19th February 2024

You are here:

Estimated Reading Time: 4 Minutes

Updating Security Measures in IRIS GST Suite

GSTN and NIC has brought new security measures by bringing 2FA model while signing up.  We have brought MFA earlier only but unlike GSTN/NIC it is optional on IRIS.

Now just to add one more layer in the overall security of your data, we are introducing Captcha check while logging in to IRIS Web portal (app.irisgst.com).

Impact of these changes on UI

CAPTCHA: Will be implemented on Signup, Login, and Forgot Password pages.
Inactive Session: Users will be directed to the login page if there is no activity on the application for 15 mins (applicable only to products, not the UUM page).

Impact for those clients who have done API integration

Auth token validity will get reduced to 8 hours (previously it was 24 hours).
Rate limiting on Login and Forgot Password.
– Login: Users will be locked for 15 mins after five consecutive incorrect password attempts.
– Forgot Password: Users must wait 15 mins before placing the next request after initiating a forgot password request.
Users will not be able sign up using disposable email addresses (e.g., Malinator). Known disposable email domains have been blocked.

Impact for SFTP

No change in SFTP upload and download

We are adding one more layer to ensure the data security.

Disable Concurrent Sessions: We will be making changes to prevent a user from being logged into the system using the same credentials from multiple devices or locations simultaneously. So if a user is logged in on one device or browser and attempts to log in from another device or browser, the system will log the user out from the first session.

For example, if suppose a person A has logged in using an ID and another person B uses same ID and login to IRIS then person A will be logged out.

So if you are using same ID for multiple users then we request you to create separate IDs for all users.

GSTR 1 E-Commerce Transaction Reporting Changes

In December 2022, GSTN issued an notification (Notification No. 26/2022 – Central Tax dated 26th December 2022) about changes in E-Commerce transactions. As per this notification, two new tables are added in GSTR1, Table 14 and Table 15.

Table 14 is for Suppliers who sell through E-commerce operators. They need to show their transactions in this table.

Table 15 is for E-commerce operators; they need to show their sales in this table.

Below are more details about this notification and its impact in GSTR1 reporting:

Scenario/Table	Description	Meaning of change	Change in GSTR1 reporting
Supplier is not selling through E-commerce operator			No change
Table 14 (a): Supplier is selling through E-commerce operator and Supplier is liable to pay tax as per Section 52	Sec 52 e-commerce transactions are currently getting reported in tables 4 to 10 and they will remain as is. But now along with this, suppliers also need to provide aggregate values in Table 14 (a)	In case the sale through E-commerce operator is as per Section 52, Supplier is liable to pay tax in GSTR3B. E-commerce operator will only deduct TCS. In this case supplier need to show the details in Table 4 to 10 and in Table 14 (a).	Invoice level format:
			Along with E-commerce GSTIN the section is to be mentioned in the new column. If nothing is mentioned in this column then default value Sec52 will be considered.
			IRIS will populate values in GSTR1 as required by GSTN.
			Aggregate format:
			i) For Table 4 to 10, details to be provided in invoice level format of regular transactions
			ii) For Table 14 (a), details to be provided in the new format (GSTR 1 5)
			Note: Any amendments in Table 14 to shown in aggregate format.
Table 14 (b): Supplier is selling through E-commerce operator and E-commerce operator is liable to pay tax as per Section 9(5)	Sec 9(5) e-commerce transactions suppliers need to report directly in Table 14 (b).	In case the sale through E-commerce operator is as per Section 9(5), E-commerce operator is liable to pay tax in GSTR3B. E-commerce operator will not deduct TCS. In this case supplier need not show the details in Table 4 to 10. He only needs to show details in Table 14 (b).	Invoice level format:
			Along with E-commerce GSTIN the section is to be mentioned in the new column. If nothing is mentioned in this column then default value Sec52 will be considered.
			IRIS will populate values in GSTR1 as required by GSTN.
			Aggregate format:
			i) For Table 14 (b), details to be provided in the new format (GSTR 1 5)
			Note: Any amendments in Table 14 to shown in aggregate format.
Table 15: For E-commerce operator if sale is as per Section 9 (5)	E-commerce operators need to report sec 9(5) e-commerce transactions in Table 15.	If the sale through E-commerce operator is as per Section 9 (5), then the details of registered and unregistered sales both need to be shown in GSTR1 by E-commerce operator. Also, E-commerce operator is liable to pay tax in GSTR3B.	IRIS has introduced two new formats (GSTR1 6 and GSTR1 6a) for providing details at the invoice level and another is for providing details at an aggregate level.
	Here recipient is registered then details need to be provided at invoice level and if the recipient is unregistered then values need to be provided at an aggregate level		Kindly note that Amendment values for Table 15 where the recipient is unregistered need to be provided in aggregate format only. The system will not calculate aggregated amended values.

Other Impacts of these changes are as follows:

Auto computes Table 3.1.1. of GSTR 3B is now possible
In GSTR 2B, new Ecom sections are introduced.

Attached here with a GSTN advisory note for the changes and updated input formats of IRIS. Below is the link for a blog published by IRIS with regards to this topic: