For a practising Chartered Accountant, the Unique Document Identification Number is not a number added at the end of a certificate as an afterthought. It links a signed certificate, report or attestation to ICAI's UDIN system, so that a bank, regulator or client can later check that the document really came from the member who signed it. The practical questions are always the same: which documents need it, who generates it, how much time is available and what can be done if it goes wrong.
ICAI's UDIN Directorate page links the portal, the announcements and the latest FAQs on UDIN, now in their sixth edition. The rules below are drawn from ICAI's announcements and from the FAQs on UDIN (fourth edition, last updated 2 July 2024), which set out the framework question by question.
What a UDIN looks like
A UDIN is an 18-character, system-generated number for every document certified or attested by a full-time practising Chartered Accountant. Its structure is YY MMMMMM AAAAAANNNN. The first two digits are the last two digits of the year of generation, the next six are the member's ICAI membership number, and the last ten are generated randomly. The FAQs give 19304576AKTSBN1359 as an example, so a member can read the year and the membership number directly from the number.
Who has to generate it
Only members holding a full-time Certificate of Practice can register on the UDIN portal and generate UDINs. The FAQs state plainly that UDIN does not apply to members in industry, and that part-time CoP holders do not generate UDINs because they cannot certify documents.
Within a firm, responsibility follows the signature:
- Only the signing partner generates the UDIN for a document. A partner who manages the engagement but does not sign cannot generate it on behalf of the partner who signs.
- Where more than one partner signs the same document, each signing partner generates a UDIN separately.
- The Firm Registration Number is a compulsory field. A member working in individual capacity selects the "NA/Not Applicable/Individual Capacity" option instead. ICAI announced in January 2022 that FRN would become compulsory for UDIN generation from 1 February 2022.
Which documents need a UDIN
The ICAI Council decided at its 379th meeting, held on 17 and 18 December 2018, to make UDIN mandatory in three phases. All three phases now apply.
| Category | Mandatory from |
|---|---|
| Certificates | 1 February 2019 |
| GST audit and tax audit reports | 1 April 2019 |
| Other audit, assurance and attestation functions | 1 July 2019 |
The requirement covers both manually signed documents and digitally signed documents uploaded online. Where an online form has no field for quoting the UDIN, the FAQs say it still has to be generated and communicated to management or to those charged with governance. For tax audit reports, ICAI's UDIN announcements record that CBDT validates the UDIN generated on the ICAI portal when the tax audit report is uploaded, an announcement dated 26 November 2020.
One assignment, one UDIN; two assignments, two
A single UDIN cannot cover every deliverable for the same client. The FAQs state that separate UDINs are needed for the audit of financial statements and the tax audit because they are separate assignments. In a bank branch audit, one UDIN can cover the audit including the LFAR and related certificates, but the tax audit report needs its own. For assignments with periodic submissions, such as concurrent audits and limited reviews, a separate UDIN is generated for each period. The FAQs also confirm that UDIN is mandatory for concurrent and internal audits of banks.
Worked count. Take a listed client for which a firm signs the statutory audit report with two partners, one partner signs the tax audit report, and the firm issues four quarterly limited review reports signed by one partner. The UDINs needed for the year are 2 for the audit report, 1 for the tax audit and 4 for the limited reviews, a total of 7. A firm that plans for "one UDIN per client" will fall short by six.
The 60-day window
In its announcement of 17 September 2021, ICAI extended the time for generating a UDIN from 15 days to 60 days from the date of signing the certificate, report or document. The FAQs add that both the date of signing and the date of generation are included in the 60 days.
In practice, counting both days means the last permitted day is the 59th day after signing:
| Date of signing | Last day to generate UDIN |
|---|---|
| 5 September 2026 | 3 November 2026 |
| 30 September 2026 | 28 November 2026 |
The 60 days are an outer limit, not a default waiting period. The same announcement says that where a regulator or other stakeholder requires the UDIN immediately on signing, or within a specified period, the member must provide it accordingly. The safer workflow is to generate the UDIN as part of sign-off rather than as a separate compliance task afterwards.
Generating a UDIN step by step
- Confirm the document is covered. Decide whether it is a certificate, a GST or tax audit report, or another audit, assurance or attestation document.
- Confirm who signs. The signing member generates the UDIN from his or her own login.
- Log in to the official portal at udin.icai.org.
- Select the FRN, or individual capacity, and the document type.
- Enter the date of signing exactly as on the document. It drives the 60-day window.
- Enter the key fields for that document type. The FAQs explain that key fields vary: a certificate needs two mandatory financial figures, while a tax audit report under section 44AB needs four fields, including total turnover, net profit ratio, written-down value of fixed assets and the assessment year.
- Review everything before final submission, then quote the UDIN on the document or communicate it as the assignment requires.
No document is uploaded to generate a UDIN. The member enters only the prescribed details and key fields, which keeps client documents off the portal.
Revocation: the 48-hour limit
ICAI's announcement of 23 June 2023, following the Council's decision at its 420th meeting on 23 and 24 March 2023, restricts revocation of a UDIN to within 48 hours from the time of its generation. ICAI said authorities and regulators that verify UDINs would be informed of the change. If a member misses the 48-hour window, the FAQs say a fresh UDIN has to be generated.
For example, a UDIN generated at 10:15 am on 1 October 2026 can be revoked only until 10:15 am on 3 October 2026. A wrong key field, wrong document type or wrong signing date should therefore be caught in a review immediately after generation. Where a fresh UDIN is needed, check that it can still be generated within 60 days of the signing date and that any regulator's own deadline is still met, and record the reason for the change in the engagement file.
How third parties verify, and why it matters
Authorities, regulators and banks verify a UDIN through the "Verify UDIN" option on the portal by entering their details, name, mobile number and email, without registering. Every time a third party verifies a UDIN, the member receives an email and SMS alert. That alert is a useful control: a verification request for a UDIN the member does not recognise is a signal that a document may have been misused.
Failure to generate a UDIN is not a clerical lapse. The FAQs warn that non-generation may attract disciplinary proceedings under Part II of the Second Schedule to the Chartered Accountants Act, 1949.
A register that prevents most errors
An engagement-level UDIN register, kept alongside the signed documents, answers most later questions from clients, banks and peer reviewers. Useful columns are:
- Client and assignment, including the period for periodic reports.
- Document type and the key fields entered.
- Signing member, date of signing and last date for generation.
- UDIN, date and time of generation, and the revocation deadline.
- Where the UDIN was quoted or to whom it was communicated.
Common mistakes
- Generating the UDIN from the login of a partner who did not sign.
- Using one UDIN for the statutory audit and the tax audit because the client and year are the same.
- Treating day 60 as the normal generation date and missing a regulator's shorter deadline.
- Counting 60 days from the day after signing, which overshoots the limit by one day.
- Entering the wrong document type, key field or signing date and not checking within 48 hours.
- Assuming a digitally signed online report needs no UDIN because the form has no UDIN field.
Updated on 27 September 2026: retitled; merged the UDIN generation guide into this page; added the UDIN format, the Council meeting behind the mandatory dates, FRN and key-field rules, a 60-day date table, a UDIN count example, third-party verification and the disciplinary consequence of non-generation.
