ED21 - Employee Onboarding: Company Number, Social Insurance Registration, ELSTER

Problem

An entrepreneur hires their first employee and faces a thicket of obligations that apply from the first employee onward:

• "What do I need to register?" - social insurance registration, ELStAM retrieval, DEÜV notification, wage tax registration - but in what order?
• Company number available, but not in the repo - the SV company number (see ED17) is stored in the payroll software, but not in the repo - if the account is deleted, it is gone
• Forgot the ELStAM retrieval - the electronic wage tax withholding characteristics must be retrieved before the first payroll run
  • but many entrepreneurs do not know this
• Late DEÜV notification - registration with the health insurance fund (DEÜV reason 10) must take place within 6 weeks after commencement of employment
  • but nobody monitors the deadline
• Overlooked immediate notification - in certain industries (construction, restaurants, cleaning, security, hairdressing, transport, etc.), the commencement of employment must be reported to the DRV before the employee starts working - anyone who overlooks this risks a fine and suspicion of illegal work
• No payroll software available - without ITSG-certified payroll software, the reporting channel is missing - the SV reporting portal (sv-meldeportal.de) offers a remedy, but is unknown to many
• No master data in the repo - the employee master data (§ 4 LStDV) are stored in the payroll software, but not in the repo - not GoBD-compliant
• No deadline monitoring - the onboarding deadlines (social insurance registration, DEÜV, ELStAM) are not centrally monitored

Trigger B - 1st employee: These obligations arise with the first employee - they build on the organizational foundation (Part II) and the authority identifiers (Part III).

Core Statement

Employee onboarding in the Git repo means:

1. Master data as a JSON artifact - all § 4 LStDV mandatory fields in the repo, with a sphere tag and V7GUID:uuidV7
2. Social insurance registration as evidence with a sidecar - DEÜV notification with reason 10, receipt with SHA-256
3. Industry check § 28a Abs. 4 SGB IV - check for each employee whether an immediate notification obligation exists (construction, hospitality, cleaning, security, etc.)
4. SV-Meldeportal as an emergency channel - without payroll software, submit notifications directly via sv-meldeportal.de, receipt as evidence with a sidecar
5. ELStAM retrieval documented - retrieval before the first payroll run, result in the repo
6. Deadline check for onboarding steps - DEÜV (6 weeks), immediate notification (before commencement), ELStAM (before payroll run), LStA (10th of the following month)
7. Onboarding checklist as a Git artifact - structured step-by-step list with status tracking

Compliance by Design: Onboarding is not carried out ad hoc, but is documented through structured mandatory fields, evidence with sidecars and a deadline check.

Onboarding Timeline

Master Data as a JSON Artifact (§ 4 LStDV)

Master Data JSON

{
  "$schema": "https://gitcover.org/schemas/employee-stammdaten-1.0.schema.json",
  "V7GUID": "<V7GUID-Class-aus-Registry>",
  "docUid": "<uuidV7-Object-mit-vorgegebener-Zeitmarke>",
  "author": "E1",
  "role": "Lohnverantwortlicher",
  "tenant": "ORG-1",
  "sphere": "ideell",
  "source": "E1",
  "source_sha256": "<SHA-256-des-Anstellungsvertrags>",
  "tags": ["mitarbeiter", "stammdaten", "§4-lstdv", "onboarding"],
  "mitarbeiter": {
    "name": "Mustermann, Erich",
    "geburtsdatum": "1985-08-04",
    "anschrift": "<ANSCHRIFT>",
    "steuer_idnr": "<STNR-11-STELLIG>",
    "sv_nummer": "<SV-NR-12-STELLIG>",
    "krankenkasse": "AOK Hessen",
    "ik_nummer": "<IK>",
    "eintrittsdatum": "2026-09-01",
    "beschaeftigungsart": "Geschaeftsfuehrer",
    "taetigkeitsschluessel": "62113",
    "personengruppe_deuev": "101",
    "beitragsgruppenschluessel": "0320",
    "aktivrente_flag": true,
    "bruttolohn_monat": 2000.00
  }
}

Note: The uuidV7 is the DocID of the entry. The Composite Key V7GUID:uuidV7 is used for storage organization and DB queries. The mitarbeiter object contains all § 4 LStDV mandatory fields. The aktivrente_flag documents the early retirement pension (§ 3 Nr. 21 EStG) - see ED16 (DRV status determination) and ED23 (payroll).

ELStAM Retrieval (§ 39e EStG)

Important - ELStAM before payroll run: The ELStAM retrieval must take place before the first payroll run. Without ELStAM data, no wage tax may be calculated (§ 39e EStG). The retrieval is documented in the repo - in the event of an error (no record), the retrieval attempt is logged as a repo event (evidence "attempted", see ED14 Interface Error Logging).

DEÜV Registration (Reason 10)

Practical example: The managing director (E1) starts at the KMU on 01.09.2026. The DEÜV registration (reason 10) must be completed by approximately 13.10.2026 (6 weeks after the month of entry). The health insurance fund's receipt is stored in the repo as evidence with a sidecar. The deadline check contains the entry "DEÜV reason 10 - 131006".

Immediate Notification to Social Insurance (§ 28a Abs. 4 SGB IV)

In addition to the regular DEÜV registration (reason 10, 6-week deadline), there is an immediate notification obligation for certain industries: The date on which an employment relationship begins must be reported to the pension insurance data center no later than when the employment relationship commences - that is, before or on the first working day, not six weeks later.

Industries Subject to the Immediate Notification Obligation

§ 28a Abs. 4 SGB IV lists 11 economic sectors in which immediate notification is mandatory:

Why these industries? These economic sectors have an increased risk of illegal work, sham self-employment and contribution avoidance. Immediate notification enables the DRV to check promptly whether an employment relationship has been correctly registered - while the employee is already working.

Legal Consequences of Non-submission

Immediate notification is not a registration under § 28a Abs. 1 SGB IV (regular DEÜV registration). It does not replace this, but is an additional reporting obligation. If it is not submitted, the following consequences are possible:

• Retroactive assessment of contributions with interest
• Estimation of the remuneration by the collection agency
• Sanctions under § 111 SGB IV (fine up to 5,000 EUR)
• Suspicion of illegal work with a reporting obligation to customs/financial control

Content of the Immediate Notification

Immediate notification contains reduced information (less than the complete DEÜV registration):

The notification is stored in the master record file under § 150 Abs. 1 und 2 SGB VI

• it serves as an early-warning system for the DRV.

Decision: Is My Company Affected?

Practical example: The KMU (software development) is not among the industries under § 28a Abs. 4 SGB IV. For the managing director (E1), no immediate notification must be submitted - the regular DEÜV registration (reason 10) with the 6-week deadline is sufficient. If the KMU were to hire an office cleaner, this would fall under building cleaning services (No. 6) - an immediate notification obligation would be triggered. Industry affiliation must be checked per employment relationship, not per company.

Reporting Without Payroll Software: The SV-Meldeportal

Not every entrepreneur has ITSG-certified payroll software. For small employers (up to approximately 10 employees), self-employed persons and exceptional cases, social insurance provides the SV-Meldeportal at sv-meldeportal.de as a system-tested form-filling tool - the legal successor to sv.net (service discontinued 30.06.2024).

Legal Basis

§ 95a SGB IV requires social insurance institutions to continuously provide a generally accessible, electronically supported and system-tested form-filling tool for data exchange under SGB IV and the Aufwendungsausgleichsgesetz. The SV-Meldeportal is this form-filling tool - it performs no calculations (it is not a competitor to professional payroll software), but merely supports the capture and transmission of notifications.

Requirements for Use

BundID account exception: Since 2024, a BundID account is alternatively permitted for foreign companies, self-employed persons and employees who use the portal exclusively for A1 certificates.

Registration and Reporting Procedure

Registration takes place once, independently of the term. In detail:

1. Apply for an ELSTER organization certificate - via Mein Unternehmenskonto (info.mein-unternehmenskonto.de); the company's tax number is also required. Each employee can apply for a separate certificate (up to 500 per business account).
2. Start registration in the SV-Meldeportal - authentication with the ELSTER organization certificate. Company data are partially transferred automatically from the ELSTER account.
3. Link the company number - mandatory; reconciliation with the BA's central company number file.
4. Activation code by post - the authorization letter is sent by post to the management. The internal organizational structure hands the activation code to the authorized user.
5. Access the portal - then with the organization certificate.
6. Create notification - DEÜV notifications (reasons 10, 30, 50, 92), contribution notices, A1 certificates, applications.
7. Receive receipt - electronic confirmation from the data acceptance office.
8. Receipt as evidence with sidecar - store in the Git repo (SHA-256, V7GUID:uuidV7, sphere tag).

Costs

Payment by bank transfer or PayPal. Any number of notifications during the term.

Feature Scope

• DEÜV notifications (registration, deregistration, annual notification, immediate notification)
• Contribution notices (SV contribution notice to health insurance fund)
• A1 certificates (EU posting certificate)
• Certificates (e.g., SV certificate for employee)
• Online data storage ("Aktenschrank") - encrypted, retained for 5 years per company number
• Personnel administration with history tracking - basic data, notification data per month
• Client administration - for tax advisers who support multiple AGs

Important for the Git repo: The SV-Meldeportal is a capture and submission tool, not a GoBD-compliant retention facility. The 5-year online data storage does not replace the GoBD retention periods (10 years for evidence, see ED08). The receipts and notification data must additionally be stored in the Git repo with a sidecar.

GitCover Integration

For Git-native compliance, the SV-Meldeportal is an interface system, just like ELSTER (see ED14):

Practical example: The KMU uses ITSG-certified payroll software and therefore does not use the SV-Meldeportal. If the payroll software fails (emergency), the SV-Meldeportal can serve as a backup channel. Registration with an ELSTER organization certificate is already available (for ELSTER LStA, see ED14). The company number is in the repo (ED17). In an emergency, the KMU can manually create immediate notifications or DEÜV registrations - the receipts are stored in the repo as evidence with a sidecar, just like the payroll software receipt.

Note from the preliminary work: The SV notification catalog in E1/agents/ states: "Immediate notifications (reason 20) are not required for GCC, because it is not among the industries under § 28a Abs. 4 SGB IV." This statement is correct for the software industry - but it must be rechecked per employment relationship as soon as employees move into industry-relevant activities (e.g., cleaner, driver).

Onboarding Checklist as a Git Artifact

{
  "$schema": "https://gitcover.org/schemas/onboarding-checklist-1.0.schema.json",
  "V7GUID": "<V7GUID-Class-aus-Registry>",
  "docUid": "<uuidV7-Object-mit-vorgegebener-Zeitmarke>",
  "author": "E1",
  "role": "GF",
  "tenant": "ORG-1",
  "sphere": "ideell",
  "source": "E1",
  "tags": ["onboarding", "checkliste", "mitarbeiter"],
  "mitarbeiter_uuidV7": "<uuidV7-der-Stammdaten>",
  "checkliste": [
    {"schritt": "Vertrag unterschrieben", "status": "done", "beleg_sha256": "<SHA-256>"},
    {"schritt": "Stammdaten erfasst", "status": "done", "beleg_sha256": "<SHA-256>"},
    {"schritt": "Branchen-Check § 28a Abs. 4 SGB IV", "status": "done", "ergebnis": "nicht betroffen"},
    {"schritt": "Sofortmeldung (falls betroffen)", "status": "n/a", "frist": "vor Aufnahme"},
    {"schritt": "ELStAM abgerufen", "status": "done", "beleg_sha256": "<SHA-256>"},
    {"schritt": "DEÜV Grund 10 angemeldet", "status": "pending", "frist": "131006"},
    {"schritt": "KK-Mitgliedschaft bestätigt", "status": "pending", "frist": "300826"},
    {"schritt": "Erster Lohnlauf", "status": "pending", "frist": "300926"},
    {"schritt": "LStA übermittelt", "status": "pending", "frist": "151006"},
    {"schritt": "SV-Beitragsnachweis", "status": "pending", "frist": "271006"}
  ]
}

Note: The uuidV7 is the DocID of the checklist. The Composite Key V7GUID:uuidV7 is used for storage organization and DB queries. The mitarbeiter_uuidV7 field references the employee's master data (cross-reference via uuidV7). Each step has a status (done/pending) and optionally a deadline and an evidence hash.

Risk Leverage

Harness Requirement (Preview)

Derivable from ED21:

The complete requirements list is in Harness-Anforderungen.md.

Sources

• EStG (§ 39e - ELStAM, § 4 LStDV - mandatory fields, § 41a - wage tax registration)
• SGB IV (§ 28a Abs. 1 - DEÜV notifications, § 28a Abs. 4 - immediate notification, § 28i - company number, § 23 - SV contribution notice, § 95a - SV-Meldeportal, § 111 - sanctions)
• SGB VI (§ 150 Abs. 1 und 2 - master record file)
• sv-meldeportal.de - Official SV-Meldeportal of the social insurance institutions
• info.sv-meldeportal.de - Information portal with registration, instructions and FAQ
• info.mein-unternehmenskonto.de - Unified business account (ELSTER)
• gesetze-im-internet.de/sgb_4/__28a.html - § 28a SGB IV full text
• E1/agents/ (anonymized) - SSoT concept with master data and onboarding checklist
• ORG-3/TOP/Employees/E1/40_SV-Meldungen_Katalog.md - Preliminary work on SV notifications, industry check and DEÜV reporting reasons

Source Topology and CDN Reference Links

Note: This mapping of sources, mirror and community hub reflects the current state and may change. Please check the respective canonical source on gitcover.org for the current state.