The Infinite KYC Trap: Why India’s Identity Infrastructure Needs Urgent Harmonisation
By Mitul Jhaveri & Aditya Sinha, Jhaveri is a public policy and GovTech professional; Sinha is a New Delhi-based economist
Every autumn, the state develops a suspicion that its pensioners have died, and each must file a certificate of being alive, the continued drawing of the pension being, apparently, insufficient evidence of appetite. Every year, a company director must file a KYC certifying that he is himself, a proposition nobody contests on the other 364 days. The provident fund office will not release a claim unless Aadhaar, PAN, and bank details match to the last character. Descartes needed only cogito ergo sum. The Indian citizen authenticates, therefore he is, and must be again next quarter.
India has built the most ambitious identity infrastructure in the democratic world, and has arranged its institutions so that almost none will accept another’s verification of who a citizen is.
eKYC is a word concealing at least four different activities. First is customer due diligence under the Prevention of Money Laundering Act, 2002, which asks who a customer is and how risky. Second is authentication under the Aadhaar Act, 2016, which asks only whether a person is who she claims to be. Third is the seeding of Aadhaar and bank accounts that routes welfare to the right beneficiary, not identity verification at all but payment plumbing. Fourth is subscriber verification in telecom and sundry portals, where the object is to trust a SIM, not to know a customer. Four tasks, four laws, one name. That is why “doing KYC” once buys the citizen nothing at the next counter.
The rulebook, oddly, is kinder than the counter. The RBI’s Master Direction on KYC, 2016, already permits Aadhaar OTP, offline Aadhaar, video identification, and DigiLocker, and directs that where a KYC Identifier exists in Central KYC Records Registry, the record be fetched and customer not troubled again unless something has changed or lapsed. The humane rule is written. The branch has not read it. Under Sebi’s circular of May 2024, a “validated” record travels across brokers and funds, but only inside the securities market. Your bank knows you well enough to sell you insurance, but not well enough for the insurer to issue the policy without fresh papers, though all four regulators sit on the same registry.
Outside finance, the checks are misdescribed by the very officials enforcing them. The department of telecommunications discontinued Aadhaar eKYC for SIMs in 2018, after Justice KS Puttaswamy v Union of India [(2019) 1 SCC 1)]; the Aadhaar number was struck from the form years ago, yet citizens still believe they are “doing Aadhaar KYC” for a phone. The rural development ministry told Lok Sabha in 2025 that the Aadhaar-based payment system is merely a mode of payment and that MGNREGA work cannot be denied for want of it; at the worksite, it is denied anyway. LPG subsidy can flow to a bank account linked directly to the gas connection, with no Aadhaar; at the showroom, biometrics are demanded regardless.
Why did centralisation not become reuse? The registry, created by notification S.O. 3183(E) of November 26, 2015, holds well over a billion records, one for every financially active adult: a library in which every book is catalogued and none is lent. India centralised storage before it harmonised purpose; each regulator runs its own logic atop the common records, and the RBI itself has been wary of records drawn from them.
Beneath this runs the incentive that defeats the rest. An institution is legally safer collecting the data itself, and re-collection is always permitted where information looks changed or incomplete. A rigid digital flow shuts out the elderly, the disabled, and the mismatched. And a citizen prompted for KYC relentlessly learns to obey exactly the signal the fraudster imitates; the “update your KYC” scam works because the state has rehearsed its victims. The fraudster, it must be said, is the one counterparty who accepts your KYC at the first attempt.
Five changes would fix most of this, and the first two need no new technology. First, amend Rule 9 of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005, to make reliance a duty: where a valid KYC Identifier exists, an entity must onboard from it, recording a specific, risk-based reason for any fresh demand, with a safe harbour for good-faith reliance. Second, supersede the 2015 notification so that bodies outside the money-laundering perimeter — the EPFO, oil marketing companies, food departments — can rely on the registry under strict purpose limitation.
Third, convert the Financial Stability and Development Council’s February 2024 proposal for uniform KYC norms into a binding standard: one data schema, one list of documents, one re-verification clock in place of today’s two-, eight- and 10-year cycles. Fourth, build a federated exchange rather than another central store, issuing purpose-bound tokens carrying only assurance level, date, source, and consent, routed through the consent managers of the Digital Personal Data Protection Rules, 2025. Singapore’s Myinfo and Estonia’s X-Road rest on the once-only principle: reuse proof, not raw data. Fifth, codify, from the Aadhaar (Authentication and Offline Verification) Regulations, 2021, an enforceable right to an alternative rail, so that no entitlement is extinguished by an authentication failure alone.
The colonial default was that an activity is prohibited unless permitted. Its digital descendant is that a citizen is unverified unless re-verified. The presumption against the citizen has survived the very technology built to retire it.
The state has identified its citizens a billion times over. It has not yet learnt to remember them. The pensioner, meanwhile, should keep his certificate handy. Autumn returns every year.
This article was first uploaded on September four, twenty twenty-six, at forty-two minutes past eight in the night.
© The Indian Express (P) Ltd
aniltikotekar4sme.com 