NBFCs and e-KYC: RBI , India
On September 13, 2021, the RBI issued a
notification permitting all NBFCs, Payment System Providers and Payment System
Participants to carry out authentication of client’s Aadhaar number using e-KYC
facility provided by the Unique Identification Authority of India (UIDAI),
subject, of course, to license being granted by MoF. The process involves an
application to the RBI, onward submission after screening of the application by
the RBI, then a further screening by UIDAI, and final grant of authentication
by the MoF
Use of demographic authentication: The Aadhaar number and demographic
information of the customer is obtained and matched with the demographic
information of the Aadhaar number holder in the CIDR.
Using one-time pin based authentication: Aadhaar number of customer is obtained.
OTP is sent to the registered mobile number and/ or e-mail address. Aadhaar is
authenticated when customer shares OTP and is shared with the same generated by
UIDAI
Using biometric information: The Aadhaar number and biometric information submitted by the
customer are matched with the biometric information stored in the CIDR.
Essentially, aadhaar
authentication requires the Regulated Entity (RE) to obtain the aadhaar number
of the customer.
However, owing to the
Supreme Court Verdict on Aadhaar, aadhaar number could be obtained only by
banks or specific notified entities. Eventually, the concept of offline
verification was introduced by virtue of which verification can be done using
XML file or QR code which carries minimum details of the customer. RE is not
required to obtain aadhaar number in this case.
Before this, NBFCs were barred entirely from
using the Aadhaar online eKYC facility for client authentication due to a
supreme court ruling in 2018 that expressed concerns regarding the risks of
online eKYC and put an end to the usage of eKYC for client authentication of
any contract.
Subsequently, PMLA (2002) was amended and
Section 11A was inserted, which allowed for –
§ Banking companies to employ aadhar e-KYC for authentication
§ The central government, in consultation with UIDAI, to permit non-banking companies to use eKYC
Additionally, Section 11A allows the Ministry
of Finance to issue notifications permitting non-banking financial companies to
use eKYC provided they follow the application steps outlined below.
According to RBI’s notification, NBFCs will have to
apply for an Aadhaar authentication licence to utilize the eKYC services
provided by UIDAI. This licence can either be a KYC User Agency (KUA) Licence
or a sub-KUA Licence.
Understanding the concept
of concept of AUA and KUA
The Aadhaar
(Authentication) Regulations, 2016 provide the following definitions:
“Authentication User Agency” or “AUA” means a requesting entity that uses the
Yes/ No authentication facility provided by the Authority;
“e-KYC User Agency”
or “KUA” shall mean a requesting entity which, in addition to being an AUA,
uses e-KYC authentication facility provided by the Authority;
“e-KYC authentication facility” means a
type of authentication facility in which the biometric information and/or OTP
and Aadhaar number securely submitted with the consent of the Aadhaar number
holder through a requesting entity, is matched against the data available in
the CIDR, and the Authority returns a digitally signed response containing
e-KYC data along with other technical details related to the authentication
transaction;
A detailed procedure for processing of applications under the PMLA provisions for use of Aadhar authentication services by entities other than banking companies has been provided by the Department of Revenue, Ministry of Finance in its circular dated May 9, 2019.
“Accordingly, non-banking finance
companies (NBFCs), payment system providers and payment system participants
desirous of obtaining Aadhaar Authentication
License - KYC User Agency (KUA) License or sub-KUA License (to perform authentication through a
KUA), issued by the UIDAI, may submit their application to this Department for
onward submission to UIDAI.
The RBI Guidance
An additional proviso is added to Section 17 as under:
Provided further that a RE may provide an option for One Time
Pin (OTP) based e-KYC process for on-boarding of customers.
Accounts opened in terms of this proviso i.e., using OTP
based e-KYC, are subject to the following conditions:
i.
There must be a specific consent from the customer for
authentication through OTP
ii.
the aggregate balance of all the deposit accounts of
the customer shall not exceed rupees one lakh.
iii.
the aggregate of all credits in a financial year, in
all the deposit taken together, shall not exceed rupees two lakh.
iv.
As regards borrowal accounts, only term loans shall be
sanctioned. The aggregate amount of term loans sanctioned shall not exceed
rupees sixty thousand in a year.
v.
Accounts, both deposit and borrowal, opened using OTP
based e-KYC shall not be allowed for more than one year within which Customer
Due Diligence (CDD) procedure as provided in section 16 or as per the first
proviso of Section 17 of the Principal Direction is to be completed. If the CDD
procedure is not completed within a year, in respect of deposit accounts, the
same shall be closed immediately. In respect of borrowal accounts no further
debits shall be allowed.
vi.
A declaration shall be obtained from the customer to
the effect that no other account has been opened nor will be opened using OTP
based KYC either with the same RE or with any other RE. Further, while
uploading KYC information to CKYCR, REs shall clearly indicate that such
accounts are opened using OTP based e-KYC and other REs shall not open accounts
based on the KYC information of accounts opened with OTP based e-KYC procedure.
vii.
REs shall have strict monitoring procedures including
systems to generate alerts in case of any non-compliance/violation, to ensure
compliance with the above mentioned conditions.
Govt notification dated April 22, 2022 included Bajaj
Finance, Shriram City Union Finance, Shriram Transport Finance, Tata Capital
Housing Finance, and Tata Financial Services among these 38 non-banking finance
companies and payment providers permitted by the government for Aadhaar
Authentication License - KYC User Agency (KUA) License or sub-KUA License.
On Section
11A of the PMLA:
Under the PMLA,
reporting entities are required to submit reports on
cash transactions, counterfeit currency, non-profit organisations, suspicious
transactions etc. The Ministry has allowed the 22 entities to verify clients by
performing Aadhaar authentication under the Aadhaar Act for purposes outlined
under section 11A of the PMLA,
which allows for reporting entities (that are banking companies) to use Aadhaar
for establishing the identity of clients under clause (a).
Section 11A also
provisions the Indian government to permit non-banking reporting entities to
perform authentication under clause (a), provided they satisfy requirements
under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits
and Services) Act, 2016 (18 of 2016), and that the UIDAI must be consulted
before any notification is issued regarding this.
But, Section 11A
specifies that if Aadhaar is being used for verification, entities must also
allow clients the choice to opt for an offline verification using Aadhaar or use
passport or any other official document as an identity proof. Further, the
choice to submit Aadhaar must be voluntary, and entities cannot deny services
on account of non-submission of Aadhaar.
Interestingly, according to a circular dated May 9, 2019, the Finance ministry laid out a procedure for processing applications by non-banking entities requesting for carrying out Aadhaar authentication for clients under Section 11A.
The move to widen the scope of Aadhaar authentication, incentivises the use of Aadhaar for purposes, which remain vague in all official notifications and may not necessarily qualify as government services or benefits.
In 2023, the Ministry of Electronics and IT (MeitY) proposed expanding Aadhaar authentication to include a broader range of private entities for various services, aiming to enhance digital identity use beyond government departments. This move is part of broader reforms to strengthen the Prevention of Money Laundering Act (PMLA) and address potential loopholes ahead of an upcoming evaluation by the Financial Action Task Force (FATF), the global watchdog for money laundering and terrorist financing, reports The Indian Express.
The proposal aligned with Section 11A of the
PMLA, which permits identity verification by reporting entities. E-KYC using
OTP-based Aadhaar authentication allows entities to offer limited services,
with an annual renewal requirement and a cap of Rs 60,000 on term loans.
Previously, in 2019, the Aadhaar Act was amended
to restrict authentication for KYC purposes to banking and telecom sectors,
following a 2018 Supreme Court ruling that deemed Section 57 of the Aadhaar Act
“unconstitutional”. This provision had allowed private companies to use Aadhaar
data, a practice challenged in court.
It was under this provision that private
companies like Paytm and Airtel Payments Bank sought Aadhaar details from
customers prior to the landmark judgement. Even the subsequent 2019 amendment
was challenged in the Supreme Court.
According to amendments proposed to the Aadhaar
Authentication for Good Governance (Social Welfare, Innovation, Knowledge)
Rules, 2020 by the IT Ministry, private entities and state governments would be
allowed to conduct Aadhaar-based authentication for promoting “ease of living”of residents and enabling better access to services for them, among other
things.
Happy Reading,
Those who read this also read:
Comments
Post a Comment