The Reserve Bank of India (RBI) has made amendments in Know Your Norms (KYC) for banks and financial institutions. As per the amended norms, financial institutions are now allowed to use video-based Customer Identification Process (V-CIP).
V-CIP is as an alternative method to recognize and identify a customer.
The changes are carried out in the Master direction on KYC dated February 25, 2016 are as follows:
1. “Digital KYC” has been defined as capturing a live photo of the customer and officially valid . document or the proof of possession of Aadhaar.
If offline verification cannot be carried out, due to remove location, then digital KYC will be used, where such live photo is being taken by an authorised officer of the Reporting Entity (RE) as per the provisions contained in the Act. Steps to carry out the Digital KYC process have also been stipulated.
2. Equivalent e-document” has been defined as an electronic equivalent of a document, issued by the issuing authority of such document with its valid digital signature including documents issued to the digital locker account of the customer as per Rule 9 of the Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016.
3. Now, the customer, for the purpose of Customer Due Diligence (CDD) process, shall submit the following documents:
- the Aadhaar number where he is desirous of receiving any benefit or subsidy under any scheme notified under section 7 of the Aadhaar (Targeted Delivery of Financial and Other subsidies, Benefits and Services) Act, 2016 (18 of 2016); or he decides to submit his Aadhaar number voluntarily to a banking company or any reporting entity notified under first proviso to sub-section (1) of section 11A of the PML Act; or
- the proof of possession of Aadhaar number where offline verification can be carried out; or
- the proof of possession of Aadhaar number where offline verification cannot be carried out or
- any Officially Valid Document (OVD) or the equivalent e-document thereof containing the details of his identity and address; and
- the Permanent Account Number or the equivalent e-document thereof or Form No. 60 as defined in Income-tax Rules, 1962; and
- such other documents including in respect of the nature of business and financial status of the client, or the equivalent e-documents thereof as may be required by the RE.
- Provided that where the customer has submitted
- Aadhaar number to a bank or to a RE notified under first proviso to sub-section (1) of section 11A of the PML Act, such bank or RE shall carry out authentication of the customer’s Aadhaar number using e-KYC authentication facility provided by the Unique Identification Authority of India.
- proof of possession of Aadhaar under clause (c.I.ii) above where offline verification can be carried out, the RE shall carry out offline verification
- an equivalent e-document of any OVD, the RE shall verify the digital signature as per the provisions of the Information Technology Act, 2000 (21 of 2000) and any rules issued thereunder and take a live photo as specified under Annex I of the Master Direction.
- proof of possession of Aadhaar number where offline verification cannot be carried out, the RE shall carry out verification through digital KYC as specified under Annex I of the Master Direction.
Provided, for a period not beyond such date as may be notified by the Government for a class of REs, instead of carrying out digital KYC, the RE pertaining to such class may obtain a certified copy of the proof of possession of Aadhaar number or the OVD and a recent photograph where an equivalent e-document is not submitted.
Equivalent e-document has also been permitted for accounts of non-individual customer.
- Where a customer has provided his Aadhaar number for identification and wants to provide a current address, different from the address as per the identity information available in the Central Identities Data Repository, he may give a self-declaration to that effect to the Regulated Entity.
- Banks: can use either OTP based Aadhaar e-KYC authentication or Offline Verification of Aadhaar for identification. Further, services of Business Correspondents (BCs) may be used by banks for aiding the V-CIP.
- REs other than banks: can only carry out Offline Verification of Aadhaar for identification.
- RE shall capture a clear image of PAN card to be displayed by the customer during the process, except in cases where e-PAN is provided by the customer. The PAN details shall be verified from the database of the issuing authority.
- Live location of the customer (Geotagging) shall be captured to ensure that customer is physically present in India.
- The official of the RE shall ensure that photograph of the customer in the Aadhaar/PAN details matches with the customer undertaking the V-CIP and the identification details in Aadhaar/PAN shall match with the details provided by the customer.
- The official of the RE shall ensure that the sequence and/or type of questions during video interactions are varied in order to establish that the interactions are real-time and not pre-recorded.
- In case of offline verification of Aadhaar using XML file or Aadhaar Secure QR Code, it shall be ensured that the XML file or QR code generation date is not older than 3 days from the date of carrying out V-CIP.
- All accounts opened through V-CIP shall be made operational only after being subject to concurrent audit, to ensure the integrity of process.
- RE shall ensure that the process is a seamless, real-time, secured, end-to-end encrypted audiovisual interaction with the customer and the quality of the communication is adequate to allow identification of the customer beyond doubt. RE shall carry out the liveliness check in order to guard against spoofing and such other fraudulent manipulations.
- To ensure security, robustness and end to end encryption, the REs shall carry out software and security audit and validation of the V-CIP application before rolling it out.
- The audiovisual interaction shall be triggered from the domain of the RE itself, and not from third party service provider, if any. The V-CIP process shall be operated by officials specifically trained for this purpose. The activity log along with the credentials of the official performing the V-CIP shall be preserved.
- REs shall ensure that the video recording is stored in a safe and secure manner and bears the date and time stamp.
- REs are encouraged to take assistance of the latest available technology, including Artificial Intelligence (AI) and face matching technologies, to ensure the integrity of the process as well as the information furnished by the customer. However, the responsibility of customer identification shall rest with the RE.
- RE shall ensure to redact or blackout the Aadhaar number in terms of Section 16.
- BCs can facilitate the process only at the customer end and as already stated in para B(b) above, the official at the other end of V-CIP interaction should necessarily be a bank official. Banks shall maintain the details of the BC assisting the customer, where services of BCs are utilized. The ultimate responsibility for customer due diligence will be with the bank.