GST Portal Non-Core Amendment OTP Verification (Rule 10A & Rule 19): Complete Compliance Guide for CAs & CFOs

Introduction to the GST Non-Core Amendment OTP Mandate

The Goods and Services Tax Network (GSTN) has rolled out a critical validation mechanism affecting registration modifications. Under the updated architecture of the GST portal, any non-core field amendment—such as changes to trade names, principal or additional places of business, bank account details, or contact information—now mandates explicit secondary authentication. Specifically, the modification requires distinct One-Time Password (OTP) verification authenticated directly by the Promoter, Partner, or Primary Authorized Signatory within a strict 3-day operational window. Failure to complete this validation within the stipulated timeline results in the automatic purging or expiration of the amendment application, forcing taxpayers to initiate the filing process afresh.

For Chartered Accountants, Tax Consultants, and Chief Financial Officers (CFOs), this update introduces significant operational friction. It shifts the compliance burden from standard digital signature certificate (DSC) or Electronic Verification Code (EVC) filings by authorized tax practitioners to direct stakeholder intervention. Understanding the statutory underpinning and restructuring internal ERP and compliance workflows is imperative to prevent delayed registrations, mismatched master data, and subsequent disruptions in electronic waybill (e-way bill) generation or invoice reporting under electronic invoicing frameworks.

Section 1: Statutory Framework & Legal Background

The legal authority for enforcing authentication and registration modification workflows stems from the Central Goods and Services Tax (CGST) Act, 2017, and the corresponding CGST Rules. Compliance professionals must review the following statutory provisions governing registration amendments and authenticity:

• Section 28 of the CGST Act, 2017: Empowers the proper officer to amend the registration certificate based on applications filed by the registered person, subject to prescribed verification checks and procedural safeguards.
• Rule 19 of the CGST Rules, 2017: Governs amendments to the certificate of registration. While core fields (such as legal name, addition/deletion of partners/directors, or principal state of business) require approval from the tax officer, non-core fields previously allowed auto-amendments. The new validation layer overlays Rule 19 to ensure that non-core updates are genuinely authorized by the entity's leadership.
• Rule 10A of the CGST Rules, 2017: Mandates the furnishing of bank account details soon after obtaining registration or within the prescribed time limit. Any subsequent modifications to bank details via non-core amendments are heavily scrutinized under this rule to curb fraudulent input tax credit (ITC) pass-through and shell company operations.

Non-Compliance & Penalty Consequences: If an amendment application expires due to the lapse of the 3-day OTP window, the changes are not updated in the electronic registry. Continuing to issue invoices with unverified addresses or bank details can lead to disputes during departmental audits under Section 65 or scrutiny proceedings under Section 61. Furthermore, discrepancies between bank accounts registered on the GST portal and those reported in financial statements can trigger automated notices for mismatch, potential freezing of refund processing under Section 54, and cascading risks of ITC disallowance for recipients under Section 16(2) due to invalid supplier master records.

Section 2: Scope of Expansion & Applicability Matrix

The enhanced OTP verification protocol applies universally across various legal entity types registered under the GST regime. However, the operational impact varies based on the governance structure and designation of the Primary Authorized Signatory.

• Proprietorship Concerns: The OTP is sent directly to the registered mobile number and email ID of the Proprietor. Since the proprietor is both the promoter and primary signatory, coordination is direct, though dependency on personal communication channels remains a vulnerability.
• Partnership Firms and LLPs: Amendments initiated by tax professionals or accountants must be explicitly cleared via OTP sent to the designated Partner or Primary Authorized Signatory. If the primary signatory is unavailable, the application stalls.
• Private Limited and Public Limited Companies: The OTP workflow requires interception by the Managing Director, whole-time director, or an authorized promoter listed in the original registration profile. Internal corporate hierarchies can create bottlenecks if compliance teams fail to route the OTP request through proper authorization channels.
• Impacted Field Categories: The mandate covers all non-core fields, notably addition/deletion of additional places of business, modification of email/mobile contacts, and changes to bank account particulars linked to the taxpayer profile.

Section 3: Step-by-Step Operational & ERP Workflow

To navigate the 3-day validity window without application expiration, organizations must institutionalize a rigid operational workflow linking tax compliance teams with executive leadership.

1. Initiation Phase: The tax compliance team or retained CA firm logs into the GST portal, selects 'Services > Registration > Amendment of Registration Non-Core Fields', and updates the requisite details.
2. Triggering Validation: Upon submitting the modification form, the portal prompts for verification. Instead of immediate direct submission via standard practitioner EVC, the system triggers an OTP to the Promoter, Partner, or Primary Authorized Signatory.
3. Alert and Routing: The ERP or internal compliance tracker must instantly flag the generation of the OTP request. Finance teams must notify the designated promoter via secure messaging or internal ticketing systems.
4. Authentication Window: The promoter enters the OTP received on their Aadhaar/PAN-linked mobile and email within the strict 72-hour (3 days) threshold.
5. Final Submission & Reference Number: Post-OTP validation, the system generates an Application Reference Number (ARN). The status updates automatically in the dashboard, completing the amendment cycle.

Section 4: Comparison of Previous Practice vs New Mandate

The following table outlines the operational shift introduced by the updated GST portal architecture for non-core amendments:

Section 5: Action Plan Checklist for Finance & Audit Teams

Finance leaders, internal auditors, and tax practitioners should implement this 5-point checklist immediately to safeguard operational continuity and master data integrity:

• ✔ Audit Signatory Contact Data: Verify that mobile numbers and email addresses of all Promoters, Partners, and Primary Authorized Signatories updated on the GST portal are active, accessible, and monitored.
• ✔ Establish Internal Sla Protocols: Set a strict internal SLA of 24 hours for completing non-core amendment OTP validations to comfortably beat the 3-day portal expiration deadline.
• ✔ Update Master Data Governance: Ensure any changes in bank accounts or business addresses are reconciled across ERP master files only *after* the ARN is successfully generated on the GST portal.
• ✔ Train Compliance Staff: Educate accounts payable and tax filing teams regarding the discontinuation of single-step non-core updates to prevent abandoned applications.
• ✔ Implement Automated Tracking: Deploy tracking mechanisms within internal compliance dashboards to monitor active GST amendment ARN statuses and prevent missed verification windows.