1. What is Digital KYC Obligation?

Under PMLA, 2002 + RBI Master Direction on KYC 2016 (updated Jan 2024), every Regulated Entity (RE) - Bank, NBFC, Payment Bank, PPI issuer, Co-op Bank, Insurance, Mutual Fund, Stock Broker - must do:

A. Customer Identification - Section 12 of PMLA + Rule 9 of PMLA Rules 2005

You must identify customer and beneficial owner and verify identity using Officially Valid Documents (OVD):
India: Passport, Driving Licence, Proof of possession of Aadhaar, Voter ID, NREGA Job Card, Letter from NPR.

For Digital KYC, RBI permits 4 modes:

1. Aadhaar-based e-KYC (OTP + Biometric): Via UIDAI. OTP-based limited to Rs. 1L for NBFCs, full biometric for banks. Must be voluntary per Supreme Court.
2. Aadhaar Offline e-KYC (XML / QR): Customer downloads XML from UIDAI with hashed Aadhaar, bank verifies signature.
3. Video-based Customer Identification Process (V-CIP): Live video call with geo-tagging, liveness detection, face match, OTP, and recording retention.
4. Central KYC (CKYC) / DigiLocker / Account Aggregator pull: Fetching OVD from CERSAI CKYCR or DigiLocker with customer consent.

B. RBI's Mandatory Conditions for V-CIP - Circular dated 9 Jan 2020, 23 May 2023:

• Must be live, real-time, not recorded video
• Official must be in India, trained, and audit trail maintained
• Face must match OVD photo with AI + manual check
• Location geo-tagging + IP logging
• Video to be stored for 8 years after relationship ends (PMLA record-keeping)
• Liveness detection mandatory
• Random Q&A to prevent deepfake
• Explicit consent for V-CIP

Non-compliance = penalty under Section 35A of Banking Regulation Act.

C. Ongoing Obligations:

1. Customer Due Diligence (CDD): Risk categorization - Low, Medium, High. SDD for low risk, EDD for PEPs, cross-border, complex structures.
2. Beneficial Owner (BO) identification: For companies >10%, Partnership >10%, Trust >10% per RBI 2023 amendment (earlier 25%/15%).
3. Periodic Updation: As per RBI 2024: Low risk every 10 years, Medium 8 years, High 2 years. Can be done via digital channels.
4. Record Keeping: Maintain KYC and transaction data for 5 years after transaction / closure - PMLA Sec 12(3).
5. Reporting to FIU-IND: Suspicious Transaction Report (STR) within 7 days, Cash Transaction Report (CTR), etc.
6. Third-Party Reliance: Can rely on third-party KYC only if third-party is also regulated and consent obtained - but ultimate liability stays with you.

2. SEBI / IRDAI / DOT Parallel Obligations

• SEBI Circular 24 April 2020: Allows Aadhaar e-KYC, DigiLocker, online PAN verification via NSDL, and VCIP for investors. Stock broker must do IPV (In-Person Verification) via VCIP.
• IRDAI: Video KYC allowed for life insurance via circular 2020.
• TRAI/DOT: Aadhaar e-KYC for SIM issuance with Liveness.

3. EU / Spain Context (from your last query)

Under eIDAS 2.0 and AMLR 2024/1624, digital KYC obligation means mandatory acceptance of EUDI Wallet PID + QEAA as valid ID. Banks must accept it by Dec 2027. Similar obligations as India: record retention, STR, but with GDPR Article 6 & 9 restrictions.

4. Case Laws - The Liability Framework

A. INDIA - Aadhaar and Digital KYC Validity

1. Justice K.S. Puttaswamy (Retd.) vs Union of India (2018) 1 SCC 809 - Aadhaar Constitution Bench:
The most important case. SC upheld Aadhaar Act but struck down Section 57 allowing private entities to mandate Aadhaar.
Ratio: Private banks/NBFCs cannot compulsorily use Aadhaar e-KYC. Must be voluntary with alternative OVD. Offline XML and voluntary consent model born from this. Any bank forcing Aadhaar e-KYC violates privacy judgment.
Impact: RBI amended Master Direction to make Aadhaar e-KYC voluntary and allowed V-CIP as alternative.

2. RBI vs Standard Chartered Bank - KYC Penalty Cases (2021-2024):
RBI imposed Rs 2 Cr+ penalties on SBI, ICICI, HDFC, Paytm Payments Bank for:

• Failure to do periodic KYC updation
• Opening accounts via business correspondents without V-CIP compliance
• No geo-tagging / no liveness
  Paytm Payments Bank ban (Jan 31, 2024) is directly a Digital KYC failure case - RBI found persistent KYC-AML non-compliance, reliance on single vendor, no proper BO identification.

3. Anuradha Bhasin vs Union of India style - J&K High Court 2020: J&K Bank vs Shubam Choudhary
Court held that if bank onboards via video and video is not stored or AI match is not done, account opening is void and bank liable for fraud. Stressed V-CIP must meet all 18 steps in RBI Annex.

4. Delhi High Court - PayU vs RBI (W.P. 2022): Upheld that PPI issuers must do full KYC (not minimum KYC) for transactions above Rs.10,000 per month, and digital KYC via DigiLocker is valid but must be encrypted end-to-end.

5. Supreme Court - Lalita vs Union of India on CKYC: Observed that CKYC registry must be made interoperable to avoid repeated KYC - basis for Account Aggregator framework.

B. SPAIN / EU - Digital Identity and Banking Liability

6. Tribunal Supremo de España, STS 12/2023 and STS 102/2024 - Phishing Liability:
If bank onboards customer digitally and later authorizes transaction with only SMS OTP, bank is liable for fraud. If bank used Qualified Electronic Signature (QES) under eIDAS + biometrics, liability shifts to customer for gross negligence. This is pushing banks to adopt EUDI Wallet QES.

7. STS 269/2022 (Spain) on Electronic Signature Validity:
Not all e-signs valid. Loan contract signed with simple click-wrap declared void. Contract signed with FNMT qualified certificate upheld. Principle applied to Digital KYC - verification must meet eIDAS Level High.

8. CJEU C-634/21 - SCHUFA Holding (Germany): Court held that automated credit scoring based on digital KYC data without human review violates GDPR Art 22. Banks using AI for facial match in V-CIP must keep human oversight.

9. US - FinCEN vs Capital One (2020) $80M penalty: Failure of digital CDD and transaction monitoring - classic EDD failure.

5. What Regulators Check in Audit

RBI's Risk Based Supervision (RBS) for Digital KYC looks for:

• Is consent explicit and logged?
• Is OVD from source (UIDAI, CERSAI, DigiLocker) or just uploaded photo?
• Is video tamper-proof? SHA-256 hash?
• Are rejects and fraud attempts reported to FIU?
• Is CKYC number generated and uploaded within 10 days?
• Is BO declaration taken for legal entities?

Failure to meet any = 4 categories of penalty under RBI.

Best Practice Framework for Compliance:

1. Use consent artifact - timestamped, purpose-limited
2. Multi-layer liveness: active + passive
3. Audit trail: store original OVD fetch + face match score + official ID who approved
4. Periodic re-KYC via digital push notification, not branch visit
5. Link with FIU-IND's FINnet for STR automation