KYB in India: verifying businesses with GST, CIN & Udyam

Onboarding a business is harder than onboarding a person. A company can be a shell, its registration can be lapsed, its 'directors' can be fronts, and its stated turnover can be fiction. Know Your Business (KYB) is the discipline of verifying that a business is real, active and who it claims to be — and in India, three public identifiers do most of the heavy lifting: GSTIN, CIN and Udyam. Here's how to use each.

GSTIN: is the business real and filing?

The GST Identification Number is a 15-character code, and its structure is verifiable at a glance. The first two characters are the state code; the next ten are the entity's PAN; the thirteenth reflects the registration count for that PAN in that state; the fourteenth is typically 'Z'; and the last is a checksum. Because the PAN is embedded in the GSTIN, the two identifiers cross-validate each other.

Beyond the format, a GSTIN lookup against the GST system returns the legal name, trade name, registration status (active, cancelled or suspended), taxpayer type, jurisdiction, registration date and return-filing history. That's a lot of KYB signal in one call: it confirms the business exists, tells you whether its registration is still live, and — through the filing history — whether it's an operating concern or a dormant shell. A GSTIN that's cancelled or hasn't filed returns in a long time is a red flag worth pausing on.

CIN and MCA data: the company's official record

For incorporated companies, the Corporate Identification Number is the master key. It's a 21-character code that encodes whether the company is listed, its industry, its state of registration, its year of incorporation, its company class, and its registration number with the Registrar of Companies. Reliance Industries' CIN — L17110MH1973PLC019786 — decodes exactly this way: listed, a 1973 incorporation in Maharashtra, a public limited company.

The CIN unlocks the Ministry of Corporate Affairs (MCA) master data, which is the authoritative record for a company: its current status (active, dormant, struck off or under liquidation), incorporation date, registered office, authorised and paid-up capital, and — critically for due diligence — its directors and their Director Identification Numbers (DINs). Checking company status catches struck-off and dormant entities; checking directors against their DINs surfaces disqualifications and lets you see what else those individuals are involved in. This is where shell structures and fronted directorships tend to reveal themselves.

Udyam: MSME status and its thresholds

For micro, small and medium enterprises, Udyam registration is the standard evidence of MSME status. The registration number follows the format UDYAM-XX-00-0000000 (a state code and a serial), and a certificate is issued on registration. MSME classification was revised effective 1 April 2025, with substantially higher ceilings: micro enterprises up to ₹2.5 crore investment and ₹10 crore turnover; small up to ₹25 crore and ₹100 crore; medium up to ₹125 crore and ₹500 crore. Classification now updates automatically from ITR and GST data rather than manual renewal. Verifying Udyam status matters wherever MSME status carries a benefit — priority-sector lending eligibility being the obvious one — and confirms a business is what it claims to be for that purpose.

Why KYB is worth doing properly

KYB underpins three things: merchant onboarding, where payment aggregators owe due diligence on the businesses they board; business lending, where the entity's existence, status and financials drive the credit decision; and fraud prevention, where shell entities and GST-status mismatches are classic warning signs. Verifying GSTIN, CIN and Udyam together — cross-checking the PAN that links them — turns a name on an application form into a business you can actually trust.

FinHub brings GST verification, company (CIN/MCA) verification and MSME/Udyam verification together in one API platform, so you can validate a business end to end — existence, status, directors and MSME classification — in a single onboarding flow.