Practice compliance
UDIN: what it is, and when you have to generate one
UDIN is one of those requirements that is simple in principle and easy to slip on in a busy season. It exists to protect the profession — to stop a non-CA passing off a document as CA-certified — and ICAI treats a missing UDIN on a document that needed one as non-compliance.
Here is what the requirement actually covers, and when it applies.
What UDIN is, and why it exists
The Unique Document Identification Number is a number a practising Chartered Accountant generates on ICAI's portal for a certificate, report or attested document, and quotes on that document. Anyone relying on the document — a bank, a regulator, a company — can verify on the portal that it was genuinely issued by a CA.
ICAI introduced it to curb the forging of CA signatures and the issue of fake certificates by people who aren't Chartered Accountants. In that sense it protects the member as much as the user of the document.
What needs a UDIN — and since when
ICAI made UDIN mandatory in phases, following its Council decision of December 2018. It applies to all Certificates with effect from 1 February 2019; to all GST and Tax Audit Reports with effect from 1 April 2019; and to all other audit, assurance and attestation functions with effect from 1 July 2019.
In practice, if a document carries your signature and your membership number in your capacity as a CA — a certificate, an audit report, an attestation — assume it needs a UDIN unless you've confirmed otherwise.
How and when it's generated
UDIN is generated at udin.icai.org, and the sensible time to generate it is at the point of signing, so the number can be printed on the document before it leaves your office. ICAI allows generation within a window after signing, but generating late means reissuing or annotating documents already sent — avoidable friction.
The number is document-specific: one UDIN per document, tied to details of that document, so it can't be reused across engagements.
Where it fits in a firm's workflow
The failure mode isn't usually not knowing the rule; it's a document going out in a rush without the number, or a partner signing a stack at quarter-end and one slipping through. The defensible approach is to treat 'UDIN generated' as a step a signed deliverable can't skip — the same way a return isn't done until it's filed.