E-Invoice IRN Validation: What AP Teams Must Check Before Approving Payment
A mandated supplier without a valid IRN means blocked ITC and GST non-compliance. Here's what AP teams must validate before approving any e-invoice for payment.
Verse HQ
An invoice arrives from a supplier whose turnover crossed ₹5 crore last year — they are now under the e-invoicing mandate. There is no IRN on the invoice. Your AP team processes it anyway, and you claim ₹2.8 lakh in ITC. At the next GST audit, the department reverses the credit. Add 18% interest on ₹2.8 lakh from the date of the original claim, and the error costs you more than the original tax amount. The fix requires one check: is this supplier mandated, and if so, does this invoice have a valid IRN?
Who Is Mandated and What That Means for AP
As of 2026, the e-invoicing mandate applies to all GST-registered businesses with aggregate annual turnover above ₹5 crore for B2B and B2G transactions. For suppliers in that threshold, generating a valid Invoice Reference Number through the IRP is not optional — it is a prerequisite for the invoice to be legally valid for ITC purposes.
The practical implication for your AP team: every invoice from a mandated supplier that does not carry a valid IRN puts the associated ITC at risk. The supplier has not just failed a compliance requirement — they have issued an invalid document. Paying that invoice and claiming ITC creates an exposure that may not surface until an audit.
Determining whether a specific supplier is mandated requires knowing their approximate annual turnover. This is where many AP teams have a gap — they verify GSTIN validity at onboarding but do not track whether a vendor has crossed the ₹5 crore threshold since. A supplier that was below the mandate last year may be above it now.
What a Complete IRN Validation Checks
Most AP teams check whether an IRN field exists. A complete IRN validation goes further.
The IRN format: a valid IRN is a 64-character alphanumeric hash generated by the IRP. An incorrectly formatted or truncated string is not a valid IRN, even if it occupies the right field on the invoice. A fraudulent invoice can include a plausible-looking fake IRN.
The QR code: every e-invoice must carry a digitally signed QR code containing the invoice data. The QR code can be scanned to verify that it matches the invoice details — invoice number, date, GSTIN, and total amount. If the QR code data doesn't match the printed invoice, the document has been tampered with.
The upload window: for suppliers with turnover above ₹10 crore, invoices must be uploaded to the IRP within 30 days of the invoice date. An IRN that was generated 45 days after the invoice date is non-compliant. The IRP will reject the upload, meaning no valid IRN exists.
Cross-reference against IRP: the GSTN provides a public API to verify IRN authenticity. For high-value invoices or any invoice from a new supplier, this verification confirms that the IRN was actually issued by the IRP and corresponds to the presented document.
Where the Validation Gap Usually Sits
The IRN field on a PDF invoice is text. AP teams using OCR for invoice extraction can pull the IRN as a data field. But pulling it and validating it are different steps. Most AP workflows extract the IRN field, accept it as present, and move to the approval queue without checking whether it is authentic, correctly formatted, or within the upload window.
The practical fix: for mandated suppliers, IRN validation needs to be a blocking check — invoices that fail validation do not enter the approval queue. For non-mandated suppliers, the check is whether a GSTIN is active and whether the invoice format meets the minimum requirements for ITC eligibility.
IRN validation is not a compliance formality. It is the strongest ITC protection control available for invoices from mandated suppliers. The cost of implementing it is a single verification API call per invoice. The cost of skipping it can be the entire ITC amount plus interest.
