KYB for merchant onboarding: GSTIN, CIN and UBO in one flow

Onboarding a merchant means knowing the business, not only the person signing up for it. In India that knowledge is spread across several registers: GST for tax registration, the company register for companies and LLPs, Udyam for small businesses, and whatever ownership information you can assemble. This guide walks through each and shows how they fit into one flow.

Start from the business PAN

A business's PAN is the thread that ties its registrations together. A GSTIN is fifteen characters long: a two-digit state code, then the business's ten-character PAN, an entity number, the letter Z by default, and a check character. Because the PAN sits inside it, one PAN can lead you to every GST registration a business holds, and many businesses hold several, one for each state where they operate.

Searching for GST registrations by PAN, where the source permits it, is a good first step. The list may be incomplete, and a registration linked to a PAN shows the relationship on record rather than anything more about ownership.

GSTIN: what the register shows

A GSTIN check returns what the GST register holds about a registration:

• its status, such as active, suspended or cancelled;
• the legal name and the trade name;
• the constitution of the business, such as a proprietorship, partnership or private limited company;
• the state jurisdiction, registration date and business activities.

Compare the legal name with what the merchant entered, and check that the registration is active. An active registration does not show that the business files its returns on time, so a filing-status check is worth adding: gaps in the filing history are a useful signal, though a filed return says nothing about whether it was accurate.

CIN and LLPIN: the company register

Companies carry a 21-character Corporate Identity Number that encodes whether the company is listed, its industry code, the state, the year of incorporation, the type of company and a registration number. LLPs have an LLPIN instead. The register's master data shows the company's status, its type, its date of incorporation, capital details and, where permitted, its officers.

Master data tells you the company exists and what state it is in on the register. It is not a certificate of good standing, and it is not a complete picture of who owns the business.

Udyam for small businesses

Many merchants are micro, small or medium enterprises with an Udyam registration. Checking it confirms the registration and shows the enterprise's classification and main activity. The classification is what the source reports as of a particular date, so record that date and let your policy decide how recent it must be.

An Udyam registration is linked to the enterprise's PAN, so check that it is the same PAN that sits behind the GST registrations you found. A different PAN usually means a different legal entity, which is worth understanding before you go further.

UBO: who is really behind the business

Ultimate beneficial owners are the people who ultimately own or control a business. They are the hardest part of KYB, because no single register gives a complete answer: shareholdings can be layered through other companies, and declarations need to be checked against what the registers show. Your KYC policy sets the ownership thresholds you apply and what evidence you need.

Koshio's draft catalogue includes ownership analysis and screening checks, but they are not among the APIs described on this site yet. Until they are, plan for ownership to need declarations and review alongside the register checks.

Putting it into one flow

A typical merchant onboarding flow runs in this order:

• Find the GST registrations linked to the business PAN.
• Verify each GSTIN you rely on, and check its filing history.
• For companies and LLPs, look up the company record.
• For small businesses, check the Udyam registration.
• Verify the settlement account before the first payout.
• Collect ownership declarations and run the screening your policy requires.
• Make your decision.

When the registers disagree

Expect differences between registers, and decide in advance which ones matter:

• Legal and trade names. A shop may trade under a name that appears nowhere on its company record. Compare the legal name, and treat the trade name as supporting detail.
• Proprietorships. The legal name on a proprietor's GST registration is usually the proprietor's own name, so the business name the merchant gave you may only appear as the trade name.
• Addresses. Each GST registration has its own place of business, and none of them need match the address on the company record.
• Timing. A change made on one register can take time to appear on another, so a mismatch may simply be a recent update.

After onboarding

A merchant that passed every check last year can look different today. GST registrations are cancelled, companies are struck off and settlement accounts are closed. Re-checking at points your policy sets, such as before a renewal, a limit increase or an unusually large settlement, catches these changes before they cost you, without re-running every check on every transaction.

Keep the evidence

Registers rarely agree character for character: names are formatted differently and records are updated at different times. Keep the source and as-of time of every answer, and the reason behind every partial match, so a reviewer or auditor can see what was checked and why the decision was made. A short note from the reviewer on why a difference was accepted is often the most useful record of all. Koshio's business verification APIs are designed to return that evidence with every result. Access is by request while the platform is being built.