Vendor Compliance in India: GST, MSME, EPFO, ESIC and TDS Checks Explained

Most vendor compliance failures are not discovered by the business. They are discovered by an auditor, or by an assessing officer disallowing a claim, or by an inspector on a site visit.

By then the compliance gap is typically months old, and the vendor who caused it may no longer be working with you.

The uncomfortable part of vendor compliance in India is that almost none of the consequences fall on the vendor. They fall on you.

What Vendor Compliance Actually Means

Vendor compliance is the ongoing verification that your suppliers hold, and continue to hold, the statutory registrations their business activity requires.

It is not the same as collecting documents. A PDF of a GST certificate proves that a registration existed on the day it was issued. It says nothing about whether that registration is active today.

The distinction matters because Indian statutory registrations are not permanent. GST registrations get cancelled, both voluntarily and by the department. Udyam certificates require periodic updating. Insurance lapses. Labour registrations become applicable when a vendor’s headcount crosses a threshold, and nobody informs you when that happens.

The Five Checks That Matter

1. GST registration status

Verify the GSTIN against the GST portal’s Search Taxpayer service. It returns the registered legal name, the registration status, the date of registration, and the type of taxpayer.

Two things to check rather than one. First, that the status is active. Second, that the legal name matches the entity you are actually contracting with — a mismatch between the contracting party and the GSTIN holder creates its own problems at assessment.

What it costs you if this lapses: input tax credit. If a vendor’s registration is cancelled and they continue to raise invoices charging GST, you have paid the tax and cannot claim it. The vendor has your money; the department has nothing from them.

2. MSME classification

Verify Udyam registration against the Udyam Registration portal.

This check runs in the opposite direction to the others. You are not protecting yourself from a non-compliant vendor — you are establishing an obligation you take on.

Under the MSMED Act, payment to a registered MSME supplier is due within 15 days where there is no written agreement, and within the agreed period up to a maximum of 45 days where an agreement exists. Your standard 60-day payment terms do not override this.

What it costs you if you get this wrong: interest on delayed payment, and a disclosure obligation in your financial statements regarding amounts outstanding to MSME suppliers.

3. EPFO registration

EPFO registration becomes applicable to an establishment at 20 or more employees.

This matters most for manpower suppliers, contractors, housekeeping and security vendors — anyone whose workers are deployed on your premises or on your work.

What it costs you if this lapses: principal employer liability. Where a contractor fails to make provident fund contributions for workers engaged on your work, the obligation can fall to you as principal employer. You end up paying contributions for people who were never on your payroll.

4. ESIC registration

ESIC applies at 10 or more employees, covering those earning up to Rs. 21,000 per month.

The same principal employer logic applies. The exposure here is sharper because ESIC covers medical benefit — if an uninsured contract worker is injured on your site, the consequences are immediate and personal rather than merely financial.

5. TDS return filing history

This is the check most businesses skip, and it is purely financial.

Under Section 206AB of the Income Tax Act, a higher rate of TDS applies where a vendor has not filed income tax returns for the specified period. The Income Tax portal provides a compliance check utility for exactly this purpose.

Separately, some vendors hold a lower or nil deduction certificate under Section 197. That certificate has a validity period, and deducting at the reduced rate after it expires is your error, not theirs.

What it costs you if you get this wrong: short deduction. You become liable for the shortfall plus interest, and the amount is recovered from you rather than from the vendor who benefited.

Vendor Compliance at a Glance

Why One-Time Verification Fails

Most businesses verify at onboarding and never again. That is the single largest gap in vendor compliance, and it exists because nothing prompts a re-check.

Consider what changes without anybody telling you:

A vendor’s GST registration is cancelled for non-filing. They keep invoicing. Nobody at your end notices, because the invoice looks identical to last month’s.

A vendor grows from 15 employees to 25 and becomes liable for EPFO registration. They may not register. You have no visibility into their headcount.

A Section 197 certificate expires mid-year. Your accounts payable team continues deducting at the reduced rate because that is what the vendor master says.

An insurance policy for a contractor working on your premises lapses. Nobody notices until there is an incident.

In every case, the compliance status changed and your records did not. The documents on file are accurate as of the day they were filed and misleading thereafter.

What a Workable Compliance Process Looks Like

Record expiry dates, not just documents. A certificate stored without its validity period is a document you will have to check manually. A certificate stored with its expiry date is something a system can watch.

Set a re-verification cadence by risk. Not every vendor needs quarterly checking. A high-spend contractor with workers on your site is a different proposition from a stationery supplier. Tier the frequency the way you tier onboarding depth.

Make the vendor master the single source. Where compliance status lives in a spreadsheet separate from the vendor record used for payments, the two will diverge. The person raising the payment needs to see the compliance status without going to look for it.

Block rather than warn. A warning gets dismissed under time pressure. Where a vendor’s compliance has lapsed, the sensible control is to prevent new purchase orders until it is resolved.

Keep the evidence. Compliance is only useful if you can demonstrate it. Screenshots of portal verifications, dated and attached to the vendor record, are what an auditor actually wants to see.

Structurally, this is the same discipline that payroll compliance requires — recurring obligations, fixed consequences for missing them, and a record that has to hold up under review.

Where This Sits in the Vendor Lifecycle

Compliance verification is one stage of a broader sequence. It follows document collection and precedes approval — the full vendor onboarding process covers where it fits and what surrounds it.

After onboarding, compliance stops being a step and becomes a state that has to be maintained. That is where most of the failures happen, and it is what vendor management software is for: holding the expiry dates, issuing the alerts, and keeping the evidence attached to the vendor record.

Frequently Asked Questions

What is vendor compliance?
Vendor compliance is the ongoing verification that suppliers hold the statutory registrations their business requires — GST, MSME, EPFO, ESIC, TDS filing status and category licences — and that those registrations remain valid throughout the relationship.

How do I check if a vendor’s GST registration is still active?
Use the Search Taxpayer service on the GST portal with the vendor’s GSTIN. It returns the registration status and legal name. Confirm both: that the status is active, and that the legal name matches the entity named in your contract.

What happens if I pay a vendor whose GST registration has been cancelled?
You lose the input tax credit on those invoices. You have paid the tax component to the vendor, but cannot claim it against your own liability. The exposure is the full GST amount on every affected invoice.

Am I liable if my contractor does not pay PF for their workers?
Potentially, yes. Where a contractor engaged on your work fails to make provident fund contributions for those workers, the obligation can fall to you as principal employer. This is why EPFO registration should be verified for any manpower or site contractor.

What are the EPFO and ESIC thresholds?
EPFO registration applies to establishments with 20 or more employees. ESIC applies at 10 or more employees, covering those earning up to Rs. 21,000 per month.

Why does MSME status affect my payment terms?
Under the MSMED Act, payment to a registered MSME supplier is due within 15 days where no written agreement exists, and within the agreed period up to a maximum of 45 days where one does. Standard longer payment terms do not override this.

How often should vendor compliance be re-verified?
It depends on risk rather than a fixed interval. Contractors with workers on your premises warrant frequent checks; low-value suppliers with no site access need far less. What matters more than frequency is that expiry dates are tracked so re-verification is triggered rather than remembered.

Is collecting compliance documents enough?
No. A stored certificate proves a registration existed on the date of issue. Verification against the source portal confirms it is valid now. The second is what protects you.

Conclusion

Vendor compliance in India is unusual in that the party bearing the risk is not the party creating it. A vendor who lets their registration lapse suffers little; the business paying them absorbs the disallowed credit, the recovered TDS, or the contribution liability.

That asymmetry is the reason to treat compliance as an ongoing state rather than an onboarding formality. The checks themselves are straightforward. What is difficult is noticing when something has changed — which is a records problem, not a legal one.

This article is general information, not legal or tax advice. Statutory thresholds and rates are amended periodically. Confirm the current position with your advisor before acting.