Before CSR or public money flows: is the implementing agency ready?

Most diligence on implementing agencies starts with a question no document can answer: is this a good organisation? The question a CSR head, or a department routing scheme money through an NGO, must answer is narrower. Can this money lawfully reach this organisation, will it be spent under controls an outsider could rely on, and will anyone be able to tell later what it bought?

The Development Operating System answers in layers: a statutory floor, which is binary, and above it the written systems that turn eligibility into delivery.

The floor, in the order the money depends on it

For CSR, rule 4(1) of the CSR Rules is the gate. An outside organisation can be a company's implementing agency only if it is a registered public trust, a registered society or a section 8 company, holds the income-tax registration and approval, and has a three-year record in similar work¹; section 10(23C) entities were added in 2022². A CSR committee's preference for section 8 companies is its own; the rule does not rank the forms.

The tax gate moved when the Income-tax Act, 2025 came into force on 1 April 2026³. Registration now sits in section 332 and donee approval in section 354^4,5, applied for on Forms 104 and 105, which replace Forms 10A and 10AB^6,7. Rule 4(1) still refers to sections 12A and 80G of the 1961 Act; the book reads those references with the new sections, under which earlier recognitions continue unless they conflict with the new Act³. Regular registration runs for five tax years, or ten where total income stayed within ₹5 crore in each of the two preceding tax years, and renewal is due at least six months before expiry^4,7.

Every implementing agency needs a CSR registration number, generated by e-form CSR-1 on MCA21 and verified by a practising chartered accountant, company secretary or cost accountant^1,8. Since 14 July 2025 the revised form asks an organisation not set up by a company or government for evidence of its three-year record⁹.

Foreign contribution is a separate corridor. It may arrive only in the FCRA Account at the specified State Bank of India branch in New Delhi, may not be transferred to any other person, and administrative expenses may not exceed 20 per cent of the contribution received in the year unless the Central Government approves more¹⁰. Since 22 June 2026, certificates are tied to declared purposes and States, existing registrants must file Form FC-6F within one year, and renewal needs at least ₹10 lakh of foreign contribution used in the last two financial years^11,12. Form FC-4 is due by 31 December, as a nil return if nothing was received¹³. Section 7 means a lead agency cannot pass foreign contribution on to consortium partners¹⁰.

Above the floor: logic, procurement and safeguarding

The logic model. The book's discipline is to state the programme as an if–then–because hypothesis and to mark where delivery ends. Outputs are what the agency counts; outcomes are the changes those outputs are meant to cause. The assumptions under the middle arrows, such as trained staff using the training, are where programmes usually fail. A baseline fielded before launch is what later allows an outcome to be shown, so it belongs in the proposal as a line that cannot be cut.

Two rules help. The 5 per cent ceiling on CSR administrative overheads applies to the company's total CSR expenditure, and the costs of designing, implementing, monitoring and evaluating a project are project costs⁸. And where a company's average CSR obligation over the three preceding years is ₹10 crore or more, each project of ₹1 crore or more is assessed by an independent agency once complete for at least a year⁸; that assessor will look for the baseline. The programme must also sit within a Schedule VII item and clear the rule 2(1)(d) exclusions, such as activities in the company's normal course of business or for its employees' benefit¹⁴.

The procurement ladder. Most government buyers work to the General Financial Rules, 2017: goods up to ₹50,000 on a certificate, a purchase committee up to ₹5 lakh, limited tender up to ₹50 lakh and advertised tender beyond¹⁵. The book's reading is that institutional funders expect an agency to adopt a ladder of the same shape, scaled to its size. A purchase committee of a field coordinator and two people who report to him is not a control, and a maker-checker rule that starts at ₹1 lakh invites invoices of ₹96,000. The book's standard is an outside member on the committee, maker-checker at every amount, and deliveries verified by people outside the delivery chain.

Public money adds a clock. A grant-in-aid under rule 230 of the GFR carries conditions on bank balances, interest and assets; a utilisation certificate in Form GFR 12-A is due within twelve months of the year's close, and the next recurring grant is not released in full until it arrives^16,17.

Safeguarding. Here the floor is statutory, whoever the funder is. Anyone who knows or apprehends that a sexual offence against a child has been or is likely to be committed must report it to the Special Juvenile Police Unit or the local police¹⁸, and the head of an institution who fails to report an offence by a subordinate faces up to a year's imprisonment and a fine¹⁹. An institution housing children in need of care and protection must be registered under section 41 of the Juvenile Justice Act, 2015, whether or not it receives government grants²⁰, and no report or publication may disclose a particular that could identify such a child or a child victim or witness²¹. From 13 May 2027, processing a child's personal data will need verifiable parental consent under rule 10 of the DPDP Rules, 2025, subject to the Fourth Schedule's exemptions²².

Readiness levels as a shared self-assessment

The book's Appendix D turns this into a self-assessment for an agency that receives and spends CSR money: nine dimensions, from legal identity to people, each placed at one of five levels using 72 criteria.

Three rules do the work. Levels are gated: a dimension reaches a level only when every criterion at that level and below is met, the same rule the Transition Pathway Initiative applies to its management-quality staircase²³. The floor overrides: one unmet statutory criterion puts the dimension at L0. And the output is a profile, each dimension reported separately and never summed into one number, because a total lets strength in one place hide a breach in another.

A criterion counts as met only if its evidence can be shown to someone who was not in the room. The owner of the work rates; someone who does not own it challenges every rating of Met. That chair suits a funder: scoring alongside the agency in a half-day workshop, with the diligence pack on the table, gives both the same list of fixes and the agency a 90-day plan. The repairs follow the money: section 332 registration and section 354 approval first, the CSR registration number before the next tranche, FCRA items before the next foreign receipt.

The levels are practitioner-built: the descriptors are the author's, written against the law as stated at 25 September 2026, and have not been validated empirically. Of the three uses Pöppelbuß and Röglinger distinguish for maturity models (describing, prescribing and comparing), these levels serve the first two²⁴. In the book's words, "A self-assigned level is not a registration, an accreditation or a funder's due diligence." No funder should take a level in place of the documents behind it.

This note draws on The Development Operating System: Laws, Frameworks, and the Lifecycle of Impact in India's Development Sector (revised edition, v2.1) by Harshal Kate, in preparation.

Analysis, not legal advice. Law stated as at 25 September 2026.