How Do Aadhaar Authentication and Biometric Verification Work?

Rule 8(4A) of the CGST Rules, 2017 makes Aadhaar authentication optional, with separate verification consequences for an applicant who declines it. Rule 8(4A) applies to an applicant who "opts for authentication of Aadhaar number", which means an applicant may decline. An applicant who declines must give a photograph and have original documents verified at a notified Facilitation Centre under the second proviso. An applicant who declines Aadhaar authentication is also routed to the 30-day physical-verification track under the proviso to Rule 9(1). Aadhaar authentication is mandatory in one case only: a person who has not opted for it cannot register under Rule 14A.

Persons notified under section 25(6D) of the CGST Act are excluded from Rule 8(4A) altogether, because the sub-rule opens with the words "other than a person notified under sub-section (6D) of section 25". Persons the sub-rule does cover are the ordinary applicants who file the wider registration application. The portal's default is Yes: GSTN's manual records that on the Aadhaar Authentication tab, "By default Yes option will be selected", and selecting No produces a warning message. Selecting YES at Option for registration under rule 14A forces Yes for Aadhaar, and the portal shows an error if the two are set inconsistently.

Your application counts as submitted on the date Aadhaar authentication succeeds, or 15 days after Part B of Form GST REG-01 is submitted, whichever is earlier. Rule 8(4A) of the CGST Rules, 2017 fixes the deemed date of submission. Every downstream registration clock runs from that date. The 7 working days in Rule 9(1), the 30 days in its proviso and the 3 working days in Rule 14A(4) all run from it. The applicable approval period begins on the deemed date of submission and is governed separately by Rule 9, Rule 9A or Rule 14A. An applicant who never completes Aadhaar authentication does not stall the file: on day 15 the application is deemed submitted anyway.

The deemed-submission rule entered Rule 8(4A) by Notification No. 62/2020-Central Tax and was restored to the body of the rule by Notification No. 04/2023-Central Tax dated 31 March 2023, which demoted the biometric requirement to a proviso: Rule 8(4A) has been substituted twice and never omitted, and the sub-rule is one of rules 8 to 14A of the CGST Rules. The downstream clocks that run from that deemed date of submission, and what each of them then does, are worked through on the GST registration timeline page.

Biometric verification is required under the first proviso to Rule 8(4A) of the CGST Rules, 2017. The first proviso applies where an Aadhaar-opting applicant is identified on the common portal, based on data analysis and risk parameters. The consequence is biometric-based Aadhaar authentication, plus a photograph, plus verification of the original copy of the documents uploaded with Form GST REG-01. A Facilitation Centre notified by the Commissioner is where that happens, operationally a GST Suvidha Kendra. Where the applicant is not an individual, the biometric and photograph steps are done for the individuals notified under section 25(6C). The application is deemed complete only after completion of the process laid down under the first proviso.

Pages that tell you to expect biometrics because you declined Aadhaar are describing a requirement the second proviso does not contain.

The first proviso prescribes no time limit at all: the 15-day completion window on this branch is GSTN's operational rule rather than the rule text.

Aadhaar authentication is required from the Primary Authorised Signatory and at least one Promoter or Partner. Which Promoter or Partner must authenticate depends on the constitution of business declared in Form GST REG-01. GSTN's registration manual sets out the requirement for each constitution, from proprietorship to Limited Liability Partnership. A company authenticates one director plus the Primary Authorised Signatory; an HUF authenticates the Karta plus the Primary Authorised Signatory. The two-person requirement sits in GSTN's advisory and in the Form, not in Rule 8(4A) itself. Rule 8(4A) does not name the persons at all.

The authentication link is sent to the mobile number and email of the selected Promoters or Partners and Authorised Signatories and is valid for 15 days: a different 15 days again from the 15 days in Rule 8(4A) itself and from the 15-day life of the Temporary Reference Number (TRN). The two-person requirement is stated in the GSTN advisory dated 1 November 2025 and in Form GST REG-32 instruction 3.

The risk parameters that route an application to biometric verification are not published by CBIC or GSTN. "Identified on the common portal, based on data analysis and risk parameters" is the whole of the statutory test in the first proviso to Rule 8(4A). No notification, circular or advisory sets out the criteria, and no threshold, PIN code or document mismatch is named anywhere in the rules. Any list of "reasons you will be flagged" is commentary, not law, wherever you read it. Whether you land on the OTP route or the biometric route is disclosed only after Part B of Form GST REG-01 is submitted.

GSTN's own manual says only that after Form GST REG-01 is submitted, "PAN validation will be done with CBDT and basis risk parameters", and then OTP-based or biometric authentication follows: the portal names the mechanism and not the criteria. That same unpublished test governs the automatic grant within 3 working days under Rule 9A, so an applicant cannot predict that route either.

A GST Suvidha Kendra appointment captures your biometrics and a photograph, and verifies the original copies of the documents you uploaded with Form GST REG-01. GSTN sends an intimation for biometric authentication and document verification instead of the OTP link. The applicant books a slot at the designated GST Suvidha Kendra. Both the selected Promoter or Partner and the Primary Authorised Signatory must attend. GSTN's manual advises that the Promoter or Partner visit the Kendra before the Primary Authorised Signatory. The Primary Authorised Signatory verifies the documents of the Promoter or Partner along with their own. A Facilitation Centre verifies original copies, not photocopies or scans.

1. Intimation arrives: GSTN emails an intimation for biometric authentication and document verification, in place of the Aadhaar OTP link.
2. Book the slot: book an appointment at the designated GST Suvidha Kendra named in the intimation.
3. Promoter or Partner attends first: GSTN advises the Promoter or Partner visit before the Primary Authorised Signatory.
4. Carry originals: carry the original copies of every document uploaded with Form GST REG-01, plus the appointment intimation.
5. Primary Authorised Signatory attends: the Primary Authorised Signatory completes document verification for both persons.

The facility that lets some applicants choose a Kendra in their home State is a top-level menu item rather than a setting inside the application: under Services and then Registration, the portal lists New Registration, Track Application Status, Application for Filing Clarifications and Home State GSK selection for Promoter/Director of specific COBs.

A Promoter or Partner of a Public Limited Company, Private Limited Company, Foreign Company or Unlimited Company may be able to attend a Kendra in their home State. GSTN allows a person listed in the Promoter/Partner tab to attend any GST Suvidha Kendra in their home State where the constitution of business is a Public Limited Company, Private Limited Company, Foreign Company or Unlimited Company. The portal calls the feature Home State GSK selection for Promoter/Director of specific COBs, and decides your home State from the residential address entered in the Promoter/Partner tab of Form GST REG-01. The menu string is the evidence for the limit. The facility's own name, for Promoter/Director of specific COBs, limits it to Promoters or Directors of the specified constitutions of business. Anyone who is not a Promoter or Director, and any constitution of business outside the specified set, is outside the feature by its own title. Proprietorships, partnership firms, LLPs, HUFs, trusts, societies and associations of persons are not covered. The facility never extends to the Primary Authorised Signatory, so where the Promoter/Partner and the Primary Authorised Signatory are the same person, the home-State option is unavailable. A Promoter or Partner whose residential address is outside India must attend the jurisdictional Kendra.

Where the applicant does not qualify, the Promoter or Partner attends a Kendra in the State of registration.

Biometric verification applies in every State and Union territory as a matter of law, and has since 10 July 2024. Notification No. 13/2024-Central Tax dated 10 July 2024 rescinded Notification No. 27/2022-Central Tax, which had excluded every State and Union territory except Gujarat. Rule 8(4B) lets the Central Government notify States or Union territories where the proviso to Rule 8(4A) shall not apply. No notification under Rule 8(4B) is in force. GSTN switched the Suvidha Kendra facility on State by State, in phases through 2024 and into mid-2025. The answer for every State is therefore yes in law; the only open question is where your nearest Kendra is.

Rule 8(4B) is a negative power: the default is that the proviso applies everywhere, and a notification carves States out, rather than notifications switching States on. Notification No. 05/2023-Central Tax dated 31 March 2023 is reported to have added Puducherry to the pre-2024 pilot.

No ARN is generated at all, and the application is treated as never submitted. GSTN's Aadhaar authentication FAQ states that no ARN is generated if a Promoter/Partner or the Primary Authorised Signatory fails to attend. That also follows where a person attends but biometric authentication fails, or document verification is not completed within 15 days. Both provisos to Rule 8(4A) provide that the application is deemed complete only after the process is completed. Form GST REG-01 must then be filed again from Part A. Nothing from the failed attempt carries over.

Missing 15 days costs a plain-OTP applicant nothing and costs a flagged applicant the whole application. If you opted for Aadhaar authentication and were not flagged, GSTN generates an ARN anyway once 15 days pass, and the application moves onto the 30-day track under the proviso to Rule 9(1). If you were flagged into biometric verification, or declined Aadhaar authentication, no ARN is generated at all and Form GST REG-01 must be filed again from Part A. The 15-day deemed-submission rule in Rule 8(4A) itself rescues only the plain-OTP Aadhaar applicant.

Neither proviso prescribes any period. The first proviso and the second proviso each say only that the application "shall be deemed to be complete only after" the process is completed. The 15 days on those branches comes from GSTN's Aadhaar authentication FAQ rather than from the rule text: it is an operational window enforced by the portal, and it comes from GSTN and never from Rule 8(4A). That distinction is why the rule's own 15 days and the branch window are two different things that happen to share a length.

An applicant who declines Aadhaar authentication gives a photograph and has original documents verified at a notified Facilitation Centre, and gives no biometrics. The second proviso to Rule 8(4A) prescribes photograph and original-document verification only, because there is no Aadhaar to authenticate against. The second proviso came into force on 11 February 2025, appointed by Notification No. 09/2025-Central Tax. Declining Aadhaar also routes the application to the 30-day track under the proviso to Rule 9(1), after physical verification of the place of business. A person who has not opted for Aadhaar authentication cannot register under Rule 14A.

• The second proviso was inserted by Notification No. 12/2024-Central Tax dated 10 July 2024 and lay dormant until 11 February 2025: any page describing the non-Aadhaar route as it stood before February 2025 is out of date.
• An applicant selecting No uploads e-KYC documents for the Primary Authorised Signatory and at least one Promoter/Partner, in PDF or JPEG, up to 2 MB, with the name spelled as in the PAN/CBDT database.
• GSTN states that where photo capturing and document verification are not completed within 15 days, no ARN is generated, and that document verification must also be done by the Promoter/Partner.
• Rule 14A(2) disqualifies a non-opting applicant from Rule 14A, except a person notified under section 25(6D).

The drop-down's field label is Type of E-KYC Document. GSTN's instruction, verbatim: Click the Type of E-KYC Document drop-down list to select the type of document for E-KYC. The list of type of documents that can be attached is displayed. Select the document from the list that you wish to upload. The taxpayer selects any one of the following six, which makes it a single-document choice rather than a multi-select:

1. Aadhaar Enrolment Number
2. Passport
3. EPIC (Voter ID Card)
4. KYC Form
5. Certificate Issued by Competent authority
6. Others

GSTN's format sentence for the slot reads File with PDF or JPEG format is only allowed. The maximum size for upload is 2 MB., and its naming rule reads Ensure that the E-KYC documents selected for upload have your name as spelled in PAN/CBDT database. The upload covers the Primary Authorized Signatory and one selected Promoter/Partner only, and is reached by UPLOAD E-KYC DOCUMENTS on the Aadhaar Authentication tab.

Four different steps in GST registration get called authentication, and only one of them is Rule 8(4A) Aadhaar authentication. Aadhaar authentication is an OTP sent to the mobile number and email linked to Aadhaar, through a link valid for 15 days. An e-KYC document upload is what an applicant who declined Aadhaar does instead, for the Primary Authorised Signatory and at least one Promoter/Partner. A Digital Signature Certificate or EVC signs Form GST REG-01 and is a separate step from authentication. Two-factor authentication on the GST portal is a login control for an existing GSTIN, not a registration step.

Digitally signing with a DSC is mandatory for a Limited Liability Partnership and for companies, per GSTN's registration manual, whatever the Aadhaar position; every other applicant may sign with DSC, e-Signature or EVC. Where the authentication link expires or an e-KYC upload fails, the fixes are on the portal errors page.