GST Check: How to Verify a GSTIN Online

A GSTIN (Goods and Services Tax Identification Number) is a 15-character alphanumeric code assigned to every business or entity registered under India’s GST regime[1][2]. Each character position carries a specific meaning.

[1][2]

The 15th character is a check digit calculated from the preceding 14, catching data-entry errors before a search even runs. Most technical explainers describe this as a Mod-36 weighted-checksum calculation; the exact algorithm is a secondary detail for a verification workflow, so treat it as background rather than something you need to calculate by hand[3].

[4]

There’s a second, informal route: the e-way bill portal (ewaybillgst.gov.in) has its own taxpayer-search feature, “Display Assesses Profile,” under its Search tab, which also returns legal name and principal place of business. If a GSTIN doesn’t turn up there, the portal directs users to the main GST portal’s Search Taxpayer tool instead[6].

A status check shows one of three states.

[13][14][15]

Why a status check might turn up a problem

Registrations get suspended for a specific set of reasons: non-filing of returns for six consecutive months by a regular taxpayer, or three consecutive tax periods by a composition taxpayer; a mismatch where GSTR-1 outward-supply figures exceed what’s declared in GSTR-3B for the same period; a declared principal place of business that doesn’t match where the taxpayer actually operates; and discrepancies between e-way bills generated and the corresponding GSTR-3B filings[13][14].

Cancellation is the permanent step beyond suspension. It follows the same non-filing triggers (six consecutive months for a regular taxpayer, three consecutive periods for a composition taxpayer), or applies where the registration was originally obtained through fraud, wilful misstatement, or suppression of material facts[14][15]. Where cancellation was triggered by non-filing specifically, filing all pending returns and clearing dues automatically drops the cancellation proceedings and reverts the status to active, even without a separate response to the show-cause notice[15].

Common reasons a GSTIN search fails

A search can return an error or no useful result because of an incorrectly entered or invalid GSTIN, a search for a GSTIN that’s already been cancelled or is otherwise inactive, captcha problems (case sensitivity, an unreadable or expired image), or portal slowness during high-traffic periods[17].

Generic GSTIN lookups serve individuals, procurement teams, and HR vendor checks as well as regulated financial institutions. For banks, NBFCs, and other regulated entities, verifying a GST number is a written regulatory requirement under RBI’s KYC Master Direction.

RBI’s Master Direction on Know Your Customer states, in its Customer Acceptance Policy provisions: “Where Goods and Services Tax (GST) details are available, the GST number shall be verified from the search/verification facility of the issuing authority”[7]. For sole proprietorship firms specifically, the same Master Direction also lists a CST/VAT/GST certificate as one of the acceptable documents proving business activity for KYC purposes[7]. RBI amended this Master Direction in October 2023, strengthening customer due-diligence and ongoing-monitoring requirements for regulated entities[8].

In practice, GSTIN checks rarely stand alone in a bank, NBFC, or fintech’s onboarding flow. They typically run alongside PAN verification, MCA director and beneficial-ownership data, Udyam registration checks, and business-address validation, as part of broader Know Your Business (KYB) verification[9].

GST data goes beyond identity checks, too. Lenders and fintechs doing MSME lending draw on GSTN filing records as a credit-underwriting signal, what’s often called “flow-based lending”: turnover and cash-flow figures, sales and purchase transaction records, buyer-supplier network breakdowns, state-wise revenue distribution, and filing-consistency status. This gets cross-verified against a borrower’s self-reported financials, alongside credit bureau, bank-statement, and KYC data, rather than used in isolation[12].

A GSTIN match confirms that a GST number exists in the government database and that the registered name matches what a business has provided. On its own, it doesn’t confirm the business has real operations, genuine employees, or a legitimate physical presence at its declared address. A compliance team that stops at “GSTIN exists and matches” can still miss shell companies that clear basic registry checks without difficulty[10].

One documented case illustrates the gap. In a business-loan fraud matter involving more than ₹9,000 crore in unpaid loans, coverage of the case has pointed to earlier use of GSTIN-linked checks, specifically checking for inactive or non-filing status rather than existence alone, as something that could plausibly have flagged the shell entities involved sooner. That framing comes from the reporting on the case rather than from a regulator’s own finding, and it isn’t a claim that a GSTIN check failure was established as the cause of the losses[11].

Central tax authorities’ detection of fraudulent Input Tax Credit (ITC) claims has risen sharply year over year.

[18]

Coverage of these numbers attributes at least part of the rise to improved detection technology, not necessarily a proportional increase in actual fraud incidence[18]. Detection methods cited by authorities include AI-based risk scoring, automated invoice matching, network-intelligence platforms, expanded e-invoicing coverage, biometric Aadhaar authentication at the registration stage, geo-tagging of business premises, and automated matching against GSTR-2B records[18].

The typologies behind these numbers recur across enforcement coverage: shell entities created solely to issue invoices with no underlying supply of goods or services, circular trading among related or associated businesses to inflate credit chains, and fabricated export documentation used to claim refunds[19]. One documented enforcement case involved a bogus billing chain worth over ₹150 crore, run through shell companies across multiple states in a layered, circular-trading structure[19]. Under Section 132 of the CGST Act, fake-invoice or fraudulent-ITC activity exceeding ₹5 crore in value is a non-bailable offence carrying a jail term of up to five years plus a fine[20].

CBIC mandated nationwide biometric-based Aadhaar authentication for new GST registration applicants via CGST Notification No. 13/2024, dated 10 July 2024, extending an earlier pilot that began in Gujarat under Notification No. 27/2022 (27 December 2022). Applicants who don’t complete Aadhaar authentication instead undergo physical or documentary verification of their business premises at a GST Facilitation Centre, per a companion CBIC Notification No. 12/2024 of the same date, with verification required within 15 days of submitting the application’s Part B or the application risks non-generation of an Application Reference Number (ARN)[21]. Rollout of this requirement for new applicants has continued in phases across individual states into 2025: Jharkhand and Andaman & Nicobar Islands from 15 February 2025, Uttar Pradesh from 15 March 2025, Assam from 1 April 2025, and Sikkim from 1 May 2025. Because the state-by-state activation is still ongoing, how trustworthy a newly issued GSTIN can be assumed to be depends partly on which state and when it was registered[21].

Under GST reforms announced at the 56th GST Council meeting on 3 September 2025, a simplified, automated registration process took effect from 1 November 2025. Eligible new applicants, either system-identified as low-risk through data analysis or self-assessing a monthly output tax liability not exceeding ₹2.5 lakh, receive automatic registration approval within three working days. The government estimated roughly 96% of new applicants would qualify for this faster route[22].

The mandatory e-invoicing threshold has stood at ₹5 crore Annual Aggregate Turnover (AATO) since 1 August 2023; any business whose turnover crossed ₹5 crore in any financial year from FY18 onward remains subject to the mandate even if current-year turnover is lower. From 1 April 2025, businesses with AATO of ₹10 crore or more must report invoices, credit notes, and debit notes to the Invoice Registration Portal (IRP) within 30 days of the invoice date, or the portal rejects the submission, a rule that previously applied only to larger taxpayers[23].

Read together, three cited facts point to the same operational gap. RBI’s KYC Master Direction requires regulated entities to verify a GST number against the GSTN portal’s own search facility[7], but that verification, on its own, only confirms the number exists and the name matches, not that the business has real operations or a genuine presence at its declared address[10]. Meanwhile, central tax authorities’ own detection of fraudulent ITC claims grew from ₹36,373.36 crore across 9,190 cases in FY24 to ₹74,782 crore across 30,162 cases in FY26[18], and separate enforcement coverage keeps surfacing the same underlying pattern behind cases like these: shell entities built to issue invoices with no real supply behind them[19]. The practical implication for a bank or NBFC’s onboarding team is that satisfying RBI’s GST-verification requirement and actually closing the shell-company gap are two different bars. The first is met by confirming a GSTIN exists and matches; the second needs filing status, return consistency, and business-activity signals layered on top, which is why GSTIN checks tend to run alongside PAN, MCA, and Udyam data rather than alone[9][12][13][14].

CBIC’s phased rollout of mandatory biometric Aadhaar authentication for new GST registrants, underway since mid-2024 and continuing state by state through 2025, suggests regulators are trying to close part of this gap at the point of registration itself, rather than leaving it entirely to downstream verification[21]. That points toward a practical distinction for onboarding checklists going forward: a GSTIN issued after biometric authentication became mandatory in a given state carries a different registration-integrity profile than one issued before, a distinction that’s a reasonable next step to draw from the pattern above, not something any single cited source states outright.