answers “what has to be done this month”.

This article is for information only. The specific obligations applicable to your company depend on sector, size, and specific circumstances; they should be confirmed with the certified accountant and, on strictly legal matters, with a lawyer.