Skip to content

India Compliance Requirements: KhataOS MVP Spec

Status as of: 2026-10-19. Scope: Indian SMEs (proprietorships, partnerships/LLPs, private companies) keeping books in KhataOS, a local-first desktop accounting app. Not legal advice. This file turns statutes, rules and portal advisories into software requirements. Get a practising CA to confirm each item before release, and re-check GSTN and CBDT advisories every quarter. The portal-level rules change often.

Confidence tags: - [PRIMARY] means confirmed against statute or rule text, or an official government or ICAI document. - [SECONDARY] means reported consistently by reputable professional or commentary sources, but the official text was not retrieved. - [UNCERTAIN] means sources conflict, the item is proposed but not notified, or it is interpretive. Flagged for review.

0. MVP must-do checklist (summary)

# Capability Driven by
1 Always-on, non-disableable audit trail: an append-only edit log of every create, alter, delete or cancel on vouchers and masters, recording who, when and before/after values. Kept for at least 8 years and protected against tampering, including at the database level. Applies to all entity types, not only companies Companies (Accounts) Rules r.3(1) proviso; CGST Rule 56(8)
2 FY-based books (1 Apr to 31 Mar), period locking, and unique invoice and CN/DN series per FY (16 characters max, [A-Za-z0-9/-] only) Companies Act s.2(41); CGST Rules 46(b), 53
3 GSTIN validation (format, state code, PAN, checksum), place-of-supply engine, CGST+SGST/UTGST vs IGST split, effective-dated rate and cess masters IGST Act ss.7 to 13; Notif. 9/2025-CT(R)
4 Rule 46 invoice fields; HSN at 4 or 6 digits by AATO; B2C/B2CL/B2B classification (B2CL threshold ₹1 lakh) CGST Rules 46, 59(4); Notif. 78/2020-CT
5 GSTR-1/IFF JSON export (Table 12 HSN split B2B/B2C; Table 13 documents); GSTR-3B computation; GSTR-2B/IMS reconciliation; GSTR-9 data CGST ss.37, 39, 44; Rule 59; GSTN advisories
6 e-Invoice (IRP) JSON per INV-01 schema, IRN and signed-QR storage and printing, 30-day guard, 24-hour cancellation; e-way bill Part A/B JSON CGST Rules 48(4), 138; Notif. 10/2023-CT
7 TDS/TCS on the Income-tax Act 2025 regime from 1 Apr 2026 (s.393 and new Forms 138/140/143/144), with 1961-Act logic kept for earlier periods Income-tax Act 2025; Income-tax Rules 2026
8 MSME vendor tagging, 15/45-day due-date tracking, overdue and disallowance report MSMED Act s.15; ITA 1961 s.43B(h) / ITA 2025 s.37
9 Schedule III Balance Sheet and P&L (Division I) mapping, with rounding rules and ageing schedules Companies Act Sch. III (2021 amendments)
10 Personal-data safeguards: encryption at rest, access control, access logs, breach-response hooks, retention/erasure workflow that respects statutory retention DPDP Act 2023 + DPDP Rules 2025
11 Data residency: books accessible in India at all times, plus a daily backup to a server physically in India for companies Companies (Accounts) Rules r.3(1), r.3(5)

1. Companies Act 2013: books of account and audit trail

Requirement Source Effective date What the software must do
Books kept on accrual basis and double-entry, at the registered office. They may be kept in electronic mode Companies Act s.128(1); text reproduced in the ICAI Implementation Guide on Audit Trail (2024), FAQ 1 [PRIMARY] 1 Apr 2014 Enforce double entry (every voucher balances). Support accrual (bills, outstanding). Proprietorships and partnerships may run cash-basis books, but the company profile must force accrual
Electronic books must "remain accessible in India, at all times" Companies (Accounts) Rules 2014 r.3(1) [PRIMARY, via ICAI guide] 1 Apr 2014; amended 2022 Local-first storage on the user's machine in India meets this. Any optional cloud sync must use India-region storage. Data must never be locked up by licence expiry: guarantee read-only access forever
Audit trail (edit log): "every company which uses accounting software ... shall use only such accounting software which has a feature of recording audit trail of each and every transaction, creating an edit log of each change made in books of account along with the date when such changes were made and ensuring that the audit trail cannot be disabled" r.3(1) proviso, inserted by GSR 205(E), 24 Mar 2021; deferred by GSR 247(E), 1 Apr 2021, then by GSR 235(E), 31 Mar 2022 [PRIMARY, ICAI guide p.3 fn.1] FY starting on or after 1 Apr 2023 (a) An append-only log for every insert, update, delete or cancel on any voucher or master that affects the books (including opening balances, voucher types and ledgers). (b) Each entry records timestamp, user ID, machine/session, object ID, version number, action, and the full before/after snapshot or diff. (c) No setting, licence tier or CLI flag can turn it off. (d) Tamper evidence: hash-chain the log entries (each entry stores the previous entry's hash) and verify the chain on open. (e) Database-level capture: SQL triggers or a write-ahead journal, so that changes made by external tools are also logged, or at least detected. (f) A UI to view the version history of any voucher (compare the Tally Alt+Q behaviour) plus a summary report
What the trail should capture: when (date and time), who (user ID), what data changed; enabled at the database level where applicable; protected from modification; access to the trail restricted and itself logged; backups of the trail archived for the statutory period ICAI Implementation Guide on Reporting on Audit Trail (Revised 2024), paras 20 and Glossary [PRIMARY: ICAI guidance, not statute] Guidance for FY 2023-24 onward Implement the full set: separate role permission for viewing the log; log every view or export of the audit trail; include the log in backups; log changes to audit-related configuration such as users and roles
Auditor must report whether the software had the feature, whether it operated throughout the year for all relevant transactions, was not tampered with, and was preserved as per statutory retention Companies (Audit and Auditors) Rules 2014 r.11(g) [PRIMARY, ICAI guide] FY starting on or after 1 Apr 2022 (reporting) Provide an "Audit Trail Integrity Report" for the auditor. It covers the period covered, a chain-verification result, any gaps (for example the app was offline or the log was restored from backup), users, and counts by action
Retention: 8 years. s.128(5) requires books to be preserved for at least 8 financial years, so the audit trail must be kept for at least 8 years from 1 Apr 2023 onward Companies Act s.128(5); ICAI guide para 19 [PRIMARY] FY 2023-24 onward Never purge the edit log or vouchers younger than 8 FYs. "Delete company" or "split FY" must keep or export the trail. Archive format must stay readable (document the schema)
Daily backup on a server physically located in India, even where books are kept outside India r.3(5) as amended by the Companies (Accounts) Fourth Amendment Rules 2022, notified 5 Aug 2022 (changed "periodic" to "daily") [SECONDARY: BCAJ, Grant Thornton, Cyril Amarchand] Aug 2022 Built-in scheduled daily backup to a user-chosen target (second local disk, NAS, or India-region object storage), with a backup log. [UNCERTAIN] whether a company's own on-premise PC in India counts as a "server physically located in India". Most practitioners read it as satisfied when primary data is on-premise in India. Default to an additional off-device daily backup and record proof
Annual disclosure to the ROC of the service provider's name and address, and the location of servers or backups, where books are kept electronically with a provider r.3(6) [SECONDARY] Aug 2022 Report screen: "Electronic books: software, version, data location, backup location", to copy into the board report or AOC-4
GST (all registered persons, not only companies): "where the registers and other documents are maintained electronically, a log of every entry edited or deleted shall be maintained"; no erasing or overwriting entries CGST Rules r.56(8) [PRIMARY] (https://taxinformation.cbic.gov.in/content/html/tax_repository/gst/rules/cgst_rules/active/chapter7/rule56_v1.00.html) 1 Jul 2017 Audit trail on for every entity type, including proprietors and partnerships. One implementation covers both rules
GST electronic records: proper electronic backup that can be restored; produce records on demand in hard copy or a readable format; disclose file passwords and codes on demand CGST Rules r.57 [PRIMARY] 1 Jul 2017 Backup and restore; export to PDF/CSV/JSON; documented open data format
GST retention: accounts kept for 72 months from the due date of the annual return for that year CGST Act s.36 [SECONDARY: standard reading, not re-fetched] 1 Jul 2017 Retention engine: max(8 FY Companies Act, 72 months after the GSTR-9 due date, income-tax period)
LLPs and non-company entities: no MCA audit-trail mandate found for LLPs [UNCERTAIN]: no LLP-rule equivalent found none Not needed for MVP. GST r.56(8) already requires the log for LLPs

2. Financial year and books rules

Requirement Source Effective date What the software must do
Company FY = 1 April to 31 March (a different period only for a holding or subsidiary of a foreign company, with Tribunal approval) Companies Act s.2(41) [SECONDARY: well established] 1 Apr 2014 Default FY Apr to Mar. Allow "books beginning from" a mid-year date (new business). Do not support non-April FYs for Indian entities in the MVP
Income-tax: "previous year" and "assessment year" are replaced by a single "tax year" (the FY in which income is earned) under the Income-tax Act 2025, in force 1 Apr 2026. Books moved from s.44AA to s.62 and tax audit from s.44AB to s.63 (₹1 cr turnover, or ₹10 cr if cash receipts and payments are each at most 5%; professions ₹50 lakh). Forms 3CA/3CB reportedly replaced by Form 26 Income-tax Act 2025 [SECONDARY: TaxGuru, Accountune; Wikipedia confirms commencement 1 Apr 2026] 1 Apr 2026 Label periods "Tax Year 2026-27" in tax reports (keep "FY" elsewhere). Tax-audit assist reports (turnover, cash-percentage test). [UNCERTAIN] exact form numbers
GST financial year = April to March. Invoice numbers unique per FY CGST Rules 46(b), 53 [PRIMARY] 1 Jul 2017 A per-FY numbering series is mandatory. Warn on rollover
Period locking and year-end close Good practice that supports s.128 and audit trail none A lock-date per company with an override permission. Any change behind the lock-date is logged with a reason

3. Schedule III: financial-statement format (companies)

Requirement Source Effective date What the software must do
Balance Sheet and Statement of P&L in the Schedule III format: Division I (AS companies, which covers most SMEs), Division II (Ind AS), Division III (NBFC) Companies Act s.129 and Sch. III [SECONDARY] 1 Apr 2014 Ship a Division I chart-of-accounts template whose groups map 1:1 to Sch. III line items (Equity, Non-current/Current liabilities, PPE & Intangibles, Investments, Trade receivables, Revenue from operations, Other income, expense heads, and so on). Show the previous-year comparative column
2021 amendments: ageing schedules for trade receivables, trade payables and CWIP; promoter shareholding disclosure; MSME vs others split of trade payables; current maturities of long-term borrowings shown under short-term borrowings; mandatory rounding (total income under ₹100 cr: to hundreds, thousands, lakhs, millions or decimals; ₹100 cr or more: to lakhs, millions, crores or decimals); "Total Revenue" renamed "Total Income"; additional disclosures (ratios, title deeds, benami, CSR, crypto) MCA GSR 207(E), 24 Mar 2021 [SECONDARY: TaxGuru, KPMG, MBG] FY 2021-22 onward MVP: trade receivable and payable ageing buckets as Sch. III requires (under 6 months, 6 months to 1 year, 1-2, 2-3, over 3 years for receivables; under 1, 1-2, 2-3, over 3 for payables; each split into MSME, others and disputed); rounding selector; export to Excel for the CA. Ratio and disclosure notes can come later
No Schedule III amendment after 2021 was found as of Oct 2026 Search of 2025-26 commentary [UNCERTAIN] none Re-check the MCA notifications page before GA
Non-company entities: no statutory format none none Offer a simplified "Proprietor/Partnership" BS and P&L

4. GST

4.1 Identity, place of supply, tax split

Requirement Source Effective date What the software must do
GSTIN structure (15 characters): characters 1-2 state code; 3-12 PAN; 13 entity number for the same PAN in that state (1-9 then A-Z); 14 is "Z" by default; 15 is the check character GSTN format, widely documented [SECONDARY: TaxGuru, AI Accountant] 1 Jul 2017 Regex ^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z][Z][0-9A-Z]$ (special formats exist for UIN, NRTP, TDS/TCS and OIDAR registrations, so allow an override). Check that the state code is valid and that the embedded PAN matches the party PAN where captured
GSTIN checksum: Luhn mod-36 over the first 14 characters (0-9 = 0-9, A-Z = 10-35; factors alternate 1 and 2 starting from the left; each product reduced as quotient(p/36) + remainder(p mod 36); check = (36 − sum mod 36) mod 36) Third-party implementations, for example https://github.com/Devil7-Softwares/GSTIN-Validator [UNCERTAIN: GSTN has not published the algorithm in the Act or Rules] none Validate offline. Show a warning, not a hard block, if the checksum fails. Optional online "verify GSTIN status" (active, cancelled, suspended) when connected
State codes (GST): 01 JK, 02 HP, 03 PB, 04 CH, 05 UK, 06 HR, 07 DL, 08 RJ, 09 UP, 10 BR, 11 SK, 12 AR, 13 NL, 14 MN, 15 MZ, 16 TR, 17 ML, 18 AS, 19 WB, 20 JH, 21 OD, 22 CG, 23 MP, 24 GJ, 26 DNHDD (25 DD legacy), 27 MH, 29 KA, 30 GA, 31 LD, 32 KL, 33 TN, 34 PY, 35 AN, 36 TS, 37 AP (28 AP legacy), 38 LA, 97 Other Territory, 99 Centre Jurisdiction GST portal state master [UNCERTAIN: compiled from product knowledge; verify against the GST portal or e-invoice master codes] none Ship as a versioned master table. e-Invoice and e-way bill use the same codes
Place of supply (POS): goods per IGST s.10 (where movement terminates; bill-to-ship-to rules); services per s.12 (both parties in India: default is recipient location if registered, with special rules for immovable property, events, transport, telecom and others) and s.13 (import or export of services) IGST Act ss.10, 12, 13 [SECONDARY: statute not re-fetched] 1 Jul 2017 POS engine: default from party state and ship-to state, with an override per voucher and a reason. Store POS state code on every invoice
Tax type: supplier state = POS state gives CGST + SGST/UTGST (intra-State); otherwise IGST (inter-State). Supplies to or by an SEZ are always inter-State (IGST). Exports are zero-rated (IGST paid or LUT) IGST Act ss.7, 8, 16 [SECONDARY] 1 Jul 2017 Derive the tax components automatically and block mixing. Support LUT number and date for zero-rated supplies. Use the Rule 46 export endorsement text (see 4.2)
Rates (GST 2.0): the four-slab structure is rationalised into 5% (merit) and 18% (standard), plus 40% (de-merit) for select goods, along with the existing special rates (0, 0.25, 3 and others). New master rate notification 9/2025-Central Tax (Rate), 17 Sep 2025 56th GST Council; Notif. 9/2025-CT(R) [SECONDARY: EY alert, India Briefing] 22 Sep 2025 (tobacco and pan masala: 1 Feb 2026) Rate masters must be effective-dated (HSN to rate history), so that pre-22 Sep 2025 invoices, credit notes and amendments keep old rates. No hard-coded slab list: rates come from data
Compensation cess: removed for most goods from 22 Sep 2025. For tobacco and pan masala it ended 1 Feb 2026, replaced by the Health Security se National Security Cess and additional central excise duty, which are outside GST Notifications dated 31 Dec 2025 [SECONDARY: Deccan Herald, Outlook Business, Taxo] 22 Sep 2025 / 1 Feb 2026 Keep the cess fields in the data model, GSTR-1 and e-invoice JSON (value 0), and support historical cess. The cess rate in masters is effective-dated

4.2 Invoices, numbering, notes, RCM

Requirement Source Effective date What the software must do
Tax invoice mandatory particulars (Rule 46): (a) supplier name, address, GSTIN; (b) serial number (see next row); (c) date; (d) recipient name, address, GSTIN/UIN if registered; (e) for unregistered recipients with value of ₹50,000 or more: name, address, delivery address, state name and code; (f) the same below ₹50,000 if the recipient asks (for OIDAR, e-commerce or online-gaming B2C supplies: state name only); (g) HSN/SAC; (h) description; (i) quantity and unit/UQC; (j) total value; (k) taxable value after discount; (l) tax rates (CGST, SGST/UTGST, IGST, cess); (m) tax amounts; (n) POS with state name for inter-State supplies; (o) delivery address if different from POS; (p) whether tax is payable on reverse charge; (q) signature or digital signature (not required for electronic invoices under the IT Act); (r) QR code with embedded IRN where e-invoicing applies; (s) declaration text for e-invoice-exempt entities above the threshold. Export or SEZ endorsement: "SUPPLY MEANT FOR EXPORT/SUPPLY TO SEZ UNIT OR SEZ DEVELOPER FOR AUTHORISED OPERATIONS ON PAYMENT OF INTEGRATED TAX" or "...UNDER BOND OR LETTER OF UNDERTAKING WITHOUT PAYMENT OF INTEGRATED TAX", plus the country of destination CGST Rule 46 [PRIMARY] (https://taxinformation.cbic.gov.in/content/html/tax_repository/gst/rules/cgst_rules/active/chapter6/rule46_v1.00.html) 1 Jul 2017; (r) 30 Sep 2020; (s) 5 Jul 2022 Validate the presence of every field before a voucher can be saved as a "Tax Invoice". The print template must render all of them. Unregistered B2C invoices of ₹50,000 or more need the state. A consolidated daily B2C invoice is allowed when the recipient is unregistered and does not ask for an invoice
Invoice serial number: "consecutive serial number not exceeding sixteen characters, in one or multiple series, containing alphabets or numerals or special characters hyphen or dash and slash ... unique for a financial year" Rule 46(b) [PRIMARY]; the same wording in r.53 for revised invoices and CN/DN 1 Jul 2017 Series config: prefix/suffix tokens ({FY}, {BR}) with a total length of 16 or less; allowed set [A-Za-z0-9/-]; no spaces, # or _. Uniqueness enforced per (GSTIN, document type, FY). Gap detection report. Cancellation (Alt+X-style) keeps the number. Document counts feed GSTR-1 Table 13. [UNCERTAIN] "consecutive": gaps are tolerated in practice when they are reported as cancelled in Table 13
Copies: goods in triplicate (ORIGINAL FOR RECIPIENT, DUPLICATE FOR TRANSPORTER, TRIPLICATE FOR SUPPLIER); services in duplicate. Not required for e-invoices issued under r.48(4) CGST Rule 48(1), (2), (6) [PRIMARY] 1 Jul 2017 Print-copy labels per copy
Time limit: services invoice within 30 days of supply (45 days for banks, insurers and NBFCs); goods at or before removal CGST Rule 47 [PRIMARY]; s.31(1) 1 Jul 2017 Warn when the invoice date is more than 30 days after the linked delivery or service date
Other documents: Bill of Supply (exempt or composition), Receipt Voucher (advance), Refund Voucher, Payment Voucher (RCM), Delivery Challan CGST Rules 49 to 52, 55 [SECONDARY] 1 Jul 2017 Voucher types with their own number series
Credit and debit notes (s.34; Rule 53(1A)): fields are supplier details, nature of document, serial number (same 16-character rule), date, recipient details, original invoice number(s) and date(s), taxable value, rate and tax credited or debited, signature. CN time limit: by 30 Nov following the end of the FY of the supply, or the date of the annual return, whichever is earlier CGST Rule 53 [PRIMARY]; s.34(2) as amended by FA 2022 s.102 [SECONDARY] Rule 53(1A) from 1 Feb 2019; 30 Nov from 1 Oct 2022 (Notif. 18/2022-CT) Link each CN/DN to its original invoice(s). Block or warn on a CN dated after 30 Nov of FY+1 that reduces output tax. A separate number series for CN and DN
Revised invoice, and "INPUT TAX CREDIT NOT ADMISSIBLE" on documents issued under ss.74, 129 or 130 Rule 53(1), (3) [PRIMARY] 1 Jul 2017 Voucher sub-type flags
Reverse charge (RCM): notified goods and services (s.9(3)); specified supplies from unregistered persons (s.9(4)). The recipient issues a self-invoice (s.31(3)(f)) within 30 days of receipt from an unregistered supplier (Rule 47A), and a payment voucher at the time of payment (s.31(3)(g)). The monthly consolidated self-invoice proviso was omitted from 1 Nov 2024. RCM tax is paid in cash; ITC follows CGST Rule 47A and Notif. 20/2024-CT [SECONDARY]; omission of the r.46 proviso w.e.f. 1 Nov 2024 [PRIMARY: r.46 footnote 11] 1 Nov 2024 RCM flag per ledger or service. Auto-draft the self-invoice with a 30-day reminder. Liability goes to GSTR-3B 3.1(d). ITC appears only after cash payment. "Reverse charge: Yes" on the invoice
e-Invoicing for RCM self-invoices (new supply types RCMDOM and RCMIMP) GSTN Advisory reported as No. 678, 16 Oct 2026; sandbox only [UNCERTAIN: secondary reports only, production date not announced] not yet Design the e-invoice module so that new supply types are data-driven. Watch for the production date

4.3 HSN/SAC digits

Requirement Source Effective date What the software must do
AATO up to ₹5 cr: 4-digit HSN on B2B invoices (optional on B2C). AATO over ₹5 cr: 6-digit on all invoices Notif. 78/2020-CT under the r.46 proviso [SECONDARY, consistent across sources] 1 Apr 2021 Company-level AATO setting (previous FY) drives validation of the minimum digit count. Masters store 8 digits where known
8-digit HSN for specified chemicals Notif. 90/2020-CT [UNCERTAIN: recalled from knowledge, not re-verified] 1 Apr 2021 Allow and validate 8 digits. Optional rule list
GSTR-1 Table 12 Phase III: HSN picked from a dropdown (no free text); Table 12 split into B2B and B2C tabs; validations start in warning mode GSTN advisory, Jan 2025 [SECONDARY] Return period May 2025 HSN master must come from the official HSN/SAC list (versioned). GSTR-1 export must build separate B2B and B2C HSN summaries, with UQC mapping per unit

4.4 Returns

Requirement Source Effective date What the software must do
GSTR-1: monthly by the 11th. Invoice-wise B2B (registered) and B2CL (inter-State unregistered over ₹1 lakh); consolidated B2CS (intra-State, and inter-State up to ₹1 lakh, state-wise and rate-wise); CN/DN; exports; HSN (Table 12); documents issued (Table 13, mandatory from May 2025) CGST s.37; Rule 59(4) as amended by Notif. 12/2024-CT (B2CL ₹2.5 lakh to ₹1 lakh) [PRIMARY: r.59 text]; Table 13 [SECONDARY] B2CL ₹1 lakh from 1 Aug 2024 GSTR-1 builder that classifies every outward document into its section. JSON export in the portal or offline-tool format. Section-wise CSV fallback
IFF (QRMP taxpayers): B2B details for months 1 and 2 of the quarter, from the 1st to the 13th of the next month, up to ₹50 lakh per month Rule 59(2) [PRIMARY] 1 Jan 2021 IFF export (B2B, CDNR and amendment sections only)
GSTR-1A (amend or add to GSTR-1 for the same period before GSTR-3B) Notif. 12/2024-CT; Rule 59 [PRIMARY: r.48(3) footnote] Jul 2024 Amendment export path
GSTR-1 / IFF JSON schema GST portal offline tool and GST API developer docs ongoing [UNCERTAIN]: the official schema files were not retrieved in this research. Action: get them from the GST portal's Returns Offline Tool package or the GST developer portal, store them under /schemas/gst/ with version and date, and build round-trip tests against the offline tool's JSON
GSTR-3B: monthly by the 20th (QRMP: 22nd or 24th by state). Tables 3.1 and 3.2 auto-populated from GSTR-1/1A/IFF and non-editable (hard-locked) from the July 2025 tax period; corrections go through GSTR-1A GSTN advisory, 7 Jun 2025 (reported as Advisory 606) [SECONDARY] Jul 2025 period The 3B computation must match the GSTR-1 figures exactly. Show the GSTR-1 vs books vs 3B variance before filing
GSTR-3B ITC (Table 4) auto-population from GSTR-2B ends from the Oct 2025 period (Notif. 16/2025-CT, as reported); interest in Table 5.1 is system-computed and cannot be edited downward from Jan 2026 (Advisory 647, 30 Jan 2026); a Table 4 ITC hard-lock is expected but not notified as of Sep/Oct 2026 [UNCERTAIN: secondary sources only and conflicting] various ITC computation from books plus 2B/IMS reconciliation. Interest calculator for late payment. Keep Table 4 logic configurable
3-year time bar: GSTR-1, 3B, 9 and others cannot be filed more than 3 years after the due date CGST ss.37(5), 39(11), 44(2), 52(14) inserted by FA 2023 (in force 1 Oct 2023); portal validation from Jul 2025 [SECONDARY] Jul 2025 (portal) Warn on unfiled periods approaching 3 years
GSTR-2B / IMS: GSTR-2B (static ITC statement) is generated on the 14th. IMS (from 14 Oct 2024) lets the recipient Accept, Reject or keep Pending each inward document; records with no action are deemed accepted when 2B is generated; acting after the 14th requires a recompute of 2B; no action is possible after GSTR-3B is filed GSTN IMS advisories, Sep and Oct 2024 [SECONDARY: BDO, ClearTax] 14 Oct 2024 2B/IMS reconciliation: import 2B or IMS JSON; match against purchase register on (supplier GSTIN, document number normalised, date, taxable value, tax) with tolerance; statuses matched, mismatched, missing in books, missing in 2B; export an IMS action file. Online IMS actions come after the MVP
GSTR-9 annual return by 31 Dec after the FY. Exempt if AATO is ₹2 cr or less (optional). GSTR-9C reconciliation statement, self-certified, required where AATO exceeds ₹5 cr CGST s.44; Rule 80 [SECONDARY]; ₹2 cr exemption reported as Notif. 15/2025-CT [UNCERTAIN: notification number varies across sources] FY 2025-26 due 31 Dec 2026 GSTR-9 table data from books (outward, inward, ITC, HSN, rate-change-period splits). 9C: books-to-return reconciliation report. Turnover is aggregated per PAN across GSTINs for thresholds

4.5 e-Invoicing (IRP)

Requirement Source Effective date What the software must do
Notified persons must report B2B invoices, CN/DN, exports and SEZ supplies to an IRP; an invoice issued otherwise "shall not be treated as an invoice" CGST Rule 48(4), (5) [PRIMARY]; Notif. 13/2020-CT as amended 1 Oct 2020 (phased) e-Invoice is a gating step: the voucher status is "pending IRN" until IRN is received. Block printing of the "Tax Invoice" title without an IRN for applicable taxpayers (allow a draft)
Threshold: aggregate turnover above ₹5 crore in any preceding FY from 2017-18 Notif. 10/2023-CT, 10 May 2023 [SECONDARY: TaxGuru Oct 2026 summary] 1 Aug 2023 Company setting: "Highest AATO since FY 2017-18". Once above ₹5 cr, e-invoicing stays on even if turnover later falls
Proposal to lower to ₹2 cr [UNCERTAIN: reported as proposed, not notified as of mid or Oct 2026] none Threshold is data-driven
Exempt classes: banks, insurers, financial institutions including NBFCs, GTA, passenger transport, multiplex cinema admission, SEZ units (not developers), plus government departments and local authorities Notif. 13/2020-CT as amended [SECONDARY] various Entity-type flag. When exempt but above threshold, print the Rule 46(s) declaration
30-day reporting limit: taxpayers with AATO of ₹10 cr or more cannot report an invoice, CN or DN to the IRP more than 30 days after its document date GSTN advisory, 5 Nov 2024 [PRIMARY: https://www.mahagst.gov.in/public/uploads/gstnadvisory/1760531580_293%20Advisory%20Time%20Limit%20for%20Reporting%20e%20Invoice%20on%20the%20IRP%20Portal%20%20Lowering%20of%20Threshold%20to%20AATO%2010%20Crores%20and%20Above.pdf] 1 Apr 2025 Daily "IRN pending" dashboard with days remaining. Hard warning at 25 days or more. A document over 30 days cannot get an IRN, so a new invoice is required
IRN: 64-character hash returned by the IRP; signed QR code and signed invoice JSON returned. The QR must be printed (Rule 46(r)). A self-made QR is not valid Rule 46(r), 48(4); INV-01 schema v1.1 (IRN length 64; document number max 16) [SECONDARY: gazette copies of the INV-01 schema] 1 Oct 2020 Store IRN, Ack No, Ack Date, SignedQRCode, SignedInvoice and status. Render the QR from SignedQRCode. Keep the IRP response verbatim in the audit trail
Schema: FORM GST INV-01, Schema version 1.1 (cardinality: 1..1 mandatory, 0..1 optional) INV-01 notification copies [SECONDARY]; a claimed "v1.11 (Jan 2026)" [UNCERTAIN] 2020 Generate JSON strictly per the schema. Validate locally with a JSON Schema before submission. Version the schema
Cancellation within 24 hours of IRN generation, whole document only; not allowed if an active e-way bill exists; a cancelled document number cannot be reused for a new IRN. After 24 hours, raise a CN IRP rules [SECONDARY: ClearTax docs] 2020 Enforce in the UI. Number-series logic must never reuse a cancelled number
Six authorised IRPs (NIC and private IRPs) GSTN [SECONDARY] 2023 MVP: offline JSON export for upload to the IRP portal, plus import of the IRP response JSON. Direct API through a GSP comes after the MVP (needs credentials and MFA)
MFA (OTP to the registered mobile) mandatory for all e-invoice and e-way bill portal users GSTN advisory, 17 Dec 2024 [PRIMARY: https://www.mahagst.gov.in/public/uploads/gstnadvisory/1760530021_309.Advisory%20on%20Updates%20to%20E%20Way%20Bill%20and%20E%20Invoice%20Systems.pdf] All taxpayers from 1 Apr 2025 Affects any API or automation design. Offline JSON avoids it for the MVP
B2C dynamic QR (UPI payment QR) for taxpayers with AATO above ₹500 cr Notif. 14/2020-CT; Circular 146/02/2021-GST [SECONDARY] 1 Dec 2020 Out of SME scope. Optional UPI QR on B2C prints

4.6 e-Way Bill

Requirement Source Effective date What the software must do
Needed before moving goods with consignment value over ₹50,000 (invoice, bill of supply or challan value including GST and cess, excluding exempt goods), whether for a supply, a non-supply reason (for example branch transfer) or an inward supply from an unregistered person. Inter-State job work and inter-State handicrafts need it at any value CGST Rule 138(1) [PRIMARY] (https://taxinformation.cbic.gov.in/content/html/tax_repository/gst/rules/cgst_rules/active/chapter16/rule138_v1.00.html) 1 Apr 2018 Compute the consignment value per Explanation 2. Prompt for an EWB when the value exceeds ₹50,000. [UNCERTAIN] some states set different intra-State thresholds: keep a per-state configurable table
Part A (consignor, consignee, goods, HSN, value, document) and Part B (transporter or vehicle). Part A without Part B is valid for 15 days for updating Part B. Part B is not needed for movement up to 50 km within the State to or from the transporter Rule 138(1), (3), (9) [PRIMARY] 1 Apr 2018 EWB-01 JSON export (Part A from the voucher; Part B fields optional). Transporter ID and vehicle number fields on the voucher
Validity: 1 day per 200 km or part thereof (Over Dimensional Cargo or multimodal shipment with a ship leg: 1 day per 20 km). A day ends at midnight of the following day. Extension is possible within 8 hours before or after expiry Rule 138(10) [PRIMARY] 200 km from 1 Jan 2021 Validity calculator from distance (PIN-to-PIN). Store the expiry and alert on it
Cancellation within 24 hours (not if verified in transit); recipient accept or reject within 72 hours, otherwise deemed accepted Rule 138(9), (11), (12) [PRIMARY] 1 Apr 2018 Track EWB status
EWB cannot be generated for documents dated more than 180 days earlier; total extension capped at 360 days from original generation GSTN advisory, 17 Dec 2024 [PRIMARY: same PDF as MFA] 1 Jan 2025 Warn on document age
Consolidated EWB (EWB-02) for multiple consignments in one vehicle Rule 138(6) [PRIMARY] 1 Apr 2018 After the MVP

5. TDS / TCS

Regime switch: the Income-tax Act 2025 commenced 1 Apr 2026, replacing the Income-tax Act 1961. TDS for residents is consolidated into a table in s.393(1) (non-residents s.393(2); others s.393(3)). TCS is in the s.392-394 range. TDS returns use 4-digit payment codes instead of section names. Transactions up to 31 Mar 2026 (Q4 FY 2025-26) are still reported on the old forms under the 1961 Act. [SECONDARY: multiple practitioner sources; Wikipedia for commencement. [UNCERTAIN] exact table and serial references; verify against the bare Act and the Income-tax Rules 2026.]

Requirement Source Effective date What the software must do
Two parallel TDS rule-sets selected by transaction or payment date (1961 Act up to 31 Mar 2026; 2025 Act from 1 Apr 2026) ITA 2025 [SECONDARY] 1 Apr 2026 "Nature of payment" master with an effective-dated mapping: old section, new section/table serial, payment code, rate (PAN / no PAN), single and aggregate thresholds, deductor-type conditions. Never hard-code rates
Common SME sections (old to new, TY 2026-27 values as reported): 194C contractors: 1% individual/HUF, 2% others; ₹30,000 single or ₹1 lakh aggregate. 194J: professional 10%, technical, call centre or film royalty 2%; ₹50,000. 194I rent: land, building or furniture 10%, plant and machinery 2%; ₹50,000 per month. 194H commission: 2%; ₹20,000. 194A interest (non-bank ₹10,000; bank ₹50,000 / ₹1 lakh seniors): 10%. 194-IA property: 1%; ₹50 lakh. 194Q purchase of goods: 0.1% above ₹50 lakh per seller, when the buyer's turnover exceeds ₹10 cr. 194T partner remuneration and interest: 10%; ₹20,000 (new from 1 Apr 2025) TaxGuru, StudyCafe and others [SECONDARY: values consistent with FA 2025 changes; table references conflict across sources] FA 2025 thresholds from 1 Apr 2025; new numbering from 1 Apr 2026 Ship these as seed data, marked "verify". Aggregate-threshold tracking per party per FY. Deduction at the earlier of credit or payment. 20% (or higher) no-PAN rate (s.206AA equivalent). Lower-deduction certificate support
194Q vs 206C(1H): 206C(1H) (TCS on sale of goods) omitted from 1 Apr 2025; only the buyer's 194Q TDS remains Income Tax Dept tutorial "TDS on purchase of goods" (amended by FA 2025) [PRIMARY] (https://www.incometaxindia.gov.in/w/tds-on-purchase-of-goods) 1 Apr 2025 Disable 206C(1H) for sales on or after 1 Apr 2025 (keep it for history). Enable 194Q for buyers whose previous-year turnover exceeded ₹10 cr
Other TCS likely relevant to SMEs (scrap, minerals, motor vehicles over ₹10 lakh under old 206C(1)/(1F)) [UNCERTAIN: not re-verified for TY 2026-27] none Configurable TCS natures. Low priority for the MVP
Quarterly statements (new forms): Form 138 (salary, ex-24Q), Form 140 (resident non-salary, ex-26Q), Form 144 (non-resident, ex-27Q), Form 143 (TCS, ex-27EQ); Form 141 challan-cum-statement (ex-26QB/QC/QD/QE). Certificates: Form 130 (ex-Form 16), Form 131 (ex-16A) Income-tax Rules 2026 [SECONDARY: BusinessToday 18 Jul 2026, TaxGuru, CAclubindia] TY 2026-27 Q1 onward Generate statement data in the RPU/FVU text format for the new forms. Keep 24Q/26Q/27EQ for FY 2025-26 and earlier corrections
Due dates (new rules): all TDS and TCS statements due 31 Jul, 31 Oct, 31 Jan, 31 May (TCS no longer due on the 15th) Rule 219(4), Income-tax Rules 2026 [SECONDARY] TY 2026-27 Compliance calendar
FVU: new File Validation Utility series for 2025-Act statements (reported v1.0 on 1 Jul 2026, v1.1 on 8 Jul 2026, v1.2 on 19 Aug 2026); legacy FVU (9.x / 2.x) for old-Act statements Protean / TIN releases [SECONDARY: TDSMAN blog] Jul 2026 MVP: export a file that the official RPU can import (or that matches the FVU input format), then run the official FVU (Java) locally. Do not re-implement the FVU. Pin the supported FVU version per form
TDS deposit: by the 7th of the following month (March deductions by 30 April) under the old Rule 30 [UNCERTAIN: new-rules equivalent not verified] none Challan reminder. Interest on late deduction or payment (1% / 1.5% per month, old s.201(1A); verify the new section)

6. MSME payments: 43B(h)

Requirement Source Effective date What the software must do
Buyers must pay micro and small enterprise suppliers by the agreed date, max 45 days from acceptance or deemed acceptance; 15 days if there is no written agreement. Compound interest at 3x the RBI bank rate on delay (s.16). Disclose overdue amounts in annual accounts (s.22) MSMED Act 2006 ss.15, 16, 22 [SECONDARY] 2006 Vendor master fields: Udyam No., category (micro, small or medium), activity (manufacturer, services or trader). Agreed credit days capped at 45 (warn above). Due date computed from the acceptance date (default = receipt date)
Income tax: an amount owed to a micro or small enterprise and unpaid beyond the s.15 limit is deductible only in the year of actual payment (no relief for paying by the return due date) ITA 1961 s.43B(h), inserted by FA 2023 [SECONDARY]; carried into ITA 2025 s.37 (reported as s.37(2)(g)) [UNCERTAIN: sub-clause number] FY 2023-24 onward; ITA 2025 from TY 2026-27 Year-end "43B(h) disallowance" report: MSE creditors outstanding at FY end beyond their due date, and payments made after the due date. Feeds the tax-audit Form 3CD clause (or its new equivalent). [UNCERTAIN] whether traders registered on Udyam are covered: the commonly held view is that they are excluded from MSMED s.15 protection, so make it a configurable flag
MSME Form 1 (half-yearly to MCA, for companies with MSE dues over 45 days); revised format with supplier-wise detail Specified Companies (Furnishing of information about payment to micro and small enterprise suppliers) Order 2019, revised 2024 [SECONDARY: TallyPrime 6.1 notes] Revised 2024 Supplier-wise outstanding and overdue export (PAN, Udyam, amount, days)

7. DPDP Act 2023 and DPDP Rules 2025 (personal data in accounting records)

Requirement Source Effective date What the software must do
The Act applies to digital personal data of individuals. In accounting data this covers sole-proprietor and individual customer and vendor names, phones, emails, addresses, PAN, bank details, and employee/payroll data. The business using KhataOS is the Data Fiduciary. KhataOS (the publisher) is not a processor for purely local data, but becomes a Data Processor for any cloud sync, backup or support access DPDP Act 2023 [SECONDARY: EY, KPMG summaries] Act passed Aug 2023 Keep a data inventory of PII fields. Offer a "privacy mode" that masks PAN, bank and phone in lists and prints where not needed. Any cloud feature needs a DPA template
DPDP Rules 2025 notified 13 Nov 2025 (G.S.R. 846(E); PIB release 14 Nov 2025). Board provisions in force immediately; Consent Manager rules at 12 months (about Nov 2026); most Data Fiduciary obligations (notice, consent, security safeguards, breach intimation, retention/erasure, rights) at 18 months (about 13 or 14 May 2027) PIB (https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014) [PRIMARY for notification]; phase dates [SECONDARY] 13 Nov 2025; 13/14 May 2027 Build the features before May 2027
MeitY proposal (Jan 2026) to cut the 18-month window to 12 months (mainly for Significant Data Fiduciaries) Business Standard, 22 Jan 2026 [UNCERTAIN: not notified as of Sep/Oct 2026 per MirvoLegal and dpdprules.org] none Track. SMEs are unlikely to be SDFs
Lawful basis: processing for compliance with law (GST invoices, TDS, books) and employment falls under "legitimate uses" (s.7), so consent is not needed for core bookkeeping DPDP Act s.7 [UNCERTAIN: interpretive; confirm with counsel] May 2027 No consent pop-ups for statutory records. Marketing features (WhatsApp reminders, payment links) need a notice and consent
Security safeguards (s.8(5); max penalty ₹250 cr). Rules: encryption or obfuscation, access control, access logs kept for at least 1 year, backups, and measures for detecting breaches DPDP Act s.8(5), Schedule; Rule 6 [SECONDARY] May 2027 Encrypt the local database at rest (for example SQLCipher) with a key protected by an OS keychain or passphrase. Role-based access. Login and access logs (reuse the audit-trail infrastructure). Encrypted backups
Breach notification (s.8(6); max ₹200 cr): inform affected Data Principals and the Board without delay, with a detailed report to the Board within 72 hours Rule 7 [SECONDARY: sources differ on the exact sequence] May 2027 An "incident export" (what data, which records, when) to help the business notify. The product's own breach process is needed if cloud services are offered
Retention and erasure (s.8(7)): erase when the purpose is served unless retention is required by law; give 48 hours' notice before erasure (Rule 8, for specified classes) DPDP Act s.8(7); Rule 8 [SECONDARY] May 2027 Statutory retention overrides erasure: 8 years (Companies Act), 72 months after the annual return (GST), income-tax periods. Provide a retention-hold flag per record and pseudonymise/erase party PII after the retention expiry without breaking the audit-trail hash chain (store PII in a separable table keyed by token)
Cross-border transfer permitted except to countries on a negative list (s.16) DPDP Act s.16 [SECONDARY]; no list notified [UNCERTAIN] May 2027 Cloud features default to India regions

8. Data localisation: summary

Requirement Source Effective date What the software must do
Company books in electronic form: accessible in India at all times, with a daily backup on servers physically in India Companies (Accounts) Rules r.3(1), r.3(5) [PRIMARY r.3(1) / SECONDARY r.3(5)] 2014 / Aug 2022 See section 1. Local-first is compliant by default. Add a daily backup scheduler with logs
GST: no localisation rule; backup and production on demand (r.57) CGST r.57 [PRIMARY] 2017 Backup and export
DPDP: no general localisation; negative-list transfers only DPDP s.16 [SECONDARY] May 2027 India-region defaults
RBI payment-data storage (2018 circular) applies only if KhataOS processes payments as a payment system RBI [UNCERTAIN: out of MVP scope] none Use regulated PG/UPI partners for payment links

9. Open items to verify before GA (consolidated)

  1. The GSTIN checksum algorithm is not officially published. Validate as a warning, not a hard block.
  2. The official GSTR-1 / IFF / GSTR-3B JSON schemas and the e-invoice INV-01 version (1.1 vs a claimed 1.11) were not retrieved. Get them from the GST portal offline tool and the e-invoice portal developer docs.
  3. Income-tax Act 2025 TDS table and serial references, payment codes, Rule 219 due dates, Form 26 for tax audit, and s.37(2)(g) for MSME. Check against the bare Act and Rules on incometaxindia.gov.in.
  4. GSTR-3B Table 4 ITC hard-lock (expected from July 2026, not notified as of Sep/Oct 2026), the Advisory 647 interest lock, and the reported Oct 2025 end of ITC auto-population.
  5. e-Invoice ₹2 cr threshold (proposed, not notified) and RCMDOM/RCMIMP self-invoice e-invoicing (sandbox only, Oct 2026).
  6. DPDP 18 to 12-month compression (proposed, not notified). Whether "legitimate use" covers all bookkeeping PII.
  7. Rule 3(5) "server physically located in India" as applied to an on-premise desktop.
  8. The GSTR-9 ₹2 cr exemption notification number (sources cite different ones).
  9. State-specific intra-State e-way bill thresholds.
  10. Schedule III: confirm no amendment after 2021.
  11. Notif. 90/2020-CT (8-digit HSN for specified chemicals).

10. Source list