Skip to content

Commercial and Statutory Prerequisites

Applies to: All subscriptions

Purpose

Settle the items that depend on third parties, contracts and statute. These have the longest lead times of anything in an implementation and are the most common reason a go-live date moves.

Audience

The customer's project manager, tax lead and procurement. Implementation consultants tracking the critical path.

Prerequisites

Steps

1. Confirm the statutory obligation

Before anything is bought or built, establish what the customer is actually required to do, and from when.

# Item Owner Why it matters
S1 Aggregate annual turnover confirmed Customer's tax lead Turnover decides which obligations apply and from what date
S2 e-Invoicing applicability confirmed in writing Customer's tax lead Scope and deadline both follow from this
S3 Applicable reporting window established Customer's tax lead Higher-turnover taxpayers must report an invoice within a limited period of its date. A missed window cannot be recovered — not in Complifly, not anywhere
S4 e-Way Bill obligations established Customer's logistics and tax leads Threshold values and intra-state rules vary
S5 Exemptions and special cases identified Customer's tax lead Exports, special economic zones, reverse charge and exempt supplies each behave differently

Item S3 deserves emphasis. The reporting window is enforced early in Complifly, at ingest, deliberately: a stale invoice is isolated at the door rather than sitting in a workbench looking ready and failing only when a user presses a button. That is helpful behaviour, but it means the window must be understood before go-live, or a batch of historical invoices will be quarantined and the team will not know why.

2. Secure registrations

# Item Owner Lead time
S6 Every GSTIN in scope listed Customer Immediate, but frequently incomplete on first pass
S7 Each GSTIN confirmed active Customer Immediate
S8 Legal name and address per GSTIN match the registration Customer Immediate. A mismatch causes rejections that look like a mapping fault
S9 Government portal credentials available where needed Customer Days
S10 TAN registered, if the TDS module is licensed Customer Days to weeks

List every GSTIN, including registrations the business considers dormant. A dormant registration that later issues a single document, and was never onboarded, produces an out-of-scope rejection that is hard to diagnose.

3. Obtain GSP credentials — start this first

This is the longest pole. It involves a third party, and no amount of internal effort accelerates it.

# Item Owner Notes
S11 GSP selected Customer, advised by Complifly Providers differ in capability; see GSP Abstraction
S12 Commercial agreement with the GSP concluded Customer Includes call volumes and pricing
S13 Sandbox credentials issued Customer and GSP Needed before any integration testing
S14 Production credentials issued Customer and GSP Needed before go-live, not on the day
S15 Credentials registered per GSTIN where the provider requires it Customer and GSP Some providers scope credentials per registration
S16 Source-address allow-listing completed Customer, GSP and network Only if the provider restricts by address
S17 Credential expiry and rotation understood Customer An expiry nobody owns becomes an outage

Verify: How GSP call volume is metered and billed, and how a customer sees consumption against their allowance, is not established in this portal. Confirm before go-live — unbudgeted overage is discovered on an invoice otherwise. Recorded as assumption D2 in the Assumptions Register.

4. Settle Complifly licensing

# Item Owner Notes
S18 Licensed modules confirmed Customer and Complifly e-Invoice, e-Way Bill, Invoice Generation, TDS, Data Privacy
S19 Licensed GSTIN count confirmed Customer and Complifly Capability is enabled per GSTIN
S20 User count confirmed Customer and Complifly Including auditors and read-only users
S21 Environment entitlement confirmed Customer and Complifly Whether non-production environments are included
S22 Support tier and hours confirmed Customer and Complifly Decides the escalation paths in this portal

Verify: Support tiers, hours and response targets are not stated in this portal, so escalation criteria elsewhere cite a matrix that must be supplied. Recorded as assumption D3.

5. Settle data protection

# Item Owner Notes
S23 Data processing terms agreed Customer's legal and Complifly Roles under the DPDP Act established
S24 Data residency requirements confirmed Customer Decides hosting location
S25 Retention requirements confirmed Customer's tax and legal leads Statutory retention for compliance evidence
S26 Security review completed Customer's security team Use Authentication and Security as the evidence pack

The critical path

  Day 0     Week 2      Week 4      Week 6      Week 8
    |          |           |           |           |
  S11-S12 --> S13 ------> S14 ------> S15-S16 ---> ready
  select      sandbox     production  scoping,
  and         credentials credentials allow-list
  contract
    |
  S1-S5 ----> confirmed in writing
  statutory
    |
  S18-S22 --> licensing settled

Everything technical can be compressed. This cannot. Begin on the day the project is confirmed.

Validation

The commercial and statutory gate is passed when every row below has documentary evidence, not a verbal assurance.

Check Evidence
Statutory position confirmed A written statement from the customer's tax lead covering applicability, date and reporting window
GSTIN list complete The list reconciles to the customer's registration records, including dormant registrations
Sandbox credentials working A successful test call, executed and dated
Production credentials working A successful connection test in the production environment, executed before go-live day
Allow-listing confirmed on both sides The egress address is registered with the provider and confirmed by them
Licensing matches scope Licensed modules, GSTIN count and users match what the implementation actually configures
Support path known The customer knows how to raise a ticket, and against which tier, before they need to
Data protection cleared Processing terms signed and the security review closed

Troubleshooting

Symptom Cause Action
Go-live approaches without production credentials Started late; the provider's issuance is outside your control Escalate commercially at once. There is no technical workaround
Historical invoices are quarantined at ingest They fall outside the reporting window Expected. Confirm the window with the tax lead and agree how historical documents are handled before loading a backlog
Rejections citing a legal-name mismatch The name in the ERP differs from the registration record Correct the master data to match the registration exactly. This is a data problem, not a mapping problem
Documents rejected as out of scope A GSTIN issuing documents was never onboarded Add it. This is why dormant registrations must be listed
The GSP bill exceeds expectations Call volume not modelled, or an integration polling a read that could be served locally Review the calling pattern; reads with a local answer should not go out. See GSP Abstraction
A module the business expected is absent Not licensed, or licensed but not enabled for that GSTIN Check licensing first, then the per-GSTIN flag. See Modules and Licensing
Provider credentials expire without warning Expiry not owned Record expiry dates in the operations calendar. See Monthly Checks
Security review blocks go-live late Started after technical work rather than alongside it Begin the review in week zero using Authentication and Security as the evidence pack