Aadhaar eKYC Integration: Who Can Use It and How It Works
The ways to verify identity with Aadhaar: online authentication and eKYC, offline verification, DigiLocker and the Aadhaar app. Who is permitted, and the storage rules.
Aadhaar is the fastest way to verify identity in India, and the most misunderstood legally. After the Supreme Court's 2018 judgment, private companies could not simply plug into Aadhaar authentication. Since then the law has opened specific, regulated routes. Which one you can use depends on who you are.
The routes
There are several distinct mechanisms, often all loosely called eKYC.
Who can use online authentication and eKYC
Online authentication is available to requesting entities appointed by UIDAI, known as AUAs and KUAs. Eligibility comes from the Aadhaar Act and related laws: government bodies delivering benefits and services, banks, and entities permitted under the money laundering law after their regulator's recommendation. In January 2025 the government amended the Aadhaar authentication rules to let other entities, including private ones, apply for authentication for specified public-interest purposes through the concerned ministry or department. Approval is case by case.
If you are not a bank or a specifically permitted entity, your route is offline verification or DigiLocker.
Offline verification and OVSEs
Offline verification is open to a wider set of organisations because UIDAI's database is not queried and the holder controls what is shared. UIDAI's regulations, amended in December 2025, provide for registration of Offline Verification Seeking Entities for verification through the Aadhaar app and offline eKYC, including an offline face verification option. Any organisation with a lawful purpose can apply. Verification using a physical or electronic copy or the QR code on it does not need that registration.
Becoming an AUA or KUA
For those eligible, the process is formal.
Storage and security rules
Rules on handling Aadhaar data are strict, and apply even where verification was lawful.
Choosing a route
Banks and permitted financial entities use OTP eKYC for instant onboarding, with video KYC to complete full KYC. NBFCs, fintechs and most other businesses use DigiLocker or offline verification. Businesses that only need to confirm identity at a counter or gate can verify the secure QR code. In every case, Aadhaar cannot be made the only option where the law does not require it: offer alternatives.
This article explains what to build, not legal advice. Rules change; confirm against the current official text before relying on it.
