No GST Registration Without Biometric Aadhaar Authentication: What the Delhi High Court's Nationwide Direction of 8 September 2026 Changes for Every New Applicant

TL;DR: On 8 September 2026, in Neha v Union of India (W.P.(C) 12210/2026), a Division Bench of the Delhi High Court (Anil Kshetarpal and Shail Jain JJ) directed that "for the time being ... all the authorities across the country" are "not to allow any GST Registration without biometric based AADHAR authentication henceforth". Until that order, the biometric visit to a GST Suvidha Kendra was reserved, under the proviso to Rule 8(4A) of the CGST Rules, for applicants the portal flagged on "data analysis and risk parameters"; other Aadhaar opt-ins cleared with an OTP, and those who did not opt for Aadhaar went to the Kendra for a photograph and document check but no biometric. The court found that a ministerial statement to Parliament that biometric authentication was mandatory had, more than a year later, "not been fully implemented", and that fake registrations on stolen PAN and Aadhaar details were continuing: Central Tax formations booked 2,800 such cases in 2023-24 (5,699 fake firms, Rs 15,085 crore detected) and 1,654 in 2024-25 (3,977 firms, Rs 13,109 crore). The direction is interim, the government may report practical difficulties, and the matter is listed on 22 September 2026. If you are filing a REG-01 this month, plan for a Suvidha Kendra appointment for every applicant and every individual notified under Section 25(6C), and build the extra days into the timeline.

1. The case

The petitioner found two GST registrations obtained in her name on her stolen PAN and Aadhaar details, which were then used, she alleged, in an attempt to move more than Rs 4.46 crore out of her savings account with Punjab National Bank. She complained to the GST authorities in March 2026 and, getting nowhere, moved the High Court for an investigation. The court heard her petition with Vikram Kaushal v Director General of Income Tax (Investigation), W.P.(C) 6218/2026, which raised the same problem.

The order of 8 September is the third in a short sequence. On 21 August the bench recorded its concern at "rampant" fraudulent registrations in the ninth year of GST, asked senior advocate Tarun Gulati to propose preventive measures, and issued notice to the Commissioner of Police. On 1 September it gave the CGST Commissioner, the Delhi GST Commissioner and the Police Commissioner a final opportunity to come back with effective safeguards. On 8 September it stopped waiting.

2. What the order says

The reports of the order agree on the operative words:

"Hence, for the time being, directions are issued to all the authorities across the country not to allow any GST Registration without biometric based AADHAR authentication henceforth."

and on the finding behind them:

"It appears that despite passage of more than one year, the statement given by the minister on the floor of the house has not been fully implemented, resulting in continuous fake GST Registration obtained using stolen or frozen PAN/AADHAR details."

Three features of the order matter for what you do next. It is interim: "for the time being", pending the next hearing, and the bench gave the government liberty to place any practical difficulty in implementing it. It is prospective: "henceforth", so it is about registrations granted from now on and says nothing about existing GSTINs. And it is addressed nationally: "all the authorities across the country". The respondents include the Union of India and the CBIC, whose common portal processes every registration application in the country, which is the practical route by which a Delhi order reaches an applicant in Kochi. Whether a State authority outside Delhi is formally bound by it is a question the order does not discuss; the safer assumption for anyone advising an applicant is that it will be applied.

The "statement given by the minister on the floor of the house" is the written reply to Lok Sabha Unstarred Question 3952 of 18 August 2025, which told the House that biometric-based Aadhaar authentication "driven by data analytics and risk-based parameters" had been implemented for registration applications throughout the country, and which carried the figures above. The court's point is that "driven by risk parameters" is not "mandatory".

The bench also has before it a further set of suggestions placed over the 1 and 8 September hearings: a dedicated risk parameter at the Directorate General of Analytics and Risk Management for PAN-Aadhaar mismatches and for the first-time use of a PAN-Aadhaar pair in a registration; facial-recognition matching against the Aadhaar database; preservation of the IP address and device details used to apply; video verification; and a requirement that the applicant name identifiable people who can vouch for the business. None of those is ordered yet. The authorities are to respond on 22 September.

3. What the rules already said

This is the part most of the coverage skipped, and it is the part that decides how much actually changes for you.

Section 25(6A) to (6D) of the CGST Act, in force since 2020, require Aadhaar authentication for registration: by the individual applicant, and, where the applicant is a company, firm, trust or other entity, by the individuals notified under sub-section (6C). The sub-section lists a wide class (Karta, managing director, whole-time directors, partners, trustees, members of the managing committee, authorised signatory), but the class actually notified, by Notification No. 19/2020-Central Tax with effect from 1 April 2020, is narrower: the authorised signatory of all types, the managing and authorised partners of a partnership firm, and the Karta of a Hindu undivided family. A company's other directors are not on that list, and the court's order does not add to it. Sub-section (6D) lets the government exempt classes of persons by notification, and Notification No. 03/2021-Central Tax of 23 February 2021 did so for, among others, persons who are not citizens of India, government departments, local authorities, statutory bodies and public sector undertakings.

Rule 8(4A) is the mechanism. An applicant who opts for Aadhaar authentication authenticates while submitting Part B of REG-01, normally by OTP to the Aadhaar-linked mobile. The first proviso, substituted by Notification No. 04/2023-Central Tax of 31 March 2023, adds the biometric layer, but only for some:

"... every application made under sub-rule (4) by a person ... who has opted for authentication of Aadhaar number and is identified on the common portal, based on data analysis and risk parameters, shall be followed by biometric-based Aadhaar authentication and taking photograph of the applicant ... along with the verification of the original copy of the documents uploaded with the application in FORM GST REG-01 at one of the Facilitation Centres notified by the Commissioner ... and the application shall be deemed to be complete only after completion of the process laid down under this proviso."

A second proviso, inserted by Notification No. 12/2024-Central Tax of 10 July 2024 and brought into force on 11 February 2025, sends the applicant who did not opt for Aadhaar to the Facilitation Centre anyway, for a photograph and document verification. Rule 8(4B) lets the government notify States where the proviso does not apply. GSTN rolled the biometric functionality out State by State through 2024 and 2025, each time with an advisory in the same form: after you submit REG-01 you receive either a link for OTP-based Aadhaar authentication or a link to book an appointment at a GST Suvidha Kendra; the ARN is generated only after the biometric authentication and document verification are done.

So the law already had biometric authentication in it. What it did not have was biometric authentication for everyone. The portal's risk engine chose who went to the Kendra, and the court's finding is that this selective application is what a statement to Parliament described as "mandatory". The order closes that gap by direction, not by amending the rule: the words "identified on the common portal, based on data analysis and risk parameters" are still in Rule 8(4A), but, for the time being, the authorities have been told not to grant a registration without the biometric step whether or not the portal flagged the case.

4. What changes for an applicant this month

Two practical consequences follow. First, timelines lengthen. Rule 9(1) gives the officer seven working days "from the date of submission of the application", and Rule 8(4A) fixes that date, for an applicant who authenticates Aadhaar, at the date of authentication or fifteen days from Part B, whichever is earlier; the proviso adds that a Kendra case is complete only when the Kendra process is done, and GSTN's advisories say the ARN issues only then. The order changes none of those clocks, but it puts the Kendra step in front of every one of them, so slot availability at the Kendra, not the officer's queue, becomes the constraint. Second, every notified individual has to be available in person. For a partnership with two managing partners and a separate authorised signatory in three cities, that is three appointments, each in the jurisdiction the intimation e-mail specifies. The Kendra visit needs the appointment confirmation, the original Aadhaar and PAN, and the originals of every document uploaded with the application.

What has not been announced, as at 13 September, is how GSTN will apply the direction on the portal: whether every application will now receive the appointment link rather than the OTP link, and from what date. Watch the portal's advisories. GSTN did announce one registration change this week, in an advisory dated 10 September: contextual guidance and field-level tooltips inside REG-01, live from 1 September. It is unrelated to the order but shows the form is being worked on.

5. Rule 14A applicants and the small-business route

The simplified registration under Rule 14A, in force since 1 November 2025 for applicants whose monthly output tax on supplies to registered persons will not exceed Rs 2.5 lakh, was built on Aadhaar authentication and electronic grant within three working days "from the date of submission of application". The court's direction does not carve it out. Sachin's explainer on Rule 14A covers how that route works; on the current wording of the order, a Rule 14A applicant should expect the Kendra step too, and since the date of submission is the Aadhaar-authentication date under Rule 8(4A), the three days in practice count from the Kendra visit. The reported agenda for the 57th GST Council, now on 7 October, includes registration simplification for applicants above the Rs 2.5 lakh line, which is the same territory from the opposite direction.

6. If a GSTIN already exists in your name

The petitioner's situation is the one to plan for, because a fraudulent registration on your PAN creates tax demands, e-way bills and bank transactions you know nothing about until a notice arrives.

1. Check. The GST portal's "Search Taxpayer" facility lets you search by PAN and lists every GSTIN registered against it, in every State. Do it for yourself and, if you advise clients, for each of them once a year.
2. Complain in writing, on the day you find it, to the jurisdictional Commissioner named against the GSTIN, and file a police complaint. The petitioner's complaint in March 2026 is what put her before the High Court in August.
3. Do not pay a demand raised on a registration you did not obtain without taking advice. The demand is against the registered person; the question of who that is, is exactly what the complaint disputes.
4. Keep the Aadhaar and PAN hygiene going: lock the Aadhaar biometrics on the UIDAI portal when not in use, and treat a request for both documents together as a request for the keys to a GSTIN.

7. What happens on 22 September

The government has been given room to explain what it cannot do. It could say the portal can implement a universal biometric route within weeks; it could say Kendra capacity in some States will not carry it; it could come with a notification amending Rule 8(4A) so that the direction becomes the rule. The court could confirm the direction, modify it, or add some of the measures from section 2. Until one of those happens, the operative words are the ones in the order. Sachin's page on input tax credit conditions covers the other end of the same fraud, the buyer who took credit from a supplier who never existed, and the 57th Council preview tracks the registration reforms on the Council's reported agenda.

Sources

• Neha v Union of India & Ors, W.P.(C) 12210/2026 with CM APPL. 56533/2026, and Vikram Kaushal v DGIT (Investigation) & Ors, W.P.(C) 6218/2026, Delhi High Court, Division Bench (Anil Kshetarpal and Shail Jain JJ): orders of 21 August, 1 September and 8 September 2026, as reported; next listed 22 September 2026.
• CGST Act, 2017: section 25(6A) to (6D); Notification No. 03/2021-Central Tax dated 23 February 2021 (classes exempt from Aadhaar authentication).
• CGST Rules, 2017: Rule 8(4A) and its provisos (first proviso substituted by Notification No. 04/2023-Central Tax dated 31 March 2023; second proviso inserted by Notification No. 12/2024-Central Tax dated 10 July 2024, in force 11 February 2025 by Notification No. 09/2025-Central Tax); Rule 8(4B); Rule 9(1) and proviso; Rule 14A (Notification No. 18/2025-Central Tax dated 31 October 2025).
• GSTN advisories on biometric-based Aadhaar authentication and document verification for GST registration applicants, issued State by State (the Sikkim advisory of 1 May 2025 is the template quoted).
• Lok Sabha Unstarred Question No. 3952, answered on 18 August 2025 by the Minister of State for Finance: cases booked by Central Tax formations for fraudulent registrations obtained on stolen or forged PAN/Aadhaar details, 2,800 cases and 5,699 fake firms with Rs 15,085 crore detected in 2023-24; 1,654 cases, 3,977 firms and Rs 13,109 crore in 2024-25; the reply also states that biometric authentication "driven by data analytics and risk-based parameters" had been implemented throughout the country. These are the figures the court recorded.
• Notification No. 19/2020-Central Tax dated 23 March 2020 (persons notified under section 25(6C), effective 1 April 2020).

This article describes an interim order of 8 September 2026 as reported by the legal press, and the CGST Act and Rules as in force on 13 September 2026. The order can be modified on 22 September or earlier, and the portal's implementation had not been announced when this was written. Check the GST portal's advisories before advising an applicant on the process.