The start-up culture in India has been in overdrive for the past decade. From only 471 start-ups in 2016, there are now over 99,000 (October 2023) with more than 100 unicorns. This boom is led by the Fintech sector, which is on course to reach a market size of $150 billion by 2025. The sector will have $1 trillion in Assets Under Management (AUM) by the end of this calendar year. Through integrated ecosystems such as Unified Payments Interface (UPI), Immediate Payment Service (IMPS), prepaid payment instruments (PPIs) and the National Electronic Toll Collection (NETC), India clocked over 80 billion digital transactions in FY22 worth $36.5 trillion.
Instances of financial misconduct and improprieties have dampened this promising growth in the sector. The Reserve Bank of India’s (RBI) Annual Report (2021–22) highlights that the volume of frauds using cards and internet banking was 34% higher at 3,596 frauds in FY22. High instances of fraudulent UPI transactions, e-wallet thefts, KYC leakages and loan app scams, among others, have created a trust deficit in the industry. Industry regulators such as the Reserve Bank of India (RBI), the Securities Exchange Board of India (SEBI), and the Insurance Regulatory and Development Authority (IRDAI) have introduced regulations to keep such unscrupulous activities in check. These include the RBI Master Direction – Know Your Customer (KYC) Directions, 2016, SEBI {Know Your Client (KYC) Registration Agency Regulations}, 2011, and IRDAI Master Guidelines on Anti-Money Laundering/Counter Financing of Terrorism(AML/CFT), 2022 among others.
The RBI master directions mandate the adoption of a policy-backed risk-based approach for periodic updation of KYC approved by the board of directors. Companies need to conduct tests of the V-CIP (Video Customer Identification Process) application software before it can be used for the KYC process. Furthermore, a clear flow and standard operating procedures (SOP) must be created to ensure variability in the sequence and types of questions. This will help companies identify pre-recorded interactions and maintain the authenticity of the process.
In addition, the V-CIP software must be capable of denying connection requests from spoofed and outside-of-India IP addresses. The video recordings must have geo-tagging enabled and contain the live coordinates along with the date-time stamp. The application has to be able to detect spoofs and face liveness as well as do face matching. The directions require that the process is to be operated by trained officials.
The KYC process helps verify the authenticity of the transactions and the identity of the person behind them. These guidelines stem from the recommendations of the Financial Action Task Force (FTAF) on Anti-Money Laundering (AML) standards and on Combating Financing of Terrorism (CFT). It allows these institutions to avoid transactions related to corruption, terrorism financing, fraud, and money laundering. As such, the regulators must implement these regulations in both the letter and spirit of the law.
Venture Capital (VC) firms have funded the Fintech sector heavily. In return, they expect high rates of growth. Often, the growth is measured in terms of the volume of client acquisition. As a result, it creates an incentive for faster customer acquisition. To achieve this, the onboarding process needs to be short and quick. Long and time-consuming onboarding processes lead to high ‘drop-off rates’. Drop-offs are users who leave or drop out during the onboarding stage and do not become customers.
In pursuit of faster onboarding, Fintechs have been cutting corners with KYC requirements. Incomplete or partial KYCs allow customers to use their services without comprehensively verifying KYC documents. Businesses are mis-selling, charging high-interest rates, and engaging in unethical practices to recover bad loans. Extensive damage is being done to the Fintech ecosystem because of a few bad apples. Recently, RBI imposed monetary penalties on a popular payment solutions provider, and various financial services companies for violating KYC and anti-money laundering regulations. In her recent budget speech, the Hon’ble Finance Minister stated that the KYC process will be simplified by adopting a ‘risk-based’ instead of a ‘one size fits all’ approach.
Customers are required to provide documentary proof of multiple addresses during KYC- current and permanent residence. A significant section of the population, such as migrant labourers and nomadic and tribal communities, among others, may not have any fixed or permanent address. Even if they have a permanent address, they may not have officially valid documents (OVDs) demonstrating their "current address". The present technological solutions have also proved to be incomplete. Various technological methods have been introduced to enhance efficiency and reduce the cost of KYC. These include using electronic KYC (eKYC) methods and video KYC. However, RBI/SEBI-regulated entities can only accept ID documents authenticated by the DigiLocker e-Sign facility for video KYC. This makes the process unavailable for those without a DigiLocker account, which, in turn, can only be created by Aadhaar holders. In addition, a bank official needs to conduct the video KYC process in real-time, which makes it a resource-intensive process with limited scaling possibilities. The digital divide also adds to the challenges of video KYC.
KYC regulations need to accommodate the requirements of a fast-delivery-of-services-dependent industry. Expanding the scope of the Central KYC Registry (CKYCR), a centralised repository of customer KYC information, can help rationalise the KYC process. As of now, only regulated entities can access the CKYCR of individuals who have a pre-existing relationship with another entity. Providing moderated access to the registry can allow Fintechs to shorten the onboarding process. As the central registry grows with more people completing their KYCs, there will be no need for individual KYCs. Furthermore, Fintechs can be allowed to share and access the KYC data of users who are already using or want to use the financial services of another enterprise. The Digital Personal Data Protection Act, 2023 mandates obtaining consent from individuals for collecting their sensitive personal data. This can be leveraged into the KYC process to speed up the onboarding process.