How to onboard a vendor in India: check PAN, GSTIN, MCA company status, Udyam and bank-account name match, in order, before the first payment.
Vendor onboarding in India is the workflow that checks a supplier before creating an active ERP vendor code. Teams verify PAN, GST filings, company records, MSME status, and bank ownership. A safe process runs six checks in order: pay nothing until the bank name matches the entity.
tips_and_updatesWhere things stand (November 2026)
GSTR-2B
Under Sections 16(2)(aa) and 16(2)(ba) of the CGST Act, 2017, buyers can claim Input Tax Credit (ITC) only when an invoice appears unrestricted in Form GSTR-2B.
15 / 45 days
Section 15 of the MSMED Act, 2006 sets a 15-day or 45-day payment limit. Section 43B(h) of the Income-tax Act, 1961 disallows overdue year-end sums to Micro and Small vendors until paid.
April 2025
The RBI 2025 KYC Directions require business GST checks from the issuing authority, and RBI's April 2025 circular added RTGS and NEFT name look-up.
The playbook
Procurement, finance, and BFSI teams control shell-vendor, tax, and payout risk by running six gates in order.
Pick a scenario to watch a vendor move through the checks.StopHoldProceed
Prospective vendor selected for onboarding
Does the active PAN match characters 3 to 12 of the GSTIN and the declared entity constitution?
Collect legal name, PAN, GSTIN, CIN or LLPIN, Udyam number, and bank details. Verify on the Income Tax e-Filing portal under Section 139A that the PAN is Active/Operative. Check its fourth letter (C company, P proprietor, F firm or LLP, H HUF, T trust, A AOP) and match GSTIN characters 3 to 12, per Forbes India.
PAN 4th character conflicts with declared entity type
pauseHold onboardingUntil vendor submits corrected entity and PAN documentation
Re-check step 01, then continue
PAN inoperative or GSTIN characters 3 to 12 mismatch
closeReject onboarding immediatelyStructural tax ID mismatch under Income-tax Act Section 139A
Is the GSTIN active on the GST portal with consistent GSTR-1 and GSTR-3B filings across all state registrations?
Check the GST Portal’s Search Taxpayer utility and our GST verification guide for Active status, names, and GSTR-1 and GSTR-3B filings. Run “Search Taxpayer by PAN”, per Pine Labs, to list all state GSTINs.
GSTIN suspended or consecutive GSTR-1 and GSTR-3B defaults
pauseHold activationUntil vendor clears FORM GST REG-31 suspension and files pending returns, or onboard strictly as non-GST supplier
Re-check step 02, then continue
GSTIN cancelled
closeReject as GST-charging supplierCancelled registration under CGST Act Section 29
Is the corporate or LLP entity active on MCA21 with an active, non-disqualified signatory director DIN?
Check MCA21 Master Data via CIN verification, per Cashfree Payments and Tally Solutions, for Active status, capital, and charges. Check signatory Director Identification Numbers (DINs) for annual DIR-3 KYC filing by 30 September under Rule 12A of the director rules and Section 164(2) disqualification.
Signatory DIN deactivated or disqualified
pauseHold contract executionUntil director files Form DIR-3 KYC under Rule 12A or board authorizes an active, non-disqualified director
Re-check step 03, then continue
Company status is Strike Off or Under Liquidation
closeReject onboarding immediatelyDissolved entity cannot execute binding contracts without NCLT restoration
Does the vendor claim MSME status with a valid 16-character Udyam Registration Number?
Verify the 16-character Udyam number and QR code on the official Udyam portal and our Udyam certificate guide. Confirm March 2025 category (Micro: up to ₹2.5 crore investment and ₹10 crore turnover; Small: up to ₹25 crore and ₹100 crore; Medium: up to ₹125 crore and ₹500 crore).
Udyam number or dynamic QR fails portal verification
pauseHold MSME preferential taggingUntil vendor supplies a valid Udyam certificate verified on udyamregistration.gov.in
Re-check step 04, then continue
Is the bank account active and does the CBS beneficiary name match the verified legal or trade name?
Verify the bank account and IFSC using penny drop verification or the RBI RTGS and NEFT name look-up facility effective April 2025. Confirm Core Banking Solution (CBS) Active status and fuzzy name match, per Cashfree Payments. Match sole proprietors against the GST Legal Name or Trade Name.
Account dormant or fuzzy name score below threshold
pauseHold payout activationUntil vendor provides an active business account matching the verified legal or GST trade name
Re-check step 05, then continue
Account belongs to unrelated third party
closeReject and escalate for fraud reviewUnverified third-party payout risk
Are PAN, GSTIN, bank account, and contact details clear of vendor-master duplicates and employee conflicts?
Cross-check PAN, GSTIN, bank account, address, phone, and email across the Vendor Master and Employee Master with maker-checker Segregation of Duties, per FASA Insights.
Matches existing active parent vendor PAN
pauseHold new vendor codeMap new branch GSTIN under existing parent vendor record after controller review
Re-check step 06, then continue
Matches employee record or blacklisted supplier
closeReject and escalate to internal auditUndisclosed employee conflict of interest or blocked vendor
Vendor onboarding starts after commercial selection and controls tax, corporate, and payout risks before a supplier enters the enterprise resource planning (ERP) system. Treating setup as file collection exposes accounts payable to shell firms, lost tax credit, and bank swap fraud, per FASA Insights’ fraud guide and Kleeto.
Teams enforce Segregation of Duties (SoD) so the user creating a vendor cannot approve orders or pay bills. Audit red flags include:
Same user creates and pays
One user creates and pays a vendor within days.
Sequential invoice numbers
Sequential invoice numbers (101, 102, 103) across months.
Split invoices
Invoices split just below approval limits.
Under the RBI 2025 KYC and Outsourcing Directions(Commercial Banks version), banks and NBFCs verify a counterparty’s GST number from the issuing authority. Regulated entities also identify natural-person Ultimate Beneficial Owners (UBOs) for corporate vendors or Direct Selling Agents (DSAs). Under Rule 9(3) of the Prevention of Money-laundering Rules, 2005, this threshold sits above 10% ownership or control.
An active GSTIN at onboarding does not guarantee that a buyer can claim Input Tax Credit on supplier invoices.
Under Section 29 of the CGST Act, 2017 and the CGST Rules (per TaxGuru), officers or system checks can suspend a GSTIN via notice FORM GST REG-31, giving 30 days to reply. Triggers include fake billing, GSTR-1 vs. GSTR-3B gaps, missing bank details, or return defaults (six months for monthly filers; two periods for quarterly filers). A Suspended vendor cannot issue taxable GST bills.
Even when a GSTIN is Active, two CGST Act rules control Input Tax Credit:
Supplier reporting
Under CBIC Notification No. 39/2021-Central Tax (enforcing Section 16(2)(aa) from 1 January 2022), the vendor must report the invoice in Form GSTR-1 so it appears in the buyer’s Form GSTR-2B.
Unrestricted credit
Under Section 16(2)(ba) of the CGST Act (from 1 October 2022), credit in Form GSTR-2Bcannot be marked “restricted” due to supplier tax defaults.
Buyers challenged credit denial before the Gauhati High Court (McLeod Russel India Limited) and Madhya Pradesh High Court (Shree Krishna Chemicals), per TaxGuru. Still, portal rules block credit missing from Form GSTR-2B.
| Anomaly | Risk | Action |
|---|---|---|
| GSTIN Suspended or filing gaps | Barred from GST billing; buyer ITC blocked in Form GSTR-2B | Hold setup until returns are filed, or onboard as non-GST |
| Company Strike Off or DIN barred | Dissolved company cannot sign; director barred or disqualified | Reject struck-off firms; hold signing until DIN is active |
| Unflagged Udyam Micro or Small | Misses 15-day or 45-day MSMED limit; tax disallowance and 3x interest | Verify Udyam at setup and set 15-day or 45-day ERP terms |
| Bank name mismatch or swap request | Payout diversion, employee conflict, or BEC fraud | Require penny-drop or RTGS/NEFT name match; lock bank fields |
Checking Udyam status at setup sets 15-day or 45-day payment clocks, while lifecycle re-checks stop post-onboarding fraud.
Under Section 15 of the MSMED Act, 2006 and Section 43B(h) of the Income-tax Act, 1961 (per IndiaFilings), buyers face strict payment limits for Udyam Micro and Small vendors. The limit is 15 days without a written contract, or up to 45 days with one. From 1 April 2024, overdue year-end sums are disallowed as tax deductions until paid. Medium firms and pure traders are excluded. Late buyers also owe compound interest at three times the RBI bank rate.
Overdue year-end invoices owed to Udyam-registered Micro and Small vendors past the 15-day or 45-day limit are disallowed until paid.
Per HyperVerge and FASA Insights, three events should place an active vendor code on payment hold:
Bank changes
Call a pre-recorded vendor number out of band to stop Business Email Compromise (BEC) fraud, and run a fresh penny drop.
GST alerts
Re-check active vendors before paying GST to catch mid-year suspension or stopped filings.
MCA alerts
Monitor corporate vendors for strike-off notices or DIN deactivation after the annual 30 September DIR-3 KYC cutoff.
Automated API checks replace manual portal lookups with real-time registry checks before an ERP vendor code is created.
The KYCKART Business Verification Suite combines 15+ real-time government registry checks into one API integration. It returns verified GST status, filing history, turnover bands, PAN validity, MCA master data, director DIN status, trade licences, and mobile-to-business lookup. Teams connect these checks to ERP systems to automate setup.
Read together, GST credit rules, MSME tax limits, and bank name-lookup rules make vendor onboarding a core financial control:
GST status vs. credit eligibility
The link between GST status and Form GSTR-2B rules suggests that checking only whether a GSTIN is Active leaves working capital exposed. Because supplier filing defaults block Input Tax Credit, the practical implication is that teams should treat multi-state PAN searches and filing history as pre-contract gates.
Master-data tags drive tax compliance
Read together, Udyam rules and income-tax limits mean that missing a Micro or Small tag risks year-end tax disallowance and compound interest. Because sole proprietors hold PAN in their personal name while banking under a firm name, rules should match bank names against either the GST Legal Name or Trade Name.
Continuous lifecycle controls
Bank-swap requests and annual cutoffs like the 30 September DIR-3 KYC deadline show that one-time checks are not enough. Teams should pair maker-checker setup gates with automated holds when a vendor changes bank details or stops filing GST returns.
Bhanujeet Choudhary
Head of Compliance, KYCKART
Published November 11, 2026
Disclaimer: This article is for informational purposes only and does not constitute legal, regulatory, tax, or compliance advice. Institutions should consult qualified legal, tax, or compliance counsel before establishing vendor onboarding, accounts-payable, or regulatory due-diligence policies.
KYCKART Intelligence
See how KYCKART runs PAN, GST, MCA, Udyam and bank-name checks through one integration, so your team onboards vendors with the registry evidence on file.
Explore KYCKART Onboarding Solutionsarrow_forward