Digital Identity & KYC - Detailed Explanation With Case Laws

This is the complete framework - India focus with global reference, because KYC now lives under PMLA 2002 + RBI Master Direction + UIDAI + DPDP Act 2023.

1. Definitions

Digital Identity: Electronic representation of a person's identity attributes that can be verified remotely. It has 3 levels under eIDAS and under Indian IT Act:

• Identification: Who you claim to be - Name, DOB, address
• Authentication: Proof you are that person - OTP, biometric, DSC
• Authorization: What you can do - KYC cleared for bank account, trading

KYC - Know Your Customer: Process of verifying identity before establishing business relationship. Digital KYC / eKYC is same process done without physical presence using legally valid electronic documents.

2. Types of KYC in India 2026

A. Traditional KYC:
Physical document + In-person verification. Still required for high-risk.

B. Aadhaar-based eKYC - Regulated by UIDAI:

• OTP-based eKYC: Name, address, gender, DOB from UIDAI with user OTP consent. Limit: Rs. 10,000 per month transaction for non-face-to-face as per RBI.
• Biometric eKYC: Fingerprint/IRIS at BC point.

C. Offline eKYC - XML / QR:
User downloads Aadhaar XML with reference number, shares with bank without revealing Aadhaar number. Introduced after Supreme Court Aadhaar judgment to protect privacy.

D. CKYC - Central KYC Registry (CERSAI):
Under PMLA Rule 9, one-time KYC record with 14-digit CKYC number. Any regulated entity can pull it. Mandatory for financial sector since 2021.

E. Video-based KYC (VKYC):
RBI allowed from January 2020 amendment to Master Direction on KYC. Live video + geotagging + PAN + Officially Valid Document (OVD) verification. Must be done by authorized official of RE.

F. DigiLocker / M-Aadhaar based:
Under IT Act 2000 Section 4 & 5, DigiLocker documents are deemed equivalent to originals.

Officially Valid Documents (OVD) as per RBI: Passport, Voter ID, Driving Licence, NREGA Job Card, National Population Register letter, Proof of Aadhaar.

3. Legal Framework - India

1. Prevention of Money Laundering Act, 2002 (PMLA) - Section 11A & 12: Defines KYC as Client Due Diligence. Any reporting entity must verify identity of client, beneficial owner, source of funds.
2. RBI Master Direction on KYC (Updated Feb 2024): Detailed procedure for REs - Banks, NBFCs, Payment Banks, Fintechs. Defines Risk categories, Periodic updation, Enhanced Due Diligence.
3. IT Act 2000 - Section 3A, 35: Electronic signature and authentication framework for digital identity.
4. Aadhaar Act 2016 + Aadhaar Authentication Regulations: Only way private entities can use Aadhaar is through offline or with Voluntary consent via licensed Authentication User Agency (AUA).
5. Telecom - DoT KYC Instructions: Aadhaar-based eKYC for SIM mandatory after SC order.
6. SEBI KYC Requirements: For demat/trading - uses CKYC + KRA + Video IPV.
7. DPDP Act 2023: New dimension - KYC data is personal data, need explicit consent, purpose limitation, retention.

Fee for KYC: Under CKYC, banks pay Rs. 14-18 per download to CERSAI. Aadhaar Auth - UIDAI charges Rs. 3 per Yes/No auth, Rs. 20 per eKYC, free for govt DBT. End user should NOT be charged for basic KYC as per RBI.

4. Global Framework

EU - eIDAS 2.0 (Regulation EU 2024/1183): Creates EUDI Wallet with PID + Qualified Attestation. KYC becomes wallet-based, user controls disclosure via zero-knowledge proofs.

US: No federal ID, KYC under BSA + Patriot Act, digital identity via NIST 800-63-3 levels.

5. Landmark Case Laws - Indian

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1 - Right to Privacy
Supreme Court declared privacy as fundamental right under Article 21. Set three-part test for Aadhaar: legality, necessity, proportionality. This case is basis for all digital identity jurisprudence.

2. Justice K.S. Puttaswamy v. UOI (2018) 1 SCC 809 - Aadhaar Judgment (5-judge Constitution Bench)
Most important KYC case.

Held:

• Aadhaar mandatory for PAN-ITR linkage and welfare DBT is constitutional
• Section 57 of Aadhaar Act struck down - Private entities (banks, telecom, e-commerce) CANNOT make Aadhaar mandatory for KYC. That is why banks had to stop Aadhaar eKYC in 2018 and later comeback via voluntary consent after 2019 amendment.
• Authentication data cannot be stored beyond 6 months, no meta data profiling.
• This is why we now have Offline XML and CKYC.

3. Anuradha Bhasin v. UOI (2020) - Internet + Identity
Court held indefinite internet suspension invalid, impacts digital KYC accessibility.

4. Paytm Payments Bank Ltd. v. RBI - KYC/AML Penalty Cases (2022-2024)
RBI imposed penalty of Rs. 5.39 Cr in 2023 and barred onboarding in 2024 for failure in KYC, beneficial owner identification, cyber audit. Tribunal upheld that VKYC not properly done, IP addresses outside India, no monitoring. Establishes that fee collected for account opening does not absolve RE from PMLA CDD.

5. RBI v. N.S. Bhatt - CKYC Deficiency Cases
Various High Courts - Bombay HC in Petition No. 324 of 2021 held that once CKYC done by one RE, other RE cannot insist on fresh full KYC unless risk is high. Avoids duplication.

6. Central Bureau of Investigation v. P. Chidambaram & KYC forgery cases
Courts held that using forged OVD for KYC attracts forgery under IPC 467 + PMLA.

7. Anvar P.V. v. P.K. Basheer (2014) & Arjun Panditrao (2020)
Relevance for Digital Identity: For digital KYC documents to be admissible in court, 65B certificate mandatory. VKYC video itself is electronic record.

8. SBI vs Ajay Kumar Sood (2021) - Digital Signature on Judgments
SC mandated DSC for judgments to ensure judicial identity, principle extended to KYC officials must sign digitally.

6. Global Case Laws for KYC Sovereignty

1. Schrems II (C-311/18, CJEU 2020): Invalidated Privacy Shield. Impact: If your KYC vendor stores KYC data on US cloud, it may violate GDPR + DPDP Act unless adequate safeguards.

2. Digital Rights Ireland (C-293/12): Blanket data retention invalid. Applied to KYC retention - you cannot retain KYC data forever.

3. La Quadrature du Net (C-511/18): Requires separation of civil identity data and traffic data - directly used for EUDI Wallet architecture.

4. German Federal Court - VideoIdent Case (BGH, 2021): Held video KYC via third party is valid if end-to-end encrypted and agent is certified.

7. Practical Compliance Checklist 2026

For a company doing KYC:

1. Take explicit consent as per DPDP Act, specify purpose
2. Minimize - don't collect Aadhaar number if offline XML works
3. Do liveness check in VKYC, geotag + timestamp + random questions
4. Store CKYC number, not Aadhaar copy where possible
5. Periodic updation: High risk - 2 years, Medium - 8 years, Low - 10 years as per RBI
6. Audit trail with digital signature of KYC officer

Liability: If RE fails in CDD and fraud happens, RE is liable under PMLA Sec 13 penalty up to Rs. 1 lakh per failure + RBI penalty. Officer can be personally liable for willful violation.