According to a notification issued by RBI, the REs, including banks and non-banking finance companies (NBFCs) among others, are required to capture a clear image of permanent account number (PAN) card displayed by the customer during the process, except in cases where the customer has e-PAN. The REs need to verify the PAN details from the issuing authority, the central bank says.
Due to the amendments in Prevention of Money-laundering (Maintenance of Records) Rules, “digital KYC has been defined in Section 3 as capturing live photo of the customer and officially valid document or the proof of possession of Aadhaar, where offline verification cannot be carried out, along with the latitude and longitude of the location where such live photo is being taken by an authorised officer of the RE as per the provisions contained in the Act.”
Further, to make sure that the customer was present in India during the V-CIP process, RBI has asked REs to capture live location or geotagging.
RBI, however specified that it would be responsibility of banks and other lenders regulated by it, to make sure that the photo of the customer in her Aadhaar or PAN marches with the video and identification details matches with details provided by the customer.
Most importantly, the notification from RBI makes it easy for customers who have address different from what is mentioned on her Aadhaar given to the RE. “Where a customer has provided her Aadhaar number for identification and wants to provide a current address, different from the address as per the identity information available in the Central Identities Data Repository (CIDR), she may give a self-declaration to that effect to the regulated entity,” RBI says.
Banking correspondents (BCs) are also allowed to help banks in V-CIP process, however the ultimate responsibility for customer due diligence would be with the bank. RBI says, “BCs can facilitate the process only at the customer end and, the official at the other end of V-CIP interaction should necessarily be a bank official. Banks shall maintain the details of the BC assisting the customer, where services of BCs are utilised.”
The central bank has asked RE to ensure that the process is a seamless, real-time, secured, end-to-end encrypted audio-visual interaction with the customer and the quality of the communication is adequate to allow identification of the customer beyond doubt. RE shall carry out the liveliness check in order to guard against spoofing and such other fraudulent manipulations.
To ensure security, robustness and end to end encryption, the REs are mandated to carry out software and security audit and validation of the V-CIP application before rolling it out.
RBI specifies that the audio-visual interaction should be triggered from the domain of the RE itself, and not from third party service provider, if any. “The V-CIP process shall be operated by officials specifically trained for this purpose. The activity log along with the credentials of the official performing the V-CIP shall be preserved. REs shall ensure that the video recording is stored in a safe and secure manner and bears the date and time stamp,” it added.
The central bank says, REs can take assistance of latest available technology, including artificial intelligence (AI) and face matching technologies, to ensure the integrity of the process as well as the information furnished by the customer. However, it says, the responsibility of customer identification would rest with the RE.