Last Updated on: 15th October 2026 | Last Reviewed on: 15th October 2026
Key Takeaways
- eKYC is not one thing. Indian law recognises several distinct electronic mechanisms, and the phrase “eKYC” is market shorthand rather than a defined legal term.
- There are four practical routes: Aadhaar OTP-based e-KYC authentication, biometric e-KYC authentication including Aadhaar Face Authentication, offline verification of Aadhaar, and retrieval of an existing record from the Central KYC Records Registry using the KYC Identifier.
- The legal authority is Section 11A of the PMLA. The operating details are in the instrument-specific rules provided by sector regulators, including RBI, SEBI, IRDAI, PFRDA and IFSCA.
- Aadhaar is never compulsory. Section 11A (3) of the PMLA states that the use of these modes is a voluntary choice, and that no client shall be denied services for not having an Aadhaar number.
Quick Answer: What eKYC Is
Electronic KYC, usually written as eKYC or e-KYC, is the process of Know Your Customer verification by electronic means instead of paper. Section 11A of the Prevention of Money Laundering Act, 2002 authorises a reporting entity to verify a client’s identity through Aadhaar authentication, offline Aadhaar verification, a passport, or other modes notified by the Central Government. The conditions attached to each mode come from your sector regulator.
eKYC Meaning: What “Electronic KYC” Covers
In ordinary use, electronic KYC means finishing your KYC without handing over photocopies. You give consent on a screen, an identity source is queried in real time, and the verified record lands in the institution’s system in seconds. The customer experience is the whole of the concept for most people, and that is a fair description of what happens.
In regulation, it is narrower and stricter, and the difference matters. There is no provision anywhere in the Prevention of Money-Laundering Act, 2002, the PML (Maintenance of Records) Rules, 2005 or the sector-specific rulebook that defines “e-KYC” or “electronic KYC” as a standalone term. What the instruments define are specific named mechanisms — “Digital KYC”, “Offline verification”, “equivalent e-document”, “Video-based Customer Identification Process” — and they attach different conditions to each. The phrase “e-KYC” appears only in composite expressions such as “Aadhaar OTP based e-KYC” and “biometric-based e-KYC authentication”.
eKYC vs Paper KYC: What Actually Changes
Electronic KYC changes the evidence, not the obligation. You still have to identify the customer, verify that identity against a reliable and independent source, understand the purpose of the relationship and monitor it afterwards. What changes is where the verification evidence comes from and how it is preserved.
- The source of truth shifts from a photocopy the customer supplies to a response the issuing authority returns. An Aadhaar authentication response comes from the Unique Identification Authority of India, not from the applicant.
- The signature changes form. Under the Information Technology Act, 2000, an electronic signature satisfies a statutory signing requirement, which is why SEBI accepts the Aadhaar eSign mechanism instead of a wet signature, and accepts even a cropped signature affixed on an online KYC form under eSign.
- The document changes form. Rule 2(1) (cb) of the PML Rules defines an “equivalent e-document” as an electronic equivalent of a document issued by the issuing authority with its valid digital signature, including documents issued to the digital locker account of the client under the digital-locker rules made in 2016.
- The audit trail improves and the fraud surface moves. A paper file can be backdated; an authentication log cannot. But a paper file cannot be attacked by a SIM swap, and an OTP-based flow can.
- The obligation does not shrink at all. Electronic completion of KYC is a change of method. It is not a reduction in the standard of due diligence, and no instrument treats it as one.
eKYC vs Digital KYC vs Video KYC: The Distinction That Trips People Up
These three are used interchangeably in marketing copy and they are not interchangeable in law. Two of them are defined terms with prescribed procedures; the third is a loose umbrella. Getting them the wrong way round is the most common accuracy failure in published content on this subject.
Term | What it means in Indian regulation |
Electronic KYC (eKYC) | Market shorthand for completing KYC by electronic means. Used in the instruments only in composite forms such as “Aadhaar OTP based e-KYC” and “biometric based e-KYC authentication”. |
Digital KYC | An authorised officer of the bank captures a live photo of the customer and of the officially valid document, along with the latitude and longitude of the location where the live photo is taken. |
Video KYC (V-CIP) | An alternative method by which an authorised official conducts customer identification with facial recognition and customer due diligence through a seamless, secure, live, informed consent based audio visual interaction. |
Two further points are worth holding on to. Digital KYC is not remote onboarding: paragraph 24 requires that the customer visit the authorised official, or the official visit the customer, with the original document in the customer’s possession at that moment. And the same video mechanism carries three different names depending on who regulates you — the Reserve Bank calls it the Video based Customer Identification Process (V-CIP), SEBI calls it Video In-Person Verification (VIPV), and IRDAI calls it the Video Based Identification Process (VBIP). They are close cousins with separately drafted conditions, so quote the one your regulator wrote.
Is Electronic KYC Legally Valid in India?
Yes, within defined limits, and the authority is statutory rather than merely regulatory. Section 11A (1) of the PMLA provides that every reporting entity shall verify the identity of its clients and the beneficial owner by authentication under the Aadhaar Act if it is a banking company, by offline verification under that Act, by use of a passport issued under section 4 of the Passports Act, 1967, or by such other officially valid document or modes of identification as may be notified by the Central Government.
Three subsections that follow are routinely left out of published summaries, and each is a live obligation. Section 11A (2) provides that a reporting entity performing Aadhaar authentication shall also make the other three modes available to its clients. Section 11A (3) provides that the use of these modes is a voluntary choice of the person being identified, and that no client shall be denied services for not having an Aadhaar number. Section 11A (4) provides that neither the core biometric information nor the Aadhaar number shall be stored.
A non bank cannot simply switch Aadhaar authentication on. Section 11A permits the Central Government to notify a reporting entity other than a banking company to use the facility, but only after consultation with the Unique Identification Authority of India and the appropriate regulator. The Department of Revenue, Ministry of Finance, set out the procedure in its circular dated 9 May 2019: the entity applies to its regulator, the regulator scrutinises the application and forwards it to UIDAI with a recommendation, UIDAI examines it against its privacy and security standards and recommends to the Department of Revenue, the Central Government notifies the entity, and UIDAI then issues the authorisation subject to the terms of an Authentication User Agency or KYC User Agency licence. The same circular asks regulators to monitor continuing compliance and permits suspension or cancellation on default.
For banks and NBFCs the operating conditions sit in the Reserve Bank of India (Commercial Banks — Know Your Customer) Directions, 2025 (dated 28 November 2025, updated as on 29 December 2025) and the Reserve Bank of India (Non-Banking Financial Companies — Know Your Customer) Directions, 2025, dated 28 November 2025, updated as on 29 December 2025). If your policy or training material still cites the Master Direction — Know Your Customer Direction, 2016, it is citing a withdrawn instrument.
For the securities market, SEBI issued a Circular dated 5 November 2019 on the e-KYC authentication facility under section 11A for resident investors, followed by a Circular dated 24 April 2020 clarifying the KYC process and the use of technology. Insurance, pension and IFSC entities each have their own instrument, covered further down this page.
Get Expert Support for AML Compliance in India
From assessing customer-related risks to improving AML policies and procedures, get professional support to strengthen your organisation’s compliance framework.
The Four Routes to Electronic KYC in India
Rather than one “electronic KYC”, think of four routes that a regulated entity can use, each with its own trigger, its own evidence and its own consequences. Paragraph 23 of the Commercial Banks KYC Directions, 2025 sets out what a customer may submit for customer due diligence, and the provisos that follow it tell the bank what it must then do with each input.
Route | How identity is proved | Presence required | Principal constraint |
Aadhaar OTP-based e-KYC | UIDAI authentication using an OTP sent to the Aadhaar registered mobile number. | None. This is the only genuinely non-face-to-face route. | All of the paragraph 25 account limits apply, and the account expires after one year. |
Biometric e-KYC authentication | UIDAI authentication using fingerprint, iris or Aadhaar Face Authentication. | Yes. Performed by a bank official, business correspondent or business facilitator. | Requires a device or app and a person. No paragraph 25 account limits. |
Offline verification of Aadhaar | An Aadhaar XML file or Aadhaar Secure QR Code verified without querying UIDAI in real time. | Depends on the flow it is embedded in. | The XML or QR generation must be recent. SEBI and IRDAI say not older than 3 days; IFSCA says three working days. |
CKYCR retrieval | The customer supplies a KYC Identifier and the entity downloads the existing record from the registry. | None, but explicit consent to download is required. | Only works if a record already exists, and it cannot be used for a record flagged as OTP based e-KYC. |
Aadhaar OTP Based e-KYC
The customer provides the Aadhaar number, gives specific consent to authentication by OTP, and enters the one time password that UIDAI sends to the mobile number registered against that Aadhaar. On success, the entity receives the verified identity record. Because nobody has seen the customer, the Reserve Bank treats the resulting account as a limited product rather than a fully verified one, and paragraph 25 attaches nine conditions to it. Two of them shape the customer journey directly: the customer must give specific consent for authentication through OTP, and the bank must send transaction alerts and OTPs only to the mobile number registered with Aadhaar, supported by a Board approved policy setting out a robust due diligence process for handling requests to change that mobile number. The remaining seven are limits and are set out in full further down this page.
Aadhaar Biometric e-KYC
Here the customer authenticates with a fingerprint, an iris scan or their face rather than an OTP. Explanation 2 to paragraph 23 of the Commercial Banks KYC Directions, 2025 states that a bank official, business correspondent or business facilitator can perform biometric-based e-KYC authentication, including Aadhaar Face Authentication. Because a person from the regulated entity is present and a biometric is captured, this is not a non-face-to-face flow, and the paragraph 25 account limits, which are expressly limited to accounts opened using Aadhaar OTP based e-KYC in non-face-to-face mode, do not attach to it. That difference is the reason biometric e-KYC is the route of choice for business correspondent networks and for any product that cannot live inside a Rs 1,00,000 balance ceiling.
The pension sector recognises the same split. Paragraph 8.2.1.3 of the PFRDA Master Circular lists “OTP based e-KYC authentication or Biometric e-KYC (fingerprint/IRIS/face) authentication” as one method and Aadhaar offline XML or QR code as another, and it references the e-KYC Setu System introduced by PFRDA circular dated 25 July 2023.
Offline Aadhaar Verification
Offline verification does not query UIDAI at the moment of onboarding. The customer generates a digitally signed XML file or presents an Aadhaar Secure QR Code, and the entity validates the signature. Paragraph 5(1)(xv) of the Commercial Banks KYC Directions, 2025 does not define the term itself but adopts the meaning assigned to “offline verification” in clause (pa) of section 2 of the Aadhaar Act, 2016. Where the customer submits proof of possession of Aadhaar and offline verification can be carried out, proviso (ii) to paragraph 23 requires the bank to carry out offline verification.
The freshness rule is the operational catch, and it is drafted slightly differently by different regulators. SEBI’s clarification of 24 April 2020 requires that the XML file or Aadhaar Secure QR Code generation date is not older than 3 days from the date of carrying out KYC. IRDAI’s Master Guidelines apply the same 3-day limit to its video process. The IFSCA Guidelines say three working days, and add a second deadline that is easy to miss: the video stage of a V-CIP must itself be undertaken within three working days of downloading the identification information, if the process cannot be completed in one go.
The Digital KYC Process Prescribed by RBI
Digital KYC under paragraph 24 is technology assisted verification, not remote verification, and it is frequently mislabelled as eKYC. The bank builds an authenticated application, makes it available at customer touchpoints, and controls access through a login and password or a live OTP mechanism. The authorised officer captures a live photograph of the customer with a watermark carrying the application form number, GPS coordinates, the officer’s name and employee code and a date time stamp, together with a live photograph of the original document. The decisive condition is presence: the customer must visit the authorised official, or the official must visit the customer, with the original officially valid document in the customer’s possession at that moment. Proviso (iv) to paragraph 23 requires digital KYC where the customer submits an OVD or proof of possession of Aadhaar and offline verification cannot be carried out. The full step sequence is set out in our separate guide to the 13-step digital KYC process, which is the right page to read if you are building that flow.
Pulling an Existing Record from CKYCR
The cheapest electronic KYC is the one you do not have to repeat. Where a customer already has a record in the Central KYC Records Registry, paragraph 23 lets them supply the 14 digit KYC Identifier with explicit consent to download the records, and proviso (v) requires the bank to retrieve those records online from the registry rather than collect documents again. Rule 9(1C) of the PML Rules is emphatic: having retrieved the record, the reporting entity shall not require the client to submit the same KYC records or information or any other additional identification documents or details.
There are four exceptions in Rule 9(1C) itself. The entity may ask again where the information has changed, where the record is incomplete or not in accordance with current norms, where the validity period of the downloaded documents has lapsed, or where the entity considers it necessary to verify identity or address, to undertake enhanced due diligence, or to build an appropriate risk profile. Rule 9(1D) requires updated information to be furnished to the registry within seven days, after which the registry informs the other reporting entities that have dealt with that client. Rule 9(1E) places responsibility for verifying authenticity on the reporting entity that performed the last KYC verification, and Rule 9(1F) prohibits using a downloaded record for any purpose other than verifying identity or address and prohibits transferring it to a third party without authorisation.
One restriction closes the loop with the OTP route. Paragraph 25(8) requires a bank to flag OTP based e-KYC accounts when uploading KYC information to the registry, and provides that other reporting entities shall not open accounts based on the KYC information of accounts opened with the OTP based e-KYC procedure in non-face-to-face mode. A limited record cannot be recycled into a full one somewhere else.
Which Route Should a Regulated Entity Use?
Situation | Route that usually fits | Why |
Small-value digital wallet or savings product, fully remote | Aadhaar OTP-based e-KYC | It is the only genuinely non-face-to-face route, and the product economics fit inside the Rs 1,00,000 and Rs 2,00,000 caps. |
Full-service account acquired remotely | V-CIP | It is treated on par with face-to-face identification, so no paragraph 25 limits attach. |
Business correspondent or field-agent acquisition | Biometric e-KYC, including Face Authentication | An official is present, so the limits do not apply, and the flow completes in one visit. |
Customer who declines Aadhaar authentication | Offline verification, OVD with digital KYC, or an equivalent e-document | Section 11A (2) requires the alternatives to be available and 11A(3) forbids denying service for want of an Aadhaar number. |
Customer already onboarded elsewhere | CKYCR retrieval using the KYC Identifier | Rule 9(1C) bars re-collecting the same records, unless one of its four exceptions applies. |
Legal entity or a customer with a changed address | Document based CDD with the appropriate electronic evidence | The Aadhaar routes verify a natural person. Entities need constitutional documents and CDD on the persons behind them. |
Build a Strong AML/KYC Compliance Framework
Establish practical AML policies, procedures, and internal controls to support customer verification and meet your applicable compliance obligations.
How Aadhaar Electronic KYC Works, Step by Step
What follows is the shape of the journey and the obligations attached to each stage, not a build specification. If you need the prescribed step sequence for the Digital KYC Process, read our 13 step guide instead; this section is about what the law requires at each point of an Aadhaar authentication flow.
Customer Consent and What Must Be Disclosed
Consent is not a checkbox formality here; it is a condition of validity. Paragraph 25(1) requires the customer to give specific consent for authentication through OTP. Explanation 4 to paragraph 23 records that the Aadhaar number is not mandatory for KYC purposes: a customer who wants a benefit or subsidy under a scheme notified under section 7 of the Aadhaar Act must provide it, and in all other cases customers may provide it voluntarily. Where the flow is intermediated, the disclosure has to name the intermediaries. SEBI requires a sub-KUA to clearly specify the name of the KUA and the sub-KUA, and the details of data sharing between them, while capturing investor consent. The IFSCA Guidelines require consent to be recorded in an auditable and alteration-proof manner.
There is a second consent that is often forgotten. Retrieving a record from the Central KYC Records Registry needs its own explicit consent to download, separate from any consent to Aadhaar authentication.
Authentication and the Data the Entity Receives
On successful authentication, the entity receives a verified identity record from UIDAI. What it may then do with that record is tightly bounded. Section 11A(4) of the PMLA prohibits storing the core biometric information or the Aadhaar number. Explanation 1 to paragraph 23 requires a bank, where the customer submits proof of possession of Aadhaar containing the Aadhaar number, to ensure that the customer redacts or blacks out the number wherever authentication is not required. SEBI goes further on the mechanics: the KUA and sub-KUA shall not store the Aadhaar number in their database under any circumstances, the number must be captured only through UIDAI’s Aadhaar Number Capture Services; the full number must not be stored or displayed anywhere and only the last four digits may be shown where a display is needed.
The securities market runs this through a licensing chain worth understanding, because it explains why a small intermediary can offer Aadhaar eKYC at all. Entities notified by the Central Government register with UIDAI as a KYC User Agency. SEBI registered intermediaries and mutual fund distributors that want to use the facility enter into an agreement with one KUA and register with UIDAI as sub-KUAs, each receiving a separate sub-KUA code. SEBI’s circular of 5 November 2019 describes two flows: an online portal flow in which the investor is redirected to the KUA portal, enters the Aadhaar number or Virtual ID, consents and completes OTP authentication; and an assisted flow in which the investor provides a biometric on a device registered and whitelisted with the KUA. It also requires the KUA to maintain auditable logs of every sharing of e-KYC data with a sub-KUA, to build monitoring for irregular transactions, and to run a grievance mechanism, and it requires an exception-handling and backup identity authentication mechanism so that service does not fail when authentication does.
What the Entity Must Do with the Record
Three obligations follow immediately. First, upload: Rule 9(1A) requires the electronic copy of the client’s KYC records to be filed with the Central KYC Records Registry within ten days of commencing an account based relationship. Second, communicate: the registry de-duplicates the record and issues a KYC Identifier, which must be communicated to the client in writing. Third, flag: where the account was opened using OTP based e-KYC in non-face-to-face mode, paragraph 25(8) requires the upload to clearly indicate that fact, precisely so that another entity cannot rely on it.
One more obligation runs underneath all of this and is easy to miss because it is not in the KYC chapter at all. Paragraph 72 of the Commercial Banks KYC Directions, 2025 requires a bank to identify and assess the money laundering and terrorist financing risks arising from new products, new business practices including new delivery mechanisms, and the use of new or developing technologies, for both new and existing products; to undertake that assessment before launch or use; and to manage and mitigate the risk through a risk-based approach with appropriate enhanced due diligence and transaction monitoring. Launching an eKYC channel is exactly the event that provision is written for.
The Limits on OTP-Based eKYC Accounts
This is the section competitors leave out, and it is the section that decides whether a product design is compliant. Paragraph 25 of the Commercial Banks KYC Directions, 2025 attaches nine conditions to accounts opened using Aadhaar OTP based e-KYC in non-face-to-face mode. Paragraph 25 of the Non Banking Financial Companies Directions, 2025 is drafted in identical terms for NBFCs. The figures below are from those instruments as updated on 29 December 2025; re-check the paragraph numbering if the Directions are updated again.
Limit | Threshold | Consequence of breach |
Aggregate balance across all deposit accounts of the customer | Rs 1,00,000 | The entity shall cease the account’s operation until it completes full CDD. |
Aggregate credits in a financial year, all deposit accounts taken together | Rs 2,00,000 | The cap is absolute; the account cannot be credited beyond it. |
Borrowal accounts: term loans only | Rs 60,000 aggregate sanctioned in a year | No other credit facility may be sanctioned on such an account. |
Life of the account | One year | Deposit accounts closed immediately; no further debits allowed on borrowal accounts. |
Cross-entity exclusivity | One OTP based account across all reporting entities | A declaration is required from the customer, and the record must be flagged to CKYCR. |
The Rs 1,00,000 Aggregate Balance Cap
Paragraph 25(3) provides that the aggregate balance of all the deposit accounts of the customer shall not exceed Rupees One Lakh, and that if the balance exceeds the threshold, the bank shall cease the account’s operation until it completes the customer due diligence referred to in paragraph 25(6). Two details are commonly misread. The cap is on the aggregate across all the customer’s deposit accounts, not on a single account, so a product team cannot engineer around it by opening a second account. And the consequence is cessation of operation, not merely a block on further credits; the account stops working until full CDD is done.
The Rs 2,00,000 Annual Credit Cap
Paragraph 25(4) provides that the aggregate of all credits in a financial year, in all the deposit accounts taken together, shall not exceed Rupees Two Lakh. This is a flow limit rather than a stock limit, and it sits alongside the balance cap rather than replacing it. An account can breach the credit cap while never coming close to the balance cap, if money moves through it quickly, which is precisely the pattern a monitoring rule should be looking for.
The Rs 60,000 Term Loan Cap for Borrowal Accounts
Paragraph 25(5) provides that as regards borrowal accounts, the bank shall sanction only term loans, and the aggregate amount of term loans sanctioned shall not exceed Rs 60,000 in a year. The product restriction is as important as the number: a revolving facility, an overdraft or a credit line cannot be extended on an OTP-based e-KYC account at all, whatever its size.
The One Year Cliff and What Happens If You Miss It
Paragraph 25(6) provides that the bank shall not allow accounts opened using OTP-based e-KYC, whether deposit or borrowal, to operate for more than one year unless it carries out identification as per paragraph 23 or as per paragraphs 26 and 27, which is V-CIP. If the bank uses Aadhaar details under paragraphs 26 and 27, it must follow that process in its entirety, including fresh Aadhaar OTP authentication; the original authentication cannot be reused to satisfy the upgrade.
Paragraph 25(7) states the consequence without discretion. If the CDD procedure is not completed within a year, deposit accounts shall be closed immediately, and in respect of borrowal accounts no further debits shall be allowed. For a lender, this is the sharper of the two: the loan does not vanish, but the facility cannot be drawn.
The No-Other-OTP-Account Declaration and CKYCR Flagging
Paragraph 25(8) carries three obligations in one clause and is the most under-reported provision in the whole subject. The bank must obtain a declaration from the customer that no other account has been opened, nor will be opened, using OTP-based KYC in non-face-to-face mode with any other reporting entity. When uploading KYC information to the Central KYC Records Registry, the bank must clearly indicate that the account was opened using OTP-based e-KYC. Other reporting entities shall not open accounts based on the KYC information of accounts opened with the OTP-based e-KYC procedure in non-face-to-face mode. The effect is that the OTP route gives a customer one limited relationship across the entire regulated system, and the record it generates is quarantined from reuse.
Monitoring Obligations and Breach Alerts
Paragraph 25(9) requires the bank to have strict monitoring procedures, including systems to generate alerts in case of any non-compliance or violation, to ensure compliance. This is a systems obligation rather than a policy one. If a product can breach the balance cap, the credit cap or the one-year limit without an alert firing, the requirement is not met even if no breach has yet occurred.
Choose the Right KYC Verification Approach
Need help evaluating Aadhaar-based verification, offline e-KYC, or other permitted verification methods? Get guidance suited to your business and customer risks.
Upgrading an eKYC Account to Full KYC
An OTP-based account is a starting position, not a destination. Paragraph 25(6) names two exits: full identification under paragraph 23, or V-CIP under paragraphs 26 and 27. Choosing between them is mostly a question of whether you can get the customer into a branch or in front of an agent.
The V-CIP Route
Paragraph 26 expressly permits V-CIP for the conversion of existing accounts opened in non-face-to-face mode using Aadhaar OTP based e-KYC authentication as per paragraph 25, alongside its use for new customer due diligence and for periodic updation. It is the only remote exit from the limits. Paragraph 27 sets the minimum standards the entity must meet, including compliance with its cyber security framework, hosting from its own premises and its own secured network domain, ownership of any data held with a cloud provider with immediate transfer and no retention by the provider, end-to-end encryption, and consent recorded in an auditable and alteration-proof manner. Where Aadhaar is used inside the V-CIP, paragraph 25(6) requires the process to be followed in its entirety, including fresh Aadhaar OTP authentication.
The Branch and Digital KYC Routes
Identification under paragraph 23 is the conventional exit. The customer can complete biometric e-KYC with a bank official, a business correspondent or a business facilitator; can undergo the Digital KYC Process under paragraph 24 with an officer present; can supply an equivalent e-document of an officially valid document, in which case the bank verifies the digital signature under the Information Technology Act, 2000 and takes a live photo as specified in paragraph 24; or can supply a KYC Identifier so the bank retrieves the record from the registry. Any of these removes the paragraph 25 constraints, because the constraints attach to the manner of opening and are lifted once identification under paragraph 23 is complete.
A Practical Upgrade Timeline for Product Teams
- At onboarding, record the opening date and the fact that the account was opened by OTP-based e-KYC. Everything downstream keys off that date, and paragraph 25(8) requires the flag in any event.
- Set the system alerts required by paragraph 25(9) at the point of onboarding, not later: aggregate balance approaching Rs 1,00,000, financial year credits approaching Rs 2,00,000, term-loan sanctions approaching Rs 60,000, and the one year date.
- Begin the upgrade campaign well before month eleven. The one-year cliff is a hard stop with a mandatory consequence, and a customer who ignores three messages in the last fortnight leaves you no discretion.
- Offer V-CIP as the default upgrade path and a branch or agent visit as the fallback, so that a customer who cannot complete a video session is not stranded.
- If Aadhaar is used within the V-CIP, run the process in full, including fresh Aadhaar OTP authentication. Reusing the onboarding authentication does not satisfy paragraph 25(6).
- On completion, update the CKYCR record so the flag no longer misrepresents the account, and furnish the updated information within the seven days allowed by Rule 9(1D).
- If the deadline passes without an upgrade, execute the paragraph 25(7) consequence: close deposit accounts immediately and stop further debits on borrowal accounts. Build this as a system action, because a manual process will not hold.
Using Electronic KYC for Periodic Updation (Re-KYC)
Periodic updation is where the rules relax rather than tighten, and a surprising number of compliance teams apply the onboarding limits here by mistake and make re-KYC harder than the regulator intended.
Why the Paragraph 25 Limits Do Not Apply to Updation
Paragraph 42(3) of the Commercial Banks KYC Directions, 2025 permits the use of Aadhaar OTP based e-KYC authentication for updation and periodic updation, and states in terms that the conditions stipulated in paragraph 25 are not applicable for that purpose. The reason is structural: paragraph 25 governs the opening of a relationship with an unverified stranger, whereas periodic updation refreshes a customer whose identity has already been established. Applying the Rs 1,00,000 cap to an existing full KYC customer doing re-KYC by OTP is a misreading.
The Mobile-Number Condition
The relief comes with one control. Paragraph 42(3) requires that the mobile number used for Aadhaar authentication be the same as the mobile number in the customer’s profile, and the instrument gives the reason expressly: in order to prevent any fraud. A mismatch is the signal that the authentication may not be the customers, so the condition should be enforced as a hard block rather than a warning.
When a Changed Address Needs No Positive Confirmation
Where the customer declares a current address that differs from the address in the Aadhaar record, paragraph 42(3) provides that no positive confirmation of that address is required. The same logic appears at onboarding: proviso (i) to paragraph 23 allows a customer who has submitted an Aadhaar number to give a self-declaration where the current address differs from the identity information in the Central Identities Data Repository, and IRDAI’s Master Guidelines carry the same self-declaration allowance for insurers.
Two further updation mechanics are worth knowing. Where there is no change in KYC information, a self-declaration from the customer suffices and may be given through the registered email address or mobile number, an ATM, a digital channel such as internet banking or the bank’s mobile application, or by letter. Where a business correspondent is used, the self-declaration is obtained in electronic mode through the BC after successful biometric-based e-KYC authentication; the BC authenticates the declaration, forwards it promptly and gives the customer an acknowledgment; the bank updates the record and intimates the customer; and the Directions reiterate that the bank retains the ultimate responsibility for periodic updation of KYC.
Electronic KYC in Other Regulated Sectors
The PMLA authority is common to everyone, but the conditions are written by each regulator, and they differ in ways that matter if you operate across sectors.
Securities Market: e-KYC Under Section 11A and the Role of KRAs
SEBI’s Circular of 5 November 2019 set up the KUA and sub KUA architecture described earlier, and the Clarification of 24 April 2020 opened up online KYC more broadly. Under the 2020 clarification, the investor completes an online form; mobile and email are verified by OTP or another verifiable mechanism, with the mobile preferably the one seeded with Aadhaar; Aadhaar is verified through UIDAI’s authentication or by offline verification with the XML or QR not older than 3 days; PAN is verified online against the Income Tax database; and bank account details are verified by a penny-drop or a bank API. Any officially valid document other than Aadhaar is submitted through DigiLocker or under eSign.
Two consequences of that circular are practically significant. The requirement that a document be “original seen and verified” is satisfied where the investor provides a clear photograph or scanned copy of the original under the eSign mechanism, or a digitally signed document issued to DigiLocker by the issuing authority. And in-person verification is switched off in defined cases: SEBI states that IPV or VIPV is not required where the KYC is completed using Aadhaar authentication or verification through UIDAI and is not required where the KYC form has been submitted online, and documents have been provided through DigiLocker or another source that can be verified online. Where an intermediary does run VIPV, the circular prescribes a live environment, a clearly recognisable investor, random questions and responses, a match against the photograph downloaded through Aadhaar, and tamper proof date and time stamped storage. Its app requirements include liveness checks to guard against spoofing, geo-location tagging to confirm physical presence in India, and software and security audits before roll-out and periodically.
KYC Registration Agencies sit alongside all of this. They are constituted under the SEBI (KYC Registration Agency) Regulations, 2011, last amended on 10 February 2025, and the norms are consolidated in the SEBI Master Circular on KYC Norms for the Securities Market dated 12 October 2023, read with the Circular for Modifications on the KYC Norms of the same date.
Insurance and Pension
IRDAI’s Master Guidelines on Anti-Money Laundering / Counter Financing of Terrorism, 2022 (dated 1 August 2022, in force from 1 November 2022) list six permitted KYC methods at paragraph 8.1.7: Aadhaar based KYC through online authentication subject to notification under section 11A; Aadhaar based KYC through offline verification; Digital KYC as per the PML Rules; the Video Based Identification Process set out in its Annexure II; use of the KYC Identifier allotted by CKYCR; or officially valid documents in each case together with PAN or Form 60. Its VBIP conditions include geotagging the customer’s live location to confirm physical presence in India, varying the sequence or type of questions to establish that the interaction is real-time, refusing a printed copy of an e-PAN, and activating the account only after separate verification.
PFRDA consolidates its requirements in the Master Circular, Guidelines on Know Your Customer / Anti-Money Laundering / Combating the Financing of Terrorism, updated as of 25 September 2025. Paragraph 8.2.1 lists the CKYC identifier route first, expressly to avoid collecting KYC documents repeatedly, followed by physical verification, Aadhaar based KYC in its OTP and biometric forms, Digital KYC as per the PML Rules, and V-CIP.
IFSC Entities
The International Financial Services Centres Authority (Anti-Money Laundering, Counter Terrorist Financing and Know Your Customer) Guidelines, 2022, updated as on 26 February 2026, permit a regulated entity performing V-CIP to obtain identification information through offline verification of Aadhaar, KYC records downloaded from CKYCR or from a KYC Registration Agency set up in the IFSC, an equivalent e-document including documents issued through DigiLocker, biometric based e-KYC authentication including Aadhaar Face Authentication, or OTP based Aadhaar e-KYC authentication. Its freshness rule is three working days for the Aadhaar XML or QR code, with the additional requirement that the video process be undertaken within three working days of obtaining the identification information where the process cannot be completed at one go.
|
Sector |
Governing instrument |
Note |
|
RBI (Commercial Banks — Know Your Customer) Directions, 2025, 28 November 2025, updated 29 December 2025 |
Paragraph 25 limits; paragraph 24 Digital KYC; paragraphs 26–27 V-CIP. |
|
|
RBI (Non-Banking Financial Companies — Know Your Customer) Directions, 2025, 28 November 2025, updated 29 December 2025 |
Paragraph 25 is drafted in identical terms to the banking version. |
|
|
Securities market |
SEBI Circular of 5 November 2019 and Clarification of 24 April 2020; Master Circular on KYC Norms dated 12 October 2023; KRA Regulations, 2011 as amended 10 February 2025 |
KUA and sub-KUA licensing chain; 3-day Aadhaar XML or QR limit; VIPV. |
|
IRDAI Master Guidelines on AML/CFT, 2022, dated 1 August 2022, in force 1 November 2022 |
Six permitted methods at paragraph 8.1.7; VBIP in Annexure II. |
|
|
Pension |
PFRDA Master Circular, updated 25 September 2025 |
CKYC identifier route listed first; e-KYC Setu System referenced. |
|
IFSCA AML, CTF and KYC Guidelines, 2022, updated 26 February 2026 |
Three working days for Aadhaar XML or QR, and for the V-CIP video stage. |
Stay Updated on RBI KYC Requirements
Understand the KYC obligations applicable to your business and get support in aligning your compliance processes with relevant regulatory requirements.
Benefits and Risks of Electronic KYC
Benefits: Cost, Speed, Drop-Off and Auditability
The commercial case is well understood and largely correct. Verification that once took days of courier and data entry completes in a single session, which cuts acquisition cost and lifts conversion at the point where applicants abandon. The compliance case is less often stated and is stronger. An authentication response from an issuing authority is better evidence than a photocopy an applicant supplied, because its provenance is independent of the applicant. The record is machine readable, which makes screening, risk categorisation and periodic updation tractable rather than manual. And the process generates its own audit trail: SEBI requires auditable logs of e-KYC data sharing, and the IFSCA Guidelines require consent recorded in an auditable and alteration proof manner. Electronic routes also feed the registry cleanly, which is what makes the Rule 9(1C) bar on re-collecting documents usable in practice.
Risks: Synthetic Identity, SIM-Swap, Consent Failures and Data Exposure
The risks are real and specific, and the drafting of the Directions tells you which ones the regulator is worried about. The mobile number conditions in paragraph 25(2) and paragraph 42(3) exist because control of the registered handset is functionally control of the identity in an OTP flow; a SIM swap or an unscrutinised mobile number change request converts an authentication control into an attack path, which is why a Board approved due diligence process for change requests is mandated rather than suggested. Presentation attacks are the equivalent risk in video and biometric flows, which is why SEBI requires checks against spoofing and IRDAI requires varied questioning to prove the interaction is not pre recorded. Consent failures are a legal risk rather than a fraud risk: an authentication performed without the specific consent. Location spoofing is addressed by the geo tagging requirements. And data exposure is met by the storage prohibitions in section 11A(4) of the PMLA on core biometrics and the Aadhaar number, the redaction duties, and SEBI’s rule that only the last four digits may be displayed.
Two risks are structural rather than technical. Over reliance on a single identity rail creates concentration risk, which is part of why section 11A (2) requires alternatives to be offered and why SEBI requires a backup identity authentication mechanism. And limit blindness: running an OTP based portfolio without the paragraph 25(9) alerts turns a product design choice into a supervisory finding a year later, all at once.
Controls That Reduce Each Risk
Risk | Control | Source of the requirement |
SIM swap or mobile number takeover | Send alerts and OTPs only to the Aadhaar registered number; handle change requests under a Board approved due diligence process. | Paragraph 25(2), Commercial Banks KYC Directions, 2025. |
Authentication by someone other than the customer at re-KYC | Require the Aadhaar authentication mobile number to match the number in the customer profile. | Paragraph 42(3), stated to be in order to prevent fraud. |
Presentation attack or replayed video | Liveliness checks against spoofing; randomised questions to prove real time interaction; live environment. | SEBI Clarification of 24 April 2020; IRDAI Master Guidelines, 2022. |
Stale identity evidence | Reject Aadhaar XML or Secure QR older than the prescribed window. | 3 days (SEBI, IRDAI); three working days (IFSCA). |
Consent that cannot be proved later | Capture specific consent to OTP authentication and record it in an auditable, alteration proof form; name every intermediary. | Paragraph 25(1); IFSCA Guidelines, 2022; SEBI Circular of 5 November 2019. |
Aadhaar data exposure | Do not store the Aadhaar number or core biometrics; capture only through UIDAI’s capture service; redact; display at most the last four digits. | Section 11A(4), PMLA; Explanation 1 to paragraph 23; SEBI Circular of 5 November 2019. |
Onboarding outside India | Geo-tag the customer’s live location to confirm physical presence in India. | SEBI Clarification of 24 April 2020; IRDAI Master Guidelines, 2022. |
Silent breach of the account limits | System alerts on balance, annual credits, term loan sanctions and the one-year date. | Paragraph 25(9), which requires systems to generate alerts. |
Launching a channel whose risk was never assessed | Assess ML and TF risk from new products, practices, delivery mechanisms and technologies before launch or use. | Paragraph 72, Commercial Banks KYC Directions, 2025. |
Common eKYC Mistakes and How to Avoid Them
- Treating e-KYC as merely collecting Aadhaar details: A common mistake is considering the collection of an Aadhaar number sufficient for customer identification. Under Rule 9 of the PML Rules, 2005, where Aadhaar is used through a permitted route, the reporting entity must carry out the applicable e-KYC authentication or Yes/No authentication and retain evidence of the verification.
- Using Aadhaar without completing the prescribed authentication: A common mistake is accepting Aadhaar details without carrying out the applicable authentication or verification process. Under Rule 9, the reporting entity must follow the verification method prescribed for the particular KYC route and maintain evidence of the verification performed.
- Accepting electronic documents without proper verification: A common mistake is relying on an electronic document without checking its authenticity. Where an electronic document is used for KYC, the reporting entity should verify it in accordance with the applicable requirements, including verification of the digital signature where required.
- Treating Digital KYC as merely uploading documents: A common mistake is treating Digital KYC as a document upload exercise. The prescribed Digital KYC process includes electronic capture of customer information and a live photograph, along with the applicable verification requirements under Rule 9.
- Treating Video KYC as an ordinary video call: A common mistake is conducting a video interaction without following the prescribed V-CIP requirements. Where V-CIP is used, the reporting entity should follow the applicable requirements for customer identification, authentication, recording, verification and auditability.
- Completing only the authorised signatory’s KYC for a legal entity: A common mistake is treating verification of an authorised signatory as sufficient KYC for a company, partnership, trust or other legal person. Rule 9 also requires the reporting entity to identify and verify the beneficial owner(s), where applicable.
- Assuming successful e-KYC means CDD is complete: A common mistake is treating successful digital identity verification as the completion of customer due diligence. Under Rule 9, identity verification forms part of the wider CDD process, which may also require customer information, beneficial ownership identification and other prescribed checks.
- Ignoring the KYC Identifier and CKYCR: A common mistake is collecting the customer’s KYC documents again without first checking whether the information is already available through the Central KYC Records Registry (CKYCR). The reporting entity should use the KYC Identifier and retrieve the existing KYC records where the applicable requirements permit.
- Submitting incomplete or inaccurate KYC records to CKYCR: A common mistake is uploading KYC information without checking its accuracy and completeness. The reporting entity should validate the prescribed customer details and supporting information before furnishing the KYC record to CKYCR.
- Failing to update CKYCR when KYC information changes: A common mistake is updating the customer’s internal records but failing to furnish the updated KYC information to CKYCR. Where updated KYC information is obtained, the reporting entity should ensure that it is furnished to CKYCR within the prescribed timeframe.
- Repeatedly asking for documents already available through CKYCR: A common mistake is requesting fresh KYC documents without checking the customer’s existing CKYCR record. The reporting entity should first retrieve the KYC record and seek fresh information only where permitted or necessary, such as where the information has changed, is incomplete, or the existing document is no longer valid.
- Failing to maintain evidence of the e-KYC process: A common mistake is completing digital verification without maintaining adequate evidence of the process. The reporting entity should preserve the KYC records and electronic evidence relied upon for identification and verification in accordance with the record-maintenance requirements of the PML Rules.
- Using the same e-KYC process for every customer: A common mistake is applying one verification method to all customers irrespective of their circumstances. The reporting entity should select and apply the appropriate KYC and verification route under Rule 9 and the applicable regulatory framework.
Conclusion
Electronic KYC in India is best understood as four legally distinct routes rather than one product category. Section 11A of the Prevention of Money Laundering Act, 2002 supplies the authority, and it comes with three conditions that are as binding as the permission: alternative modes must be offered, no client may be denied services for want of an Aadhaar number, and neither the Aadhaar number nor core biometric information may be stored. The operating detail comes from your regulator for banks and NBFCs, the Reserve Bank of India Know Your Customer Directions, 2025 issued on 28 November 2025 and updated as on 29 December 2025, and for other sectors the instruments named in the table above.
The practical divide is between the OTP route and everything else. Aadhaar OTP based e-KYC in non-face-to-face mode buys reach at the price of a capped, flagged, one-year account that no other regulated entity can rely on. Biometric authentication, the Digital KYC Process and V-CIP each cost a moment of presence and remove those constraints entirely. If you are a customer, find out which route your provider used, because it determines what your account can do and when it expires. If you are a compliance officer, check three things this week: that your policy cites the 2025 Directions rather than the withdrawn 2016 Master Direction, that the paragraph 25(9) alerts actually exist in your systems, and that a customer who declines Aadhaar can still open an account.
Need Help with eKYC and KYC Compliance?
Get expert guidance on customer identification, electronic verification, and applicable KYC requirements for your business in India.
Frequently Asked Questions
Electronic KYC, or eKYC, is the process of Know Your Customer verification by electronic means rather than on paper. Section 11A of the Prevention of Money Laundering Act, 2002 permits a reporting entity to verify identity through Aadhaar authentication, offline Aadhaar verification, a passport issued under the Passports Act, 1967, or other modes notified by the Central Government. Note that “eKYC” is market shorthand: it is not defined as a term anywhere in the PMLA, the PML Rules or the RBI KYC Directions, which instead define specific mechanisms.
No. Aadhaar-based authentication is one family of electronic KYC routes, and it has two forms OTP-based and biometric, the latter including Aadhaar Face Authentication. Offline verification of Aadhaar using an XML file or a Secure QR Code is a third and different route, and retrieval of an existing record from the Central KYC Records Registry using a KYC Identifier is a fourth that does not involve Aadhaar authentication at all.
Yes, within defined conditions. The authority is section 11A of the PMLA. The conditions are set by the sector regulator: for banks the Reserve Bank of India (Commercial Banks — Know Your Customer) Directions, 2025 dated 28 November 2025 and updated as on 29 December 2025; for NBFCs the parallel Directions of the same date; for the securities market SEBI’s circulars of 5 November 2019 and 24 April 2020; and separate instruments for insurance, pension and IFSC entities. A non-banking reporting entity must additionally be notified by the Central Government before it can perform Aadhaar authentication, under the procedure the Department of Revenue laid down on 9 May 2019.
Rs 1,00,000. Paragraph 25(3) of the Commercial Banks KYC Directions, 2025 caps the aggregate balance of all the deposit accounts of the customer at Rupees One Lakh. It is an aggregate across all the customer’s deposit accounts, not a per-account figure, and if the balance exceeds it the bank must cease the account’s operation until it completes full customer due diligence. A separate cap under paragraph 25(4) limits aggregate credits in a financial year to Rs 2,00,000.
One year. Paragraph 25(6) provides that such accounts must not be allowed to operate for more than one year unless the entity carries out identification under paragraph 23 or completes V-CIP under paragraphs 26 and 27. Where Aadhaar is used within the V-CIP, the process must be followed in its entirety, including fresh Aadhaar OTP authentication.
Video KYC, properly the Video-based Customer Identification Process or V-CIP, is one specific method defined at paragraph 5(1)(xvi) of the Commercial Banks KYC Directions, 2025 and governed by paragraphs 26 and 27. It involves a live, informed-consent based audio-visual interaction with facial recognition, and when the prescribed standards are met it is treated on par with face-to-face identification — which is why it carries none of the paragraph 25 account limits. “eKYC” is the broader informal label. SEBI calls its version VIPV and IRDAI calls its version VBIP.
Yes, and the rules are more relaxed than at onboarding. Paragraph 42(3) permits Aadhaar OTP-based e-KYC for updation and periodic updation and states that the paragraph 25 conditions are not applicable for that purpose. One condition does apply: the mobile number used for the Aadhaar authentication must be the same as the one in the customer’s profile, expressly in order to prevent fraud. Where there is no change in KYC information, a self-declaration is enough and can be given by registered email or mobile, at an ATM, through internet or mobile banking, by letter, or through a business correspondent after successful biometric e-KYC authentication.
No. Section 11A (3) of the PMLA provides that the use of these modes of identification is a voluntary choice of the person being identified, and that no client shall be denied services for not having an Aadhaar number. Section 11A (2) requires a reporting entity that performs Aadhaar authentication to also make offline verification, the passport route and other notified modes available.
The Aadhaar authentication routes verify a natural person, so a company cannot itself be verified that way. A legal entity is onboarded on its constitutional documents; for a company, the certificate of incorporation, the memorandum and articles, and the authorisation of the persons who will operate the account together with full customer due diligence on those authorised persons and on the beneficial owners. Electronic methods are used within that process: those individuals can be verified electronically, equivalent e-documents can be accepted where the issuing authority has digitally signed them, and an existing registry record can be retrieved with a KYC Identifier.
Paragraph 25(7) leaves no discretion. If the customer due diligence procedure is not completed within a year, deposit accounts must be closed immediately, and in respect of borrowal accounts no further debits are allowed. The obligation sits on the regulated entity, which is why banks and NBFCs chase these upgrades well before the deadline.
It depends on which sector you belong to. The statute is common: the PMLA and the PML (Maintenance of Records) Rules, 2005, administered by the Department of Revenue with FIU-IND as the financial intelligence unit. The operating rules come from your supervisor: the Reserve Bank of India for banks and NBFCs, SEBI for securities market intermediaries, IRDAI for insurers, PFRDA for the pension sector, IFSCA for entities in an International Financial Services Centre and various others for specific categories of DNFBPs. UIDAI sits alongside all of them, licensing the Authentication User Agencies and KYC User Agencies through which Aadhaar authentication is performed.
About the Author
Pathik Shah
FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)
Pathik is a Chartered Accountant with more than 26 years of experience in governance, risk, and compliance. He helps companies with end-to-end AML compliance services, from conducting Enterprise- Wide Risk Assessments to implementing the robust AML Compliance framework. He has played a pivotal role as a functional expert in developing and implementing RegTech solutions for streamlined compliance.
Reach Out to Pathik
