{"id":1811,"date":"2026-10-01T07:34:48","date_gmt":"2026-10-01T07:34:48","guid":{"rendered":"https:\/\/trackwizz.com\/knowledge-hub\/?p=1811"},"modified":"2026-10-16T07:39:30","modified_gmt":"2026-10-16T07:39:30","slug":"ckyc-aadhaar-and-frictionless-onboarding-in-india","status":"publish","type":"post","link":"https:\/\/trackwizz.com\/knowledge-hub\/ckyc-aadhaar-and-frictionless-onboarding-in-india\/","title":{"rendered":"CKYC, Aadhaar and Frictionless Onboarding in India"},"content":{"rendered":"

India has several established routes for digital customer identification: records held in the Central KYC Records Registry (CKYCR<\/strong>), Aadhaar offline verification, equivalent electronic documents including those issued through DigiLocker, and the Reserve Bank of India\u2019s Video based Customer Identification Process (V-CIP<\/strong>). They can reduce repeated document collection, but each route has conditions. A faster handoff of identity data does not by itself establish that a customer has been adequately assessed for money laundering risk.<\/p>\n

The distinction matters to anti-money laundering (AML) teams. CKYCR lets a reporting entity obtain an existing KYC record; Aadhaar offline verification lets it check a digitally signed identity artifact without online Aadhaar authentication; and V-CIP provides a regulated remote interaction. The institution still has to adhere to the customer due diligence (CDD), beneficial ownership, risk assessment and ongoing monitoring requirements relevant to its relationship with the customer.<\/p>\n

The practical question is therefore how to reuse reliable identity information while identifying what must be checked afresh. The answer lies in the governing rules and in the quality, currency and scope of the information actually available.<\/p>\n

CKYCR Reduces Repetition But Does Not Transfer Responsibility<\/h3>\n

The Government designated the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI<\/strong>) as the CKYCR in November 2015. The registry receives, safeguards and makes digital KYC records available to reporting entities. It assigns a KYC Identifier to a customer whose record is registered, allowing another entity to retrieve that record for a permitted purpose. This makes reuse possible across participating institutions; it does not make the original institution\u2019s assessment binding on the next one.<\/p>\n

The Union Budget 2025-26 announced that a revamped Central KYC Registry would be rolled out in 2025 and that a streamlined system for periodic updating would be implemented. An April 2025 Department of Financial Services meeting discussed modernization, reduced redundancy and stronger security. Those announcements do not establish the specific performance figures, technologies or integrations attributed to \u201cCKYCRR 2.0\u201d<\/em> in the earlier draft.<\/p>\n

The RBI\u2019s current sector specific KYC Directions set out the operational duties. A bank must upload a customer\u2019s KYC record to CKYCR within 10 days of starting an account based relationship. When it obtains additional or updated information covered by the rule, it must furnish the update within seven days, unless the Central Government specifies another period. CKYCR then notifies reporting entities that have dealt with that customer, which must retrieve the revised record and update their own files.<\/p>\n

A KYC Identifier can reduce repeat collection. For an account-based relationship, an update or an identity check, the RBI directs an entity to seek or retrieve the identifier and obtain the record online. A bank may ask the customer for the same records or additional identification material only in specified circumstances, including a changed, incomplete or outdated record, an expired document, or a need to verify identity or address, conduct enhanced due diligence or build an appropriate risk profile.<\/p>\n

DigiLocker is a separate source of equivalent electronic documents under the RBI framework, and documents issued through it may be used in V-CIP. The governing Direction does not establish that CKYCR automatically draws every customer\u2019s Aadhaar, PAN and driving licence from a DigiLocker vault. The institution must verify the document and follow the applicable CDD route.<\/p>\n

The RBI\u2019s August 14, 2025 amendment was narrower than the draft suggests. Among other changes, it addressed non-discriminatory onboarding, occasional transactions of at least \u20b950,000 or connected transactions reaching that amount, Aadhaar Face Authentication in an existing provision, and accessibility in V-CIP liveness checks. It did not introduce a new universal \u201cdeepfake detection\u201d or \u201cpresentation attack detection\u201d mandate, nor did it create a new list of officially valid documents.<\/p>\n

UIDAI notified the Aadhaar (Authentication and Offline Verification) Amendment Regulations, 2025 on December 9, 2025. They concern the Aadhaar authentication and offline verification framework. The changes should not be described as a substitute for the RBI\u2019s CDD requirements or as proof that every new credential or verification feature is available in every regulated onboarding journey.<\/p>\n

The resulting picture is a set of complementary channels, subject to their own legal and technical controls. An institution must choose a permitted identification method for the customer and product, obtain the required consent, verify the evidence it receives and retain an audit trail appropriate to the route used.<\/p>\n

What Aadhaar Offline Verification Establishes<\/h3>\n

An Offline Verification Seeking Entity (OVSE<\/strong>) operates within UIDAI\u2019s framework for checking Aadhaar information without an online authentication query to the Central Identities Data Repository. Offline verification can use the UIDAI signed XML or secure QR code; newer Aadhaar app-based credential sharing is governed by UIDAI\u2019s applicable specifications and registration requirements. The method used should be identified precisely rather than treating every offline route as the same process.<\/p>\n

UIDAI says the paperless offline e-KYC XML contains the holder\u2019s name, address, photograph, gender and date of birth, hashes of the registered mobile number and email address, and a reference ID containing the final four digits of the Aadhaar number and a timestamp. It does not disclose the full Aadhaar number in that XML. The holder supplies the file and a share code; the recipient can validate UIDAI\u2019s digital signature. Consent, lawful collection and limits on retention still matter.<\/p>\n

A valid digital signature helps establish that the XML has not been altered and was issued by UIDAI. It does not, on its own, prove that the person presenting it is the holder, that every other customer\u2019s assertion is true, or that the relationship is low risk. The regulated entity must connect the verified data to the person before it and complete the CDD measures required for the customer and product.<\/p>\n

Where an entity uses Aadhaar offline XML or a secure QR code in V-CIP, the RBI requires the artifact to have been generated no more than three working days before the video process. V-CIP also calls for an authorized, specially trained official, a live interaction, facial matching and liveness or spoof detection in the application. These requirements address different failure points; neither a signed document nor a video check is a complete AML assessment.<\/p>\n

Record Quality Determines the Value of CKYCR<\/h3>\n

A central record is useful when its contents are accurate, current and sufficient for the new relationship. A retrieved KYC Identifier does not show, by itself, that the customer\u2019s beneficial owners, business activity or risk profile have been assessed to the standard required by the receiving entity. Under the RBI\u2019s December 2025 clarification, the entity that last uploaded or updated the CKYCR record is responsible for verifying identity and\/or address. A bank relying on a current, PML compliant record need not repeat authenticity verification, while it must still perform its own relationship specific risk assessment and applicable CDD.<\/p>\n

The timing rules are distinct. The initial upload follows commencement of an account based relationship and has a 10 day deadline under the RBI Direction. A subsequent covered update is furnished to CKYCR within seven days, subject to any notified alternative. A three working day period appears in the separate V-CIP rules governing the age of an Aadhaar XML or QR code and, in limited circumstances, the timing of the video process after identification information is obtained. It is not the general CKYCR upload deadline.<\/p>\n

The RBI\u2019s November 2024 amendment refined reuse of a CKYCR record. It specified when an institution should retrieve the record and the exceptions that justify requesting documents again. It did not replace the institution\u2019s own duty to assess customer risk and perform ongoing due diligence. Reuse is designed to prevent needless duplication while leaving room for information required by the particular relationship.<\/p>\n

The receiving bank should review whether the retrieved record is current and compliant, whether the listed exceptions call for further identity or address evidence, and whether enhanced measures are necessary. The last uploader\u2019s responsibility for identity or address authenticity avoids an automatic duplicate verification when those conditions are satisfied. If the record is stale or the customer\u2019s circumstances have changed, the exceptions in the Direction allow further information to be collected. This is an assessment under a defined rule, not a presumption that all CKYCR entries are deficient.<\/p>\n

For AML teams, the useful sequence is to retrieve the record, check its fit for the proposed product and the customer\u2019s current circumstances, resolve gaps under the permitted exceptions, and document the risk decision. The registry supports this work. Transaction monitoring and the obligation to keep information current continue after onboarding.<\/p>\n

Video Identification and Impersonation Risk<\/h3>\n

V-CIP already required face liveness or spoof detection and face matching before the August 2025 amendment. The August change added that the liveness check must not exclude a person with special needs. A claim that the amendment first imposed universal deepfake or presentation attack detection would misstate the chronology and the text of the RBI Direction.<\/p>\n

Remote identity checks can be attacked with forged or manipulated material. The RBI responds through a controlled live video process: consent and auditability, location and time information, trained officials, variable questions, checks against identification data, and technical testing. It places ultimate responsibility for customer identification on the regulated entity even when technology assists the official.<\/p>\n

The institution should treat anomalies in the video interaction and inconsistencies among the customer, identification document and other information as reasons for investigation. The Direction also requires accounts opened through V-CIP to become operational only after concurrent audit. A digitally signed Aadhaar artifact provides document authenticity; the live process addresses the person presenting it; risk assessment addresses the intended relationship.<\/p>\n

UIDAI\u2019s later credential framework creates additional ways to share verifiable Aadhaar information, including selective disclosure described in its Aadhaar app specifications. Whether a particular institution may use a given route for regulated CDD depends on the applicable Aadhaar and sectoral requirements. The existence of a technical credential should not be equated with automatic acceptance for every onboarding case.<\/p>\n

Periodic Updating and Event Driven Review<\/h3>\n

Customer information cannot be treated as static. The RBI requires ongoing due diligence so that transactions remain consistent with what the institution knows of the customer, the business, risk profile and source of funds or wealth. It also requires a system to review account risk categories at least every six months and to consider enhanced due diligence where needed. A periodic document refresh is only one part of that process.<\/p>\n

The RBI Direction sets minimum periodic KYC update intervals of two years for high-risk customers, eight for medium risk and ten for low risk, measured from account opening or the last update. These are maximum intervals between scheduled updates, not a rule to ignore a material change until the next date. The institution must use a risk-based approach and keep CDD information relevant and current.<\/p>\n

CKYCR\u2019s update mechanism can help propagate revised identity information: after a reporting entity furnishes an update, the registry notifies other entities that have dealt with that customer, and they retrieve the revised record. It does not automatically supply a complete, continuously refreshed view of adverse media, transaction behaviour, beneficial ownership or source of funds. Those checks remain within each institution\u2019s own controls.<\/p>\n

In June 2025 the RBI allowed transactions to continue for low-risk individual customers while periodic KYC was completed within one year after it fell due or by June 30, 2026, whichever was later, subject to regular monitoring. The same amendment added requirements for advance notices and reminders. This accommodation should be read with its dates and conditions; it did not waive CDD or ongoing monitoring.<\/p>\n

What the AML Function Should Take From These Changes<\/h3>\n

The dependable developments are specific: the CKYCR reuse and update rules, regulated digital identification options, the existing safeguards for V-CIP, the 2025 Aadhaar amendments, and the RBI\u2019s adjustments to periodic KYC. The public Budget announcement of a registry revamp is a policy commitment, not evidence for unverified claims about production latency, AI duplicate detection or automatic DigiLocker integration.<\/p>\n

Three operational lessons follow those rules.<\/p>\n

First, use the KYC Identifier to avoid unnecessary repeat collection while checking that the retrieved record is fit for the proposed relationship. Apply the RBI\u2019s listed exceptions where more evidence is justified. Make the initial upload and subsequent updates within their respective deadlines, and ensure the record sent to CKYCR is accurate.<\/p>\n

Second, keep document authenticity, presenter identity and customer risk separate in the control design. UIDAI\u2019s signature check can authenticate the offline XML; V-CIP controls can test the live presenter and compare information; CDD and monitoring address beneficial ownership, purpose, activity and emerging risk. Each addresses a different question.<\/p>\n

Third, set clear triggers for review when credible new information emerges, while meeting the RBI\u2019s scheduled update intervals and ongoing due diligence duties. CKYCR notifications are one input. A change in beneficial ownership, unusual activity or a material discrepancy should be assessed under the institution\u2019s risk policy, with the decision recorded.<\/p>\n

India\u2019s shared KYC infrastructure can reduce repeated effort and support more consistent identity records. Its AML value depends on how reporting entities verify what they receive, update what they learn and act on risk after the account opens.<\/p>\n

A smoother onboarding experience is compatible with rigorous CDD when the institution uses the permitted digital routes correctly and remains accountable for the customer relationship.<\/p>\n

Primary sources referenced:<\/strong><\/p>\n