GST Verification for Vendor Onboarding: A Practical Guide

GST verification for vendor onboarding means checking a supplier’s GSTIN against live government records — not just its format — before you create the vendor in your books. Done properly, it is a five-stage workflow: intake, format and checksum validation, a live status lookup, a legal-name match against supporting documents, and a risk tier that decides how much manual review the vendor gets.

The vendor onboarding workflow, step by step

Most procurement and finance teams run vendor onboarding as a linear pipeline: a supplier fills in an intake form with their GSTIN, PAN, bank details and registration documents; the finance or vendor-master team validates those details; and only then does the vendor get created in the ERP with an active payment terms record. GSTIN verification for vendor onboarding slots into that pipeline as an automated gate, typically triggered the moment the intake form is submitted.

The workflow below is the shape most GST verification API integrations follow, whether the intake form lives in a homegrown portal, an ERP add-on, or a spreadsheet-based process a finance team is trying to modernise.

Format and checksum validation

The first, cheapest check is structural: is the string 15 characters, does it encode a plausible state code in the first two positions, and does the 15th character match the checksum computed from the first fourteen? This step catches typos instantly and for free, before you spend an API call or a human minute on the vendor.

It is worth being explicit with your team about what checksum validation does not prove. Because the algorithm is public, anyone can construct a string that passes it without the GSTIN ever having been issued by GSTN. See our GSTIN format explainer for the full structure, and treat checksum validation as a spam filter, not a verification step.

Live status lookup against government records

Once a GSTIN is well-formed, the next step is a live lookup — a call to a GST verification API such as GET https://gstinapi.com/api/get-taxpayer-info/{gstin} with an X-API-Key header — which returns the taxpayer’s current registration status along with legal name, trade name, constitution, registration date, and jurisdiction. This is the step that actually confirms the vendor exists in government records and is registered under the identity they claim.

A well-built response also returns GSTR filing history, so onboarding can look past “is this GSTIN real” to “is this vendor actually keeping up with GSTR-1 and GSTR-3B filings” — a useful early signal for the risk tiering step below.

Matching legal name against PAN, bank and registration documents

A GSTIN status of Active tells you the number is real, not that it belongs to the vendor sitting across the table. The legal name returned by the lookup should be checked against three other artefacts already collected during intake:

• PAN — since the GSTIN’s positions 3–12 are literally the entity’s 10-character PAN, the legal names on both should agree.
• Bank account — the account holder name on the vendor’s cancelled cheque or bank letter should reasonably match the GSTIN legal name, not an unrelated individual or shell entity.
• Registration documents — certificate of incorporation, partnership deed, or the GST registration certificate itself, for constitution and address consistency.

Minor formatting differences — “Pvt. Ltd.” versus “Private Limited”, extra spacing — are normal and should not trigger a rejection. A materially different name, or a mismatch in constitution (an individual PAN attached to a GSTIN claiming to be a private limited company), should route the vendor to manual review rather than auto-approval.

Risk tiering a new vendor

Not every new vendor needs the same level of scrutiny. A practical risk tier combines GSTIN status, registration age, and filing regularity into a simple low/medium/high band:

Signal	Low risk	Medium risk	High risk
GSTIN status	Active, long-standing	Active, recently registered	Suspended or not found
Filing regularity	On-time, no gaps	Occasional delays	Multiple missed periods
Name match	Exact match across PAN, bank, docs	Minor formatting variance	Material mismatch
Recommended action	Auto-approve	Approve with a note for periodic review	Manual review before approval

What to do for Active, Suspended, Cancelled and not found

The GSTIN status field is the single most decision-relevant value in the response. Here is a practical decision table finance and procurement teams can wire directly into an onboarding workflow.

Status	What it means	Recommended action
Active	Registration is live and current.	Proceed to legal-name match and risk tiering; onboard on a clean match.
Suspended	Cancellation proceedings are underway but not final; the vendor may still be able to issue valid invoices depending on the reason.	Hold onboarding; ask the vendor for an explanation and re-check status before proceeding.
Cancelled	Registration has been terminated; the vendor cannot legally issue a valid GST invoice on this number.	Block onboarding on this GSTIN. Request a valid, active alternative GSTIN or reject the vendor.
Not found	The number does not exist in government records, despite being well-formed.	Reject outright and flag as a likely fraudulent or fabricated submission.

Periodic re-verification after onboarding

A vendor that passed every check on day one is not permanently verified — GSTIN status, filing behaviour and even legal name can change without any notice to you as the buyer. Most mature vendor onboarding programs schedule a periodic sweep, monthly or quarterly, that re-runs the same lookup against the entire vendor master and flags any vendor whose status has moved away from Active or whose filing gaps have grown.

This is cheap to automate: a scheduled job iterates the vendor master, calls the verification endpoint for each GSTIN, and writes any status change to an exceptions queue for accounts payable to review before the next payment run. For teams managing this at scale, see our bulk GSTIN verification guide.

Related entities worth tracking alongside status — HSN/SAC codes on the vendor’s invoices, their AATO band for e-invoicing applicability, and their QRMP filing preference — are all part of the same taxpayer record and available from a single lookup, which is why most teams run this as one API call rather than several separate checks.

Frequently asked questions

Where does GST verification fit in vendor onboarding?

It sits right after the vendor submits an intake form and before the vendor master record is created in your ERP or accounting system, so a bad GSTIN never becomes an approved supplier in the first place.

Can a vendor onboarding checklist rely on GSTIN checksum validation alone?

No. A checksum-valid GSTIN only proves the number is well-formed — anyone can generate a checksum-valid string. You need a live lookup against government records to confirm the number was actually issued and is currently active.

What should happen if a vendor GSTIN shows as Cancelled?

Treat it as a hard block. A cancelled GSTIN cannot legally issue a valid tax invoice, so any GST charged by that vendor is not usable for input tax credit and the vendor should not be onboarded until the registration is restored or a new GSTIN is provided.

How often should an approved vendor be re-verified?

Most finance teams re-run GSTIN status checks monthly or quarterly across the full vendor master, since status changes — suspension, cancellation — happen without any notice to the buyer.

Does the legal name on a GSTIN have to match exactly with PAN and bank records?

It should match closely, allowing for minor formatting differences (spacing, abbreviations, legal suffixes). A material mismatch between the GSTIN legal name and the PAN or bank account holder name is a strong signal to flag the vendor for manual review.

Is a suspended GSTIN the same as a cancelled one?

No. Suspended usually means cancellation proceedings are underway but not final — the vendor may still resolve the issue and return to Active. Cancelled is final unless revoked. The two states warrant different onboarding decisions.