Compliance Calendar 2026: Build One Source of Truth for Statutory Deadlines

Most late-filing penalties don't come from a business not knowing the rules. They come from the rules living in five different places at once — a note in someone's phone, a WhatsApp reminder from the accountant, a mental note the finance officer swears they had, and a sticky note on a monitor that got thrown away during a desk clean-up. PAYE is due one week, NSSF another, SHIF somewhere in between, VAT a week after that. Nobody owns the whole picture, so when one person is on leave, or the KRA portal has a bad day, or payroll runs late, something slips through — quietly, until the penalty notice arrives.

The fix isn't a better memory. It's a single, shared, boring document that every statutory deadline lives in, that more than one person can see, and that gets checked off — not just remembered. This article walks through what that looks like in practice for a Kenyan business handling PAYE, NSSF, SHIF, and VAT.

Before you rely on any date in this article, confirm it. KRA, SHA, and NSSF periodically review filing rules, and actual due dates shift around weekends and public holidays. Treat the figures below as the general long-standing pattern, not this year's confirmed calendar. Check KRA iTax, the SHA/SHIF portal, and NSSF's official communications directly before you file, and build that verification step into your own calendar rather than treating this post as the final word.

The real problem: fragmentation, not ignorance

Ask any finance officer in Nairobi when PAYE is due and they'll tell you, roughly, without hesitating. The compliance knowledge in Kenyan businesses is usually fine. What's missing is a system that holds all four obligations — PAYE, NSSF, SHIF, VAT — in one place, with one view of what's coming up, what's been filed, and what's still open.

When deadlines live only in individual memory, three predictable things happen. First, redundancy disappears — if the one person who "just knows" the dates is out sick or leaves the company, the knowledge leaves with them. Second, there's no shared visibility, so nobody can glance at a single source and confirm "yes, everything statutory this month is filed." Third, and most dangerous, there's no record of who was supposed to act, which means when something is missed, the conversation becomes "I thought you filed that" instead of a quick fix.

A compliance calendar solves this not by teaching anyone something new, but by taking obligations out of people's heads and putting them somewhere shared, checkable, and permanent.

The monthly obligations, at a glance

Here is the general pattern for the four statutory obligations most Kenyan employers deal with every month. Cadence and the broad due-date pattern are stable and long-standing; the exact date for any given month can move for weekends, holidays, or rule changes, so treat this table as a starting template, not a substitute for checking the official portals each month.

Notice the pattern: PAYE, NSSF, and SHIF cluster around the same date early in the month, and VAT falls later. That clustering is itself useful — it means your calendar really only needs two "checkpoints" a month, not four scattered ones, as long as you build it to show all four obligations against those checkpoints.

Building a compliance calendar you'll actually maintain

You don't need specialised software to do this well. A shared Google Sheet, an Excel file on a shared drive, or a shared calendar with recurring events all work, provided everyone who needs to see it has access and it's treated as the single source of truth — not one of several competing reminder systems.

At minimum, each row or entry should capture:

• The obligation — PAYE, NSSF, SHIF, VAT, and eventually others (more on that below).
• Cadence — monthly, annual, or whatever applies.
• General due date — the date pattern from the table above, flagged for reconfirmation each period.
• Owner — the named person responsible for actually filing it.
• Verifier — the named person who confirms it was filed, separate from the act of filing itself.
• Confirmation location — where the filing receipt, acknowledgement, or payment confirmation gets saved once submission is done, so there's a record beyond someone's inbox.

That last point matters more than it sounds. A filing that happened but left no trace is almost as risky as one that didn't happen — if a dispute or audit comes up later, "we filed it" needs to be backed by a saved receipt, not a recollection.

Build in buffer time — don't file on the deadline

Treat the actual statutory deadline as the point of failure, not the target. A sensible internal rule is to file 2–3 days before the real due date, every time, as standard practice rather than an exception. This buffer absorbs the things that go wrong in the last 48 hours: the iTax or SHA portal being slow or down under end-of-window load, a bank transfer confirmation that takes a day to clear, a payroll figure that needs a last-minute correction, or someone being unexpectedly out of office.

In practice this means your internal "due date" in the compliance calendar should already be a few days earlier than the statutory one. That way, even if something does slip on your internal date, you still have room before the real deadline — the buffer is a second chance, not a rounding error.

Assign clear ownership — one filer, one verifier

Every obligation on the calendar needs exactly one named person accountable for filing it, and one named person — the same person or a different one — responsible for confirming it actually happened. Vague ownership ("the finance team handles this") is where things fall apart, because a team isn't accountable, a person is.

Separating the filer and verifier roles (even loosely, even if it's a five-minute check) catches the single most common failure mode in compliance work: everyone assumed someone else had it covered. If the same person always does both jobs, at minimum have them tick the calendar and file the confirmation immediately after filing — the discipline of writing it down closes most of the gap on its own.

Build an escalation habit, not just a calendar entry

A calendar tells you what's due. It doesn't, by itself, stop a deadline from being missed. You need a simple, understood rule for what happens the moment something looks at risk — not after it's already late.

A workable version: if an obligation is not marked filed by its internal buffer date, the verifier escalates immediately to whoever manages compliance for the business — a director, the finance lead, or an external accountant — rather than waiting to see if it resolves itself. The habit to build is escalate early, escalate small. A two-line message the day the buffer date passes ("PAYE hasn't been marked filed yet, checking now") costs nothing. Discovering the same thing three days after the statutory deadline costs a penalty and, often, interest.

Extend it beyond the monthly four

PAYE, NSSF, SHIF, and VAT are the recurring monthly backbone for most employers, but they're not the whole compliance picture. The same single source of truth should also hold:

• Annual obligations, such as Income Tax returns and any other yearly filings that apply to your business structure.
• Licenses and permits specific to your business — a single business permit, health certificates, sector-specific licenses — each with its own renewal cycle.
• Any other periodic statutory or regulatory requirement that applies to your industry, even if it only comes up once a year or once every few years.

The value of the calendar comes from it being the place everything statutory lives, not one of several. The moment a second, competing tracker exists — a licenses spreadsheet nobody else sees, a separate reminder just for VAT — you've recreated the original fragmentation problem in a smaller form.

The point isn't the dates — it's the system

Nobody needs to memorise that PAYE is due around the 9th and VAT around the 20th. What a business actually needs is a shared, living record that survives someone being on leave, someone leaving the company, or a busy month where three other things went wrong at the same time. Build the calendar once, assign the owners and verifiers, add the buffer days, and make escalation the default response to risk rather than the exception. Do that, and statutory compliance stops being a thing one person carries in their head — it becomes a process the business runs, whoever happens to be at their desk that week.