Aadhaar Verification for GST Registration: OTP, Biometric and the Fixes When It Fails

Short answer: Aadhaar verification is the identity check built into GST registration. Most applicants clear it with an OTP sent to the mobile number linked to their Aadhaar. Applicants the system flags on risk parameters are sent to a GST Suvidha Kendra for biometric authentication instead. Skip it, and your application moves to physical verification of your place of business.

If you are applying for GST registration right now, this is probably the step that decides how fast you get your GSTIN. Not your documents. Not your business address. This one check. I have seen clean applications sail through in days and equally clean ones stall for a month, and the difference was almost always what happened at the Aadhaar step.

What Aadhaar verification actually is

Section 25(6A) to (6D) of the CGST Act, 2017 creates the framework: a person applying for registration must authenticate their Aadhaar number, or furnish proof of possession of it, in the manner the rules prescribe. Rule 8(4A) of the CGST Rules, 2017 supplies the two manners. The first is simple authentication, done with an OTP. The second is biometric-based authentication, done in person, along with a photograph and verification of the original documents you uploaded.

Think of it the way airports work. Most passengers check in online and walk straight to the gate. A few get called to the counter for a document check. Nobody at the counter is accusing you of anything. The system simply picked your file for a closer look. OTP verification is the online check-in. Biometric verification is the counter.

One confusion to clear first: signing your application with a Digital Signature Certificate does not tick the Aadhaar box. They are two different steps. The DSC proves the application was signed by an authorised person. Aadhaar authentication proves that person is who they claim to be. You need both where both apply.

Who has to authenticate

It is not every person named anywhere in the application. The GST portal's constitution-wise position is narrower, and it follows a pattern: one key person from the business plus the primary authorised signatory.

Where the proprietor and the primary authorised signatory are the same person, that person authenticates once in each capacity the portal asks for. Certain notified classes — government departments, public sector undertakings, local authorities and statutory bodies — are excluded from the requirement under Section 25(6D). If you are a regular business, assume it applies to you.

The OTP route: what actually happens

After you submit Part B of Form GST REG-01, the portal sends an authentication link to the email address in your application. For most applicants, that link leads to OTP-based authentication. The OTP goes to the mobile number linked to the Aadhaar of the person authenticating — not to the mobile number you typed into the GST application, and not to your office number. That distinction causes more failures than any other single thing.

Once authentication succeeds and the application is otherwise complete, the officer route under Rule 9 runs on a seven-working-day clock. CBIC's Circular No. 257/03/2026-GST, dated 26 October 2026, restates this plainly: Aadhaar-authenticated applications are processed within seven working days, while applications needing physical verification run to thirty days.

The biometric route: who gets flagged, and where you go

Some applicants are identified on the common portal on the basis of data analysis and risk parameters. The rules do not publish the parameters, so no honest guide can tell you in advance whether you will be flagged. If you are, the email after REG-01 carries a different link: one to book an appointment at a designated GST Suvidha Kendra (GSK).

At the centre, the process is biometric authentication of the person, a photograph, and verification of the original copies of the documents you uploaded. As of GSTN's March 2025 advisory, biometric authentication was enabled in 33 States and Union Territories, with the remaining few to follow — which is why the only reliable answer to "will I need to visit a centre?" is the link your own application generates.

One practical relief from that same advisory: promoters and directors of companies who are selected for biometric authentication can, in most states, choose any GSK in their home state instead of travelling to the centre mapped to the business jurisdiction. The catch is that this choice is one-time and cannot be changed once made, and it is not available where the promoter or director is also the primary authorised signatory — the primary authorised signatory must visit the jurisdictional centre for document verification.

Rule 14A makes Aadhaar authentication compulsory, not optional

This is where the stakes jump. Under Rule 14A(2), inserted by Notification No. 18/2025-Central Tax (G.S.R. 805(E), 31 October 2025, effective 1 November 2025), a person who has not opted for Aadhaar authentication is simply not eligible for the fast-track registration route. There is no workaround and no officer discretion on this point.

Under Rule 14A(4), once authentication succeeds, registration is granted electronically within three working days. If you think you might qualify for the fast track, check your eligibility first with the Rule 14A eligibility checker before you file — opting out of authentication by accident costs you the three-day route entirely. The full fast-track conditions are covered in our Rule 14A guide, and the wider registration picture in the GST guide.

What happens if you skip it

Choosing not to authenticate, or failing to complete it, does not reject your application. It reroutes it. Under the proviso to Rule 9(1), registration is then granted only after physical verification of your place of business under Rule 25, and the thirty-day clock applies instead of seven working days. An officer visits, photographs the premises, and files the report in Form GST REG-30.

That is a real delay, not a technicality. A month of waiting for a GSTIN is a month of not issuing tax invoices, not claiming input tax credit cleanly, and explaining to customers why your number is still "applied for". If you can authenticate, authenticate. The physical-verification route exists as a safety net for people who genuinely cannot, not as an equal alternative.

The four failures I see most, and the fix for each

Your Aadhaar-linked mobile number is old. Fix that first

This deserves its own section because it is the failure that wastes the most time. A mobile number linked to Aadhaar cannot be changed fully online through the myAadhaar web portal. The standard route is a visit to an Aadhaar Seva Kendra or authorised enrolment centre, where the change is verified with your biometrics. The prescribed fee for a demographic update of this kind is ₹75. UIDAI's newer Aadhaar app offers a remote update for eligible users, but only where the old Aadhaar-linked number is still accessible for verification — if your old number is dead or was never registered, the centre visit is the route that works.

Do this before you file REG-01, not after. Filing first and discovering the OTP problem second means your application sits unauthenticated while you sort out a different department's queue.

Five mistakes to avoid

• Assuming the OTP comes to the number in your GST application. It comes to the Aadhaar-linked number.
• Opting out of Aadhaar authentication "to keep it simple", then losing the Rule 14A three-day route.
• Filing with a PAN–Aadhaar name mismatch and hoping the portal overlooks it. It will not.
• Choosing a primary authorised signatory who cannot attend a GSK visit, in a case that gets flagged.
• Treating DSC signing as a substitute for authentication. It is not.

Frequently asked questions

Is Aadhaar verification compulsory for GST registration?

For most applicants, effectively yes. You can choose not to authenticate, but the price is physical verification of your premises and a thirty-day timeline instead of seven working days. For Rule 14A fast-track registration, authentication is a hard eligibility condition, not a choice.

OTP or biometric — who decides which one I get?

The common portal decides, based on data analysis and risk parameters that are not published. After you submit REG-01, your intimation email carries either an OTP authentication link or a GSK appointment-booking link. That email is your answer.

Does a company need every director to authenticate?

No. One director plus the primary authorised signatory is the portal's position for companies. The same one-plus-signatory pattern applies across constitutions, as the table above shows.

What if my Aadhaar is not yet assigned, or I have no Aadhaar?

The Act provides alternate and viable means of identification where Aadhaar has not been assigned, and physical verification of the premises is the route the rules prescribe in that situation. Expect the thirty-day timeline.

How long does the whole registration take once authentication succeeds?

On the ordinary officer route, seven working days for a complete, authenticated application. On the Rule 14A route, three working days from successful authentication. On the no-authentication route, thirty days including physical verification.

If your registration is stuck at this step, or you are unsure whether the fast-track route is open to you, our GST registration service handles the authentication sequencing as part of the filing — including the cases where a centre visit turns out to be needed.