UDIN: What It Is, When It's Mandatory, and How to Generate One

For most of the profession's history, a chartered accountant's signature on a certificate was the only thing standing between that document and a forger. Anyone could type a firm name, scan a signature, invent a membership number, and hand the result to a bank as proof of turnover. The bank had no way to check, because there was nothing to check against. UDIN, the Unique Document Identification Number, exists to close exactly that gap: an 18-digit number generated by the signing member on ICAI's portal, quoted on the document, and verifiable by anyone who receives it.

What the Number Actually Proves

A UDIN does not certify that the contents of a document are correct. It certifies something narrower and more useful: that a specific member, holding a specific membership number, generated this number against a document of this type, for this client, carrying these key financial figures, on this date. When a bank, a regulator, or a government department enters the UDIN on the verification portal, it sees those particulars and can compare them with the document in its hand. If the figures do not match, or the number was never generated, the document is not what it claims to be. That is the whole mechanism, and it is why regulators adopted it so quickly: RBI, SEBI, CBDT, MCA, and the banks now routinely ask for UDIN on documents they receive, and several of their systems reject submissions without one.

Which Documents Need a UDIN

The requirement was rolled out in phases and now covers essentially the full range of attest work performed by a member in practice. That includes all certificates issued to clients, whether for turnover, net worth, capital contribution, or any of the dozens of purposes for which banks and departments ask a CA to certify a figure. It covers GST and income tax audit reports. It covers statutory audit reports and the accompanying financial statements, and it covers the wider category of assurance and attestation engagements. The practical rule members use is simpler than the phase-wise notification history: if you are signing something in your capacity as a chartered accountant in practice, and someone outside your firm will rely on it, assume it needs a UDIN and check before deciding otherwise.

The obligation attaches to the individual member who signs, not to the firm. A partner signing on behalf of the firm generates the UDIN under their own membership number and their own portal login, and the number is theirs. Only members holding a Certificate of Practice can generate one, which is itself part of the control: a member who has not taken a COP has nothing to attest with.

The Generation Window

This is the part that catches people, because the rule changed. UDIN was originally meant to be generated at or very close to the time of signing, within a tight window of days. That proved impractical in a profession where documents are signed in volume during filing season, and ICAI extended the permitted window substantially, to 60 days from the date of signing. That extension is a genuine relief, but it is not an invitation to batch everything to the end. The number has to be quoted on the document itself, which means generating it after the document has left your office creates an awkward gap: the client has a signed certificate with no number on it, and you have a number attached to nothing they hold. The disciplined approach, and the one every firm eventually arrives at, is to generate at signing and write the number onto the document before it goes out.

Generating and Revoking

1. Log in to the UDIN portal at udin.icai.org using your membership number and portal credentials. First-time users register with their membership details.
2. Choose the document category: certificate, GST and tax audit, or audit and assurance. The fields you are asked for differ by category, which is deliberate.
3. Enter the client's name or code, the date of signing, and the document description.
4. Enter the key financial figures the document turns on, selected from the prescribed list. These are what a verifier will later see, so they need to match the document exactly.
5. Generate. The 18-digit number is issued immediately and appears in your UDIN history.
6. Write the number on the signed document, conventionally near your signature and membership number.

A UDIN can be revoked, and the facility exists for good reason: a document signed in error, a figure that turns out to be wrong, or an engagement withdrawn after the certificate was issued. Revocation requires a reason, and the revocation and its reason are visible to anyone who subsequently verifies the number. That visibility is the point. A revoked UDIN tells a verifier that the member no longer stands behind the document, which is precisely the signal a bank relying on it needs. What revocation does not do is erase history, so it is a correction mechanism rather than a way to make an inconvenient certificate disappear.

What Happens If You Don't Generate One

Not generating a UDIN where one is required is treated as professional misconduct under the Chartered Accountants Act, which puts it in the same category as the other disciplinary matters the Institute pursues rather than in the category of administrative oversights. The practical consequences usually arrive sooner than the disciplinary ones. Filing utilities and regulator portals increasingly refuse documents without a valid UDIN, banks return certificates for correction, and a client who discovers their certificate cannot be verified will ask why. For a firm, the reputational cost of a document that fails verification is disproportionate to the two minutes generating the number would have taken.