Vendor KYC Verification: How to Check PAN, GSTIN and MSME Status Before Onboarding a Vendor

Vendor KYC verification is the set of checks a business runs before adding a supplier to its vendor master: confirming the vendor's PAN, GST registration, MSME status and bank details are real, current and belong to the business you are paying. Skipping it rarely causes a problem on day one. The cost shows up later as TDS deducted at the wrong rate, input tax credit (ITC) that cannot be claimed, interest on late MSME payments, and hours spent cleaning up the vendor master before an audit.

This guide explains the four checks that matter most for Indian businesses, what each one prevents, where to run it, and a checklist your accounts payable team can use at onboarding.

Why vendor KYC matters for tax compliance

Every payment to a vendor touches at least one tax rule:

• TDS is deducted against the vendor's PAN. A missing, invalid or inoperative PAN means TDS at a higher rate, and credit that may not reach the vendor.
• GST input tax credit depends on the supplier's registration being valid and on the supplier reporting your invoice in its GST returns.
• MSME payment rules require payments to micro and small enterprises within the time allowed under the MSMED Act; delayed payments can lose the expense deduction for that year (see our guide on Section 43B(h)).
• Lower deduction certificates let you deduct TDS at a lower rate, but only within the certificate's limit and period.

Getting these right once, at onboarding, is far cheaper than correcting TDS returns, chasing suppliers for GST corrections, or recalculating disallowances at year-end.

The four vendor KYC checks

1. PAN verification

Check three things: that the PAN exists, that the name on it matches the vendor, and that it is operative. A PAN that is not linked with Aadhaar (where linking is required) becomes inoperative, and TDS is then deducted as if no PAN had been furnished, at a higher rate.

Record the PAN status and the date you checked it. PAN status can change, so a PAN that was operative at onboarding may not be next year.

2. GSTIN verification

The GST portal's public Search Taxpayer service shows whether a GSTIN is active, cancelled or suspended, along with the legal and trade name. Match the legal name to the vendor's documents and check that the state code in the GSTIN matches the address on the invoice.

A useful cross-check: characters 3 to 12 of a GSTIN are the business's PAN. If the PAN inside the GSTIN does not match the PAN the vendor gave you, stop and ask why.

3. GST return filing status

A valid registration is not enough. ITC on your purchase depends on the supplier reporting the invoice in its GST returns, so that it appears in your GSTR-2B. A vendor who files irregularly is an ITC risk even if its registration is active. Check filing status at onboarding and periodically after that, especially for high-value suppliers.

4. MSME (Udyam) status

Ask for the vendor's Udyam Registration Number and verify it, or run a PAN-based check if you only have the PAN. Record the category (micro, small or medium) and the date you checked. Our guide on how to check MSME status by Udyam number or PAN explains each method.

The category decides your payment obligations: the MSMED Act time limits apply to micro and small enterprises, not medium ones.

Other checks worth adding

• Bank account validation, so payments go to an account in the vendor's name.
• Lower or nil deduction certificate, if the vendor gives one: record the certificate number, the limit and the validity period, and stop applying the lower rate once either runs out.
• Company status on MCA, for corporate vendors, so you are not onboarding a company that has been struck off. See our MCA strike-off status guide.

Vendor onboarding KYC checklist

• PAN collected, verified, name matched and status (operative/inoperative) recorded with the date.
• GSTIN verified as active; legal name and state code match the vendor's documents.
• PAN inside the GSTIN matches the vendor's PAN.
• GST return filing status checked.
• Udyam number verified, or a PAN-based MSME check run; category recorded.
• Vendor declaration taken if the vendor says it is not registered as an MSME.
• Bank account validated in the vendor's name.
• Lower deduction certificate (if any) recorded with limit and validity.
• Maker-checker approval before the vendor is activated for payment.
• Re-check date set (at least yearly, and after 1 April for MSME classification).

When to re-check vendors

Vendor KYC is not a one-time task. Re-check:

• Every year after 1 April, when MSME classifications can change based on the previous year's data.
• Before high-value or long-term contracts.
• When ITC mismatches appear for a supplier in GSTR-2B reconciliation.
• When a TDS default shows a PAN error for a deductee.

For an existing vendor master with thousands of records, a bulk clean-up is faster than one-by-one checks. Our guide on vendor master clean-up covers how to do it.

How VenCPC handles vendor KYC

VenCPC is Figment's vendor management software for banks, NBFCs and enterprises. For vendor KYC, the relevant features are:

• Vendor registration by GSTIN, PAN or MSME data, including vendors registered by PAN only or unregistered.
• Real-time GST and PAN validation through Income Tax and GSTN APIs, flagging discrepancies and partial matches for review.
• MSME (Udyam) number and category recorded in the vendor master.
• Lower deduction certificate details captured for TDS.
• Maker-checker approval workflows with role-based branch access before a vendor is activated.
• Vendor GST filing status and ITC monitoring after onboarding.

To run the same checks from your own ERP, Figment's PAN verification API, GST verification API and MSME verification API are available.

Key takeaways

• Vendor KYC verification protects TDS, GST input tax credit and MSME payment compliance.
• Check PAN status (operative or not), GSTIN status, GST filing status and MSME category before activating a vendor.
• The PAN inside a GSTIN is a quick cross-check against the PAN the vendor gives you.
• Record every check with a date, and re-check at least yearly.