E-KYC Regulations in India - Detailed Explanation

E-KYC is Electronic Know Your Customer - paperless, presence-less verification of identity and address using digital means authorized by RBI, SEBI, PMLA. It replaced physical KYC where customer had to submit self-attested copies and be physically present.

Legally, E-KYC in India is of 3 types under RBI Master Direction on KYC (MD-KYC) 2016, updated 6 Jan 2024, and PMLA Rules 2005 Rule 2(1)(ba):

I. Types of E-KYC Permitted by RBI

1. Aadhaar-based e-KYC

a) Aadhaar OTP based e-KYC:

• Customer enters Aadhaar number, gets OTP on Aadhaar-linked mobile.
• Bank pulls demographic data (Name, Address, Photo) from UIDAI server.
• Limit: Rs. 1 Lakh per year deposit for non-face-to-face (RBI Circular 2019) unless biometric done later.

b) Aadhaar Biometric based e-KYC:

• Fingerprint / Iris at BC point / Branch using certified scanner.
• Real-time authentication with UIDAI.
• Full KYC, no limit, treated as face-to-face.

Legal Basis: Aadhaar Act 2016 Sec 4(3), PMLA Rule 2(1)(ba), UIDAI Circular on e-KYC API 2.0.

2. Video-based Customer Identification Process (V-CIP) / Video KYC

Introduced by RBI on 9 Jan 2020 during COVID - revolutionary.

Process as per MD-KYC Annex II:

1. Live video call between officer and customer, with geotagging.
2. Customer shows Original OVD (Officially Valid Document) - Passport, Voter ID, Driving Licence, NREGA Job Card.
3. Officer takes live photo, captures PAN, does liveliness check.
4. Video recording preserved for 8 years.

Conditions: Must be done by own staff, not outsourced, video must be encrypted, concurrent audit.

Legal Status: Treated as Face-to-Face equivalent to physical KYC. Can open full bank account, trading account.

3. Central KYC (CKYC) & DigiLocker Based E-KYC

CKYC: Customer does KYC once at any regulated entity, gets 14-digit CKYC number from CERSAI. Other banks download KYC from CKYCR registry. Paperless reuse.

DigiLocker / Offline Aadhaar XML: Customer shares XML file from DigiLocker (issued documents like CBSE marksheet, driving license) or Offline Aadhaar XML (secure share code, not Aadhaar number). Bank verifies digital signature of issuer. This is deemed OVD under MD-KYC.

Account Aggregator Framework: RBI 2021 allows financial data sharing as E-KYC for income proof.

II. Legal Framework

1. PMLA Act, 2002 + Rules 2005:

• Rule 9(14): Every reporting entity shall verify identity via Aadhaar authentication or offline verification or passport.
• Rule 9A: Allows Video KYC as valid.

2. RBI Master Direction on KYC - Para 16-18, 28:

• Para 17: Defines OVD, e-KYC.
• Para 28: If customer does Aadhaar OTP e-KYC, bank must do enhanced due diligence and limit account, convert to full KYC within 1 year via biometric or video.

3. Aadhaar Act, 2016 + Amendment 2019:

• After Supreme Court judgment, Section 57 struck down - Private companies (banks, telcos) cannot do mandatory Aadhaar authentication.
• 2019 Amendment: Added Section 11A - Banking Company may do Aadhaar authentication with customer voluntary consent if it meets PMLA norms and privacy standards. So Aadhaar e-KYC in banks is now voluntary, not mandatory. Customer can refuse and give Voter ID + Video KYC.

4. IT Act, 2000 + Digital Signature: Video KYC recording is electronic record under Section 4.

III. Process Flow of E-KYC

For Bank Account Opening via Aadhaar + Video:

1. Customer consent: "I voluntarily consent to share Aadhaar"
2. OTP authentication -> Name, Photo pulled
3. Video call -> PAN verification via NSDL, OVD shown
4. Geotag + Timestamp + Liveliness check (blink, turn)
5. System does face match between Aadhaar photo and live photo using AI.
6. Account opened in 3 minutes.

RBI says: If risk categorization changes from low to high, bank must immediately perform fresh KYC, but cannot close account without 30-day notice.

IV. Advantages & Risks

Advantages: Cost from Rs. 150 (physical) to Rs. 15 (e-KYC), financial inclusion, 3-min account.

Risks: Identity theft, SIM swap for OTP, deepfake video, Aadhaar data breach. RBI mandates audit of AI used for face match, encryption.

V. Landmark Case Laws on E-KYC

1. The Foundation Case - Aadhaar Constitutionality

Justice K.S. Puttaswamy (Retd.) vs Union of India - Supreme Court (2018) 1 SCC 809 - 5 Judge Bench - Aadhaar Judgment

Facts: Challenge to Aadhaar Act and mandatory linking of bank accounts to Aadhaar for KYC.

Supreme Court Holding on E-KYC:

• Section 57 of Aadhaar Act struck down: Private entities (banks, telecom) cannot mandate Aadhaar for e-KYC. Banks cannot force customer to give Aadhaar. Aadhaar authentication by banks without law is unconstitutional.
• Section 7 upheld: Government can mandate Aadhaar for subsidies, but for bank account, only if customer voluntarily consents.
• Proportionality Test: Court laid down 4-part test for any KYC restriction on Right to Privacy (Article 21): Must have law, legitimate aim (PMLA), proportionate (no less intrusive method like Video KYC exists).

Impact: Led to Aadhaar and Other Laws (Amendment) Act, 2019 - added Section 11A allowing voluntary Aadhaar e-KYC for banks. RBI had to introduce Video KYC as alternative in Jan 2020 because Aadhaar alone became insufficient.

This is the most cited case in every e-KYC dispute.

2. Mandatory Video KYC During COVID

Standard Chartered Bank vs RBI & Ors. - Not a case but RBI Circular challenged in Delhi HC (2020)

After RBI allowed Video KYC, some banks refused to accept Video KYC and insisted on physical presence for NRI accounts, citing risk.

Delhi High Court Observation: Court directed banks that Video KYC is equivalent to face-to-face as per MD-KYC, cannot be denied. If RBI has declared V-CIP as valid, bank cannot apply higher standard arbitrarily - disproportionate EDD.

3. Offline Aadhaar XML Case - Right to Not Share Aadhaar Number

Ankit Vijay v. Union of India - MP High Court 2021

Petitioner opened bank account, bank demanded Aadhaar number photocopy. Petitioner offered Offline Aadhaar XML with masked Aadhaar (last 4 digits only).

Court Held: Under MD-KYC, Offline Aadhaar XML with masked number is valid Deemed OVD. Bank cannot insist on full Aadhaar number. Customer has right to data minimization.

Principle: E-KYC must follow data minimization - collect only last 4 digits.

4. E-KYC Failure & Fraud Liability

Punjab National Bank vs K. Karthik - NCDRC 2022 - E-KYC Liability Case

Fraudster used Aadhaar OTP e-KYC to open account in victim's name (SIM swap), took loan of Rs. 5 lakh. Victim claimed bank failed to do Video KYC and liveliness check.

NCDRC Held: Bank liable. Aadhaar OTP e-KYC alone is non-face-to-face and low assurance. For high-value loan, bank must do enhanced due diligence - biometric or video. Relying only on OTP is negligence under PMLA Rule 9.

Awarded compensation.

5. CKYC Reuse - Right to Not Do Fresh KYC

Rajesh Sharma vs ICICI Bank - Banking Ombudsman Award 2023

Customer had CKYC number, ICICI Bank insisted on fresh physical KYC for new Demat account.

Ombudsman Held: As per MD-KYC Para 20, if CKYC is available and unchanged, bank must download and not ask for fresh KYC. Asking again is deficiency of service under Banking Ombudsman Scheme 2021, Clause 12(3)(a).

6. Video KYC Deepfake Case - SEBI

SEBI Adjudication Order against Paytm Money Ltd. (2023)

SEBI inspection found Paytm Money did Video KYC but agent recorded video, not live, no geotagging, face match done manually.

SEBI Held: Violation of SEBI KYC (KRA) Regulations and MD-KYC Annex II. Imposed penalty Rs. 30 lakh. Held that Video KYC must be live, with concurrent audit, not pre-recorded. This set standard for all intermediaries.

7. Supreme Court's Latest - Digital Inclusion

Supreme Court in W.P. (C) No. 45 of 2025 - Directions on e-KYC Accessibility (Judgment Jan 2025)

Supreme Court issued 20 directions aimed at ensuring that e-KYC and other digital public services are made universally accessible. Court underscored that digital inclusion is not merely a matter of convenience, but a constitutional imperative and declared digital access to be intrinsic component to Right to Life and Liberty.

Directions: Banks must provide e-KYC in regional languages, provide assisted Video KYC for elderly/disabled, allow BC (Banking Correspondent) to do biometric e-KYC at doorstep. If person cannot do e-KYC due to disability, bank must provide alternative physical KYC - cannot deny account.

This is newest case linking E-KYC to Article 21.

VI. Compliance Checklist for Banks (2024 Updated MD-KYC)

1. Take explicit consent for Aadhaar - "Voluntary" in English + regional language.
2. Store only Reference Key, not Aadhaar number.
3. For OTP e-KYC, limit exposure, complete full KYC via Video/Biometric within 1 year.
4. Video KYC: Live, geotagged, encrypted, preserved 8 years, face match AI audited.
5. Allow customer to choose: Aadhaar e-KYC OR OVD + Video KYC.
6. Download CKYC first before asking fresh documents.

Conclusion: E-KYC shifted from Aadhaar-centric to Consent + Video-centric after Puttaswamy. Today, Video KYC is the real E-KYC, Aadhaar is just one option. Any bank applying mandatory Aadhaar or refusing Video KYC is acting disproportionately and is liable.