Starting April 1, 2025, Multi-Factor Authentication (MFA) became mandatory for all GST taxpayers accessing the GST portal. This security enhancement requires users to verify their identity using at least two independent authentication factors - typically a password plus an OTP. The phased rollout began January 2025 for high-turnover businesses, and now applies to every GST-registered entity in India. This guide walks you through the setup process and explains why MFA matters for your business.
What is Multi-Factor Authentication and Why is it Mandatory?
- Definition: MFA requires two or more verification factors (password + OTP)
- Purpose: Strengthen security against unauthorized access and fraudulent filings
- GSTN Advisory: Reducing risk of data breaches and misuse of GST credentials
- Accountability: Ensures only authorized personnel access GST portal
- Compliance mandate from FY 2025-26 for all taxpayers
Phased Rollout Timeline
- January 1, 2025: Mandatory for businesses with AATO > Rs 20 crore
- February 1, 2025: Mandatory for businesses with AATO > Rs 5 crore
- April 1, 2025: Mandatory for all taxpayers and users (no threshold)
- Extended to e-Way Bill and e-Invoice systems from April 1, 2025
Available Authentication Methods
- Option 1: SMS-based OTP to registered mobile number (traditional method)
- Option 2: Sandes App - government messaging app with OTP generation
- Option 3: NIC-GST-Shield App - specialized offline OTP generator (no internet required)
- Choosing the right method based on connectivity and convenience
Step-by-Step Setup Guide for MFA
- Step 1: Visit GST portal (gst.gov.in) and log in with credentials
- Step 2: Navigate to Profile > My Profile on the main menu
- Step 3: Click '2-Factor Authentication' or 'Security Settings'
- Step 4: Select preferred OTP method (SMS/Sandes/NIC-GST-Shield)
- Step 5: Download and configure chosen app (if using Sandes or NIC-GST-Shield)
- Step 6: Test authentication by logging out and back in
- Troubleshooting: What to do if OTP doesn't arrive or apps malfunction
Additional Security Changes in FY 2025-26
- Biometric authentication for company promoters and directors
- Verification at GST Suvidha Kendras for enhanced security
- Extension of Aadhaar-based verification for GST registration
- MFA requirements for e-Way Bill and e-Invoice system access
Best Practices for Secure GST Portal Access
- Keep registered mobile number updated in GST records
- Download official apps only from trusted sources (Google Play/App Store)
- Use strong, unique passwords and change them regularly
- Train all authorized signatories and employees on MFA usage
- Maintain backup authentication method in case primary fails
Need help configuring MFA for your GST portal or training your accounts team? Mark IT Solutions provides GST compliance support and TallyPrime integration services. Contact us for hands-on assistance with the new security requirements.