Two Registries. Enormous Data. Real-Time Access.
India runs two of the most data-rich business registries in the world: the Goods and Services Tax Network (GSTN) and the Ministry of Corporate Affairs' MCA21 system. Together, they cover virtually every formally registered business in the country — over 14 million active GST registrations and 2.7 million registered companies. And critically, both registries expose real-time verification APIs.
For procurement, finance, and compliance teams building vendor onboarding workflows, these registries are the fastest, most authoritative source of information about the businesses you are dealing with. This post covers exactly what data is available, what it tells you, and what its limitations are.
GSTN: What You Can Verify via the GST API
GSTIN Validity
A simple validity check tells you whether a GSTIN actually exists in the registry. This catches the most basic fraud: vendors who provide a fictitious or expired GSTIN to claim input tax credit eligibility. The check returns in under a second.
Business Name and Registration Details
The GSTN API returns the legal name of the entity, trade name (if different), registration date, and registration address. Cross-reference this against the vendor's own letterhead and contract to identify discrepancies — name mismatches are a common indicator of entity substitution fraud.
GST Filing Status
Returns the vendor's filing compliance record: whether they have filed GSTR-1, GSTR-3B, and annual returns for the relevant periods. A vendor who has not filed GST returns in the last 6 months is a material risk flag for two reasons:
- You cannot claim input tax credit on invoices from a non-compliant supplier
- Non-filing is often a precursor to entity dissolution or abandonment
Business Category and Turnover Band
The API returns the business category (goods, services, or both) and the annual turnover band. While not a precise revenue figure, the turnover band provides a sanity check against a vendor's stated size — a vendor claiming ₹50 crore in annual revenue registered in a sub-₹5 crore turnover band warrants investigation.
Cancellation Status
A GSTIN can be cancelled voluntarily (business closure) or by the GST officer (for persistent non-compliance). The API shows cancellation status, reason, and effective date. You should not be processing invoices from a cancelled GSTIN — this is one of the most common vectors for tax fraud in the Indian supply chain.
MCA21: What You Can Verify via the Company Registry
Company Existence and Status
The MCA21 API confirms whether a company (Private Limited, LLP, Public Limited, etc.) is active, struck off, under liquidation, or dormant. A struck-off company cannot legally enter new contracts — but many continue to do so because their counterparties do not check.
Registered Address and Date of Incorporation
The registered address on MCA21 should match what the vendor has provided you. Mismatches — particularly where the vendor claims a premium address but is registered at a residential address or a company formation agent — warrant scrutiny.
Director Information
MCA21 exposes the list of current directors, their DIN (Director Identification Number), date of appointment, and designation. You can cross-reference this list against the signatory on vendor contracts — is the person signing the contract actually a current director of the entity?
Filing Compliance
Annual return and financial statement filing status is available via the API. A company that has not filed annual returns for two years is in default and may be in the process of being struck off by the Registrar.
Charges and Hypothecations
The charges register shows any security interests registered against the company's assets — bank loans, debentures, or asset-backed financing. Relevant for assessing financial health and for understanding encumbered assets in supply chain financing contexts.
What These APIs Cannot Tell You
It is important to be clear about the limitations:
- Actual financial performance: MCA21 contains filed annual returns, but these are often 12–18 months behind and audited financials are not always filed on time
- UBO structure for complex group entities: Beneficial ownership beyond the direct directors requires additional investigation
- Reputational risks: Neither registry surfaces adverse media or litigation beyond what is filed with the MCA
- Partnership firms, sole proprietors, and trusts: These entities are not registered under MCA and not required to have a GSTIN if their turnover is below the threshold
This is why real-time registry checks should be the starting point, not the entirety, of vendor due diligence. They are fast, authoritative, and free of the subjectivity that plagues manual document reviews — but they need to be supplemented with director identity checks, sanctions screening, and where warranted, adverse media search.