Notification No. 3/2015

The text, read by machine from the scan

This is not the department’s typed text. The department published this one as a scanned image of a signed paper, so there is no text in the file to copy. What follows was read off that image by optical character recognition and is reproduced without correction — the mistakes you can see are the machine’s, and there may be others you cannot. It is here so the document can be found and read; it is not a substitute for the file, which is linked below. Do not quote from this page.

If :
Hee | |
a
F.No.: DGIT(S)/CPC(TDS)/Corp_Authentication Mech/2015-16 y F Y554 -ly £0
| Government of India
| a Ministry of Finance 8
, Central Board of Direct Taxes ar -
Hen: Directorate of Income-tax(Systems) Ga
*| i ; a ¥ 4
| 1 New Delhi. —
a Notification No. 3/2015
New Delhi, 1° of December 2015 ,
| ; ; me
| Subject:' Stringent Authentication mechanism through Corporate Head Quarter Server for filing of Correction
| statements & download of TDS certificates, Consolidated files etc. by Banks/Corporates- regarding. ;
Section 200 of the Income tax Act provides for filing of TDS statements. The manner of filing such statements and the particulars have been laid down in Rule 31A of the Income tax Rules. Vide Sub Rule 5 of Rule 31A (placed at
DFA-Il) of the Income Tax Rules, it has been specified that the Director General of Income Tax (Systems) shall specify the procedures, formats and standards for the purposes of furnishing and verification of the statements or
| claim for refund in Form 26B and shall be responsible for the day-to-day administration in relation to furnishing
| and verification of the statements or claim for refund in Form 26B in the manner so specified.
|
| In exercise of the powers delegated by the Central Board of Direct Taxes (Board) under Explanation to Sub Rule 5
| of Rule 31A of the Income-tax Rules 1962, the Principal Director General of Income-tax(Systems) lays.down the
| _ authentication mechanism for filing of correction statements & download of TDS certificates, Consolidated files
| etc. by Banks and Corporates deductors as under:
| a Need of Authentication Process 7
| 1.1 CPC-TDS initiated “corporate connect” with an intent to pursue TDS compliance related issues of all
| _ branches of a corporate with their corporate headquarter. This initiative has multiplier effect as TDS defaults of
| over 2lac deductors can be addressed by following it up with only 4000 PAN entities. CPC-TDS also rolled out
| functionality for corporate headquarter at PAN level to provide summary of TDS defaults of its branches. The criticality of this initiative can be understood from the fact that 30% of total TDS defaults and 80% of total PAN
| errors pertain to only 4000 PAN entities. ie :
1.2 - - During this exercise, the banks were finding it hard to resolve the TDS defaults in case of closed branches and branches merged with other banks. The banks were not able to retrieve old records for FY 2007-08, 2009-10
etc. in order to file correction statements to resolve the outstanding defaults. Further banks also found challenge :
| __.in procuring digital signatures for. each branch for filing online correction on. TRACES portal. The genesis of the
| modified access process lies in strategy to address the above challenges of retrieval of old data without use of
| digital signature. As discussed above, 80% of total PAN errors pertain to banks. The modified access process will
' bring in discipline to the correction process as only the authorized bank official would be able to work.on TRACES ©
system. The concept of involving head quarter as a “corporate connect” drive will help in bringing in better TDS
compliance as the headquarter will have complete picture of the TDS compliance of each branch.
|
|
Page 1 of 3
| Sh etn

a. Mechanism involved:

24 This mechanism is based on the concept of routing the access requests of various TAN branches of a particular entity through its corporate headquarter’s server. The deductor branch will pass-on the login credentials to the relevant bank/corporate Headquarter’s (HQ) server and HQ server will validate the login credentials & IP address of the user’s system. After necessary validations, HQ server will send the digitally signed string, in form of encrypted information, to TRACES server. TRACES server will authenticate the defined particulars referred in para 2.2.2 provide access to the concerned TAN account. This mechanism has three benefits:

a) Secured access of sensitive third party data: Only authorized representative of banks/corporates will be able to access TRACES portal as the login would be through corporate server only.

b) Corporate headquarter can keep track of the access requests of the branches and this

will help in enforcing discipline among the branches.
c) No need to procure separate digital signature for each bank/corporate branch to access J
TRACES portal on account of routing of request through corporate server.
22 The detailed process in this regard is as under:
2.2.1 Deductor Functionalities Access Service URL
For accessing the geductor functionalities through corporate servers, corporate banks need to send request data via HTTP Post Method. Access of deductor functionalities through corporate bank server will be provided over SSL.
2.2.2 Listof Request Parameters
1 * data* Text PAN of Deductor, TAN of Deductor, Transaction Timestamp, IP, Email ID, Mobile
Number of AP etc.
2 _ signature Text Digital signature in PKCS7 format with base 64 encoding
Data from website needs to be submitted only using POST method through HTTPS request using the following parameters:
' 2.2.3 Structure of “data” field
Pe Veet Pe pert ee Se. a
1 PANofDeductor Character 10 Mandatory AAAAASS99A
j 2 TANofDeductor Character 10 Mandatory
AAAAS9999A
3 PAN of AP Character 10 Mandatory As entered during login (PAN of
Authorised Person)
4 Mobile number Numeric 10 Mandatory 9999999999
of AP :
Page 2 of 3

# Field Name Data Type Field Mandatory / Sample value length Optional
5 Email ID of AP Character NA Mandatory email ID having bank’s/corporate’s domain name e.g. (____ @sbi.co.in)
6 Transaction Character (YYYY- 26 Mandatory 2009-10-26-15.07.40.071658
Timestamp MM-DD-
hh24.mi.ss.ffffff)
* The above fields in the data will be separated by "*"
2.2.4 List of unauthorized access scenarios a. Bank request data not in proper format b. Bank URL through which bank is accessing traces application is not correct c. Incorrect digital certificate d. Request parameters not valid e. Timestamp will be used for checking staleness
FE CPC (TDS) will gradually migrate banks and corporates to the modified authentication process of accessing
TRACES portal. During transitional period of on boarding of banks/ corporates normal access to TRACES portal will remain available to the users of respective banks/corporates. The normal access will be discontinued only after complete onboarding of the entity and all its branches. (
(Ps. ingaleng)
Dy. Commissioner of Income Tax (CPC-TDS)
O/o The Pr. Director General of Income-tax (Systems)
Copy to:
¥. PPS to the Chairman and Members, CBDT, North Block New Delhi.
2. All Chief Commissioners/Director General of Income-tax/Commissioners of Income-tax/ Commissioners of Income-tax(TDS) — with a request to circulate amongst all officers in their regions/charges.
3. JS(TPL)-I&ll / Media coordinator and Oficial spokesperson of CBDT.
4. DIT(IT)/DIT(Audit)/ DIT (Vig.)/ ADG (Systems) 1,2,3 4, 5 /ADG(TDS)/CIT(CPC-ITR), Bangalore, CIT(CPC-
TDS) Ghaziabad
5. ADG (PR, PP &OL) with a request for advertisement campaign for the notification.
6. TPL and ITA Divisions of CBDT
7. The Institution of Charted Accountant of India, IP Estate, New Delhi.
8. The Web Manager, ’‘incometaxindia.gov.in’ for hosting on the website.
9. Database cell for uploading on www. irsofficersonline.gov.in and in DGIT(Systems) corner.
10. ITBA publisher for uploading on ITBA Portal
Dy. Commissioner of Income Tax (CPC-TDS)
0/o The Pr. Director General of Income-tax (Systems)
Page 3 of 3