Aadhaar and Biometric Authentication for GST Registration

You submit Part B of your GST registration application, expect an ARN, and instead receive an email asking you either to authenticate your Aadhaar with an OTP or to book an appointment at a GST Suvidha Kendra and turn up in person with your original documents. That is GST biometric authentication, and it exists because the easiest way to steal input tax credit in India has long been to register a business that does not exist. This post explains which route you get, why, who has to be present, what to carry, and what the stronger checks still leave for you to verify on the other side of a transaction.

Why GST registration asks for Aadhaar

GST lets a buyer claim credit for tax charged by a supplier. A registration that exists only on paper can issue invoices, pass on credit that was never paid to the government, and disappear before anyone visits the address. Enforcement drives against fake registrations have repeatedly turned up networks of GSTINs opened with borrowed or stolen identity documents, rented or fictitious premises and dummy directors, each used for a few months of invoice trading and then abandoned.

Identity checks at the point of registration attack the cheapest part of that operation. If the person whose PAN and Aadhaar are on the application has to authenticate with their own phone, or stand in front of an officer and give a fingerprint, lending your documents to someone else's shell company becomes much harder to do by accident and much harder to deny afterwards.

For the wider context of how these networks show up in a buyer's books, see how to check a fake GST number.

The legal basis: Section 25 and Rule 8(4A)

The requirement sits in two places.

• Section 25(6B), (6C) and (6D) of the CGST Act. Sub-section (6B) makes Aadhaar authentication a condition for an individual to be granted registration. Sub-section (6C) extends it to persons other than individuals, by requiring authentication of specified people connected with the entity. Sub-section (6D) lets the government exempt notified persons or classes of persons. These provisions were added to the Act by amendment and brought into force in 2020.
• Rule 8(4A) of the CGST Rules. This is where the mechanics live: an applicant opting for Aadhaar authentication undergoes it at the time of application, and applicants identified on the basis of data analysis and risk parameters undergo biometric-based Aadhaar authentication, have their photograph taken and have their original documents verified at a facilitation centre notified by the Commissioner. The biometric limb was added to the rule after the pilots began.

Rules 9 and 25 connect authentication to processing time. An authenticated, low-risk application is generally expected to be decided within seven working days. An application where authentication was not done, or failed, or that was flagged on risk parameters, becomes eligible for physical verification of the place of business and a longer processing window. The current timelines and any recent amendments are on cbic-gst.gov.in; confirm there before you plan around a specific number of days.

OTP authentication versus biometric at a GSK

Both routes use Aadhaar. The difference is where and how the match happens, and what else is checked.

OTP-based authentication is remote. The portal sends a link to the email address of each person who needs to authenticate; they open it, enter their Aadhaar number, and confirm with the OTP sent to the mobile number linked to their Aadhaar. Nothing else is inspected at this stage.

Biometric-based authentication is in person at a GST Suvidha Kendra (GSK), a facilitation centre set up by the state or central tax administration. A fingerprint or iris is matched against Aadhaar, a live photograph is captured, and the officials compare your original documents with the scans you uploaded. It was piloted in Gujarat from 2023, then extended to other states in phases, and now covers most of the country. Coverage has changed several times, so check GSTN's advisories on gst.gov.in for your state.

The routes are not interchangeable. If the email tells you to book a GSK appointment, completing an OTP authentication elsewhere does not substitute for the visit.

Who has to authenticate, and who is exempt

For an individual, such as a proprietor, it is the applicant. For anyone else, Section 25(6C) points to the people who control or represent the entity: the Karta of a HUF, the managing and whole-time directors of a company, the partners of a firm, the members of the managing committee of an association, the board of trustees, and the authorised representative and authorised signatory. On the portal this surfaces as the promoters, partners or directors you listed, together with the primary authorised signatory.

Get this right before you file. Every person you add as a promoter or signatory is someone who will be asked to authenticate, and if the application is routed to a GSK, someone who has to turn up in person. Listing a partner who lives in another city, or a signatory who has not linked their current mobile number to Aadhaar, is a common and avoidable cause of delay. The full checklist of registration fields is in the online GST registration walkthrough.

The exemptions notified under Section 25(6D) are narrow. Broadly they cover persons who are not citizens of India, government departments and establishments, local authorities, statutory bodies and public sector undertakings, and persons applying for a Unique Identification Number, such as embassies and UN bodies (see what a UIN is under GST). If you are an ordinary private business, assume you are not exempt.

The biometric flow, step by step

If your application is routed to biometric authentication, this is the sequence.

1. File Part A and Part B of Form GST REG-01 as usual, with the Aadhaar authentication option selected, and submit.
2. Read the email. Instead of an ARN, you get either the OTP authentication link or an intimation that you must complete biometric authentication at a GSK, with a link to book an appointment. The intimation names the centre, usually the one for your jurisdiction.
3. Book the appointment through that link. You pick a date and slot from those the centre offers. Keep the confirmation.
4. Visit within the window. The intimation gives a limited number of days to complete the visit. The exact figure is set by the portal and has been stated in GSTN advisories; read it in your own email and do not assume you have longer.
5. At the GSK, each person who needs to authenticate has their biometrics matched against Aadhaar and their photograph taken, and the officials check the original documents against what was uploaded.
6. ARN is generated once the biometric authentication and document verification are complete. From here the application goes to the jurisdictional officer and follows the normal cycle, including a possible REG-03 query. You can then follow it through the steps in how to check GST ARN status.

If the visit is not completed within the window, the application is not taken forward and no ARN is generated. The practical fix is a fresh application, which is why booking the earliest slot you can make is worth more than booking a convenient one.

What stronger registration does not fix

Biometric checks raise the cost of opening a fake GSTIN. They do not clean up the registrations that already exist, and they say nothing about what a real business does after it is registered. If you buy from GST-registered suppliers, three risks remain.

• Older registrations. GSTINs granted before authentication tightened, or in categories that were not risk-flagged, are still live until an officer acts on them.
• Status changes. A properly authenticated business can be suspended or cancelled later, sometimes with retrospective effect, which puts your input tax credit at risk.
• Borrowed identities. Nothing on a printed invoice proves the GSTIN on it belongs to the company that sent it. A real, active GSTIN copied onto someone else's invoice passes a format check every time.

That is why supplier checks still matter: confirm the GSTIN is active, that the legal name matches your counterparty, and that the supplier is actually filing returns. The GST fraud detection guide explains which signals are worth automating. You can check an individual GSTIN on the free GST number search (five lookups a day, no signup), or use GSTIN verification through the API, which returns registration details and GSTR filing history in a single call at ₹0.50 per verification.

Frequently asked questions