1. What is e-KYC / Digital Onboarding?

RBI defines 3 permissible modes under Para 16-19 of KYC Master Direction:

1. Face-to-face: Traditional branch verification
2. Non-face-to-face Digital Onboarding: OTP-based Aadhaar e-KYC, DigiLocker, CKYCR (Central KYC Registry)
3. Video-based Customer Identification Process (V-CIP): Live video - the only digital method treated as face-to-face equivalent

In 2025, RBI clarified: All three are permitted, and Digital KYC can replace traditional in-person KYC while still compliant. V-CIP now permissible for all customer types including NRIs, and for reactivation of dormant/inoperative accounts as per June 2025 amendment.

2. The Detailed Compliance Framework

A. OTP-based Aadhaar e-KYC (Low Risk)

• Aadhaar OTP authentication with UIDAI
• Limit: Earlier Rs 1 lakh/year transaction cap, now with V-CIP no cap. OTP e-KYC alone still treated as non-face-to-face.
• Must be voluntary - cannot be forced per Puttaswamy
• Requires customer consent, encrypted transmission

Mandatory Failure Point: Bank of Maharashtra was penalized Rs 31.80 lakh for not following rules while opening accounts using Aadhaar-based OTP e-KYC where customer was not physically present. RBI inspection for FY ending March 31, 2024 found non-compliance with digital account opening guidelines.

B. V-CIP - Video KYC - Para 19 - The Gold Standard

RBI's V-CIP guidelines mandate:

• Live interaction is mandatory - pre-recorded videos or third-party recordings strictly prohibited
• AI checks: Face matching, liveness detection, deepfake-proof liveness, document verification
• Capture: Live photo of customer + PAN + Aadhaar masking
• Audit: Geo-tagging, timestamp, recorded consent, encrypted audit-ready recordings, India-based data storage
• Human oversight: Official must be on video, ask random questions
• Time: Must be concurrent, not offline

This combines human oversight with AI-based checks.

Benefit: V-CIP significantly reduces onboarding time and fraud risk, enabling account opening in minutes while maintaining AML controls.

C. CKYCR + DigiLocker Interchangeability

Banks may use DigiLocker and Central KYC Registry data interchangeably for onboarding as per KYC Directions 2025. Means if customer already has CKYC number, bank can pull data instead of fresh e-KYC.

3. Case Laws - The Turning Points

Case Law 1: Justice K.S. Puttaswamy (Retd.) vs Union of India - 2017 Right to Privacy + 2018 Aadhaar Judgment - Supreme Court Constitution Bench

Landmark that rewrote KYC overnight.

• 2017: Declared privacy as fundamental right
• 2018: Struck down Section 57 of Aadhaar Act, 2016 - provision that allowed private entities including banks and telecom to require Aadhaar authentication

The entire KYC ecosystem was built on assumption Aadhaar was compulsory. What did SC actually strike down? Section 57 - private entities cannot require Aadhaar.

Effect: Pursuant to judgment, financial institutions were effectively prohibited from using Aadhaar-based authentication as primary mode of due diligence. Telecom TSPs directed to stop using Aadhaar for customer verification. Banks had to stop e-KYC until Aadhaar Amendment Act 2019 allowed voluntary use.

Current position: Usage of Aadhaar is voluntary. Customer can give Aadhaar voluntarily, bank must offer alternative OVD.

Case Law 2: RBI Penalties for KYC Failure - 2025 Series

RBI imposed penalties ranging Rs 25-50 lakhs on four banks for violating KYC and AML:

• ICICI Bank - Rs 97.80 lakh - Order April 29, 2025: Non-compliance with Cyber Security Framework, KYC, Credit Card issuance. Powers under Sec 47A(1)(c) read with Sec 46(4)(i) Banking Regulation Act, 1949.
• HDFC Bank - Rs 75 lakh - March 24, 2025: Non-compliance with KYC directions
• Fino Payments Bank - Rs 29.6 lakh - June 2025: Non-compliance with KYC norms for payments banks
• Government Employees Co-op Bank Dharwad - Rs 1 lakh - July 17, 2025: KYC + Cyber Security Framework for UCBs
• Citizen Co-op Bank Noida - Rs 6 lakh - May 30, 2025: Contravention Sec 12B + KYC
• Sikkim State Co-op Bank - Rs 50,000 - Sept 8, 2025: KYC

Legal takeaway: Penalty imposed under Sec 47A(1)(c) read with Sec 46(4)(i) and Sec 56 of Banking Regulation Act, 1949.

Case Law 3: NPCI eSign Suspension Post Puttaswamy

NPCI CEO Dilip Asbe: Have to be compliant with SC ruling on Aadhaar not allowing private firms for Aadhaar authentication for eKYC and trying to find solution.

Physical mandate for NACH entailed 10x cost vs paperless, 50% failure rate. NPCI suspended eSign-based eNACH.

Impact: If bank onboarded customer using Aadhaar eSign via private eSign provider after 26 Sept 2018, mandate void. Sec 25 PSS Act prosecution fails.

Case Law 4: Video KYC for Dormant Accounts - June 2025 Amendment

RBI amended KYC guidelines and allowed banks to conduct video KYC to reactivate dormant (inoperative) accounts and unclaimed deposits. This is now permitted.

If bank insists on branch visit for dormant reactivation and customer is abroad, bank can be held deficient - new case law evolving.

4. PMLA + KYC Risk Matrix

Under PMLA Rule 9:

• High-risk customers: KYC updation every 2 years
• Medium-risk: Every 8 years
• Low-risk: Every 10 years
• AML / PEP / UNSC sanctions screening mandatory at onboarding + ongoing

Periodic KYC updation mandatory - failure = penalty as above.

5. Compliance Checklist to Avoid Rs 31.8 Lakh Penalty

For OTP e-KYC:

1. Customer consent + voluntary declaration recorded
2. Aadhaar number masked, no storage of Aadhaar number in plain
3. Transaction limit enforced if not doing V-CIP
4. Physical presence not claimed if only OTP done

For V-CIP:

1. Live interaction + random questions + liveness + face match
2. Geo-tagging + timestamp
3. PAN + OVD captured live
4. Recording encrypted, stored in India, audit trail 5 years
5. Official trained and authorized
6. Customer can opt-out / cancel

Common granular failure RBI punishes:

• Pre-recorded video used
• No geo-tag
• No explicit consent
• OTP e-KYC used for high-value account without V-CIP
• No periodic updation