Country Guide, India: Video-Based Customer Identification Under the RBI KYC Direction

For information; not legal advice.

India does not treat remote customer onboarding as one thing. Its central bank sets out several routes, each with its own conditions: a live video interaction with an official of the institution, an Aadhaar one-time-password route with hard limits on the account, a digital KYC process run by an official with an application, and a general non-face-to-face route with extra safeguards. This guide reads the primary texts for these routes and for the layers around them, so that a reader can tell which route a given product could belong to.

It is a reading guide. It does not say that any product meets the texts, and it does not cover sectors or institutions whose own regulator has issued separate rules. For a comparison with another jurisdiction that has a central-bank rulebook, read the article on the UAE rules for remote onboarding.

The layers of rules

The money laundering statute and rules

The base is the Prevention of Money-laundering Act, 2002 and the rules made under it. The Prevention of Money-laundering (Maintenance of Records) Rules, 2005 were notified by the Ministry of Finance, Department of Revenue, on 1 July 2005 and have been amended many times since. Rule 9 of those rules sets out client due diligence. A reporting entity must apply it when an account-based relationship begins, or when it carries out an occasional transaction at or above rupees fifty thousand, whether as a single transaction or several that appear connected, or any international money transfer operation. It must identify the client, verify identity using reliable and independent sources of identification, understand the purpose and intended nature of the relationship, and identify the beneficial owner and take steps to verify that person.

Two further parts of the rule matter for remote onboarding. The first is the central KYC registry: a reporting entity must file the electronic copy of a client's KYC records with the Central KYC Records Registry within ten days after an account-based relationship begins, and the registry issues a KYC identifier. When it later verifies identity, the entity must ask for that identifier or retrieve it and obtain the records online, and must not ask the client for the same records again unless a listed exception applies, such as a change in the client's information or a lapse in the validity of the downloaded documents. The second is reliance on third parties: a reporting entity may rely on due diligence done by a third party that is regulated, supervised or monitored and is not in a jurisdiction assessed as high risk, but the reporting entity is ultimately responsible for client due diligence.

The central bank's KYC direction

For banks, non-bank lenders and several other institutions, the working rulebook is the Reserve Bank of India's Master Direction on Know Your Customer, issued in 2016 and amended many times. The version served on the Reserve Bank's website when this guide was written is marked as updated as on 14 August 2025. The direction applies to what it calls regulated entities, a term that covers scheduled commercial banks, regional rural banks, local area banks, co-operative banks, all-India financial institutions, non-banking finance companies, asset reconstruction companies, payment system providers and prepaid instrument issuers, and authorised persons such as agents of money transfer schemes. The direction states that the ultimate responsibility for customer due diligence stays with the regulated entity when it relies on a third party.

The securities regulator

Securities intermediaries answer to the Securities and Exchange Board of India, whose own published FAQ on KYC for the securities market explains that intermediaries must perform client due diligence under the same money laundering statute and rules. The same FAQ describes digital KYC for the securities market: the investor's photograph, acceptance of an officially valid document through facilities such as DigiLocker, online, offline or biometric Aadhaar, video capture in a live environment, time stamping, geo-location tagging to ensure the physical location is in India, and a liveness check. The remainder of this guide follows the central bank's text, because it is the one that sets the detailed standards for video identification.

Four KYC routes, and which of them are remote

Three of the four routes are remote. Digital KYC is a digital capture process, not a remote one, because the official and the customer are at one location, and it stays outside the remote-route count. The table is a summary of the sections below, not a quotation.

Route one: V-CIP

What the definition requires

The direction defines the video-based customer identification process as an alternate method of customer identification, with facial recognition and customer due diligence, carried out by an authorised official of the institution through a seamless, secure, live, informed-consent based audio-visual interaction with the customer. The aim is to obtain the identification information needed for due diligence and to check the information the customer gave through independent verification, while keeping an audit trail. Processes that meet the prescribed standards are treated on par with face-to-face identification.

Read the definition twice. The interaction is with an official, and the direction requires that the process be operated only by officials who are specially trained for it. A selfie flow with no official on the other end is therefore a different kind of process under this text. It may be a perfectly usable one, but it belongs to the other routes in the table, with their own conditions.

What V-CIP may be used for

Paragraph 18 of the direction lists three uses. The first is due diligence for new customers: individuals, the proprietor of a proprietorship firm, and the authorised signatories and beneficial owners of legal entities. The second is the conversion of accounts that were opened non-face-to-face with Aadhaar OTP e-KYC. The third is updating, including periodic updating, of KYC for eligible customers.

Infrastructure standards

An institution that opts for V-CIP must meet minimum standards in three groups. The first group concerns infrastructure.

• The institution must comply with the Reserve Bank's baseline cyber security and resilience framework.
• The technology should be housed in the institution's own premises, and the connection and interaction should originate from its own secured network domain.
• Where a cloud model is used, ownership of the data must rest with the institution, the data including the video recording must move to its exclusively owned or leased servers immediately after the process, and no data may be retained by the cloud provider or by a third-party technology provider assisting the process.
• Data between the customer's device and the hosting point of the application must be encrypted end to end, and the customer's consent must be recorded in a manner that can be audited and cannot be altered.
• The application should be able to prevent connections from IP addresses outside India or from spoofed IP addresses.
• The recordings should contain the live GPS co-ordinates of the customer and a date-time stamp, and the video quality must allow identification of the customer beyond doubt.
• The application shall have components for face liveness or spoof detection and for face matching with a high degree of accuracy, while the ultimate responsibility for identification rests with the institution; artificial intelligence may be used to make the process robust.
• Based on detected, attempted and near-miss cases of forged identity, the technology and the workflows must be upgraded regularly, and any detected case of forged identity through V-CIP must be reported as a cyber event under existing guidelines.
• The infrastructure must undergo vulnerability assessment, penetration testing and a security audit, conducted by auditors empanelled by the Indian Computer Emergency Response Team (CERT-In), and any critical gap must be closed before roll-out.
• The application software and its interfaces must also be tested for function, performance and maintenance strength before use in a live environment.

Two of these deserve a second look for anyone who buys technology from a provider. The own-premises and own-network rule, combined with the data-ownership rule for cloud deployments, means that a hosted service in which the provider keeps recordings is a poor fit with this text. The face matching and liveness rule names accuracy but sets no figure for it. A buyer should therefore ask for the provider's test evidence and read it as the article on presentation attack detection testing describes.

Procedure standards

The second group concerns the procedure itself.

• Each institution must write a clear workflow and standard operating procedure and keep to it.
• The official must be able to carry out a liveness check and to detect other fraudulent manipulation or suspicious conduct, and the liveness check must not result in the exclusion of persons with special needs.
• Pausing or reconnecting a call must not create multiple video files; if a pause does not lead to multiple files, no fresh session is needed, but after a call drop or disconnection a fresh session must be started.
• The sequence or type of questions, including those that show the interaction is live, must be varied, to establish that it is happening in real time and is not pre-recorded.
• Any prompting observed at the customer's end must lead to rejection of the account opening.
• The workflow must take into account whether the person is an existing or a new customer, whether the case was rejected earlier, and whether the name appears on a negative list.

The official records the audio and video and captures a photograph, and obtains the identification information through one of four sources: Aadhaar OTP e-KYC authentication, offline verification of Aadhaar, KYC records downloaded from the central KYC registry using the identifier the customer gave, or an equivalent e-document of an officially valid document, including documents issued through DigiLocker. An equivalent e-document is defined as an electronic equivalent of a document, issued by the issuing authority with its valid digital signature. Where an Aadhaar XML file or secure QR code is used, its generation date must be no older than three working days at the time of the V-CIP, and the video process must take place within three working days of downloading the identification information.

Further rules apply to the documents shown on screen.

• The institution must capture a clear image of the PAN card displayed by the customer, unless an electronic PAN is provided, and the details must be verified from the issuing authority's database, including through DigiLocker.
• A printed copy of an equivalent e-document, including an electronic PAN, is not valid for V-CIP.
• The official must ensure that the photograph in the Aadhaar or officially valid document and in the PAN matches the customer on the video, and that the identification details match what the customer provided.
• If the current address differs from the address in the document, suitable records of the current address must be captured, and the economic and financial profile submitted by the customer must be confirmed during the V-CIP.

Assisted V-CIP is allowed for banks that use business correspondents, but only at the customer end; the bank keeps the details of the correspondent and the ultimate responsibility for due diligence stays with the bank. All accounts opened through V-CIP may be made operational only after a concurrent audit that checks the integrity of the process and the acceptability of the outcome.

Records

The third group covers records. The entire data and recordings of a V-CIP must be stored in systems located in India, in a secure manner and with a date and time stamp that allows easy historical search. The activity log, together with the credentials of the official who ran the process, must be preserved. Under the record-management chapter, the institution must keep transaction records for at least five years from the date of the transaction, and identification records for at least five years after the business relationship has ended. The article on retention and erasure of identity data explains why such statutory periods and a deletion promise to the user have to be designed together.

Route two: Aadhaar OTP e-KYC, non-face-to-face

Paragraph 17 allows accounts to be opened with Aadhaar OTP-based e-KYC in non-face-to-face mode, on conditions. There must be a specific consent from the customer for authentication through the OTP. Transaction alerts and OTPs must go only to the mobile number registered with Aadhaar. The aggregate balance of all deposit accounts of the customer must not exceed rupees one lakh, after which the account ceases to be operational until due diligence is complete, and the aggregate of all credits in a financial year must not exceed rupees two lakh. For borrowal accounts, only term loans may be sanctioned, with an aggregate not exceeding rupees sixty thousand in a year. Such accounts are not allowed for more than one year unless identification under paragraph 16 or by V-CIP is carried out, and if the due diligence is not completed within the year, deposit accounts must be closed and borrowal accounts accept no further debits. The customer must declare that no other account has been or will be opened with OTP-based KYC in this mode with any other regulated entity.

Route three: digital KYC

The direction defines digital KYC as capturing the live photo of the customer and of the officially valid document, or of the proof of possession of Aadhaar where offline verification cannot be carried out, together with the latitude and longitude of the location, by an authorised officer of the institution. The process in Annex I runs through an application that the institution controls. The customer and the officer are at the same location, the live photograph is taken by the officer and embedded in the customer application form with a readable watermark that carries the form number, GPS co-ordinates, the officer's name and employee code, and the date and time. The application must capture only a live photograph, and no printed or video-graphed photograph of the customer. An OTP sent to the customer's own mobile number, after the customer is told to verify the details, is treated as the customer's signature on the form. This route is a way for an official to run KYC with a tablet or phone application, and it is distinct from a remote video session.

Route four: other non-face-to-face onboarding

Paragraph 40 of the direction covers non-face-to-face onboarding other than the OTP route, using digital channels such as the central KYC registry, DigiLocker and equivalent e-documents, or non-digital modes such as copies of documents attested by additional authorities for non-resident Indians. Enhanced due diligence applies. Where the institution has introduced V-CIP, it must be offered as the first option for remote onboarding. Alternate mobile numbers must not be linked after due diligence for transaction OTPs, and the institution must verify the current address through positive confirmation before allowing operations. PAN must be obtained and verified with the issuing authority, the first transaction must be a credit from the customer's existing KYC-complied bank account, and the customer must be categorised as high risk and subjected to enhanced monitoring until identity is verified face to face or through V-CIP.

After onboarding: updating and monitoring

Periodic updating of KYC must follow a risk-based approach, and in any case it must happen at least once in every two years for high-risk customers, once in every eight years for medium-risk customers and once in every ten years for low-risk customers, counted from the date of opening or the last updating. Risk categorisation of accounts must be reviewed at least once in six months. These periods are in the direction as served when this guide was written; the direction also contains transition relief for low-risk individual customers.

Data protection law

India's Digital Personal Data Protection Act, 2023 is being brought into force in stages. A notification of the Ministry of Electronics and Information Technology of 13 November 2025 appoints three dates. A first group of provisions came into force on the date of publication. Two provisions follow one year after publication. A third group, which includes sections 3 to 5, sections 7 to 17 and sections 28 to 34, follows eighteen months after publication. This guide does not read the Act's duties on notice, consent or erasure against the V-CIP rules, because the primary texts it relied on do not do so; a reader who must design for both should read the Act and the central bank's direction together with a lawyer. The direction's requirements on storage in India and on records stay in place in the meantime.

Questions to ask a provider

• Which route does the proposed flow belong to: V-CIP, OTP e-KYC, digital KYC or another non-face-to-face mode?
• Who is the official in the flow, how are they trained, and how does the tool handle a dropped call?
• Where are the recordings and the activity log stored, and can the provider keep any copy?
• Which auditors performed the vulnerability assessment, the penetration test and the security audit, and when?
• What does the liveness and face matching component report, and on what test evidence?
• How are the three-working-day limits for Aadhaar XML, QR and downloaded records enforced?
• How is a concurrent audit organised before an account is made operational?

Where this sits in a verification flow

A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The document step detects, classifies and reads IDs, including printed and handwritten text and the machine readable zone with its checksum. The face match step compares the selfie with the portrait on the document in a one-to-one comparison, and includes foreign-face detection and an age check against the date of birth. The liveness step is active: the person moves the face closer through two ovals. Deepfake and face-swap detection works inside the selfie and liveness steps. This article does not state that these steps meet the Reserve Bank's direction.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

• Master Direction - Know Your Customer (KYC) Direction, 2016, Reserve Bank of India, marked updated as on 14 August 2025.
• The Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, Ministry of Finance, Department of Revenue.
• Notification G.S.R. 843(E) of 13 November 2025 on the commencement of the Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology.
• Frequently asked questions on KYC norms for the securities market, Securities and Exchange Board of India, May 2024.