This is the fifth in a series of case studies, using our evaluation framework for the governance of digital identity systems. These case studies, which analyse identity programmes and their uses, illustrate how our evaluation framework may be adapted to study instances of digital identity across different regions and contexts. This case study looks at the use of digital identity programmes for e-KYC in India.

Financial institutions are required by law to conduct KYC (Know Your Customer) procedures to verify the identity and other details of their clients and crack down on fraudulent transactions. This has traditionally been established by the customer submitting physical copies of their original identity and address proof, and a manual vetting of this information.

Aadhaar-based e-KYC enables the identity and address of a customer to be verified electronically via Aadhaar authentication, making the entire process paperless. The customer provides their explicit consent (by providing biometrics or OTP) for the e-KYC service to instantly generate an electronic, non-repudiable proof of identity and proof of address.

Legislative Mandate

Is the use of digital identity system for e-KYC codified in valid law?

When examining the law governing e-KYC in India, it is important to consider whether processes around collection, storage, use, access to and sharing of personally identifiable information (“PII”) are regulated by Parliament, or whether they have been delegated to the Executive.

The Prevention of Money Laundering Act, 2002 (“PML Act”) mandates that requesting entities must verify the identity of its clients,¹ the manner and conditions of which are are to be prescribed as per Rules made by the Central Government.² The Aadhaar and Other Laws (Amendment) Act, 2019³ added a provision enabling e-KYC authentication via Aadhaar by banking entities to the PML Act.⁴

The Aadhaar Act, 2016 is the parent legislation primarily governing the use of Aadhaar in India. However, the Act itself does not codify the use of Aadhaar for e-KYC. The framework governing the use of Aadhaar for e-KYC is instead codified by a number of regulations issued by the Unique Identification Authority of India (“UIDAI”, which derives its power as an executive body from the Aadhaar Act), as well as by the Reserve Bank of India (“RBI”), Securities and Exchange Board of India (“SEBI”), and the Ministry of Finance. For instance, the Aadhaar (Authentication) Regulations, 2016 define an “e-KYC authentication facility” as “a type of authentication facility in which the biometric information and/or OTP and Aadhaar number securely submitted with the consent of the Aadhaar number holder through a requesting entity, is matched against the data available in the CIDR, andthe Authority returns a digitally signed response containing e-KYC data along with other technical details related to the authentication transaction”.⁵ Procedures for identification, authentication, actors, and storage of information are also similarly delegated to the Executive, potentially amounting to excessive delegation.

In a 2013 notification addressed to all recognized stock exchanges, stockbrokers through recognized stock exchanges, depository participants through depositories, Association of Mutual Funds in India, mutual funds through AMFI, Portfolio Managers, KYC Registration Agencies, Alternative Investment Funds, Collective Investment Schemes and Custodians, SEBI originally allowed e-KYC as a valid form of KYC.⁶ SEBI exercised its powers under Section 11(1) of the Securities and Exchange Board of India Act, 1992 to protect the interests of investors in securities and to promote the development of, and to regulate the securities markets.⁷

There have been a number of amendments to the executive and legislative framework regulating e-KYC since 2019. The Aadhaar Act was amended via the the Aadhaar and Other Laws (Amendment) Act, 2019 to allow an Aadhaar holder to voluntarily use their Aadhaar number in electronic form for authentication,⁸ in addition to “an entity” being permitted to perform authentication if it is compliant with standards of privacy and security specified by regulations, or is permitted to offer authentication services by any other law, or seeks authentication for purposes prescribed by the government.⁹ A series of amendments to the Prevention of Money-laundering (Maintenance of Records) Rules, 2005 (“PML Rules”)¹⁰ and the RBI Master Direction on KYC Norms, added new provisions for authentication via e-KYC.¹¹ The central government has authorised the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (set up under Section 20(1) of the Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest Act, 2002) to perform the functions of the Central KYC Records Registry.¹²

Thus the framework governing the use of e-KYC in India is primarily made up of delegated legislation.

Legitimate Aim

Does the law have a legitimate aim?

The use of e-KYC must correspond to a legitimate aim in the law governing it. This legitimate aim should not operate in a manner that discriminates on the basis of race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status. The PML Act aims to “prevent money-laundering and to provide for confiscation of property derived from, or involved in, money-laundering and for matters connected therewith or incidental thereto.” In addition, the Aadhaar Act, which governs digital identity in India, states its primary purpose as providing for, “as a good governance, efficient, transparent, and targeted delivery of subsidies, benefits and services”.

These objectives qualify as a legitimate aim.

Defining Actors and Purposes

Does the law clearly define all the actors and purposes involved in e-KYC?

Section 4(4) of the Aadhaar Act permits “an entity” to perform authentication if it is compliant with standards of privacy and security specified by regulations, or is permitted to offer authentication services by any other law, or seeks authentication for purposes prescribed by the government. The Act does not define who may ask for authentication, and the UIDAI is tasked with determining who will manage the CIDR.¹³ The Aadhaar (Authentication) Regulations define a requesting entity as “an agency or person that submits the Aadhaar number, and demographic information or biometric information, of an individual to the CIDR for authentication.” ¹⁴ An e-KYC User Agency (“KUA”) is defined as a requesting entity which… uses e-KYC authentication facility provided by the UIDAI.¹⁵

The PML Act defines a reporting entity as “a banking company, financial institution, intermediary or a person carrying on a designated business or profession.” ¹⁶ Banking companies are the only reporting entities allowed to conduct Aadhaar-based authentication,¹⁷ however, the Central Government may allow a reporting entity other than a banking company to perform authentication via Aadhaar if it is satisfied that the company complies with privacy and security standards under the Aadhaar Act, and it is considered necessary and expedient to do so.¹⁸

The Department of Revenue, Ministry of Finance issued a 2019 circular on the procedure for processing of applications under Section 11A of the PML Act for Aadhaar authentication services by entities other than banking companies. It states that the Central Government may permit a reporting entity to carry out authentication using e-KYC if it is satisfied with the recommendations of the appropriate regulator and the UIDAI, if the reporting entity complies with the privacy and security standards under the Aadhaar Act, and if it is necessary and expedient to do so.¹⁹

The RBI Master Direction on KYC has listed the Regulated Entities that can conduct e-KYC authentication.²⁰ In addition to these entities, the Master Direction also provides that biometric-based e-KYC authentication can be carried out by bank official/ business correspondents/ business facilitators.²¹

As seen above, the actors and purposes involved in e-KYC have been identified in the regulatory framework with varying degrees of specificity.

Regulating Private Actors

Is this use of the ID system by private actors adequately regulated?

The use of e-KYC by private actors is regulated within the governing framework of rules and regulations, and no private entities can mandate the use of Aadhaar.

Private actors were empowered to use Aadhaar under Section 57 of the original Aadhaar Act, 2016. This Section was later read down by the Supreme Court in the Aadhaar Judgment to exclude individuals and body corporates from seeking authentication due to concerns that it would “enable commercial exploitation of an individual biometric and demographic information by the private entities.” ²² The 2019 amendment²³ to the Aadhaar Act did away with Section 57, but circumvented the spirit of the Judgment by restoring the use of Aadhaar by private actors via other newly added sections. Section 4(4) of the Aadhaar Act now permits “an entity” to perform authentication if it is compliant with standards of privacy and security specified by regulations, or is permitted to offer authentication services by any other law, or seeks authentication for purposes prescribed by the government.

The 2019 amendment inserted Section 4(3) to the Indian Telegraph Act, 1885, which allows “any person” with a license to identify its customers via authentication or offline verification under the Aadhaar Act, in addition to other modes of identification. The amendment also added Section 11A to the Prevention of Money Laundering Act, 2002 to enable “every reporting entity” to to verify the identity of its clients and beneficial owner by authentication or offline verification under the Aadhaar Act.

The Department of Revenue, Ministry of Finance issued a 2019 circular on the procedure for processing of applications under Section 11A of the PML Act for Aadhaar authentication services by entities other than Banking companies. It states that the Central Government may permit a reporting entity to carry out authentication using e-KYC if it is satisfied with the recommendations of the appropriate regulator and the UIDAI, if the reporting entity complies with the privacy and security standards under the Aadhaar Act, and if it is necessary and expedient to do so.²⁴ This circular thus enables private entities in the securities market to undertake e-KYC.²⁵ As per a subsequent circular, these entities will be registered with the UIDAI as KYC user agencies (“KUAs”) and shall allow all SEBI registered intermediaries/ mutual fund distributors to undertake e-KYC of their clients through them.²⁶ The circular also details the the processes by which KUAs and sub-KUAs can adopt e-KYC for resident investors in the securities market.²⁷

As seen above, there is regulation of private actors using digital ID for e-KYC.

Data Specification

Does the law clearly define the nature of data that will be collected?

The Aadhaar Act provides a fairly exhaustive list of data that will be collected. Section 3(1) states that a resident shall enroll by submitting their demographic and biometric information. As per the Act, demographic information includes name, date of birth, address and other relevant information as may be specified to issue an Aadhaar number. The Act specifically excludes race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history from this category.²⁸ Biometric information here includes photograph, fingerprint, iris scan or other biological attributes that may be specified.²⁹ Core biometric information means fingerprint, iris scan, or other biological attributes as may be specified.³⁰

These provisions allow the scope of these categories to be expanded by the executive authority via regulations, which could result in new categories of data being collected without sufficient legislative oversight.

The provision for demographic information guards against this by specifically listing the categories of data that cannot be collected. The Aadhaar (Authentication) Regulations, 2016 define e-KYC data as meaning demographic information and photograph of an Aadhaar number holder. This will include name, address, date of birth, gender, photograph, mobile number, and e-mail ID (if available).

User Notification

Does the ID system provide adequate user notification mechanisms for this use case?

The law does not explicitly provide for user notification mechanisms for authentication.

However e-KYC requires the explicit consent of the user and is carried out voluntarily.

User Rights

Do individuals have rights to access, confirmation, correction, and opt out?

Aadhaar holders have the right to access and correct/ update their demographic and biometric information stored in the Central Identities Data Repository (“CIDR”).³¹ The RBI Master Direction on KYC also allows customers to provide a current address different to that stored in the CIDR, which they may do by submitting a self-declaration to that effect.³² In addition, e-KYC via Aadhaar is not mandatory, and users can choose to verify their identities through other means.

Most of the user rights are provided to individuals while using e-KYC.

Redressal Mechanisms

Are there adequate civil and criminal redressal mechanisms in place to deal with violations of their rights arising from the process of e-KYC?

While there are redressal mechanisms under the Aadhaar Act, we did not come across any specific redressals that citizens have access to arising from the failure of e-KYC.

Data Minimisation

Are principles of data minimisation followed in the collection, use, and retention of personal data for this use case?

The scope of the data has been clearly defined, and the use of e-KYC has been limited to only KYC purposes.

The PML Act explicitly states that for identification of a client of beneficial owner, authentication or offline verification, neither his core biometric information or Aadhaar number shall be stored.³³ KUAs/ sub-KUAs have been prohibited from storing Aadhaar numbers in their databases for any purposes, and only the full Aadhaar number cannot be stored or displayed anywhere in the system and only the last 4 digits of the Aadhaar number may be displayed wherever required.³⁴ The Aadhaar (Authentication) Regulations also mandate that a requesting entity cannot store, publish or share core biometric information for any purpose, or keep a copy of this information.³⁵

However, the Aadhaar (Authentication) Regulations allow a KUA to store, with consent of the Aadhaar number holder, e-KYC data of an Aadhaar number holder, received upon e-KYC authentication, in encrypted form and subsequently share the e-KYC data with any other agency, for a specified purpose, upon obtaining separate consent for every such sharing from the Aadhaar number holder for that purpose.³⁶ If the Aadhaar number holder revokes their consent, the KUA shall delete any e-KYC data and not share it further.³⁷

KYC records are stored digitally in a Central KYC Records Registry, which is defined under Rule 2(1) of the PML Rules, to receive, store, safeguard and retrieve a customer’s KYC records. The PML (Maintenance of Records) Rules mandate that KYC records are to be stored for a period of ten years from the date of cessation of transactions between the client and the reporting entity. However, it is not explicitly mandated that this data must be deleted after ten years.³⁸

Data minimisation principles are followed to some extent in the use of e-KYC.

Access to Data

Does the law specify access that various private and public actors have to personal data in this use case?

KYC records are stored in a Central KYC registry for a period of ten years from the date of cessation of transactions between the client and the reporting entity.³⁹ The Registry can be accessed by institutions registered/ authorised under the PML Act and other rules.⁴⁰

Under the Indian Telegraph Act, “any person” with a license may use e-KYC for authentication. The PML Act allows “every reporting entity” to verify the identity of its clients and beneficial owner by authentication or offline verification under the Aadhaar Act. As per a 2019 circular issued by the Department of Revenue, Ministry of Finance, entities other than banking companies may also carry out e-KYC if they comply with certain requirements. This notification thus regulates private entities in the securities market to undertake e-KYC.⁴¹ As per a subsequent circular, these entities will be registered with the UIDAI as KUAs and shall allow all SEBI registered intermediaries/ mutual fund distributors to undertake e-KYC of their clients through them.⁴² This circular also details the the processes by which KUAs and sub-KUAs can adopt e-KYC for resident investors in the securities market.⁴³ KUAs shall maintain auditable logs of all such transactions where e-KYC data has been shared with sub-KUA, for a period specified by the Authority.⁴⁴

There is adequate regulation of access to data collected for the purposes of e-KYC using digital ID.

Mandatory Use and Exclusions

Does the use of digital identity in e-KYC lead to exclusionary impacts?

Since e-KYC is not mandatory and there exist alternative forms of authentication, it does not necessarily lead to exclusionary impacts due to failures.

Risk Assessment

Is this use case regulated taking into account its potential risks?

There is no data protection law in place (and no sufficient judicial oversight) governing the use of personal data for e-KYC.

Response to Risks

Is there a mitigation strategy in place in case of failure?

There are some mitigation strategies inbuilt in the design for use of e-KYC.

Authentication for e-KYC can be either via OTP or biometrics,⁴⁵ and in case of failure of authentication via e-KYC, other authentication alternatives exist. However there does not seem to be any clearly articulated mitigation strategy in case of failure of e-KYC.

Notes