Video KYC Integration: Build for RBI V-CIP in India
AI Summary: Video KYC integration in India requires an orchestration layer that chooses the appropriate onboarding route for each regulated product. CKYCR, KRA, DigiLocker, offline Aadhaar and V-CIP serve different functions and are not interchangeable permissions. Consent, routing, live-session controls, evidence retention and exception handling must be designed with the responsible regulated entity. |
Most Indian fintechs do not need "another KYC screen". They need an orchestration layer that decides, for each customer and product, whether to reuse a Central KYC Records Registry (CKYCR) record, pull from a KYC Registration Agency (KRA), accept DigiLocker or offline Aadhaar artefacts, or run a live Video-based Customer Identification Process (V-CIP) that stands up to an audit. Getting that routing wrong creates either drop-offs or exam findings.
This guide is for teams building that stack for a regulated entity (RE) — a bank, NBFC, payment player, securities intermediary or other RE under the applicable KYC framework. It is intentionally different from our earlier posts on unified KYC and CKYC, Aadhaar–PAN–DigiLocker lending flows, digital KYC benefits and KYC plus bureau checks in an LMS. Those cover registry concepts, lending onboarding patterns and product benefits. Here we focus on the reusable platform: modes, V-CIP controls, APIs and compliance features. For licences across products, see the Fintech Licensing Requirements 2026 guide.
Video KYC integration: What an eKYC / Video KYC stack is (and is not)
The stack is a decisioning and evidence system. It collects consent, chooses an identification mode allowed for your RE type and risk, captures or fetches identity data, runs matching and liveness where required, stores artefacts with retention rules, and emits a KYC status other systems can trust.
It is not:
A marketing claim that "KYC is instant for everyone"
A way to bypass Aadhaar restrictions by scraping or storing Aadhaar numbers unlawfully
A substitute for the RE's board-approved KYC policy and MLRO/compliance ownership
UIDAI Aadhaar e-KYC and offline verification are available only through permitted routes. Design for AUA/KUA, DigiLocker, offline XML/QR or other allowed channels — do not invent a private Aadhaar API.
Regulatory map
RBI KYC Master Direction and V-CIP
For RBI-regulated entities, the starting point is the Master Direction – Know Your Customer (KYC) Direction, 2016. V-CIP is recognised as a customer identification process that can be treated on a par with face-to-face CIP when the Direction's conditions are met. In product terms, expect requirements along these lines (always confirm the current consolidated text):
Live, consent-based video interaction with a trained official of the RE (or as the Direction permits)
End-to-end security of the video session, with controls such as encryption and location/IP related checks as specified
Liveness / spoof detection and face match to the ID artefact
Geotagging and reliable date-time stamping of the interaction
Use of permitted identity artefacts (for example Aadhaar OTP e-KYC where allowed, offline Aadhaar verification, CKYCR records or equivalent e-documents as provided in the Direction)
Recording retention and concurrent audit before the account relationship is fully activated
Treat every numeric threshold in circulars (artefact freshness, session rules) as policy configuration that compliance updates — not hard-coded magic numbers in multiple services.
CKYCR (CERSAI)
The Central KYC Records Registry lets REs upload KYC records and, with customer consent, download existing ones so customers are not re-KYC'd from scratch every time. Your stack needs search, download, uplift/update and upload workflows, plus clear handling when the registry returns no hit or a partial match. Operating instructions and API onboarding are published through CKYCRR/CERSAI channels; wire to the current CKYCRR interfaces your RE is onboarded for.
KRA (securities intermediaries)
SEBI-registered intermediaries use KYC Registration Agencies to upload and fetch KYC. KRAs also have obligations toward CKYCRR under SEBI directions (see, for example, SEBI's materials on uploading of KYC information by KRAs to CKYCRR). If you serve brokers, advisers or other intermediaries, KRA status often gates trading or activation even when a CKYC record exists. Model KRA and CKYC as parallel tracks with explicit product rules, not as one interchangeable flag.
Own vs partner
Route | Who is the RE | What you operate | Best for | Trade-offs |
In-house stack | Your licensed entity | Full orchestration, V-CIP agents, storage, audits | Large REs wanting control | Hiring trained agents; concurrent audit ops |
Vendor components behind your orchestration | Your licensed entity | You own routing and evidence; vendors supply video, OCR, liveness, CKYC connectivity | Most fintechs | Vendor diligence and exit plans; RE remains accountable |
Pure outbound to a partner's KYC | Partner RE onboards customers | Thin UI only | Limited use cases | Weak product control; still need contractual clarity on whose KYC it is |
Outsourcing technology does not outsource RE accountability. Your programme agreement and architecture should show how the RE controls policy, agents (where required), audit and data access.
Identification modes compared
Mode | Typical use | Strengths | Watch-outs |
CKYCR download | Customer already has identifier | Fast reuse with consent | Stale data; uplift rules; match failures |
KRA fetch | Securities intermediary journeys | Market standard for intermediaries | Does not replace product-specific checks |
DigiLocker / offline Aadhaar artefacts | Where allowed for your RE | Strong document evidence | Validity windows; parse and verify carefully |
Aadhaar OTP e-KYC | Only via permitted AUA/KUA routes | High assurance when allowed | Access restrictions; purpose limitation |
V-CIP | New-to-registry or high-assurance path | Face-to-face equivalent when MD conditions met | Agent capacity, recording storage, concurrent audit latency |
Offline / biometric / branch | Exceptions, failures, high risk | Fallback completeness | Cost and conversion |
Orchestration design
Encode a transparent decision tree:
Capture purpose, product, RE policy version and customer consent
PAN (and other identifiers as required) → dedupe against your own customers
Attempt CKYCR search/download where your entity type participates
For securities flows, attempt KRA fetch/upload path in parallel or sequence per compliance design
If registry hit and risk allows, uplift missing fields and complete CDD
Else collect DigiLocker / offline artefacts as permitted
Else queue V-CIP with slotting, agent assignment and pre-checks
Only flip kyc_status=active when policy gates pass (including concurrent audit for V-CIP where required)
Upload/update CKYCR/KRA as mandated after account-based relationship
Every branch should write a reason code. Support and auditors will ask why a customer was sent to video.
V-CIP controls as software requirements
Control theme | Product behaviour |
Trained official | Agent roster, training attestation dates, shift assignment, random question banks |
Live session security | RE-controlled or approved apps, encrypted media, session tokens, abuse detection |
Location and time | Capture geo and trusted timestamps; block or flag sessions outside policy |
Liveness and face match | Vendor scores + RE thresholds; store model/version used |
ID artefact binding | Link session to PAN/Aadhaar offline file/CKYC id; reject mismatches |
Recording and retention | Immutable object store, legal hold, retrieval for audit within SLA |
Concurrent audit | Second-person review queue; account activation blocked until pass/fail |
Consent and scripts | Versioned scripts; customer consent artefacts stored with the case |
If activation can happen before concurrent audit completes, you are not building V-CIP — you are building a video chat with KYC branding.
Reference architecture
Layer | Components | Notes |
Channels | Mobile/web SDK, agent desktop, auditor console | Separate agent and auditor roles |
Orchestration | Rules engine, case state machine, retry/compensating flows | Policy-as-data |
Registry connectors | CKYCR, KRA adapters | Idempotent upload/download |
Document and DigiLocker | Fetch, verify, parse, hash | Store hashes and permitted artefacts per policy |
V-CIP | Signalling, recording, liveness, face match, agent tools | Horizontal scale agents independently |
Case vault | Encrypted artefacts, audit log, retention jobs | Key management owned by RE |
Downstream | Core banking / LMS / broking / wallet activation APIs | Emit only final KYC events |
Monitoring | Funnel metrics, agent QA, model drift, vendor SLA | Feed compliance dashboards |
Key APIs and integrations
CKYCR search, download, upload and update
KRA upload/download (securities)
PAN verification services used by your RE
DigiLocker pull for issued documents
Permitted Aadhaar e-KYC or offline verification channels
Liveness, face match and OCR vendors
Video infrastructure (TURN/SFU as needed) with recording pipeline
e-sign for additional forms where product requires
Ticket/QA tools for concurrent auditors
Event bus to loan, payments or investment systems (see also our LMS KYC and bureau guide when lending is the consumer)
Compliance features to build
Purpose limitation and consent ledger per data source
Policy version stamped on every decision
Dual control for overriding fail decisions
Agent and auditor identity tied to each V-CIP case
Redaction tools for screenshots and downloads
Retention and deletion aligned with KYC MD and DPDP obligations as applicable
Vendor inventory with diligence artefacts for exams
Complaint and dispute workflow when customers contest identity matches
For why digital KYC still needs process design, not only APIs, see top benefits of digital KYC for onboarding. For CKYC conceptual background, see decoding unified KYC / CKYC.
Cost and timeline drivers
Driver | Why it matters |
RE type | Bank, NBFC, PA/PPI and securities intermediaries have different registry and mode mixes |
V-CIP volume | Agent hiring, training and concurrent audit capacity dominate operating cost |
Registry onboarding | CKYCR and KRA credentials and certification take calendar time |
Vendor count | Each liveness/OCR/video vendor adds diligence and fail-over design |
Evidence model | Cheap capture with weak vault design fails the first audit |
Multi-product reuse | One orchestration service shared by lending and payments pays off; copy-paste flows do not |
We do not publish generic rupee quotes; scope against your modes and peak V-CIP concurrency instead.
Build plan
Write the KYC policy matrix by product and risk with compliance
Onboard CKYCR/KRA (as applicable) in parallel with UI
Ship registry-first flows before V-CIP to learn data quality
Add V-CIP with activation hard-gated on concurrent audit
Run an exam-style sample of cases end-to-end
Only then market "minutes to KYC" — with honest fallbacks
FAQs
Is V-CIP mandatory for every customer?
No. It is one permitted identification process under the RBI KYC Master Direction when its conditions are met. Many customers can be completed via CKYCR or other allowed modes. Policy and risk decide the path.
Can a fintech without an RE licence offer video KYC as a product?
You can offer technology to REs. The regulated entity remains responsible for CDD. Marketing that implies you independently "KYC" customers for regulated accounts without an RE in the loop creates regulatory risk.
How is this different from DigiLocker-based lending onboarding?
DigiLocker and Aadhaar–PAN flows are modes inside the stack. This guide covers the orchestration layer that also includes V-CIP, CKYC and KRA. For a lending-shaped walkthrough of Aadhaar–PAN–DigiLocker, see our Paysense-style KYC flows guide.
Do securities clients need both KRA and CKYC?
Often yes in practice: intermediaries use KRA processes, and SEBI has directed KRAs regarding CKYCRR uploads. Build explicit states for both rather than assuming one identifier unlocks every product.
What usually delays go-live?
Registry onboarding, agent training for V-CIP, concurrent audit staffing and getting retention/retrieval working under production identity stores.
Should bureau checks live in this stack?
Keep identity KYC separate from credit bureau pulls, then compose them in the loan or account opener. Our LMS KYC and bureau guide covers that composition.
Build your eKYC / Video KYC stack with Fintegration
Fintegration builds KYC orchestration for Indian REs: CKYC and KRA connectors, DigiLocker and offline artefact flows, V-CIP agent and auditor tooling, and activation gates that survive compliance review. Talk to our team to scope your video KYC and eKYC stack.
