Verifying the Counterparty Before You Sign: What a Private Company Can Legally Check, and How It Strengthens the Contract's Evidence
Before you sign with a counterparty, you want to know it exists, who can bind it, and that the signer is who they say. Which verification methods are legally available to a private company after the 2019 Aadhaar amendment, how verification feeds the signature's evidence, and how long to keep the records under the DPDP Act.
Most "KYC" explainers are written for banks. A private company onboarding a vendor, a franchisee or a marketplace seller has a different question: which checks is it allowed to run, which are worth running, and how do they connect to the contract it is about to sign? This guide answers that from the contracting side. Position as of October 2026.
Three things to verify
- The entity exists and is who it claims: legal name, registration (CIN for companies, LLPIN for LLPs), GSTIN, PAN, Udyam registration for MSEs, registered address.
- The signer can bind it: board resolution or authority letter for companies; partnership deed for firms; the proprietor for sole proprietorships.
- The signer is the person: identity verification at the time of signature.
What a private company may do with Aadhaar
The Aadhaar and Other Laws (Amendment) Act, 2019 reshaped this. Under section 4 of the Aadhaar Act as amended, use of Aadhaar is voluntary with the holder's informed consent, and Aadhaar authentication (online verification with UIDAI) may be performed only by entities permitted under a law made by Parliament or for a purpose the Central Government has notified. Banks and telecom licensees have express statutory routes (the amendment inserted section 11A in the Prevention of Money-laundering Act and new sub-sections in section 4 of the Telegraph Act). Other private companies generally cannot run Aadhaar authentication for their own onboarding unless authorised under the government's rules permitting Aadhaar authentication for specified purposes. ****
Two routes are open:
- Offline verification under section 8A (QR code, offline XML, Aadhaar paperless e-KYC through DigiLocker-type channels): the holder shares a verifiable offline copy; the verifying entity may not collect or store the Aadhaar number or biometrics (section 8A(4)).
- Aadhaar eSign at signature: the eSign Service Provider performs the authentication; your business receives the signed hash and the signer's name, not the Aadhaar number. This verifies the signer at the moment it matters.
Other checks that are open to everyone
- Company and LLP records on the Ministry of Corporate Affairs portal: directors, charges, filings.
- GSTIN and PAN validation through official portals.
- Udyam registration verification for MSE status (which drives the 45-day payment rule under section 15 of the MSMED Act, 2006).
- Central KYC Registry (CKYC) records are accessible to regulated entities, not generally to private companies; do not plan on it unless you are a regulated entity.
- Video verification for remote, unknown signers of high-value documents, with a separate DPDP consent.
How verification feeds the contract's evidence
A contract challenged years later raises two questions: did the counterparty agree, and did the person who signed have authority. Verification answers both if it is recorded with the contract:
- The entity checks and the authority document (resolution, authority letter) filed against the agreement.
- The identity method recorded in the audit trail (Aadhaar eSign response, DSC certificate details, video verification record).
- The whole record retained so that a section 63 certificate under the Bharatiya Sakshya Adhiniyam, 2023 can describe how it was produced.
Verification done in a separate system, with no link to the signed document, is weaker than it looks.
Retention under the DPDP Act
KYC records are personal data of the signer (and of a proprietor, the business owner). From 13 May 2027, section 8(7) of the DPDP Act, 2023 requires erasure when the purpose is no longer served, "unless retention is necessary for compliance with any law for the time being in force"; rule 8 and the Third Schedule of the DPDP Rules address when a purpose is deemed no longer served for notified classes of fiduciaries. For a contracting business, the purpose includes defending the contract, so retain verification records with the agreement for its term plus the limitation period, state that period in your notice, and erase on schedule. Never store an Aadhaar number from an offline verification (section 8A(4) forbids it).
A verification tier model
| Counterparty risk | Entity checks | Signer checks |
|---|---|---|
| Low (small vendor, standard terms) | GSTIN, PAN, Udyam | OTP eSign or DSC |
| Medium (service provider with data access) | Plus MCA record, authority letter | Aadhaar eSign or DSC |
| High (large value, unknown, remote) | Plus board resolution, financials | DSC or biometric eSign, plus video verification with consent |
Where Legatio fits. Legatio captures entity details and authority documents at intake, records the identity method per signer in the audit trail, and holds the verification record with the executed contract under a retention rule. Which checks you are permitted to run is a question of the Aadhaar Act and sector law.
Position stated as of October 2026. General information; regulated entities should follow their regulator's KYC directions.