The frame: MCA is a starting point, not a verdict
Every due-diligence guide written about Indian companies either over-trusts MCA data or under-trusts it. Over-trusting treats an 'Active' status and a filed MGT-7 as proof of ongoing business. Under-trusting writes off the MCA register as useless and falls back on gut feel. Both are wrong.
MCA master data is a filing-trailing legal record. It reliably tells you the legal state of a company — its identity, its registered office, its director composition, its capital, its filing compliance. It does not tell you whether the company has customers, whether its products work, or whether its representatives are operating in good faith. Those are different questions that require different sources.
The framework here is to use MCA for what it is good at — legal identity and compliance baseline — and then triangulate across independent sources for operational reality.
Step 1: Start from the CIN, not the name
Company name collisions are common, especially for generic descriptive names. 'Blue Sky Technologies Private Limited' might be four different companies across four states with nothing in common. If you only have a name, search MCA and look at every match, not just the first.
The CIN is the unambiguous identifier. If you are going to rely on the due-diligence output in any serious way — contracts, wire transfers, partnerships — get the CIN from the company directly (it must appear on their letterhead under Section 12) and verify against their claimed identity. If the CIN they give you does not match the state, year of incorporation, or ownership structure they describe, stop and investigate.
Our glossary entry on CIN walks through how to decode a 21-character CIN manually. If you only do this once in a while, use our CIN decoder diagram on the What Is a CIN guide.
Step 2: Verify basic identity on MCA
Once you have the CIN, load the master record. Confirm:
Company name and the CIN match. The name you see should be the exact legal registered name — capitalisation, suffixes (PRIVATE LIMITED, LLP, LIMITED), everything.
Incorporation date. Match this against the claim — a 'ten-year old company' that was incorporated six months ago is an immediate red flag.
Registered office state. The state code embedded in the CIN should match the current registered office state. If they differ, the company has moved its registered office across state lines (a formal ROC-transfer process) and that's worth noting.
Company type and ownership. PTC, PLC, OPC, FTC, FLC, NPL — each has different implications. A claimed 'startup' that turns out to be a Section 8 non-profit (NPL) is a different animal.
Step 3: Check the status field carefully
Read the exact status string, not just the colour-coded badge. Indian corporate status values include: Active, Active Compliant, Strike Off, Under Process of Striking Off, Dormant under Section 455, Amalgamated, Dissolved, Under Liquidation, Captured, and Converted to LLP.
Each has different implications. 'Under Process of Striking Off' means the ROC has initiated removal proceedings — the company has weeks, not months, left. 'Captured' means the ROC has flagged the record for manual investigation. 'Dormant' is a formally declared state of inactivity with relaxed compliance, which may be fine for a shell that holds an IP asset but is a signal if the company claims to be operating.
'Active' is the most frequently misread value. It means the company has not been struck off. It does not mean it's operating. Always combine status with filing history.
Step 4: Read the filing history
A more meaningful indicator of operational reality than status is whether the company has filed its annual return (MGT-7) and financial statements (AOC-4) for the most recent completed financial year.
A company that has filed both, with a reasonable cadence for the past 3 years, is almost certainly operating. A company that hasn't filed for two or more years is almost certainly heading toward strike-off regardless of what its current status says.
Partial filing — MGT-7 but no AOC-4, or vice versa — is a signal worth noting. It often indicates disputes with the auditor, or a company that is going through the motions of annual return compliance without genuinely closing its books.
Step 5: Audit the director list
Look at the current director list and cross-reference each DIN.
Filter to active directors — those with no cessation date (or a cessation date in the future, which is unusual but possible for scheduled retirements). A company with two directors, both appointed in the last six months, where one or both have very short prior directorship histories, is a different animal from a company with stable long-tenured directors.
Click through each director's DIN to their profile. Look at the directorship portfolio. Professional directors sitting on many boards is legitimate and common; nominee directors sitting on many unrelated companies with overlapping addresses is a different pattern. Our due-diligence playbook treats the second as a signal for further investigation, not a conviction.
Also worth checking: Section 165 compliance. A director holding 20+ active directorships is at or past the cap. Their ability to accept new appointments is constrained, which matters if you expect them to take on a new board role.
Step 6: Check capital figures for plausibility
Compare paid-up capital against the scale of business the company claims.
A company claiming ₹50-crore revenue with ₹1-lakh paid-up capital is physically possible but unusual. Either the working capital is being funded by loans (check the AOC-4 for borrowings), or the claimed revenue is overstated. Neither answer is disqualifying but both warrant explanation.
Also check the ratio of paid-up to authorised capital. A paid-up that equals authorised means the company is at its issuance ceiling and would need to increase authorised capital (Form SH-7) before raising more equity. This is a neutral signal — many companies sit at their ceiling while waiting for the next round. But if they claim a recent fundraise without a corresponding authorised-capital increase, something does not add up.
Step 7: Investigate the address
Look at the registered address. Is it a real office, a residential flat, a CA firm's office, or a virtual-office service?
On CorpIntel, we surface the address cluster size — how many other companies share the same normalised address. A shared CA-firm office with 20 companies is normal for small companies in the CA's client portfolio. A virtual-office service with 400+ companies at one address is also normal for the service itself, but combined with a recent incorporation and minimal capital, it's a signal.
None of this is dispositive on its own. A Fortune-500-style group headquarters will also have many companies at the same address — their own subsidiaries. What matters is the combination: cluster size + industries represented + activity levels + director overlap. Our address-cluster pages surface all of these for a given address.
Step 8: Triangulate with non-MCA sources
This is the step most first-time MCA users skip and it's the most important. MCA gives you the legal shape; the world gives you the operational reality.
Website: does the company have one? Is it up-to-date, or last modified three years ago? Is the content substantive or placeholder? Website dormancy often precedes operational dormancy by 12-24 months.
GST registration: Indian companies with actual operations and taxable revenue will have a GSTIN. You can verify a claimed GSTIN against the GST portal. A company claiming scale but without a GSTIN is a red flag.
LinkedIn headcount: for knowledge-work companies, LinkedIn employee counts are a reasonable proxy. A company claiming 100 employees showing 3 on LinkedIn warrants explanation.
Press and news: do substantive mentions exist beyond their own press releases? Paid coverage and wire-service reprints don't count the same way independent reporting does.
Trade references: for B2B companies, ask them for two customer references you can actually call. Not testimonials on their website — live phone or email references. Their willingness to provide and the quality of the references tells you as much as the references themselves.
What a real red flag looks like
A single signal in isolation rarely means anything. Red flags are combinations.
A combination that warrants serious pause: recent incorporation (under 2 years), minimal paid-up capital, registered at a virtual-office address shared with 100+ companies, two directors with minimal prior directorship history, no MGT-7 or AOC-4 filed yet (which is possible for a brand-new company), no website, no GST registration, and no independent references. That's not a company — that's a shell.
A combination that's usually fine: 5+ year incorporation, stable director composition, timely MGT-7 and AOC-4 filings, a registered office that looks like an actual office on maps, a real website, GSTIN verifiable on the GST portal, and a few independent press mentions. Even if the capital figures look small, this is almost certainly a legitimate operating business.
The art is in the cases in between. Our view: when in doubt, ask for more information directly. A legitimate company will not be offended by due-diligence questions.
Tools we use
For MCA master data lookup: our own platform (CorpIntel), MCA21, and the data.gov.in mirror. When in conflict, MCA21 is authoritative.
For address visualisation: Google Maps / Street View for the registered office. A tiny apartment building in a residential neighbourhood versus a named corporate park tells you a lot.
For director network analysis: our director profile pages surface directorship portfolios and network strength. For deeper graph analysis, contact our research desk.
For GSTIN verification: the official GST portal (gst.gov.in).
For press: Google with site-restrictors to exclude the company's own domain and common PR-wire sources.
What to do with the result
Write it down. A due-diligence result that lives in your head is not a due-diligence result. A one-page summary with the CIN, key facts, signals, and your conclusion — even in bullet points — is enough.
Share it with the decision-maker. The point of due diligence is to inform a decision, not to demonstrate effort. If you conclude the company is fine, say so clearly. If you conclude it's risky, state the specific risks.
Flag where you had to make assumptions or use weak signals. Every due-diligence report has soft spots. Naming them up front is more useful than pretending certainty.