If you onboard businesses rather than individuals, GST is usually the most informative single check available to you. A GSTIN confirms the entity is registered, says where, ties back to a PAN, and tells you whether the registration is still active. Most teams use perhaps half of that.
Reading a GSTIN before you even call an API
A GSTIN is fifteen characters and structured, so a meaningful amount of validation is possible locally, instantly and for free. Doing this first removes obvious errors before they consume an API call.
- Characters 1–2 are the state code, which should be consistent with the address the applicant gave you.
- Characters 3–12 are the entity's PAN, which means a GSTIN and a PAN submitted together can be cross-checked against each other with no network call at all.
- Character 13 is the registration count for that PAN within the state.
- Character 14 is normally Z, a fixed placeholder, so anything else is worth a second look.
- Character 15 is a checksum, so a mistyped GSTIN can usually be caught before submission.
Implementing the checksum
The final character is computed from the preceding fourteen, which means a single transposed digit is detectable in the browser. It is a modulus check over an alphanumeric set, and it takes an afternoon to implement once.
- Map each character to a valueDigits 0–9 map to 0–9 and letters A–Z map to 10–35, giving a 36-character alphabet.
- Weight alternating positionsWalk the first fourteen characters applying alternating multipliers, carrying the quotient and remainder of each product against the alphabet size.
- Derive the expected characterSubtract the running total's remainder from the alphabet size and map back to a character.
- Compare, and fail loudly in the fieldA mismatch means a typo with near-certainty. Say so at the input rather than waiting for a server round trip.
The payoff is not the API call saved. It is that the applicant finds out immediately, while they are still looking at the number, rather than after submitting a form and waiting.
The state code is a cross-check too
The first two characters identify the state of registration. Compared against the address the applicant typed, this catches a class of error that no name match will: a business submitting the GSTIN of a different branch, or of a related entity in another state.
Treat a state mismatch as a question rather than a rejection. Multi-state businesses hold several GSTINs, and the applicant may simply have supplied the wrong one — which is fixable in a sentence if you tell them what you noticed.
What the lookup returns, and how to use each field
A GST verification returns a compact set of fields, each answering a different question. Treat them as separate signals rather than as one pass or fail.
| Field | What it tells you | How to act on it |
|---|---|---|
| Legal name | The registered name of the entity | Match against the applicant's stated name; mismatches need review |
| Trade name | The name it operates under | Often differs legitimately — do not treat a difference as a flag |
| Registration status | Active, cancelled or suspended | Anything other than active is a hard stop pending explanation |
| Registration date | How long it has been registered | Recent registration is context for risk, not disqualifying |
| Principal place of business | The registered address | Compare with the address given; a state mismatch contradicts the GSTIN |
| Nature of business | What activities it is registered for | Useful where your own risk policy is sector-sensitive |
| Taxpayer type | Regular, composition and so on | Relevant to invoicing and credit treatment downstream |
Taxpayer type changes what you can do downstream
This field is routinely collected and rarely used, which is a missed opportunity. The registration type affects how the counterparty invoices and what tax treatment applies, so capturing it at onboarding saves a conversation later.
- A regular taxpayer issues tax invoices in the ordinary way.
- A composition taxpayer operates under a simplified scheme with different invoicing obligations.
- Casual and non-resident registrations are time-bound, which is worth knowing before you build a long-running relationship on one.
- Input service distributor registrations exist for internal credit distribution and are rarely the right counterparty for a commercial arrangement.
You do not need to be a tax expert to use this. You need to store it, and to route the unusual types to someone who can decide whether they fit the product the applicant is signing up for.
The mismatches you will actually hit
Most GST verification failures in production are not fraud. They are a business describing itself the way people do rather than the way a register does.
Trade name against legal name
An applicant types the name on their signage; the register holds the name on their incorporation certificate. Comparing against both the legal and trade name, and accepting a match on either, removes most of this noise.
The same normalisation that helps with PAN name matching applies here, with one addition: entity suffixes vary more in business names than in personal ones, so expanding or collapsing 'Private Limited', 'Pvt Ltd' and 'P Ltd' to a single canonical form before comparing is worth the few lines it takes.
Address differences
Operating address and registered address are frequently different and legitimately so. Compare at state level, which is what the GSTIN itself encodes, rather than trying to match free-text addresses line by line.
Line-by-line address matching is a trap. Indian addresses have no canonical format, abbreviations are inconsistent, and the same premises is written five ways by five people. Any matcher strict enough to be meaningful will reject most legitimate applicants.
Cancelled registrations
A cancelled GSTIN is the one status that genuinely warrants stopping. Businesses do deregister for ordinary reasons — restructuring, falling below a threshold, closing a branch — but onboarding one without asking why leaves you with a counterparty whose tax status you cannot rely on.
Distinguish cancellation from suspension where the response allows it. Suspension is frequently procedural and temporary; cancellation is not. Treating them identically either blocks recoverable cases or waves through ones you should not.
Multiple registrations under one PAN
A business operating in several states holds a GSTIN per state, all sharing the same PAN. This is entirely normal and surprises teams who assumed a one-to-one relationship.
- Do not treat a second GSTIN under a known PAN as a duplicate account attempt.
- Decide deliberately whether your product models one customer per PAN or per GSTIN — retrofitting that choice is painful.
- Where you collect one GSTIN, record which one, so a later query about a different state's registration is answerable.
Fitting verification into the signup flow
- Validate locally as they typeCheck length, state code and checksum in the browser. Catching a typo before submission is faster for the applicant and costs you nothing.
- Cross-check against the PANIf you already hold a PAN, compare the embedded characters. A disagreement here is worth resolving before anything else.
- Call the lookup once, then cacheRegistration details change rarely. Cache the result against the GSTIN with a sensible expiry rather than re-querying on every page load.
- Prefill from the responseUse the returned legal name and address to populate the rest of the form. It reduces typing, reduces errors, and makes the verification feel like a feature rather than a hurdle.
- Route exceptions, do not reject themSend mismatches to a review queue with both values shown side by side. Most are resolved in seconds by someone who can see both.
Designing the review queue
The exception queue is where onboarding either recovers legitimate customers or quietly loses them. It deserves more design attention than it usually gets, because it is the only part of the flow a human operates.
- Show both values side by side, highlighted at the difference. Most decisions take a second when the reviewer can see what differs.
- Show why it was queued — which check, which threshold — rather than only that it was.
- Offer the two or three actions that actually occur: approve, request a correction, decline. A free-text box is not a decision.
- Capture a one-line reason at the moment of the decision, which is the only time anyone remembers it.
- Sort by age, not by score, so nothing sits unexamined because it looked uninteresting on arrival.
Letting the applicant self-correct
Many queued cases are the applicant having typed a trade name or an old address. If your flow can tell them what did not reconcile, without disclosing anything useful to someone probing, a share of the queue resolves itself before a reviewer sees it.
The rule of thumb: say which field you could not confirm, not what the correct value is. 'The business name you entered does not match the registration' is helpful. Showing them the registered name so they can copy it back is not.
Keeping verification current
A GST check captures a moment. Registrations get cancelled, businesses restructure, and a file verified two years ago describes an entity that may no longer exist in that form. Onboarding checks that are never refreshed slowly become decoration.
| Trigger | What to re-check | Why |
|---|---|---|
| Scheduled cycle | Registration status | Cancellation is silent — nobody tells you |
| New payout account | Status and legal name | The destination changing is the highest-risk event |
| Change of registered name | Full lookup | Often accompanies a restructure |
| Sharp volume change | Status and nature of business | Activity outside the registered pattern is worth a look |
| Long dormancy then activity | Full lookup | The gap is where a registration lapses unnoticed |
Set the cycle from the risk tier rather than reviewing everything annually. The same tiering logic that keeps onboarding proportionate is covered in more detail in the piece on KYB mistakes.
Frequently asked questions
Can I validate a GSTIN without calling an API?
Partly. The format, state code and checksum can all be validated locally, which catches typos and fabricated numbers. Only a lookup can confirm the registration exists, is active and belongs to the name given.
Why does the legal name not match what the customer typed?
Usually because they typed their trade name — the name they operate under — rather than the legal name on the register. Compare against both and accept a match on either.
Can one business have several GSTINs?
Yes. A business operating across states holds one registration per state, all sharing the same PAN. A second GSTIN under a known PAN is normal rather than a duplicate account attempt.
Is a recently registered GSTIN a risk signal?
On its own, no. New businesses register every day. It is context to weigh alongside other signals rather than a reason to decline.
What is the difference between a suspended and a cancelled GSTIN?
Suspension is frequently procedural and may be temporary; cancellation is not. Treating them identically either blocks recoverable cases or admits ones you should not, so handle them separately where the response distinguishes them.
How often should GST details be refreshed?
On a cycle set by risk tier, plus on material events — a new payout account, a change of registered name, a sharp volume change, or activity resuming after a long gap.
Should I match the address returned by the lookup?
Only at state level, which is what the GSTIN encodes. Indian addresses have no canonical format, so line-by-line matching strict enough to be meaningful will reject most legitimate applicants.
