In short, a SIN is character's general physical information (i.e. DOB, metatype, etc.) and some other data (criminal records and whatnot) about them stored in a database run by a nation or corporation. In addition to this use of the information, SINs are often used for advertisers and financial transactions, by being linked to a credstick or commlink, allowing for their owners to be tracked but also experience a highly customized lifestyle that theoretically improves their quality of life.
Pages 366-368 have the rules for the mechanical functions of a (fake) SIN; essentially, your SIN is theoretically broadcast from your commlink at all times, but you can set it up to use any of your SINs, or even just not to broadcast (though this gets you in trouble in the uber-secure areas). As a general rule, unless the player has already presented another SIN, they may choose the one they want to use when questioned/checked/otherwise harassed about handing over a SIN. The quality of a SIN determines how "real" it is without, of course, being your normal SIN, unless you're SINless.
The point of the SINner negative quality is for three reasons:
- Identification
- Taxes
- Scrutiny
The first of these is pretty simple; it's theoretically possible to look up a person's SIN using biometrics, so if you get taken in for doing something, you need to consider the fact that you'll want a fake to present before they find your real identity. Usually, unless it's an obvious fake, that sticks your (hopefully clean) fake SIN with the criminal record, at which point you can ditch it and get another.
Taxes, of course, are one of the two things which are certain in life, and one of the upsides of not having an official identity is that you also do not wind up paying taxes; some of this is offset by the fact that the SINless may have to pay for public services a SINner can access free, but as a general rule a 400 nuyen bus pass is still cheaper than 3600 a year in taxes.
And scrutiny is the largest one. The SINless distrust SINners, especially corporate types; it's one thing if you're born into the squalor of a ditch in the UCAS but your parent(s) happened to have a SIN or two between them and got you one, but if you've got a high-level corp SIN you're essentially looking at being set for life with a silver spoon, unless you do something horrible. Also, while it's not technically scrutiny, people with corporate SINs often find themselves "scouted" by rival corporations or even other branches of their own corporations, and extractions can be dangerous for everyone involved.
Is it too easy?
From your description he seems to be spending a large amount of his money on circumventing the possible consequences from his corporate SIN. Thing is, spending all that money to avoid the consequences is a consequence in itself.
How much time or money would a corp invest in tracking people with corporate SINs that aren't active employees?
The corporation should only care from a liability standpoint. They do not want their Corporate SIN associated with illegal activities that might damage their reputation and ultimately their bottom line. Its probably not feasible or cost effective that they would run heavy surveillance on the PC in question but more likely that a computer system would routinely screen and compare recorded behaviors (such as purchases, net activity, general location activity)behaviors against an algorithm that would flag the owner of the Corporate SIN as being suspicious.
Possibilities to make things more difficult but keep it fair
As you stated he's trying to maintain a cover, but what he does to maintain that cover is pretty pedestrian and anyone who examined his life closely if it all could see through it. Hint to the player (whether in game or out) that his PC's transaction history without any recorded income (and thus taxes for the Corporation which they do want) seems like it might attract attention. The PC then might have to build a real cover, a job with an income which pays taxes to the corp, a whole fake life including purchases, people who know him, an apartment (basically he would have to pay some part of a living expenses for the cover) which he will need to maintain. The corporation may send someone sniffing around after his previous irregular income and spending actions, but if he looks above aboard he may be able to ride it out.
Best Answer
There is nothing preventing a runner with the SINner negative quality from earning and associating legitimate licenses with their legitimate SIN.
The biggest problem, in addition to those you point out yourself, is that not every act can be made legal with licenses. Only Restricted items can be made legal to possess with a license, and technically according to the Core Rulebook you need a separate license for each individual type of item (which means you need a separate license for your Katana and your Shock Gloves to stay completely within the law). The first time you get caught with that Forbidden Cavalier Arms Crockett EBR or FNP93 Praetor then both your legit SIN and all the licenses associated with it are burned. So it's basically a complete waste of time and effort. But sure, if you want to make the game more difficult, you could do it. If it were me I would restrict myself to Restricted gear despite all the best weapons and armor being Forbidden to make the choice slightly less dangerous, and I would use exclusively Stick-N-Shock ammo for living targets to avoid committing murder whenever possible since sooner or later your illicit activity will catch up to you.
Also, while fake licenses merely need to be purchased, your GM may make you jump through additional hoops to earn legitimate licenses. I'm reminded of the episode of Star Trek: Voyager (S07E22) where Tom Paris is accused by the locals of reckless piloting and is forced to take what amounts to a "safe drivers" course in order to regain his permission to fly within their space.