In search of e-KYC 2.0: Aadhaar’s identity crisis10 min read . Updated: 31 Dec 2018, 07:53 AM IST
SC's ban on the use of Aadhaar by private firms has led to intense lobbying for alternatives. What shape will the solution take?
SC's ban on the use of Aadhaar by private firms has led to intense lobbying for alternatives. What shape will the solution take?
New Delhi: The weekend of 13 October was probably the longest weekend in Mr. A’s life. He was not able to sleep or focus on anything. His life had come to a standstill. The moment he was dreading had finally arrived. On 12 October (late Friday), the Unique Identification Authority of India (UIDAI) had issued a circular to entities operating in the e-payments space to completely halt the use of Aadhaar e-KYC (electronic-know your customer).
Mr. A, the founder of an e-wallet company, who was not able to get clarity from regulators on the usage of Aadhaar post the Supreme Court’s verdict, finally got clarity from the circular. But the scramble had only just begun. Life in a world without e-KYC had to be figured out, at least for the time being. But the senior executive team of the e-wallet firm was to get together only on 14 October (Monday) to hash out a way forward.
Three weeks earlier, like most people in the country, Mr. A was glued to his television set from 10.30am, switching from one news channel to other. It was unlike him to be watching TV in the office that early on a weekday, but the day was momentous.
It was 26 September—the day the Supreme Court weighed in on the fate of the Aadhaar unique identity project. Mr. A recounts how anxious he had become as he waited for the court verdict. “What happens if Aadhaar-based customer acquisition is banned? What happens to my business model? What happens to all these years of efforts?" were some of the thoughts that crossed his mind. And then, around 12.30pm, the Constitution bench’s verdict was finally out.
While affirming the constitutional validity of Aadhaar, the apex court had said Aadhaar can only be used for welfare schemes and for delivering state subsidies. It had barred private companies from using Aadhaar data for authenticating customers. Also, in order to address privacy concerns, the court said it was not mandatory to link Aadhaar with bank accounts or mobile phone numbers.
For Mr. A and his team, making sense of the 1,448-page judgment itself took time. They brainstormed about the many possible interpretations of the judgment for more than five days, trying to somehow figure out a way to save the business from collapsing. He also did not know when exactly to stop customer verification through the Aadhaar-based mechanism. “The judgment was not 100% clear on whether it had to be stopped on the same day," he said.
While the Reserve Bank of India (RBI) had updated its KYC guidelines in April 2018, all eyes had been on the Supreme Court. In the meantime though, e-wallet firms had already gone ahead with customer verification models based on Aadhaar. It was just cheaper and far more convenient. But on 14 October, in the internal meeting at Mr.A’s company, the top management decided to completely roll back Aadhaar-based customer verification until further clarity came from the regulators. It was a sudden and unexpected speed bump in the path of India’s booming fintech industry.
Impact on industry
Like Mr. A, most fintech companies, telecom operators and payment banks had built their business models based on the unique biometric number in order to deliver services in a paperless, cashless and presence-less manner.
“All the pillars of financial inclusion have been impacted with the restricted use of Aadhaar," said Suresh Sethi, managing director and chief executive officer (CEO), India Post Payments Bank (IPPB). “It was being used for not only banking and account opening, but other efficiencies were getting introduced—like the whole concept of instant loans and insurance, and also the ability to invest immediately," he added.
IPPB, which used Aadhaar-based e-KYC to verify customers, has not been able to on-board new customers in the last two months. Only customers seeking direct benefit transfer (DBT) have been able to open accounts through Aadhaar-based e-KYC, said Sethi. “Currently, the account opening per day is 15-20% of what we were doing earlier. The pace of acquisition has slowed down by 75-80%."
Similarly, other payment banks have also confirmed that they have not been able to on-board new customers other than those seeking DBT as they all use Aadhaar-based KYC to verify customers.
IPPB has been incorporated as a public sector company under the Department of Posts with 100% government equity and is governed by the RBI. The bank was launched by Prime Minister Narendra Modi on 1 September to increase access to banking services in rural areas. The postal agents provide doorstep banking and account opening facility using a hand-held device, mobile phone, and a biometric reader.
According to Mr. A, the prepaid payment instruments (PPI) industry caters to around 250 million customers annually and the average cost of doing a physical KYC for each customer is around ₹ 100. The total cost of verifying these customers physically would be around ₹ 2,500 crore to the industry.
Even if other forms of identification were listed during customer verification, most customers would voluntarily opt for Aadhaar and this was also easier for us as the customer would be verified on a real-time basis, said Harshil Mathur, CEO and co-founder of Razorpay Software Pvt. Ltd, an online payment solutions company.
Since Aadhaar-based verification is not possible anymore, around 30-40% additional customers have to be physically verified which has significantly ramped up the operational costs for the company.
If the e-KYC suspension was not the only cause of worry for the fintech industry, e-sign based e-mandates used for automated collection of loan payments was also suspended in November by the National Payments Corporation of India (NPCI), the umbrella organization for all retail payments in the country. It resulted in even higher operational costs for digital lenders.
According to a circular issued on 23 November by NPCI to banks, the e-sign based e-mandate product has been suspended with effect from 26 November in compliance with the judgment of the Supreme Court.
“A lot of mutual funds and digital lending companies which were moving from physical mandates to Aadhaar-based mandates had to go back to physical mandates which is expensive and inefficient," said Mathur of Razorpay. “For customers too, this is very inefficient. Instead of auto debit every month, customers will have to come and make payments now."
Some of the fintech firms are now using net banking-based mandate, which is currently live with only five banks. NPCI has plans to launch a debit card-based eNACH which might offer some respite for these companies. A recent report by Omidyar and the Boston Consulting Group said that digital lending to micro, small and medium enterprises in the country is projected to increase between 10-15 times by 2023 to ₹ 6-7 trillion.
The Aadhaar judgment has been lauded as a pro-consumer move by most critics of the project. It has definitely eased the lives of the common people who would get calls and emails from banks, insurance companies, lending companies and telecom operators to update their Aadhaar details. Before 26 September, Aadhaar was mandatory for almost everything including school and hospital admissions. With the Supreme Court doing away with the mandatory linking of Aadhaar, most consumers that Mint spoke with feel that they have finally gotten a chance to decide for themselves and use Aadhaar voluntarily.
Anirudh Sharma, a 32-year-old mechanical engineer recounts how he would get notifications from Paytm every day in July to complete his full KYC. “I was not able to send money to my friends and family in their Paytm wallets. So, the only option left was to get my full KYC done," he said. However, when the Paytm executive came to his doorstep to do his full KYC, he was told that only Aadhaar-based KYC would be possible. The executive was carrying a biometric reader and a mobile phone to complete the process. Despite the quick and easy verification experience, Sharma said, “I should be the one choosing which identity proof I want to give or not give."
Similarly, Seema Vashisht, a 46-year-old designer, who runs her own fashion store, said she got her Reliance Jio SIM card a few months ago through Aadhaar e-KYC. She too never got an option to exercise her choice while submitting identity proof documents. “After getting a mobile phone number based on my Aadhaar number, how can they ask me to link my mobile phone to Aadhaar? Isn’t it a two-way process? Why does it involve one process after another?" she said.
In the absence of a digital fix, which bypasses the bar on e-KYC, the offline process for acquiring a new phone number could take between 24 to 36 hours. In this nebulous sweet spot between convenience and privacy rights, the future of Aadhaar’s use by the private sector will be decided. Some experts say the top court judgment requires the use of Aadhaar to be purpose-limited, legally-backed and privacy-protected. They say there may still not be a problem if a person volunteers to give his or her Aadhaar card as proof of identity.
According to a 27-year-old civil services aspirant, who did not wish to be named, every state and the central government entrance exam still lists Aadhaar as the first option among the many documents admissible as a form of identity proof. “Before the judgment, Aadhaar would be marked compulsory, but now only the word ‘compulsory’ has been removed. The rest is the same. Aadhaar still is the topmost option in the list of documents and while verification, the examiners also emphasize on Aadhaar for establishing identity when I go to take the test."
Sethi of IPPB said the bank is actively in talks with the regulators to get an alternative KYC process in place. “We have made various representations to the government and we have very clearly heard from the government that they are working towards finding a way which involves voluntary usage of Aadhaar e-KYC."
UIDAI has recently introduced an XML-based protocol, which they have shared with RBI, he said. “RBI is reviewing it to see if it can be a surrogate, paperless process. It basically means that you get on to a portal and you get your Aadhaar data downloaded in the form of an XML file and that file will have all the information needed for opening an account."
However, the proposed process will depend on the accessibility to the internet. “Under the new mechanism, a customer will have to go to the bank or kiosk to get the sourced data, which is going to be a bit of a barrier, especially for the segments we are targeting. If we expect them to download and create this file, or go to an enrolment centre and get the file, there are going to be barriers," Sethi said.
Mr. A said he has also approached the Payments Council of India (PCI), the industry body for prepaid payments, for exploring all the possible options to be able to conduct his business—including video-based KYC and artificial intelligence (AI)-based solutions.
The AI-based application being considered will help customers send their identity proof over the web, enabling their facial images to be captured by the app from different angles to ensure liveliness. (Liveness is the ability to check whether it is a photograph before the camera or an actual human being). The use of ‘offline Aadhaar’, which relies on QR (quick response) code instead of biometric e-KYC for customer verification, is also being considered by the central bank, said a person familiar with the development.
But despite the many rounds of meetings and consultations, no clear path forward is yet in place.
The way forward
On 17 December, the government for the first time laid out its cards in the open, with the Union cabinet giving a go-ahead to amend existing laws in order to give legal backing to the voluntary use of Aadhaar. But the regulatory space will continue to be a muddle for quite some time. Any changes in legislation would require parliamentary approval and with a general election in sight, the time available for piloting any amendments through parliament is rather limited. The related big-ticket item of a personal data protection law is also pending.
The Congress, on its part, strongly opposes the use of the biometric ID by private entities. Thus, what’s in store seems to be months of uncertainty and impasse.
The prevailing state of affairs has pushed some industry voices to question the logic of a government-mandated standard to begin with. “What if multiple solutions were encouraged originally?" asked Ashish Aggarwal, senior director and head of public policy at Nasscom. Instead of getting into how exactly private companies verify their customers, the regulators should just focus on common standards, interoperability, and portability. The market can come up with ideal solutions to solve issues of operational nitty-gritty, Aggarwal said.
Caught up in these larger debates are ordinary people like Mr. A and millions of India’s fintech users. Their wait continues as the country’s e-wallet boom looks to push past the e-KYC hiccup.