How to Verify Indian Supplier Bank Accounts
India is unusual in two directions at once. Its account-verification infrastructure is better than Europe's — a penny drop returns the account holder's actual name, not a match or no-match verdict. But its tax law puts you on the hook for your supplier's behaviour in a way almost no other jurisdiction does: if an Indian supplier collects GST from you and never pays it to the government, you can lose the input tax credit. The Supreme Court has now confirmed that is constitutional. And that is only the first of two Indian rules that turn a supplier's paperwork into your tax bill. This guide covers both layers, and why the company checks matter more here than almost anywhere else.
Sources: industry-reported digital payment fraud data, FY2024; Section 15 MSMED Act 2006 read with Section 43B(h) Income Tax Act; Section 16(2)(c) CGST Act 2017.
The account layer: penny drop
India's standard control for confirming a bank account is the penny drop. The mechanics are simple: a verification provider initiates a transfer of one rupee to the account over the IMPS rail, and the receiving bank responds with the registered account holder's name together with status flags — active, dormant, frozen or closed. The returned name is then compared to the name you hold on file, using exact, fuzzy or phonetic matching. The round trip typically completes in seconds.
IMPS is used because it runs continuously, including weekends and public holidays, and returns structured data the calling system can read.
Verification of Payee in the EU returns a verdict — match, close match, no match. A penny drop returns the name itself. That means you control the matching logic, you can see exactly how a near-miss differs, and you can distinguish a transliteration variant from a genuinely different party. For Indian company names, where spellings and abbreviations vary widely, that distinction is worth a great deal.
Penny drop versus penny-less
There are two methods, and the difference matters operationally.
| Penny drop | Penny-less (account validation) | |
|---|---|---|
| How it works | An actual ₹1 IMPS credit to the account. | A query against the NPCI database. No money moves. |
| Returns | Account holder name, plus account status. | Account holder name if the record is found. |
| Speed | Seconds, but slower than a database query. | Faster, typically a few seconds. |
| Coverage | Works across bank accounts generally. | Not every bank participates. |
| Downside | The supplier sees an unexplained ₹1 credit. | Depends on database currency rather than a live bank response. |
For onboarding a new supplier or acting on a change of bank details, the penny drop is the more definitive of the two because the response comes from the bank holding the account rather than from a database that reflects it.
The regulatory position
Penny drop is long-established rather than novel. The Reserve Bank of India has accepted it as part of KYC since 2016. SEBI permitted it for digital KYC from April 2020. The pension regulator, PFRDA, made it mandatory for NPS exits, withdrawals and bank-account modifications from July 2021. It is the default control across Indian lending, insurance, mutual funds and payouts.
Account numbers: there is no IBAN
This catches out buyers used to European payments. India has no IBAN, and Indian account numbers have no fixed length — they vary by bank, commonly between nine and eighteen digits. You cannot validate one structurally the way you can validate an IBAN, and any rule in your ERP that enforces a fixed length will reject legitimate accounts.
What you validate instead is the IFSC — the Indian Financial System Code that identifies the bank branch. It is eleven characters: four letters for the bank, a fifth character that is always zero and reserved for future use, and six characters identifying the branch. The IFSC can be checked against the RBI's published directory, and confirms the branch exists. It says nothing about the account.
The company layer: three identifiers that cross-check each other
Indian entities carry several identifiers, and the useful property is that they are nested — one contains another, which lets you cross-validate documents without querying anything.
| Identifier | What it is | Who has one |
|---|---|---|
| PAN | Ten-character Permanent Account Number issued by the income tax department. | Every taxpayer, individual or entity. |
| GSTIN | Fifteen-character GST registration. Contains the PAN. | Businesses registered for GST, one per state. |
| CIN | Twenty-one-character Corporate Identification Number from the Registrar of Companies. | Companies only. LLPs get a seven-character LLPIN; sole proprietors get neither. |
The GSTIN contains the PAN
This is the single most useful verification trick in the Indian stack, and it costs nothing. Characters 3 to 12 of a GSTIN are the entity's PAN. So if a supplier gives you both a GSTIN and a PAN on an invoice, you can confirm in a second, offline, that they refer to the same entity.
One consequence worth understanding: because GST registration is state-wise but PAN is national, a company operating in five states has five different GSTINs sharing one PAN. Receiving invoices under different GSTINs from the same supplier is normal, not suspicious — provided the embedded PAN is identical each time.
Checking the GSTIN
The GST portal's Search Taxpayer function is free and requires no login. It returns the legal name of the business, the trade name, the effective date of registration, the constitution of business, the principal place of business, the taxpayer type, the current status — active, cancelled or suspended — and, importantly, the return filing history.
That last field is the one most buyers never look at, and it is the one that matters most. More on why below.
Checking the company: MCA21 and the CIN
Companies are registered with the Registrar of Companies under the Ministry of Corporate Affairs, and the register is public and free through the MCA21 portal. The key is the CIN, a twenty-one character code that encodes six facts about the company before you look anything up.
| Segment | Example | Meaning |
|---|---|---|
| 1 character | L | Listed (L) or unlisted (U). |
| 5 digits | 17110 | Industry code under the National Industrial Classification. |
| 2 characters | MH | State of the registered office. |
| 4 digits | 1973 | Year of incorporation. |
| 3 characters | PLC | Ownership type — PTC private, PLC public, OPC one-person, GOI government. |
| 6 digits | 019786 | Registration number allotted by the Registrar. |
So L17110MH1973PLC019786 — Reliance Industries — reads as a listed, Maharashtra-registered public company incorporated in 1973. A supplier whose CIN says it was incorporated last year, in a state unrelated to where it claims to operate, under an industry code unrelated to what it is invoicing you for, has told you something before you have run a single query.
The MCA21 master data view returns the company name, status (active or struck off), incorporation date, registered office, authorised and paid-up capital, directors and signatories, and the index of charges — all free and without a login.
The index of charges lists loans and mortgages registered against the company's assets. It is the one part of Indian company data that reveals leverage a supplier will not volunteer, and it is visible to anyone. For a supplier you are about to depend on, it is worth thirty seconds.
Two structural points. An LLP has a seven-character LLPIN rather than a CIN and appears under the separate LLP master data view. A sole proprietorship has no corporate identifier at all — it is not a registered legal person, so there is no company to look up, and verification rests on the proprietor's PAN and GSTIN alone.
Ownership
Beneficial ownership sits under section 90 of the Companies Act 2013, which requires individuals holding significant beneficial interest to declare it to the company, and the company to file that information with the Registrar. The Indian threshold is lower than the EU's — significant beneficial ownership starts at 10% of shares, voting rights or distributable dividend, against 25% in most European regimes. Directors are visible in MCA21 master data; the significant beneficial owner filings are less consistently accessible in practice, and coverage varies.
Why this matters more than usual: your input tax credit
Here is the part that turns Indian supplier verification from good practice into a financial control.
Section 16(2) of the CGST Act 2017 sets cumulative conditions for claiming input tax credit. Two of them depend entirely on your supplier's behaviour:
- Clause (aa) requires the supplier to have reported the invoice in its outward return, so that it appears in your auto-populated GSTR-2B. If the supplier files late, files incorrectly, or does not file, the credit does not appear.
- Clause (c) requires that the tax charged has actually been paid to the government. If your supplier collects GST from you and never deposits it, the condition fails.
The consequence is that an honest buyer, holding a valid tax invoice, having received the goods and paid in full through banking channels, can lose the credit because of something the supplier did after the money left.
In Bhandari Scrap Traders v. Union of India, the Supreme Court dismissed a batch of Special Leave Petitions and affirmed the Gujarat High Court's judgment in Maruti Enterprise, holding that section 16(2)(c) is neither unconstitutional nor liable to be read down. The argument that a bona fide purchaser should not lose credit for a default beyond its control did not succeed. The route back is to reverse the credit and re-avail it once the supplier discharges the liability.
The practical advice from Indian tax practitioners following the ruling is consistent, and it is a verification agenda rather than a legal one: strengthen vendor due diligence, monitor supplier compliance through GSTR-2B, and put tax-withholding or indemnity clauses into supply contracts.
What you can and cannot see
The asymmetry is the crux. You can check whether a supplier has filed its returns, through the free public GSTIN search, and you can see whether an invoice has landed in your GSTR-2B. You cannot see whether the supplier actually deposited the cash, because its GSTR-3B payment particulars and electronic ledgers are not accessible to you.
So filing history is a proxy, not a guarantee. It is nonetheless the best available signal, and a supplier with a pattern of late or missing returns is exactly the supplier whose defaults will cost you credit later.
A supplier verified once at onboarding tells you nothing about whether it filed last month. Exposure accrues invoice by invoice, every month, for as long as the relationship lasts. In India the case for continuous supplier monitoring is written into the credit mechanism itself.
The second exposure: paying a small supplier late
The GST rule punishes you for who your supplier is. The second rule punishes you for when you pay them — and unlike the first, this one is entirely within your control.
Section 43B(h) of the Income Tax Act, effective from 1 April 2024, ties your deduction to timely payment of micro and small enterprises. If you do not pay within the window set by section 15 of the MSMED Act, the expense is disallowed in that financial year and becomes deductible only in the year you actually pay.
The window is short:
- 15 days from acceptance where there is no written agreement.
- 45 days where a written agreement sets a longer period.
The 45-day cap is absolute. A written agreement granting 60 or 90-day terms is valid commercially but not for this purpose — the excess is disregarded, and the disallowance applies to the whole amount. Negotiating longer payment terms with a micro or small Indian supplier does not extend the tax deadline; it just guarantees you miss it.
There is a second cost. Late payment to a micro or small enterprise attracts interest under the MSMED Act at three times the RBI bank rate, compounded monthly — and that interest is itself not deductible.
Who it applies to, and who it does not
This is where verification comes in, because the rule turns on the supplier's classification, not on its size as you perceive it. Two exclusions matter, and both are easy to get wrong in either direction.
| Supplier | Covered by 43B(h)? | Why |
|---|---|---|
| Udyam-registered micro or small, manufacturing or services | Yes | Squarely within section 15 of the MSMED Act. |
| Udyam-registered medium enterprise | No | The provision reaches micro and small only. |
| Udyam-registered trader | No | Wholesale and retail traders hold Udyam registration but fall outside section 15. |
| Not Udyam-registered | No | The classification depends on registration under the MSMED Act. |
The trader exclusion catches people out constantly. A supplier can hold a perfectly valid Udyam certificate and still be outside the rule because the certificate shows trading activity rather than manufacturing or services. Conversely, treating every Udyam-registered supplier as covered means paying faster than you need to.
The evidence point is the supplier's Udyam Registration Number together with the classification shown on the Udyam record — micro, small or medium, and the registered activity. Collect it at onboarding, store it against the vendor master, and re-check it: classification changes as a supplier grows, and the status that matters is the one current when the invoice is accepted.
Note also that the classification is not static in law. Section 43B(h) sits within a broader recodification, moving to section 37 under the Income Tax Act 2025, and the reporting obligation appears in clause 22 of the tax audit report in Form 3CD. The substance is stable; the section numbers are moving.
What a penny drop will not catch
A penny drop is a genuinely strong control. It confirms the account is real, active, and tells you the name of the person or business that holds it. That is more than most European buyers can establish before a payment.
It tells you nothing about the company. The account can be live and correctly named while the entity behind it has been struck off the register, has stopped filing GST returns, carries undisclosed charges over its assets, or is a sole proprietorship with no corporate existence at all. And critically, it says nothing about either of the exposures above: whether your input tax credit will survive, or whether the supplier is a micro enterprise you have 15 days to pay. There are several company red flags a bank account match alone will not catch, and in India they carry a direct, quantifiable tax cost.
One integration, instead of one per country
MonitorPay provides account verification and registry-sourced company intelligence across 49+ markets through a single API — payee name matching against the account holder, plus registered legal name, national identifiers, status, directors, shareholders, beneficial ownership and group structure from over 200 government registries. India's own portals are free and worth using directly; the difficulty is that the Indian stack, the Polish register, the Spanish provincial registries and the Emirati licensing authorities share no format, cadence or identifier scheme between them. Available as bulk file checks, REST API or the online platform, with every check logged for audit and continuous monitoring on suppliers already onboarded. MonitorPay does not initiate or hold funds.
A practical verification workflow
For a new Indian supplier, or a change to an existing one, a defensible sequence looks like this:
- Validate the IFSC. Eleven characters, fifth always zero, checkable against the RBI directory. Do not enforce a fixed length on the account number — there isn't one.
- Run a penny drop. Confirm the account is active and capture the returned holder name. Compare it to the legal name on the invoice, not the trade name.
- Cross-check the GSTIN against the PAN. Characters 3 to 12 of the GSTIN are the PAN. If they disagree, the documents are inconsistent before you query anything.
- Check the GSTIN on the GST portal. Confirm status is active and the legal name matches. Free, no login.
- Read the return filing history. This is the step that protects your input tax credit. A pattern of late or missing filings is a commercial risk with a number attached.
- Look up the CIN on MCA21. Confirm active status, incorporation date, registered office and directors. Read the CIN itself for listing status, state, year and entity type.
- Capture the Udyam status. Ask for the Udyam Registration Number and record the classification and registered activity. Micro or small, manufacturing or services, means a 15 or 45-day payment clock that affects your deduction.
- Check the index of charges. Registered loans and mortgages over the supplier's assets, visible free, volunteered by nobody.
- Establish the entity type. A company has a CIN, an LLP an LLPIN, a sole proprietor neither. Verification depth differs accordingly.
- Protect the contract. Following the Supreme Court ruling, tie the GST element of payment to the supplier's filing, or take an indemnity.
- Set the payment terms to the rule, not the negotiation. For micro and small suppliers, a 60-day term is not a term — it is a disallowed deduction with interest attached.
- Monitor. Re-verify on every bank-detail change request, and monitor GST filing status across the supplier base monthly rather than annually.
Bulk, API, or the online platform
Company verification and ownership data on Indian and international suppliers is available through whichever access method fits your team: bulk file checks for onboarding runs and supplier-base reviews, the REST API for verification inside your existing payment workflow, or the online platform for one-off checks with full audit logs.
Frequently asked questions
How do I verify an Indian supplier's bank account?
Run a penny drop. A verification provider sends ₹1 to the account over IMPS, and the receiving bank returns the registered account holder's name along with the account status. Compare that name against the legal name on the invoice. Validate the IFSC separately against the RBI directory, and do not enforce a fixed account-number length, because Indian account numbers vary by bank.
Pair it with a company check: cross-check the GSTIN against the PAN, verify the GSTIN on the GST portal, and look up the CIN on MCA21. In India the company checks also determine whether your input tax credit survives.
What is penny drop verification?
Penny drop is India's standard bank account verification method. A transfer of one rupee is initiated to the account over the IMPS rail, and the receiving bank responds with the registered account holder's name and status flags — active, dormant, frozen or closed. The name is then matched against your records using exact, fuzzy or phonetic logic, and the check completes in seconds.
It is well established in regulation: the RBI has accepted it for KYC since 2016, SEBI permitted it for digital KYC from April 2020, and PFRDA made it mandatory for NPS exits and bank-account changes from July 2021.
What is the difference between penny drop and penny-less verification?
Penny drop moves an actual rupee through IMPS, so the answer comes from the bank that holds the account and includes live account status. Penny-less verification, also called account validation, queries the NPCI database instead and moves no money, which makes it faster and avoids confusing the supplier with an unexplained credit.
The trade-offs are coverage and currency: not every bank participates in the database route, and the response reflects a record rather than a live bank confirmation. For onboarding or a bank-detail change, penny drop is the more definitive of the two.
Does India have an IBAN?
No. India does not use the IBAN system, and Indian account numbers have no fixed length — they vary by bank, commonly between nine and eighteen digits, with no checksum you can validate offline.
The structurally checkable element is the IFSC, an eleven-character code identifying the bank branch: four letters for the bank, a fifth character that is always zero and reserved, and six characters for the branch. Any ERP rule that enforces a fixed account-number length will reject legitimate Indian accounts.
How do I verify an Indian GSTIN?
Use the Search Taxpayer function on the GST portal. It is free, needs no login, and returns the legal name of the business, the trade name, the effective date of registration, the constitution of business, the principal place of business, the taxpayer type, current status — active, cancelled or suspended — and the return filing history.
Before you even query it, check the structure: a GSTIN is fifteen characters, beginning with a two-digit state code, followed by the entity's ten-character PAN, an entity number for that state, a default Z, and a checksum.
Does a GSTIN contain the PAN?
Yes. Characters 3 to 12 of a normal GSTIN are the entity's PAN in full. That makes the two identifiers self-validating: if a supplier provides both on an invoice and the PAN does not match those characters of the GSTIN, the documents disagree and the discrepancy needs explaining before payment.
It also explains something that looks suspicious but is not. GST registration is state-wise while PAN is national, so a supplier operating in five states holds five GSTINs sharing a single PAN. Different GSTINs from the same supplier are normal, provided the embedded PAN is identical.
Can I lose input tax credit if my Indian supplier does not pay GST?
Yes. Section 16(2) of the CGST Act makes input tax credit conditional on the supplier reporting the invoice so it appears in your GSTR-2B, and on the tax having actually been paid to the government. If the supplier collects GST from you and never deposits it, the condition fails and the credit can be denied — even where you hold a valid invoice, received the goods and paid in full.
The Supreme Court, in Bhandari Scrap Traders v. Union of India, dismissed challenges to this and affirmed the Gujarat High Court's judgment in Maruti Enterprise, holding section 16(2)(c) neither unconstitutional nor liable to be read down. The remedy is to reverse the credit and re-avail it once the supplier pays.
How can I check whether an Indian supplier is filing its GST returns?
The public GSTIN search on the GST portal shows return filing details without any login, and reconciling your GSTR-2B each month shows which suppliers' invoices have actually landed. Both are free.
What you cannot see is whether the supplier deposited the cash, because its GSTR-3B payment particulars and electronic ledgers are not accessible to you. Filing history is therefore a proxy rather than a guarantee — but it is the best available signal, and a pattern of late or missing returns identifies the suppliers most likely to cost you credit later.
What is Section 43B(h) and how does it affect paying Indian suppliers?
Section 43B(h) of the Income Tax Act, effective from 1 April 2024, links your tax deduction to paying micro and small enterprises on time. If payment is not made within 15 days of acceptance where there is no written agreement, or within 45 days where there is one, the expense is disallowed that year and becomes deductible only in the year you actually pay.
Late payment also attracts interest under the MSMED Act at three times the RBI bank rate, compounded monthly, and that interest is not deductible either. For a buyer, this converts payment timing from a supplier-relations matter into a tax exposure.
Can I agree 60-day payment terms with an Indian MSME supplier?
Commercially yes, but it will not protect your deduction. The 45-day limit under section 15 of the MSMED Act is an absolute cap, and any agreed credit period beyond it is disregarded for the purposes of Section 43B(h). The disallowance then applies to the full amount, not merely the excess.
In practice this means payment terms for micro and small Indian suppliers should be set to the statutory window rather than negotiated freely. A 60 or 90-day term with such a supplier guarantees the deduction moves into the following year.
How do I check whether an Indian supplier is a registered MSME?
Ask for the Udyam Registration Number and check it against the Udyam portal. What you need from the record is the classification — micro, small or medium — and the registered activity, because both determine whether the payment deadline applies.
Store it against the vendor master and re-check periodically. Classification changes as a supplier grows, and the status that governs is the one current when the invoice is accepted, not the one captured at onboarding two years earlier.
Does the 45-day rule apply to every Udyam-registered supplier?
No, and this catches buyers out in both directions. The rule reaches micro and small enterprises only, so medium enterprises are outside it. More surprisingly, wholesale and retail traders are excluded even when they hold a valid Udyam certificate, because the delayed-payment provisions in section 15 of the MSMED Act apply to manufacturers and service providers.
So a supplier whose Udyam certificate shows trading activity does not trigger a Section 43B(h) disallowance, while treating every Udyam-registered supplier as covered means paying faster than the law requires. The registered activity on the certificate is the field that decides it.
What does an Indian CIN number mean?
A CIN is a twenty-one character code issued by the Registrar of Companies at incorporation, and it encodes six things: listing status (L listed, U unlisted), a five-digit industry code, a two-character state code, the four-digit year of incorporation, a three-character ownership type (PTC private, PLC public, OPC one-person, GOI government), and a six-digit registration number.
So L17110MH1973PLC019786 is a listed, Maharashtra-registered public company incorporated in 1973. Reading the CIN tells you the company's state, age and type before you look anything up — and lets you spot a supplier whose registered state or industry code does not match what it claims to do.
How do I check an Indian company on MCA21?
Search the MCA21 portal by CIN, or use Find CIN if you only have the name. The master data view is free and needs no login, returning the company name, status (active or struck off), date of incorporation, registered office, authorised and paid-up capital, directors and signatories, and the index of charges.
The index of charges is the most under-used field: it lists loans and mortgages registered against the company's assets, which is leverage information a supplier will not volunteer. Check filing recency too — an "active" status alongside a last filing from three years ago is not the reassurance it appears to be.
My Indian supplier has no CIN. Is that a red flag?
Usually not — it is more often the wrong entity type. Only companies registered under the Companies Act receive a CIN. A limited liability partnership has a seven-character LLPIN instead and appears under the separate LLP master data view. A sole proprietorship is not a registered legal person and has no corporate identifier at all.
For a sole proprietor there is no company to look up, so verification rests on the proprietor's PAN and GSTIN plus the penny drop. That is thinner assurance, and worth weighing against the value of what you are buying.
Does a successful penny drop mean an Indian supplier is legitimate?
No. A penny drop confirms the account exists, is active, and returns the name of the holder. It says nothing about the business behind it — which may have been struck off the register, stopped filing GST returns, carry undisclosed charges over its assets, or have no corporate existence at all.
In India there is a further consequence. Because input tax credit depends on your supplier's tax compliance, the company-layer checks are not only a fraud control but a direct protection of money you have already spent. Account verification and company verification answer different questions, and in India the second one has a price attached.
