Compliance & Regulation

Video KYC Under RBI Rules: What a V-CIP System Must Do

RBI's Video-based Customer Identification Process explained as product requirements: live officials, geotagging, liveness, PAN and Aadhaar checks, recording, audit and infrastructure.

Purushottam Kumar Suman
Purushottam Kumar Suman
Founder & CEO, Drema AI
8 min read
Video call on a laptop

RBI allowed video KYC in January 2020 and tightened the rules in May 2021. A completed Video-based Customer Identification Process, or V-CIP, is treated as equal to face-to-face verification, which is why banks and NBFCs use it to open full-KYC accounts without a branch visit. The rules are detailed, and most of them are software requirements.

01

What V-CIP is, and who can use it

V-CIP is a live, consent-based, audio-visual interaction between a customer and an authorised official of a regulated entity, used to identify the customer and verify their documents. It is available to RBI-regulated entities: banks, NBFCs, payment system operators and others covered by the KYC directions. A fintech uses it through, and under the responsibility of, its regulated partner. It can be used for onboarding new customers, converting accounts opened with Aadhaar OTP eKYC to full KYC, and periodic updating of KYC.

02

The interaction itself

The call is not a selfie upload. It has to be live and conducted by a trained official.

Live officialConducted only by officials of the regulated entity, specifically trained for the purpose
ConsentInformed consent recorded at the start
Liveness and spoof checksConfirm a live person and detect manipulated video
Varied questionsThe sequence and type of questions changed to establish the interaction is real-time and not pre-recorded
GeotaggingLive location captured to confirm the customer is physically in India
Interrupted callsIf the call drops, start a fresh session
Face matchThe customer's face matched with the photograph on the identity document
03

Documents and verification

Identity is established using one of the permitted Aadhaar-based methods or other officially valid documents, plus PAN.

AadhaarOTP-based eKYC where the entity is permitted, offline verification, or documents issued through DigiLocker
FreshnessAadhaar XML or secure QR used for offline verification must not be older than three working days
PANA clear image of the PAN card captured during the call unless an e-PAN is provided, and verified against the issuing authority's database
Address checkIf the current address differs from the document, capture it as the rules require
Economic and financial profileCaptured from the customer during the process where required
04

Recording, audit and activation

The entire interaction is recorded and stored safely with a date and time stamp, in a way that makes the record easy to retrieve. The account is not activated on the agent's word alone: accounts opened through V-CIP become operational only after a concurrent audit of the process.

The agent verifies the customer. The auditor verifies the agent. Both steps need a screen in the system.

05

Infrastructure requirements

The directions set conditions on where and how the technology runs. This is where many off-the-shelf video tools fall short.

HostingTechnology infrastructure housed in the regulated entity's own premises, with the V-CIP connection originating from its secured network; cloud is permitted if data ownership stays with the entity and data is brought back to its systems
EncryptionEnd-to-end encryption of the video session and data
Data in IndiaVideo recordings and data stored in systems located in India
BlockingDetect IP spoofing and block connections from outside India
Security testingVulnerability assessment, penetration testing and security audit by CERT-In empanelled auditors before go-live and periodically
OutsourcingTechnology may be sourced from a vendor, but responsibility stays with the regulated entity
06

What to build

A workable V-CIP product has four parts: a customer journey on mobile web or app, an agent console, an auditor console and an admin layer.

Slot booking and queueingNetwork and device pre-checksAgent console with checklistOCR for PANFace match scoreLiveness detectionGeolocation and IP checksRecording and storageAuditor review queueTamper-evident audit logRegional language agents
07

Designing for completion

Most failed sessions fail for ordinary reasons: poor network, bad lighting, a missing PAN card or a long wait for an agent. Run pre-checks before the customer joins the queue, tell them what to keep ready, offer call-back slots and support regional languages. Note that RBI has since reorganised its KYC rules into consolidated directions; check the current text for exact wording.

Live
A trained official, not a recorded selfie
3 working days
Maximum age of Aadhaar XML or QR
Audit first
Concurrent audit before the account goes live
Sources · last reviewed October 1, 2026

This article explains what to build, not legal advice. Rules change; confirm against the current official text before relying on it.

Purushottam Kumar Suman
Written by
Purushottam Kumar Suman
Founder & CEO, Drema AI

Founder and CEO of Drema AI. Builds AI systems, SaaS platforms and industry software — and writes about what actually survives production.

CTA Background

Got a problem like this one?

Bring it to a call with a founder.You will get a straight answer, including when the answer is no.

View Our Work
AI-First Engineering
Secure & Scalable
Built to Deliver Impact