1. What is E-KYC Compliance?

Electronic KYC is paperless verification of customer's identity through digital means authorized by regulator, instead of physical OVD - Officially Valid Documents.

Legal Definition as per RBI Master Direction - KYC Direction, 2016 [Updated 6th Jan 2025]:

E-KYC means authentication of customer through:

1. Aadhaar Authentication - Biometric / OTP based
2. Video-based Customer Identification Process [V-CIP]
3. Offline Aadhaar XML / Aadhaar QR
4. Central KYC Registry [CKYCR]
5. DigiLocker issued OVD

Compliance means doing it with customer consent, purpose limitation, data minimization, and storage limitation under PMLA Rule 9, IT Act, and DPDP Act 2023.

2. Types of E-KYC Allowed in India

3. Legal Framework - The 3 Layer Structure

Layer 1: Aadhaar Act 2016:
Sec 4 - Authentication, Sec 29 - Privacy. Sec 57 - allowed private entities to use Aadhaar - This was struck down.

Layer 2: RBI Master Direction KYC 2016 [as amended 2025]:

• Para 16 - Customer Identification Procedure
• Para 17 - Aadhaar e-KYC
• Para 18 - V-CIP Guidelines
• Para 56 - Confidentiality - Aadhaar not mandatory, mandatory only for schemes notified under Sec 7 of Aadhaar Act. New explanation in 2025 Master Directions reiterating that Aadhaar is not mandatory for KYC and is mandatory only for schemes notified under Section 7

Layer 3: PMLA 2002 + IT Act + DPDP Act 2023:
PMLA Rule 9 requires RE to verify identity, address, beneficial owner. Failure = Sec 12 violation.

4. Case Laws - Landmark

Case Law 1: Justice K.S. Puttaswamy [Retd.] v. Union of India (2017) 10 SCC 1 - Privacy Case

Facts: 91 petitions challenged Aadhaar being made mandatory for bank accounts, mobile SIM, PAN.

Held: 9 Judge Bench unanimously held Right to Privacy is Fundamental Right under Article 21. Any state action infringing privacy must pass triple test - Legality, Necessity, Proportionality. This became basis for all future e-KYC litigation.

SC banned private entities from using Aadhaar e-KYC for verification considering security of biometric data

Case Law 2: Justice K.S. Puttaswamy [Aadhaar-5J] v. Union of India (2019) 1 SCC 1 - 26 Sept 2018 Judgment - Most Important for E-KYC

Facts: Same petitions challenged Section 57 Aadhaar Act - which allowed private entities, including banks and telecom companies, to require Aadhaar authentication.

Held by 4:1 majority [Justice Chandrachud dissent]:

1. Aadhaar scheme upheld for welfare / PAN / IT - does not breach privacy.
2. Section 57 struck down as unconstitutional - Preventing private companies, such as banks, fintech, telecom from accessing Aadhaar data. Judgment was blow to private entities which need to comply with KYC regulation because they have been relying on Aadhaar IDs to digitally onboard customers.
3. Banks and telecom companies can no longer make Aadhaar mandatory. Aadhaar must remain voluntary. Authentication only if customer voluntarily uses his Aadhaar number for identification purpose.
4. Commercial banks, e-wallets like Paytm, MobiKwik, and Payments Bank can no longer insist on KYC verification using Aadhaar. Telecom providers too cannot seek Aadhaar details for verification purposes

Impact Overnight: The entire KYC ecosystem from KYC Master Direction to bank branch operations was built on assumption that Aadhaar was compulsory. RBI had to amend KYC Direction on 29 May 2019:

Banks have been allowed to carry out Aadhaar authentication of an individual who voluntarily uses his Aadhaar number for identification purpose.

And introduced Offline XML and V-CIP as alternative.

This is why in your image, if bank forces Aadhaar e-KYC - it violates Puttaswamy 2018.

Case Law 3: Paytm Payments Bank Ltd. v. RBI - 2024 Action - Live Example of E-KYC Non-Compliance

Facts: RBI Audit found Paytm Payments Bank did:

• Onboarded lakhs of customers with single PAN - same PAN used for 1000+ accounts
• No V-CIP, no liveliness check, e-KYC data not stored
• No beneficial owner identification for wallet merchants

Action: RBI under Sec 35A Banking Regulation Act imposed:

• Ban on onboarding new customers - 11 March 2022
• Complete ban on deposits / credit transactions - 31 Jan 2024, later 15 March 2024 deadline
• Fine Rs. 5.49 Crore for PMLA violation

Principle: E-KYC compliance is not just Aadhaar match. You must ensure de-duplication, storage limitation, and video verification. Failure = Business closure.

Case Law 4: Internet and Mobile Association of India v. RBI 10 SCC 274 - Crypto KYC

Facts: RBI banned banks from dealing with crypto exchanges citing KYC/AML risk.[2020]

Held: SC struck down ban as disproportionate, but held that exchanges must do full E-KYC including V-CIP, IP tracking, and STR filing under PMLA. Brought crypto under E-KYC compliance.

Case Law 5: SEBI - Karvy Stock Broking E-KYC Fraud - 2019

Facts: Karvy used client e-KYC data to pledge client securities without consent.

Held: SEBI banned Karvy, held that e-KYC data collected for one purpose cannot be used for another purpose - violates purpose limitation under Puttaswamy and DPDP Act.

5. Current Position After 2025 Amendment

Aadhaar Amendment Rules, 2025: These rules allow private entities to use Aadhaar for their services, provided they adhere to strict data protection norms.

Conditions:

• Must be certified by UIDAI
• Must comply with DPDP Act 2023 - consent manager, data fiduciary obligations
• Must offer alternative OVD - cannot deny service if customer refuses Aadhaar
• Must store only masked Aadhaar - last 4 digits

So private banks can again do Aadhaar e-KYC, but only with voluntary consent + alternative.

6. Checklist for E-KYC Compliance - For Audit / Exam Answer

If Aadhaar OTP E-KYC:

1. Obtain explicit consent - "I voluntarily share Aadhaar for KYC"
2. Show alternative - Passport / Voter ID / Driving Licence
3. Do not store Aadhaar number - Store masked XML only
4. Complete full KYC via V-CIP within 1 year, else freeze account
5. File STR if mismatch in name / photo

If Video KYC:

1. Live video, no pre-recorded
2. Official must be in India, video must have geo-tag, time stamp
3. Customer must show original OVD, not photocopy
4. Liveliness check - ask to blink, move
5. Face match with OVD photo - AI score >90%

Penalty for Non-Compliance:

• RBI - Sec 47A BR Act - Up to Rs. 5 Cr
• PMLA Sec 13 - Rs. 50 lakh to Rs. 1 Cr per failure
• DPDP Act 2023 Sec 33 - Up to Rs. 250 Cr for data breach

Final Exam Line:

After Justice K.S. Puttaswamy 2018, Section 57 Aadhaar Act struck down, Aadhaar e-KYC cannot be made mandatory by private entities. It is voluntary, requires alternative OVD, and OTP based e-KYC is valid only for 1 year unless followed by V-CIP / OVD verification, as per RBI Master Direction Para 17 and 18.