Section 206AA of the Income Tax Act requires TDS at 20% on any payment where the vendor’s PAN is missing or invalid at the time of deduction. Most Indian mid-market vendor masters contain a material number of records where the PAN was never valid, including placeholder entries from data migration, blank fields that passed ERP validation, and format errors that were never caught. Each of those records is a live short-deduction exposure sitting with the deductor, not the vendor.
When we ran VCR-010 (invalid PAN format check) as part of a vendor master diagnostic at a mid-market manufacturer with over 5,000 active vendors, 1,510 PAN records came back invalid. Not inoperative. Not pending Aadhaar linkage. The records were placeholder strings entered at ERP go-live, blank fields the system accepted, and values like “A1” and “ABCDE1234F” that passed the 10-character format check and sat undetected in the master data for years.
The AP team had estimated the problem was isolated, but it was systemic, concentrated in vendors onboarded during the original migration batch, and had been producing TDS short-deductions on every invoice since.
What Invalid PAN Records Actually Look Like in a Vendor Master
Three failure modes account for most of what VCR-010 surfaces.
The first is placeholder entry at migration. When an ERP goes live and vendor data is bulk-loaded from spreadsheets, PAN is often not available for every record. Rather than leave the field blank and risk a system error, the migration team enters a placeholder such as “A1”, “0”, “PANNOTAVBL”, or “ABCDE1234F”. The ERP accepts these because they pass basic format validation. They then persist in the master data indefinitely because no downstream process forces a correction.
The second is unenforced blank fields. Many ERP configurations do not make PAN mandatory at vendor creation. A vendor is onboarded without a PAN, the record goes live, and invoices are processed. The ERP’s withholding tax module either skips the deduction or applies the standard section rate without triggering the Section 206AA override. Neither outcome surfaces as an error at the time of posting.
The third is format errors that pass validation but do not correspond to a real PAN in the ITD registry. A 10-character string in the correct alphanumeric pattern (five letters, four digits, one letter) will pass ERP-level format checks. If that PAN does not exist in the Income Tax Department’s database, it is invalid under Section 206AA, as typically interpreted, regardless of its structural appearance. This is the “structurally valid, actually invalid” category, the hardest to catch because it looks correct until verified against the ITD registry.
These are not the same as inoperative PANs, which are real, registered PANs that lost active status because the vendor did not link PAN to Aadhaar. That is a separate scenario with different legal treatment and a different remediation path. The records above were never valid. There is no Aadhaar to link, no inoperative status to fix. Section 206AA applies directly, as typically interpreted.
For context on how vendor master data quality problems accumulate over time, see Vendor Master Data Quality in India: What Good Looks Like When You Measure It and ERP Data Quality in India: Why the Numbers Your Finance Team Trusts Are Already Wrong.
How the Vendor Master PAN Field Drives ERP TDS Calculation, and Where It Breaks
In SAP, Oracle, and Tally, TDS auto-calculation depends on three fields in the vendor master: the PAN, the withholding tax type, and the withholding tax code. At invoice posting, the system applies the rate linked to the tax code. The PAN field is the anchor. If it is blank, invalid, or contains a placeholder, the ERP has no mechanism to trigger the Section 206AA override automatically. It either deducts at the standard section rate (short-deduction) or does not deduct at all.
Under the Income Tax Act, the liability to deduct TDS crystallises at the time of credit to the vendor’s account (invoice booking in the ERP) or at the time of payment, whichever is earlier. The compliance status under Section 206AA is locked in at that moment. If the PAN in the vendor master was invalid at the time the invoice was posted, the 20% rate applied from that point forward, under Section 206AA as typically interpreted.
The short-deduction demand sits with the deductor. The company that processed the payment is the assessee in default, not the vendor.
CBDT Circular No. 9/2025, issued under Rule 114AAA, protects deductors from short-deduction demands where the vendor’s PAN was inoperative at the time of deduction but is made operative through PAN-Aadhaar linkage within two months from the end of that month. This relief applies only to PANs that exist in the ITD registry but lost active status due to a failure to link with Aadhaar. It does not apply to placeholder values, blank fields, or structurally invalid strings. For those records, as interpreted under Section 206AA, the 20% rate applies without a safety net.
This creates two distinct risk buckets in any vendor master audit:
| PAN status | Section 206AA applies? | Two-month buffer (Circular 9/2025)? |
|---|---|---|
| Inoperative (real PAN, Aadhaar not linked) | Yes | Yes, if vendor links within 60 days |
| Invalid or placeholder (never registered) | Yes | No, treated as flat failure to furnish PAN |
The diagnostic finding above, 1,510 invalid PANs at a single company, fell entirely in the second bucket.
For more on how GSTIN validation follows the same structural pattern in vendor masters, see GSTIN Validation in Your Vendor Master: What Indian Diagnostics Actually Find.
What a Finance Controller Should Do Before the Next TDS Return Cycle
The check has three parts.
First, extract all vendor records where the PAN field is blank, fewer than 10 characters, or matches known placeholder patterns. This is a data extract from the vendor master, not a system configuration change. It takes one query.
Second, for records that appear structurally valid, with 10 characters and the correct alphanumeric format, cross-reference against the ITD PAN verification portal. A PAN that looks correct internally may not exist in the registry. The only way to confirm is to verify against the source.
Third, prioritise by transaction volume. Section 206AA exposure is proportional to payment value. Vendors above the threshold for the relevant TDS section (194C for contractors, 194J for professional and technical services, 194H for commission) and with high outstanding invoice values are the highest-priority records to remediate before the next return.
Making the PAN field mandatory in the ERP going forward does not correct existing records. Each invalid PAN requires the vendor to supply a valid, verified PAN before the next deduction event. That is a vendor communication exercise, not a system fix. For vendors who cannot supply a valid PAN, TDS must be deducted at 20% on all future payments. This is the conservative and defensible position under Section 206AA as typically interpreted.
The exposure from invalid PANs is correctable before a notice arrives. It is not correctable after.
If you want to know how many invalid PAN records are in your vendor master and which transactions are at risk in the current TDS cycle, the IQSS Diagnostic runs VCR-010 alongside 12 other vendor master checks and produces a prioritised remediation list within five working days.
Key observations
- Invalid PAN records in a vendor master, including placeholders, blank fields, and format errors, trigger Section 206AA directly, as typically interpreted. TDS at 20% applies from the moment the invoice is posted, not from when a notice arrives.
- CBDT Circular 9/2025’s two-month buffer applies only to inoperative PANs, real PANs not linked to Aadhaar. It does not apply to PANs that were never valid, a legally distinct category with a different remediation path.
- ERP TDS auto-calculation depends entirely on the PAN field in the vendor master. A blank or invalid PAN does not trigger the 206AA override automatically. It produces a silent short-deduction that surfaces only at the TDS return stage.
- At a mid-market manufacturer with 5,000+ active vendors, a vendor master diagnostic found 1,510 invalid PAN records. The pattern was systemic, not isolated, and concentrated in vendors onboarded at ERP go-live.
- Remediation requires valid PAN collection from each affected vendor, not an ERP configuration change. Starting before the next TDS return cycle is the difference between a correctable gap and a demand notice.