What changed
The definition of V-CIP has been updated to include facial recognition, live consent-based audio-visual interaction, and independent verification with audit trail. V-CIP can now be used for CDD of new individual customers, proprietors, authorised signatories, and beneficial owners of legal entities, as well as for converting OTP-based e-KYC accounts and periodic KYC updation. Accounts opened using OTP-based e-KYC are now restricted to one year unless full identification via Section 16 or V-CIP is completed.
What it means for you
Banks and regulated entities can now onboard customers remotely using V-CIP with the same legal standing as in-person verification, reducing branch footfall and operational costs. The one-year limit on OTP-based e-KYC accounts pushes lenders to upgrade these accounts via V-CIP or face-to-face, ensuring stronger due diligence. Strict tech requirements like geo-tagging, liveness detection, and India-only IP connections raise the bar for IT infrastructure and cybersecurity compliance.
What you must do
- Update internal KYC policies and systems to support V-CIP for all eligible customer types, including legal entities and proprietors.
- Ensure V-CIP infrastructure meets RBI's cybersecurity framework, end-to-end encryption, and geo-tagging requirements.
- Implement face liveness detection and spoof prevention technology, with regular reviews of near-miss fraud cases.
- Set up processes to convert existing OTP-based e-KYC accounts within one year, using V-CIP or Section 16 identification.
- Train staff on the new V-CIP standards and audit trail maintenance for compliance.
Who it affects
All regulated entities (banks, NBFCs, payment banks, etc.), IT and cybersecurity teams of regulated entities, Compliance and KYC operations teams, Customers using OTP-based e-KYC accounts
Can V-CIP be used for all customer types?
Yes, V-CIP is allowed for onboarding individual customers, proprietors of proprietorship firms, authorised signatories, and beneficial owners of legal entities. For proprietorship firms, you must also obtain e-documents for activity proofs.
What happens to accounts opened with OTP-based e-KYC?
Such accounts are restricted to one year unless you complete full identification via Section 16 (face-to-face) or Section 18 (V-CIP). If using Aadhaar under V-CIP, a fresh Aadhaar OTP authentication is required.
What are the key tech requirements for V-CIP?
The V-CIP application must prevent connections from outside India, use end-to-end encryption, record live GPS co-ordinates and date-time stamp, and include face liveness/spoof detection and face matching technology. The infrastructure must be housed in the RE's own premises and comply with RBI's cybersecurity framework.