In India, §§25(6B) and 25(6C) of the Central Goods and Services Tax Act, 2017 (CGST Act) make Aadhaar authentication a condition of GST registration, commenced on 1 April 2020. Rule 8(4A) of the CGST Rules, 2017 sends a failed or skipped authentication into physical verification under Rule 25 and strips the deemed approval that Rule 9(5) would otherwise give.
TL;DR for founders
Aadhaar authentication is not paperwork — it is the fork in the registration road. Complete it and your application runs on a short clock with a real chance of automatic approval. Skip it, or fail it, and an officer has to physically visit your premises before anything issues, which is where weeks disappear. Two things surprise people. The exemption list is categorical, so a foreign-national director or a government buyer does not need to authenticate and should not be pushed into it. And the obligation does not end at registration: if you never authenticated, you will hit the wall later when you apply for a refund or try to revive a cancelled GSTIN, because both of those are gated on it.
The statutory architecture, in four sub-sections
Section 25 carries the whole framework in four adjacent sub-sections, and identifying the right one is the first step in any registration dispute:
| Provision | Who it reaches | Commencement |
|---|---|---|
| §25(6A) | Persons already registered — inserted by the Finance Act 2021 | Operationalised through Rule 10B |
| §25(6B) | An individual applicant | 1 April 2020 (CGST_18_2020) |
| §25(6C) | Authorised signatories of all types, managing and authorised partners of a partnership firm, and the Karta of a Hindu Undivided Family | 1 April 2020 (CGST_19_2020) |
| §25(6D) | Government's power to notify who is out | Exercised by CGST_17_2020, superseded by CGST_03_2021 |
Both commencement notifications carry the same proviso, and it is narrower than it is usually read: where an Aadhaar number has not been assigned to the person, an alternate and viable means of identification under Rule 9 must be offered. That is a route for the genuinely un-enrolled — not for an applicant whose Aadhaar exists but is inconvenient to authenticate.
Who is out, and why the list matters commercially
Notification 17/2020-Central Tax (CGST_17_2020) originally disapplied §§25(6B) and (6C) to persons who are not citizens of India and to any class other than the four categories named in those sub-sections. Notification 3/2021-Central Tax (CGST_03_2021), dated 23 February 2021, superseded it with a consolidated six-category list:
- Persons who are not citizens of India
- A Department or establishment of the Central or State Government
- A local authority
- A statutory body
- A public sector undertaking
- A person applying for registration under §25(9)
Notification 36/2021-Central Tax (CGST_36_2021) then inserted a reference to sub-section (6A) alongside (6D), aligning the exemption with the post-Finance-Act-2021 architecture that reaches already-registered persons.
The commercial point is that the exemption is categorical — no application, no relief order. A partnership with a foreign-national managing partner, a foreign company's Indian subsidiary with a non-citizen authorised signatory, or a PSU taking a fresh registration should be routed to documentary KYC from the outset. Pushing such an applicant through Aadhaar authentication it cannot complete converts a clean registration into a Rule 25 physical-verification case for no reason.
What Rule 8(4A) actually does
Rule 8(4A), inserted by Notification 16/2020-Central Tax (CGST_16_2020) as part of the CGST (Third Amendment) Rules, 2020, does two things and neither is a refusal:
- It routes the application into physical verification of the place of business under Rule 25.
- It removes deemed approval under Rule 9(5).
That second limb is the expensive one. Deemed approval is what converts registration from a discretionary act into a clock-driven one; without it, the application sits until an officer acts. The whole compliance value of authenticating is timeline certainty, not eligibility.
Rule 8(4B) is the companion switch: it lets the Government specify the States and Union Territories in which the Rule 8(4A) biometric requirement operates at all.
The sequencing consequence is worth planning for. A business that needs a GSTIN before a specific date — to raise its first invoice, to onboard onto a marketplace, or to meet a tender condition — should treat the authentication step as the critical path item and complete it at the moment of filing FORM GST REG-01, not after a query lands. Where the signatory genuinely cannot authenticate, the alternative is to substitute a signatory who can before filing, rather than to file and then attempt to amend. An amendment after the application has already been routed to Rule 25 verification does not retrospectively restore deemed approval; the file stays on the physical-verification track it entered.
Veritect Legal AI
The biometric rollout is the single most misquoted chain in GST registration practice, because it moved four times in eighteen months and then reversed. Notification 27/2022-Central Tax (
CGST_27_2022), dated 26 December 2022, used Rule 8(4B) to switch biometric authentication off everywhere except Gujarat — a single-State pilot against fraudulent registrations. It was amended in March 2023, then Notification 31/2023-Central Tax (CGST_31_2023) added the Union Territory of Puducherry from 31 July 2023. Notification 13/2024-Central Tax (CGST_13_2024) then rescinded the December 2022 notification entirely on 10 July 2024, as part of a mid-2024 rationalisation of registration-phase authentication. Anyone advising on a registration application in a given State on a given date has to resolve that sequence — including whether the requirement was re-notified under a fresh instrument rather than the rescission leaving a gap. Veritect Legal AI holds all four notifications with their Rule 8(4B) linkage and effective dates, so a query such as "was biometric Aadhaar authentication required for a Puducherry registration application filed in May 2024" resolves to a single answer instead of a four-notification reconciliation.
How an application is actually processed
CBIC Instruction 03/2023-GST (INS_03_2023), effective 14 June 2023, is the operative verification protocol and the best single document for testing whether a rejection or a query was procedurally sound. It was issued as the standing counterpart to the Special All-India Drive against fake registrations, and was later complemented by Instruction 03/2025-GST of 17 April 2025, which tightened documents-list discipline.
The protocol runs in sequence:
- Task List scrutiny immediately on ARN landing.
- Document check on FORM GST REG-01 against public sources — land registry, electricity distribution company, municipal records.
- DGARM risk rating of High, Medium or Low, consulted through Report Series 400.
- PAN-history scrutiny for past cancellation, suspension or rejection.
- Query in FORM GST REG-03, reply in REG-04, rejection in REG-05, on a seven-working-day timeline for Aadhaar-authenticated applications.
- Physical verification under Rule 9 read with Rule 25 in non-Aadhaar-authenticated cases, and in authenticated cases where the officer deems it essential, with the report in FORM GST REG-30 uploaded in advance.
- Post-grant verification within fifteen days where a High-risk application was approved on Aadhaar authentication, on referral to the jurisdictional Commissionerate; deemed-approval cases are supervised by the Principal Chief Commissioner or Chief Commissioner.
Two defensive uses follow directly. A REG-03 query outside the indicative grounds in the instruction is challengeable as beyond the sanctioned scope. And a Rule 25 physical verification whose REG-30 report was not uploaded in advance is procedurally defective — the instruction requires the upload, and its absence is discoverable.
After the certificate: two obligations that outlive registration
Bank account within 45 days. Rule 10A, inserted by Notification 31/2019-Central Tax (CGST_31_2019) as part of the CGST (Fourth Amendment) Rules, 2019, requires a newly registered person to furnish bank account details within 45 days of the grant of registration or by the due date of the first return under §39, whichever is earlier. Enforcement is not a penalty — it is cancellation under Rule 21. This is the most commonly missed post-registration step because the certificate has already issued and nothing forces the action.
Aadhaar authentication for the registered person. Rule 10B, inserted by Notification 35/2021-Central Tax (CGST_35_2021) and commenced from 1 January 2022 by Notification 38/2021-Central Tax (CGST_38_2021), requires an already-registered person to authenticate, and gates two applications on it: revocation of cancellation of registration under Rule 23, and refund under Rule 89. A business that skipped authentication at registration discovers the gap when it needs a refund released or a cancelled GSTIN restored — precisely when it has the least time to fix it.
The CBIC registration FAQ (FAQ_registration-under-gst_2019) remains a useful orientation to the application flow, but it predates the entire Aadhaar layer and should not be relied on for the authentication position.
FAQ
Q: Who must complete Aadhaar authentication to get GST registration?
A: Section 25(6B) of the Central Goods and Services Tax Act, 2017 (CGST Act) covers an individual applicant and Section 25(6C) covers authorised signatories of all types, managing and authorised partners of a partnership firm, and the Karta of a Hindu Undivided Family. Notification 18/2020-Central Tax (CGST_18_2020) and Notification 19/2020-Central Tax (CGST_19_2020) both commenced these requirements on 1 April 2020, and each carries the same proviso: where an Aadhaar number has not been assigned to the person, an alternate and viable means of identification under Rule 9 of the CGST Rules, 2017 must be offered. Section 25(6A), inserted by the Finance Act 2021, extends authentication to persons already registered.
Q: Which applicants are exempt from Aadhaar authentication?
A: Notification 3/2021-Central Tax (CGST_03_2021), issued under §25(6D) of the CGST Act on 23 February 2021, supersedes the original exemption notification and lists six categories: persons who are not citizens of India; a Department or establishment of the Central or State Government; a local authority; a statutory body; a public sector undertaking; and a person applying for registration under §25(9). Notification 36/2021-Central Tax (CGST_36_2021) later inserted a reference to sub-section (6A) alongside sub-section (6D), aligning the exemption with the post-Finance-Act-2021 architecture. The exemption is categorical — it does not require an individual application for relief — but documentary KYC verification still applies.
Q: What happens if the applicant does not complete Aadhaar authentication?
A: Rule 8(4A) of the CGST Rules, 2017, inserted by Notification 16/2020-Central Tax (CGST_16_2020), routes the application into physical verification of the place of business under Rule 25, and critically removes the benefit of deemed approval under Rule 9(5). The practical consequence is timeline rather than refusal: an Aadhaar-authenticated application runs on the short statutory clock, while a non-authenticated one waits for an officer to visit the premises and upload a report in FORM GST REG-30. CBIC Instruction 03/2023-GST (INS_03_2023) directs that physical verification under Rule 9 read with Rule 25 be carried out in non-Aadhaar-authenticated cases, and in Aadhaar-authenticated cases where the officer deems it essential.
Q: Where does biometric Aadhaar authentication apply?
A: Rule 8(4B) of the CGST Rules lets the Government specify the States and Union Territories in which the Rule 8(4A) biometric requirement operates. Notification 27/2022-Central Tax (CGST_27_2022), dated 26 December 2022, switched it off everywhere except the State of Gujarat — a single-State pilot aimed at fraudulent registrations. Notification 31/2023-Central Tax (CGST_31_2023) added the Union Territory of Puducherry from 31 July 2023. Notification 13/2024-Central Tax (CGST_13_2024) then rescinded the December 2022 notification on 10 July 2024 as part of a wider rationalisation of registration-phase authentication, so the operative State list must be checked against the current notification rather than assumed.
Q: What does CBIC Instruction 03/2023-GST require an officer to do?
A: Instruction 03/2023-GST (INS_03_2023), effective 14 June 2023, sets the verification protocol for registration applications. The officer scrutinises the Task List on ARN landing; checks FORM GST REG-01 documents against public sources such as the land registry, the electricity distribution company and municipal records; consults the DGARM risk rating of High, Medium or Low through Report Series 400; and examines PAN history for past cancellation, suspension or rejection. Queries issue in FORM GST REG-03, replies in REG-04 and rejection in REG-05, on a seven-working-day timeline for Aadhaar-authenticated applications. High-risk applications approved on Aadhaar authentication are referred to the jurisdictional Commissionerate for post-grant physical verification within fifteen days.
Q: Does Aadhaar authentication apply after registration is granted?
A: Yes. Rule 10B of the CGST Rules, inserted by Notification 35/2021-Central Tax (CGST_35_2021) and commenced from 1 January 2022 by Notification 38/2021-Central Tax (CGST_38_2021), requires an already-registered person to undergo Aadhaar authentication, and gates two specific applications on it — revocation of cancellation of registration under Rule 23, and refund under Rule 89. A business that never completed authentication at registration therefore discovers the gap at the worst possible moment: when it needs a refund released or a cancelled GSTIN restored.
Q: What is the bank-account obligation that follows registration?
A: Rule 10A of the CGST Rules, inserted by Notification 31/2019-Central Tax (CGST_31_2019) as part of the CGST (Fourth Amendment) Rules, 2019, requires a newly registered person to furnish bank account details within 45 days of the grant of registration or by the due date of the first return under §39 of the CGST Act, whichever is earlier. Enforcement runs through Rule 21, under which registration may be cancelled for the failure. It is the most commonly missed post-registration step because the certificate has already issued by then and nothing on the dashboard forces the action.
Related on Veritect: GST registration and deregistration — the full lifecycle · Casual and non-resident taxable persons — §27 registration and advance tax · Rule 16A temporary identification number
Sources
Primary CBIC and Government of India sources relied on for this explainer:
- CBIC Tax Information Portal — notification and instruction text: taxinformation.cbic.gov.in
- CBIC GST portal (archival notifications and the Registration FAQ manual): cbic-gst.gov.in
- GST Council — recommendations underlying the biometric-authentication rollout: gstcouncil.gov.in
- CGST Act, 2017 — §§25, 29, 39: indiacode.nic.in
- Gazette of India — notification publication: egazette.gov.in
Corpus anchors: CGST_16_2020, CGST_17_2020, CGST_18_2020, CGST_19_2020, CGST_03_2021, CGST_36_2021, CGST_35_2021, CGST_38_2021, CGST_27_2022, CGST_31_2023, CGST_13_2024, CGST_31_2019, INS_03_2023, FAQ_registration-under-gst_2019.
This explainer is general information on Indian central GST law and is not legal or tax advice. Verify the operative notification and the State-wise biometric position for the period in question before acting.
Beyond this brief Preview
This article covers the framework. The full compliance picture includes the verbatim text of §25 sub-sections (6A) to (6D) with the §25(9) cross-reference, Rules 8(4A), 8(4B), 9, 10A, 10B, 21 and 25 in sequence, the complete six-category exemption text of Notification 3/2021-Central Tax, the full State-and-date chain of the biometric rollout across Notifications 27/2022, 31/2023 and 13/2024 with the intervening March 2023 amendment, the seven-step verification protocol of Instruction 03/2023-GST including its indicative grounds for a REG-03 query and its FORM GST REG-30 upload requirement, and the documents-list discipline added by Instruction 03/2025-GST. Veritect Legal AI holds all fourteen anchor instruments cited above in full text, supersession-tracked, so practitioners can resolve queries such as "was deemed approval available on a non-Aadhaar-authenticated application filed in Maharashtra in August 2023" or "does a statutory body's authorised signatory need to authenticate" against the operative sources rather than secondary summaries. Access through veritect.ai.