India OIDAR Enforcement: DGGI Notices Target Nonresident SaaS

India's Directorate General of GST Intelligence (DGGI) is in the middle of a multi-year push against nonresident digital service providers who sell into India without registering under the OIDAR regime. What began as outreach letters to a handful of streaming and advertising giants in late 2023 has widened into a broad enforcement programme covering SaaS, cloud, edtech, online gaming, cryptocurrency exchanges and advertising platforms — many of which had never heard of OIDAR until the notice arrived. This article explains what the notices look like, why they are being issued now, the retrospective exposure back to 2017, and how a nonresident SaaS company should respond.

Why the notices are arriving now

Two amendments to the IGST Act, effective 1 October 2023, triggered the enforcement wave. The first rewrote the definition of "non-taxable online recipient" in Section 2(16) to cover any unregistered person in India — including unregistered small businesses and sole proprietors — not just individuals buying for personal use. The second removed the "essentially automated and involving minimal human intervention" qualifier from the OIDAR definition in Section 2(17), pulling in hybrid services that previously escaped.

The combined effect: an overseas SaaS vendor selling to any Indian customer without a GSTIN is now making a B2C supply, must register from the first rupee, and must charge 18% IGST. There is no turnover threshold. The DGGI spent 2024 mapping which foreign platforms were still serving Indian users without a GST registration, and since then has been systematically contacting them.

The notice ladder: guidance letter to summons to show-cause

DGGI outreach typically follows an escalating sequence. Understanding where a notice sits on the ladder determines how much time you have and what the response should look like.

1. Guidance letter / outreach communication

The opening contact is usually an informal letter or email from the Bengaluru OIDAR commissionerate (or one of the zonal DGGI units) asking the foreign supplier to confirm whether it makes supplies to Indian recipients, and inviting voluntary registration. These letters are not legal summons, but they are the warning shot — ignoring them almost always leads to step 2.

2. Section 70 summons

A summons under Section 70 of the CGST Act compels the production of documents and can require a representative to appear before the authority. For foreign suppliers the summons is typically served on an Indian group company, an Indian payment processor, or the supplier's local representative. The Supreme Court confirmed in August 2025 that a Section 70 summons does not itself constitute "initiation of proceedings", which means State GST authorities and the DGGI can run parallel tracks on the same taxpayer.

3. Show-cause notice (SCN)

An SCN under Section 73 or Section 74 of the CGST Act is the formal step that crystallises a tax demand. Section 73 applies to non-fraudulent cases and carries a three-year look-back; Section 74 is the one to watch — it alleges suppression or willful misstatement, carries a five-year look-back, and a penalty equal to the tax demanded. Several of the late-2023 notices against global platforms were framed as Section 74 demands, which is what enables the "back to 2017" framing that has dominated the press coverage.

4. Recovery and collateral measures

If the SCN is confirmed and the taxpayer does not pay, the DGGI has several collateral levers:

• Section 79 recovery — attaching funds held by Indian banks, customers, or group companies.
• Payment aggregator directives — the DGGI has asked Indian PA/PG licensees to suspend settlements to unregistered foreign merchants.
• Website blocking under Section 69A of the IT Act — invoked sparingly but on the table for egregious non-compliance.
• Information-sharing requests to the vendor's home tax authority and, in the case of US-based vendors, to the IRS via exchange-of-information channels.

Who has received notices so far

The visible tranche of late 2023 covered approximately 70 foreign digital companies including Netflix, Spotify, Meta and Alphabet (Google), along with advertising networks, edtech platforms, online gaming operators and cryptocurrency exchanges. Coverage in 2024–2025 widened into cloud and SaaS categories: collaboration tools, analytics vendors, developer tooling companies, CRM and marketing automation platforms, and AI infrastructure providers. Many of these firms had Indian revenue under INR 5 crore and had treated the Indian market as too small to warrant local registration — a calculation that the zero-threshold OIDAR regime breaks.

Retrospective exposure: the 2017 math

The worst-case look-back for an OIDAR non-registrant is the period from 1 July 2017 (when GST replaced the erstwhile Service Tax) to the present. For the years before October 2023, exposure is limited to supplies to individuals (the narrow pre-amendment NTOR definition). For October 2023 onwards, exposure extends to every unregistered recipient.

A worked example. Suppose a US SaaS company billed USD 600,000 to Indian customers from October 2023 to date, with roughly 40% of that to unregistered recipients. The tax-exclusive B2C value is ~USD 240,000. At 18% IGST that is ~USD 43,200 of tax, plus 18% annual interest from the date the tax was due, plus a Section 74 penalty equal to the tax if suppression is alleged. The gross exposure can easily reach 250–280% of the original tax figure before any settlement discussion.

How to respond if you receive a notice

The response pattern that has worked best, based on advice from Indian GST counsel handling these matters:

1. Acknowledge the letter promptly. A short written reply confirming receipt and requesting a reasonable extension to gather data is almost always granted, and it starts the dialogue on a cooperative footing.
2. Quantify the Indian B2C base. Pull billing data segmented by customer country and by GSTIN presence. The split between B2B (GSTIN-bearing, reverse charge) and B2C (unregistered, OIDAR in scope) is the single most important number in any subsequent discussion.
3. Register under Form GST REG-10. The simplified nonresident OIDAR registration does not require an Indian entity, bank account, or local signatory. Voluntary registration before the SCN is issued meaningfully weakens any Section 74 "suppression" allegation.
4. File past-period GSTR-5A returns. The portal allows back-filing, with late fees (INR 200/day, capped at INR 10,000 per return) and interest at 18% per annum on the tax. Paying the tax and interest upfront is a precondition for most settlement routes.
5. Engage Indian counsel before the SCN. Once the SCN is issued, the statutory timeline for a reply is 30 days (extendable). A pre-SCN voluntary disclosure under Section 73(5) or 74(5) can significantly reduce penalty exposure — in some cases to 15% of tax — but the window is narrow.

Supreme Court backdrop

The Supreme Court's July 2025 disposal of a long-running public interest litigation on foreign OIDAR compliance was a notable moment. The Court declined to direct the executive on collection methodology but flagged the continuing monitoring gaps for overseas providers — a comment widely read as a green light for the DGGI to keep pressing. The August 2025 ruling on Section 70 summons, which held that a summons does not trigger the bar on parallel proceedings, removed a defence strategy that some foreign platforms had relied on.

What good OIDAR hygiene looks like

For a nonresident SaaS company that has not yet been contacted but sells into India, the sensible baseline is:

• Register under Form GST REG-10 as soon as Indian supplies begin — there is no threshold to wait for.
• Validate every Indian customer's GSTIN at invoice time; store the validation response as audit evidence.
• Apply 18% IGST on all supplies to customers without a valid GSTIN; apply reverse charge (no tax collected, recipient self-assesses) on supplies to customers with a GSTIN.
• Capture two pieces of location evidence per Section 13(12) of the IGST Act — billing address, IP, card-issuing country, SIM MCC, or bank account country — and retain them with the invoice.
• File GSTR-5A monthly by the 20th of the following month; pay IGST in INR via electronic cash ledger.
• Keep supplies to Indian customers out of any consolidated VAT tracker that treats zero-threshold regimes the same as thresholded ones — India, UAE, Turkey and a handful of others need their own rules.

Frequently asked questions

Why is India's DGGI contacting nonresident SaaS companies?

After the October 2023 OIDAR amendment, the universe of foreign SaaS suppliers that fall within India's GST net expanded sharply. The DGGI has been working through a list of overseas platforms that serve Indian users without a GSTIN, opening with guidance letters and escalating through summons and show-cause notices.

How far back can Indian tax authorities demand OIDAR tax?

Up to 1 July 2017 under Section 74 of the CGST Act where suppression is alleged, which gives a five-year look-back plus the pre-2017 service tax period for the very earliest notices. Most current SCNs run from October 2023 onwards for the expanded B2C base, with pre-2023 claims limited to supplies to individuals.

What happens if a nonresident SaaS company ignores an OIDAR notice?

Penalties under Section 122 (the greater of INR 10,000 or the tax evaded), interest at 18% per annum, recovery under Section 79, directives to Indian payment aggregators to freeze settlements, and in egregious cases website blocking orders under Section 69A of the IT Act. Ignoring the letter is the single worst option on the response menu.

Can a foreign SaaS register voluntarily before receiving a notice?

Yes, via Form GST REG-10 on the GST portal. No Indian entity, local bank account, or resident signatory is required. Voluntary pre-notice registration is the cleanest way to cap retrospective exposure and pre-empt a Section 74 "suppression" framing.

Is a Merchant of Record a way out of OIDAR?

Only if the MoR is the contracting party with the Indian customer and issues the invoice in its own name. If you self-invoice Indian customers and merely use the MoR for payment processing, you remain the supplier for OIDAR purposes and the registration obligation sits on you.