DEV Community: BeFisc

UIDAI’s Sub-AUA/Sub-KUA LITE Framework: What the AUA KUA Change Means for Lenders and Fintechs

BeFisc — Mon, 02 Nov 2026 01:54:46 +0000

An AUA (Authentication User Agency) uses UIDAI’s Yes/No Aadhaar authentication, while a KUA (e-KYC User Agency) uses its e-KYC facility. A Sub-AUA or Sub-KUA accesses those services through an existing AUA or KUA. UIDAI’s new LITE framework aims to make that route faster for low-volume entities.

On 29 September 2026, UIDAI announced five initiatives at Aadhaar Samvaad in Kolkata. Most coverage focused on face authentication for ration distribution. For fintechs and lenders, the more consequential item is a lighter Sub-AUA/Sub-KUA onboarding route.

This briefing explains the AUA KUA structure, what UIDAI has said about LITE, what it has not yet said, and what regulated entities should do while the details arrive.

What UIDAI Announced on 29 September 2026

According to the PIB release, UIDAI launched five initiatives:

Face Authentication: Face Authentication for ePDS, built with the Department of Food and Public Distribution and NIC, for consent-based, contactless authentication in the public distribution system.
SWIK Portal 2.0: Allows non-government entities to submit Aadhaar authentication proposals directly to the concerned ministries or departments.
Sub-AUA/Sub-KUA (LITE) Framework: Designed for government and eligible non-government entities with lower authentication volumes.
Token Management System: Introduced for UIDAI's state and regional offices.
Revamped UIDAI Website: Supports 13 languages, with expansion to 23 languages planned.
PIB says the LITE framework lets such entities use “the authentication infrastructure of an existing AUA/KUA, enabling simpler and faster onboarding in real time without establishing any authentication infrastructure.” Minister of State Jitin Prasada and UIDAI CEO Saurabh Vijay spoke at the event.

AUA, KUA, Sub-AUA, Sub-KUA and ASA Explained

The Aadhaar (Authentication and Offline Verification) Regulations, 2021 define the roles precisely:
Authentication Service Agency (ASA): "A licensed entity providing necessary infrastructure for ensuring secure network connectivity and related services." ASAs carry requests between requesting entities and UIDAI's data centre.
AUA (Authentication User Agency): "A requesting entity that uses the Yes/No authentication facility provided by the Authority." The answer is only a match or no match.
KUA (KYC User Agency): "A requesting entity which uses e-KYC authentication facility provided by the Authority." A successful e-KYC returns demographic data and a photograph, with the resident's consent.
Sub-AUA: A requesting entity that uses Yes/No authentication "through an existing AUA".
Sub-KUA: A requesting entity that uses e-KYC "through an existing KUA".
The KUA full form, e-KYC User Agency, explains the difference: a KUA receives identity data, so its obligations on storage and security are heavier.

Two rules matter for Sub-AUAs. Regulation 14 requires an AUA or KUA to obtain UIDAI’s approval before appointing a third party as a Sub-AUA or Sub-KUA. Regulation 15 makes the requesting entity jointly and severally liable with its Sub-AUAs for non-compliance. In February 2025, UIDAI’s Circular 2 of 2025 tightened the Sub-AUA application and joint undertaking, including Aadhaar Data Vault and HSM requirements.

The Good Governance Rules Behind Non-Government Access

On 31 January 2025, MeitY notified the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Amendment Rules, 2025. PIB said the amendment enables “both government and non-government entities to avail Aadhaar authentication service” for public-interest purposes, including e-commerce, travel, tourism, hospitality and health.

The process: the entity applies to the concerned ministry or department, UIDAI examines the application, MeitY approves on UIDAI’s recommendation, and the ministry notifies the entity. SWIK Portal 2.0 is the upgraded front end for that process.

This matters because it widened the pool of non-government entities that can seek Aadhaar authentication at all. The LITE framework addresses the next question: how a low-volume entity can start without building AUA-grade infrastructure.

What the LITE Framework Changes, and What Is Still Unknown

What is known from the PIB release:

Low Authentication Volumes: LITE targets government and "eligible" non-government entities with low authentication volumes.
Shared Infrastructure: It relies on an existing AUA/KUA's infrastructure rather than the entity's own.
Real-Time Onboarding: UIDAI describes the onboarding process as real-time.
What is not yet public, as of 7 October 2026:
Eligibility Criteria: What are the eligibility requirements and the volume threshold that defines "low volume"?
Sub-AUA Codes and Licence Keys: Will LITE entities hold their own Sub-AUA codes and licence keys?
Liability, Audit, and Data-Vault Obligations: How will these responsibilities be divided between the AUA/KUA and the LITE entity?
Regulated Financial Entities: Do regulated financial entities fall within the definition of "eligible" entities?
Fees: What fees will apply to entities using the LITE framework?

There is a precedent. UIDAI’s Circular 03 of 2023 allowed government entities with under 50,000 annual transactions to use their AUA/KUA’s licence keys without a separate Sub-AUA/Sub-KUA code. LITE may extend similar logic, but until UIDAI publishes operating rules, no entity should assume eligibility. Watch UIDAI circulars and the SWIK portal.

Access Routes Compared

Route	Who it suits	Infrastructure needed	Main obligations	Status
Own AUA/KUA	High-volume entities permitted by law	ASA connectivity, HSM, Aadhaar Data Vault, audits	Full UIDAI compliance	Established
Sub-AUA/Sub-KUA	Entities using a partner AUA/KUA	Integration with AUA/KUA; vault and security per joint undertaking	UIDAI approval; joint and several liability	Established, tightened Feb 2025
Sub-AUA/Sub-KUA LITE	Low-volume government and eligible non-government entities	Uses existing AUA/KUA infrastructure	Not yet published	Announced 29 Sep 2026
Offline verification (paperless e-KYC XML, QR code)	Entities verifying without authentication	XML/QR validation, consent capture	Consent and offline verification obligations under the 2021 Regulations	Established

Offline verification is defined in the 2021 Regulations as verifying identity “without authentication, through offline modes”. For many fintech journeys, it and DigiLocker remain the practical routes.

What Regulated Entities Should Do Now

Map your current route: Are you an AUA/KUA, a Sub-AUA/Sub-KUA, or using offline verification or DigiLocker? Document the legal basis under your sector rules, with reference to RBI's 2025 KYC Directions.
Review AUA/KUA partner contracts: Check them against Circular 2 of 2025, especially vault, HSM, audit, and incident clauses.
Audit Aadhaar number handling: Masking, vault storage, and log retention are the controls an audit will test first.
Align consent with DPDP: The DPDP Rules' notice and consent provisions apply from 14 May 2027.
Keep alternatives live: Maintain offline XML, QR, and DigiLocker options, reducing dependence on any single verification route.
Watch for LITE rules: Wait for the LITE framework rules before making changes to your existing architecture.

For broader context, our pillar covers the full stack, and the guide covers proof of address options.
Where BeFiSc fits: IDProof gives onboarding teams Aadhaar-based routes, DigiLocker document fetch, face match, and liveness through one integration. That lets you run several verification paths side by side while UIDAI finalises LITE. Book an IDProof demo to see these routes on a sample journey.

Key Takeaways

UIDAI's LITE Framework: UIDAI announced a Sub-AUA/Sub-KUA LITE framework on 29 September 2026 for low-volume government and eligible non-government entities.
Existing Infrastructure: LITE uses an existing AUA/KUA's infrastructure for real-time onboarding. Eligibility, thresholds, and liability rules are not yet published.
Good Governance Amendment Rules: The 2025 rules opened Aadhaar authentication to non-government entities through ministry approval. SWIK 2.0 streamlines this process.
Sub-AUA Liability: Sub-AUAs already carry joint and several liability with their AUA, with tighter undertakings since February 2025.
Action for Regulated Entities: Audit current verification routes, partner contracts, and Aadhaar data handling now. Wait for the LITE rules before re-architecting.

Conclusion

The LITE framework signals that UIDAI wants Aadhaar authentication to reach smaller entities without each building heavy infrastructure. For the financial sector, it could lower the cost of the Sub-AUA route, but only once eligibility and liability rules are clear.

Until then, the sensible posture is preparation: know your AUA KUA route, tighten Aadhaar data handling, align consent with DPDP, and keep alternative KYC paths working.

Digital Arrest Scam: How It Works, Red Flags, and the Mule Account Problem

BeFisc — Mon, 02 Nov 2026 01:40:42 +0000

A digital arrest is a cyber fraud in which callers pose as police, CBI, customs, ED, or court officials, claim the victim is linked to a crime, and keep them on a video call under threat of arrest until they transfer money. No law enforcement agency in India arrests or detains anyone over a video call.

The script borrows the authority of real institutions and isolates the victim for hours, which is why it catches retirees and professionals alike.

The money lands in bank accounts opened or rented for the purpose, known as mule accounts. That is why the Supreme Court and RBI have turned their attention from awareness campaigns to the accounts receiving the proceeds. This guide covers how the scam runs, how to respond, and what regulated entities must now do.

What a Digital Arrest Is (and Is Not)

“Digital arrest” has no legal meaning in India. Neither the Bharatiya Nagarik Suraksha Sanhita nor any other statute allows an officer to arrest a person through a phone or video call, confine them to a room by camera, or demand a payment to “verify” their funds.

The Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs said so in its October 2024 public advisory: CBI, police, customs, ED and judges do not arrest people on video calls. The advisory directed citizens to report such calls on the 1930 helpline or at cybercrime.gov.in.

According to I4C figures cited by Drishti IAS, such complaints stood at 1,23,672 in 2024, fell to 58,249 in 2025, and were 16,377 by June 2026. Each remaining case can still drain a lifetime of savings.

How a Digital Arrest Scam Unfolds

Most cases follow a recognisable sequence:

The hook: A call or WhatsApp message claims a parcel in your name contains drugs or fake passports, or that your Aadhaar or mobile number is linked to money laundering.
The escalation: The call is "transferred" to a fake police officer or CBI official, often on a video call with uniforms, badges, and a set resembling a police station.
The isolation: The victim is told they are under digital arrest, must keep the camera on, and must not speak to family because the case is "confidential".
The extraction: The victim is asked to move money to a "secure government account" for verification, or to pay a fine or bail, with a promise of a refund once cleared.
The dispersal: The money is split across several mule accounts within minutes, then moved onward through more accounts, wallets or cash withdrawals.
Messaging platforms are a core channel. As reported by MoneyLife, the Attorney General told the Supreme Court that WhatsApp had banned over 9,400 accounts linked to digital arrest scams over 12 weeks from January 2026.

Red Flags That Give the Scam Away

The table below contrasts what fraudsters say with how real investigations work.

What the caller says	What actually happens in a real case
"You are under digital arrest; stay on camera"	Arrests are physical, with written grounds; no camera custody exists.
"Transfer your funds to an RBI or court account for verification"	No agency asks citizens to move money for verification.
"Do not tell your family; the case is secret"	You have the right to consult family and a lawyer.
"We will refund once you are cleared"	Seized funds are handled through courts, not refunds by phone.
Video call from a "police station" with uniforms	Notices are served in person or in writing from verifiable offices.

Other warning signs: official-sounding caller IDs, threats that escalate when you hesitate, and pressure to install remote-access apps.

What to Do If You Receive a Digital Arrest Call

Speed matters most, because funds move through mule accounts quickly.

End the call: A genuine officer will not object to you verifying through official channels.
Do not transfer money: Never share OTPs or install any app requested by the caller.
Call 1930: Contact the national cyber fraud helpline or file a complaint at https://cybercrime.gov.in. Report even if you have not lost money.
Provide transaction details: If you have paid, give the helpline your bank transaction reference, time, and beneficiary account details immediately.
Inform your bank: Notify your bank so it can attempt to stop or trace the funds.
Report the number: Use the Chakshu facility on the Sanchar Saathi portal.
Talk to someone you trust; the scam depends on isolation.

The Supreme Court and RBI Response on Mule Accounts

In early August 2026 (order dated 4 August 2026, as reported by IANS), a bench led by Chief Justice Surya Kant issued fresh directions on these scams. Among them:

RBI's responsibility: Prepare and circulate a standard operating procedure for dealing with mule accounts within four weeks, including temporary debit holds on accounts linked to cyber fraud (Drishti IAS summary).
States and Union Territories: Operationalise cyber crime coordination centres and grievance and money-restoration mechanisms.
e-Zero FIR mechanism: States to adopt the e-Zero FIR mechanism in consultation with I4C.

RBI’s draft temporary debit hold framework

On 11 September 2026, RBI released the draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, with comments due by 2 October 2026. Key proposals, as summarised by Corplaw Updates and Outlook Money:

Temporary debit hold: Banks may place a temporary debit hold when their monitoring flags transactions of Rs 1,000 or more as possibly linked to cyber fraud or mule activity.
Hold duration: A hold would generally last no more than 60 days unless a law enforcement agency or competent authority directs otherwise.
Customer notification and response: Customers must be told the reason. They get 20 days to explain, and the bank decides within 10 days of a reply (or 30 days without one).
KYC non-compliance: Failure to file suspicious transaction reports on confirmed mule accounts would count as KYC non-compliance.
Applicability: Commercial banks (including small finance, payments, regional rural and local area banks) and urban cooperative banks, with a proposed effective date of 1 April 2027.
The draft may change before it is final. For a deeper view of detection signals, see our guide.

Enforcement is reaching the suppliers.

On 6 October 2026, Telangana Today reported that the Telangana Cyber Security Bureau had arrested over 100 people across Telangana, Andhra Pradesh, Karnataka, Tamil Nadu and Kerala for allegedly arranging bank accounts and KYC documents for cybercriminals. Debit cards and passbooks were seized. Mule networks are supply chains, and many start with an account that passed onboarding.

Stopping Mule Accounts at Onboarding

Debit holds act after money arrives. Catches behaviour once the account is live. The cheapest control sits earlier: refusing to open accounts for impersonators or for people renting out their identity.

Mule account types and the onboarding control that helps

Mule pattern	What onboarding can check
Account opened with stolen identity documents	Face match between selfie and ID photo, with liveness to block photos and replays.
Same face behind many accounts with different documents	Face match plus internal deduplication of selfies.
Rented account: real person, paid to open it	Name match between ID and linked bank account; tighter review for high-risk profiles.
Wallet or merchant account receiving pooled funds	Confirm that the payout account belongs to the onboarded person.

Rented accounts are hardest because the identity is real. Onboarding checks reduce the problem but cannot remove it; post-onboarding monitoring remains essential.

Illustrative scenario

A digital wallet (illustrative) sees a cluster of new users whose selfies come from one face but whose PAN cards differ. Within the flow, the duplicates are flagged before any wallet is activated, rather than discovered after a police notice.

Where BeFiSc fits: IDProof lets banks, NBFCs and fintechs run face match with liveness, name match and bank account verification at account or wallet opening, so impersonated identities and mismatched payout accounts are stopped before they can receive fraud proceeds. IDProof does not monitor transactions or place debit holds. Book a demo of a mule-resistant onboarding flow.

Key Takeaways

Digital arrest is a scam: No Indian agency arrests or confines anyone over a video call. Learn more about digital arrest.
Report immediately: Victims should end the call and report to 1930 or https://cybercrime.gov.in, with transaction details if money has been transferred.
Mule accounts: Fraud proceeds flow through mule accounts, which is why the Supreme Court directed RBI to frame a mule account SOP in August 2026.
RBI's proposed framework: RBI's September 2026 draft proposes temporary debit holds of up to 60 days, with customer notification and response timelines.
Stronger onboarding controls: Face matching, liveness detection, name matching, and bank account verification can help reduce impersonated mule accounts, although they cannot eliminate rented accounts.

Conclusion

The scam succeeds on fear and isolation and fails the moment a victim hangs up and calls 1930. Awareness has helped, as I4C’s declining complaint figures suggest.

For regulated entities, the focus has shifted to the accounts that receive the money. RBI’s temporary debit hold framework will standardise what happens after funds arrive. The institutions that verify faces, names, and bank accounts properly at onboarding will face fewer of those holds in the first place.

Gig Workers in India: Onboarding Verification for Platforms

BeFisc — Fri, 23 Oct 2026 08:54:14 +0000

Gig workers in India earn from work outside a traditional employer-employee relationship, often through delivery, mobility, or home-service apps. Since the Code on Social Security, 2020 took effect on 21 November 2025, platforms engaging gig workers carry registration and contribution duties, making onboarding verification a compliance task as well as a safety one.

A delivery partner rings the doorbell of a customer’s home. A beautician walks into a living room. A driver picks up a passenger at midnight. In each case, the platform has vouched for a stranger’s identity, usually after an onboarding check that took a few minutes on a phone.

That check now carries more weight. Indian law formally recognises gig workers; aggregators must report them to a government database, and several states have their own laws. This article covers who counts as a gig worker, what the framework asks of platforms, and how to build a verification flow that holds up at scale.

Who Counts as a Gig Worker in India

The Code on Social Security, 2020 gave Indian law its first formal definitions. Section 2(35) defines a gig worker as “a person who performs work or participates in a work arrangement and earns from such activities outside of a traditional employer-employee relationship.”

A platform worker, under Section 2(61), is a person engaged in platform work: work in which organisations or individuals use an online platform to access other organisations or individuals to provide services in exchange for payment. All platform workers are gig workers, but not all gig workers work through platforms. A freelance photographer hired directly is a gig worker; a food delivery partner on an app is a platform worker.

The Code defines an aggregator as “a digital intermediary or a market place for a buyer or user of a service to connect with the seller or the service provider.” Its Seventh Schedule covers ride-sharing, food and grocery delivery, logistics, e-marketplaces, professional services, healthcare, travel and content services.

How large is the workforce?

NITI Aayog’s June 2022 report, “India’s Booming Gig and Platform Economy”, estimated 7.7 million gig workers in 2020-21 and projected 23.5 million by 2029-30. The government cited these figures in a Rajya Sabha reply published by PIB on 4 December 2025.

Registration is catching up. PIB reported about 5.12 lakh platform workers on the e-Shram portal as of 1 December 2025, and roughly 11.5 lakh by August 2026, after aggregators were directed to onboard their workers.

The Legal Framework Platforms Now Operate Under

The four labour codes were made effective on 21 November 2025. For platforms, three obligations matter most.

Aggregator contribution

Aggregators must contribute 1-2% of annual turnover to a Social Security Fund, capped at 5% of the amount paid or payable to gig and platform workers. Confirm with counsel whether the rate for your category has been notified.

E-Shram registration and data sharing

The Social Security Rules, 2026 require aggregators to share details of the gig and platform workers they engage with the government. On 1 June 2026, the Ministry of Labour and Employment directed aggregators to complete onboarding on the e-Shram portal, integrate through API, and share worker data electronically by 21 June 2026. Workers registered on e-Shram receive a Universal Account Number.

Identity data a platform holds is now reported to a national database, so duplicates and borrowed identities stop being an internal problem.

State laws

Rajasthan passed the Platform Based Gig Workers (Registration and Welfare) Act, 2023. Bihar enacted its own Act on 12 August 2025, and Karnataka passed the Platform Based Gig Workers (Social Security and Welfare) Act on 12 September 2025, with a welfare fee of 1% to 5% of payouts and an obligation to register workers with a state welfare board. Several of these state obligations depend on rules still being framed, so confirm commencement for each state where you operate.

Why Platforms Verify Gig Workers

Platforms verify gig workers for safety, for compliance, and because fraud is expensive.

Customer safety. Workers enter homes, vehicles, and private spaces. Platforms need confidence that the person on the job is the person who was checked.

Account renting and sharing. A verified worker lends or rents login credentials to someone unverified. The ID on file is genuine; the person delivering is not.

Duplicate accounts. One person registers several times with different phone numbers to game incentives, referral bonuses, or rating resets.

Payouts to mule accounts. Earnings are routed to a bank account that does not belong to the worker, sometimes as part of laundering networks.

Reporting accuracy. With worker data flowing to e-Shram, a duplicate or fictitious identity becomes a reporting error.

A document check alone addresses none of these fully. The weak point is usually the link between the document, the face, and the bank account.

A Seven-Step Onboarding Verification Flow

Most gig workers should clear this flow on a phone in minutes, with exceptions routed to manual review.

Capture consent and notice. Show a clear notice explaining what data is collected and why, and record consent before any check runs.
Verify PAN or an Aadhaar route. Confirm the PAN is valid and the name matches, or use offline Aadhaar verification or DigiLocker to fetch a government-issued document. Our guide explains response fields.
Run face match with liveness. Compare a live selfie with the photo on the fetched document, and confirm the selfie is a real person in front of the camera.
Name match across sources. Compare the name on the identity document, the bank account, and any licence. A fuzzy match handles initials and transliteration without approving unrelated names.
Verify the payout bank account. Confirm the account exists, is active, and that the holder name matches the verified identity. Our guide compares penny-drop and pennyless methods.
Add role-specific checks. Drivers need licence and vehicle checks; home-service workers may need address or police verification. A covers employment and court-record checks where lawful and proportionate.
Re-verify periodically. Ask for a fresh liveness selfie at login or at random intervals, and match it against the onboarding face. This is the main control against account renting. Where BeFiSc fits: IDProof combines PAN and Aadhaar-route checks, DigiLocker retrieval, face match, liveness, name match, and bank account verification behind one API, with average responses of about three seconds. That covers steps 2 to 5 and the re-selfie in step 7 for thousands of workers a day. Book a bulk onboarding demo to test it on a sample of your own applicants.
Where flows typically break
Teams often verify the document thoroughly and the bank account loosely, so a worker later adds a payout account in someone else’s name. Tie any payout change to a fresh liveness check and name match. Without re-verification, a platform knows who was verified on day one, not who is working on day ninety.
Use Cases Across Platform Categories
Food and quick-commerce delivery. Volume is the constraint. A festive-season ramp-up of delivery partners needs straight-through approval for clean applicants and a narrow manual queue. Periodic re-selfies matter most here because account renting is easiest.

Ride-hailing and logistics. Licence and vehicle registration checks sit alongside identity, and many platforms add background checks for drivers carrying passengers.

Home services. Gig workers enter customers’ homes, so identity and address verification carry more weight.

Freelance marketplaces. Workers may never meet customers, but payouts are larger, so bank account ownership and PAN-name consistency come first.

Consent and Data Protection

Gig worker onboarding processes personal data, and from November 2025 the Digital Personal Data Protection Rules, 2025 set the operating framework, with an 18-month phased timeline. The Rules call for standalone, clear consent notices that explain the specific purpose of collection.

For gig workers, that means collecting only what each check needs, storing verification results apart from raw documents where possible, and setting retention periods that respect both labour-law record-keeping and data protection limits. Our guide covers consent design in more detail.

Key Takeaways

Gig and platform workers have been defined in law since the Code on Social Security, 2020 took effect on 21 November 2025.
Aggregators owe a contribution of 1-2% of turnover, capped at 5% of worker payouts, and must share worker data with the e-Shram system.
State laws in Rajasthan, Bihar, and Karnataka add welfare fees and registration duties.
The main fraud risks with gig workers are account renting, duplicate accounts, and payouts to accounts they do not own.
An effective flow links documents, face, and bank account, then re-verifies the face periodically.
Consent notices and data minimisation under the DPDP Rules should be designed into the flow, not added afterwards.
Conclusion
Gig workers have moved from an informal category to a regulated one. Platforms that once verified gig workers mainly to protect customers now also report them to a national database and fund their social security.

The verification flow therefore has to answer three questions reliably: is this a real, unique person, is the person working the one who was verified, and does the payout go to them? Platforms that answer all three at onboarding, and keep answering the second over time, will find compliance and safety point in the same direction.

MLRO Full Form: Principal Officer and Designated Director Under PMLA

BeFisc — Thu, 22 Oct 2026 10:31:09 +0000

The MLRO full form is Money Laundering Reporting Officer: the senior person in a regulated firm who receives internal suspicion reports and decides what goes to the national financial intelligence unit. Indian law does not use the term. Its equivalents under the PMLA are the Principal Officer and the Designated Director.

Job descriptions at Indian fintechs increasingly ask for an “MLRO”, often copied from UK or Singapore templates, and candidates search the MLRO full form to decode them. The title is harmless; the confusion is not. FIU-IND recognises only the roles defined in the PML Rules, and those roles carry specific, dated obligations.

This guide maps the global MLRO concept to Indian law, sets out who the Principal Officer and Designated Director must be, lists their duties, and shows what enforcement looks like when the roles exist only on paper.

What MLRO Means and Where the Term Comes From

A Money Laundering Reporting Officer is a nominated individual responsible for an institution’s anti-money laundering reporting. The term is standard in the UK and in several jurisdictions that follow its model, where the MLRO evaluates internal disclosures and files reports with the national authority.

India’s framework assigns the same functions differently. The Prevention of Money-Laundering Act, 2002 places record-keeping and reporting obligations on reporting entities in Chapter IV, chiefly Section 12. The PML (Maintenance of Records) Rules, 2005 then name two people who carry that burden.

So when someone searches for the MLRO full form in an Indian context, the useful answer is a mapping:

Signal	Risk Indicated	Suggested Action
Invalid syntax or no MX	Typo or fabricated address	Prompt correction inline
Disposable domain	Low-commitment or abusive signup	Ask for a permanent address; block for credit products
Mailbox does not exist	Fabricated address	Request a different email before proceeding
Catch-all or unknown	Unverifiable mailbox	Send an OTP or verification link
Role account on retail product	No individual owner	Ask for a personal address
Very new domain	Possible impersonation or bulk creation	Step up to stronger identity checks

India’s framework is assessed seriously at the international level. FATF’s mutual evaluation, published in September 2024, placed India in “regular follow-up”, the highest rating category, while noting areas for improvement.

Principal Officer and Designated Director Under Indian Law

The Principal Officer

Rule 2(1)(f) defines the Principal Officer as an officer designated by the reporting entity. RBI’s KYC Master Direction adds that the Principal Officer must be an officer at the management level, responsible for furnishing information under Rule 8.

Under Rule 8, the Principal Officer furnishes monthly reports, including cash transaction reports, by the 15th of the following month, and reports suspicious transactions promptly once satisfied that a transaction is suspicious. Rule 8 also treats each day of delay as a separate violation.

The Designated Director

Rule 2(1)(ba) defines the Designated Director as the person designated to ensure overall compliance with Chapter IV of the Act and the Rules. For a company, this is the Managing Director or a whole-time Director duly authorised by the Board. RBI’s KYC Master Direction requires the Board to nominate the Designated Director and states that the Principal Officer cannot also be the Designated Director (para 6(d)). The separation is deliberate: one person reports, another is accountable at Board level.

Communicating the appointments

Rule 7 requires the reporting entity to communicate the names, designations and addresses of both officers to the Director, FIU-IND. RBI’s KYC Master Direction also requires these details, with contact information, to be sent to RBI (paras 6 and 7).

In practice, this happens through registration on FIU-IND’s FINnet 2.0 portal. The registration gap is real. FIU-IND’s list dated 17 August 2026 states that 3,228 of 7,936 Base Layer NBFCs and 65 of 540 Middle Layer NBFCs registered with RBI had not registered on FINnet 2.0, and were therefore non-compliant with the PML Act and Rules.

Core Responsibilities: A Working Checklist

Whatever the internal title, the Principal Officer’s function usually covers the following:

Register the entity, the Principal Officer, and the Designated Director on FINnet 2.0, and update FIU-IND and the regulator when either changes.
File cash transaction, counterfeit currency, non-profit, and cross-border wire reports monthly by the 15th, as applicable to the entity.
Run the suspicious transaction process: receive internal alerts, investigate, document the decision, and file STRs promptly.
Maintain records of transactions and customer identification for the statutory retention period.
Own the internal mechanism for detecting reportable transactions, as Rule 7 requires.
Train staff, report to the Board through the Designated Director, and respond to FIU-IND requests.
Keep a clear audit trail for every decision not to file, as well as every decision to file. Point 7 is where most programmes are weakest. A decision not to report is a judgement, and examiners will ask for the evidence behind it.
Penalties and Enforcement Under Section 13
Section 13(2) of the PMLA gives the Director, FIU-IND, graduated powers when a reporting entity, its Designated Director or any employee fails

to comply with Chapter IV:
issue a written warning;
direct compliance with specific instructions;
require reports on the measures being taken;
impose a monetary penalty of not less than ₹10,000 and up to ₹1 lakh for each failure. The phrase “for each failure” matters. Combined with Rule 8’s per-day treatment of delays, a systemic gap can produce a large aggregate penalty.

FIU-IND publishes its orders. In an order dated 8 April 2025, it imposed a penalty of ₹37 lakh on Union Bank of India for contraventions of Section 12 of the PMLA read with Rules 3, 7 and 9 of the PML Rules, and directed diligent compliance with Chapter IV obligations.

A real-world scenario

A digital NBFC grows quickly and appoints its Head of Risk as Principal Officer, then elevates the same person to whole-time director and names them Designated Director. The two roles now sit with one individual, contrary to RBI’s separation requirement. Months later, a review finds that internal fraud alerts were closed without documented AML assessment. The firm faces questions on both governance and reporting, and the fix requires a new appointment, a back-review of closed alerts and refreshed FINnet 2.0 details.

Supporting the Principal Officer at Scale

Whatever the MLRO full form on a business card, the Principal Officer’s decisions are only as good as the evidence in front of them. Three capabilities matter most.

First, verified data at onboarding. If identity and business details are verified against source registries, later investigations start from facts rather than self-declared fields.

Second, statement analysis. Many alerts at lenders come down to questions about money flows: cash concentration, pass-through activity, round-tripping, credits from unrelated parties. Reading those patterns in a structured statement view is faster and more consistent than paging through PDFs. This is also where statement review meets.

Third, audit trails. Every alert, review note, and filing decision should be retrievable with a timestamp and owner. Most provide this layer; the Principal Officer should test it before relying on it.

Where BeFiSc fits: Finnalyzer, BeFiSc’s bank statement analysis product, reads 100+ statement formats and gives investigators a structured view of credits, debits, and cash patterns when an alert needs review. It supports the analysis; filing decisions stay with the Principal Officer. Book a demo with sample statements from a recent case.

Key Takeaways

The MLRO full form is Money Laundering Reporting Officer, a UK and global term not used in Indian law.
In India, the Principal Officer (Rule 2(1)(f)) reports to FIU-IND, and the Designated Director (Rule 2(1)(ba)) holds overall compliance accountability.
RBI requires the Principal Officer to be at management level and the two roles to be held by different people.
Both appointments must be communicated to FIU-IND and RBI, in practice through FINnet 2.0 registration.
Section 13 penalties run from ₹10,000 to ₹1 lakh per failure, and Rule 8 counts each day of delay separately.
Conclusion
The MLRO full form answers a vocabulary question. The compliance question is whether your Principal Officer and Designated Director are properly appointed, registered with FIU-IND, separated from each other, and equipped to make defensible decisions on time.

FIU-IND’s August 2026 list shows that registration alone is still a gap for thousands of NBFCs. The firms that close it and back their Principal Officer with clear evidence and audit trails will spend far less time answering show-cause notices.

Email Risk Score: Signals That Flag Fraud at Signup

BeFisc — Thu, 22 Oct 2026 10:11:13 +0000

Fraud teams use it at signup to decide whether to approve, step up verification, or review, rather than to decline outright.

Every digital lender, BNPL app, and marketplace asks for an email address at signup. Most treat it as a contact field. Fraud teams increasingly treat it as evidence, and an email risk score turns that evidence into a decision: an address created ten minutes ago on a throwaway domain says something different from a five-year-old mailbox on a company domain.

This guide explains what goes into an email risk score, how each signal works technically, which ones are reliable, and how to turn them into proportionate decisions that block abuse without turning away genuine customers.

Why Email Is a Useful First Signal

Fraud in Indian lending is concentrated where money leaves the institution. RBI’s Annual Report for 2025-26 recorded 10,114 fraud cases involving Rs 48,021 crore, with advances-related frauds accounting for 8,640 cases and Rs 40,774 crore. Many lending frauds begin at onboarding, with identities that look complete on paper.

Email is one of the cheapest identity attributes to fabricate. A fraudster can create hundreds of addresses in an afternoon. That is precisely why it is informative: genuine customers rarely use throwaway addresses for a loan application, while organised abuse often does.

It is also the first data point captured, often before PAN, Aadhaar or bank details. A signal available at the first screen lets teams adjust friction before any expensive check runs. Email signals work best alongside device data, because each is easy to fake alone and harder to fake consistently together.

The Signals Behind an Email Risk Score

An email risk score is only as good as its inputs. The signals fall into three groups: deliverability, domain characteristics, and behaviour.

Deliverability signals

Syntax. The address must conform to the format rules in RFC 5322. Invalid syntax usually indicates a typo, but repeated malformed submissions from one device suggest scripted testing.

Domain and MX records. A valid domain needs DNS records showing where its mail goes. A missing MX record, or a “null MX” as defined in RFC 7505, means the domain does not accept mail at all.

Mailbox existence. A verifier can open an SMTP conversation, defined in RFC 5321, with the receiving server and ask whether a mailbox would accept mail, without sending a message. Many large providers deliberately give ambiguous answers, so this check returns “unknown” more often than teams expect.

Catch-all domains. Some domains accept mail for any address. The mailbox check then cannot distinguish a real user from an invented one, so catch-all status lowers confidence rather than proving fraud.

Domain characteristics

Disposable and temporary domains. Services that issue short-lived inboxes are the strongest single signal of low-commitment signups. Lists of such domains change constantly, so a static blocklist decays quickly and weakens any email risk score built on it.

Role accounts. RFC 2142 standardises role mailboxes such as postmaster and abuse, and businesses add others like info@ or sales@. A role address on a personal loan application is unusual, because no single individual owns it.

Free versus corporate domains. A free webmail address is normal for retail customers. On a B2B form or a business loan application, a free domain where a company domain is expected merits a closer look.

Domain age. A domain registered days before the application, especially one that resembles a known brand, is a classic sign of impersonation or bulk account creation.

Behavioural signals

Name-email consistency. “priya.menon84@” on an application from Priya Menon is coherent. A random string, or a name belonging to someone else, is not proof of fraud, but it adds weight to other signals.

Velocity and reuse. The same address, or near-identical variants such as added dots or plus-tags, appearing across many applications, devices, or PANs is a strong indicator of fraud or promo abuse.

Breach exposure. Some providers note whether an address appears in known data breach compilations. Interpret this carefully: exposure is common among genuine, long-standing users and can indicate an established address. It is more useful as a flag for account takeover risk than as a signup decline reason.

How Fraud Teams Use an Email Risk Score

The most common mistake is wiring an email risk score directly to auto-decline. Signals are probabilistic, and many genuine customers have unusual emails. A tiered response works better.

Signal	Risk Indicated	Suggested Action
Invalid syntax or no MX	Typo or fabricated address	Prompt correction inline
Disposable domain	Low-commitment or abusive signup	Ask for a permanent address; block for credit products
Mailbox does not exist	Fabricated address	Request a different email before proceeding
Catch-all or unknown	Unverifiable mailbox	Send an OTP or verification link
Role account on retail product	No individual owner	Ask for a personal address
Very new domain	Possible impersonation or bulk creation	Step up to stronger identity checks

A practical decision flow looks like this:

Validate syntax and domain at the input field, so honest typos are fixed before submission.
Check mailbox, disposable, and catch-all status in the background as the user continues.
Combine the email result with phone, device, and identity signals into a single risk tier.
Apply friction by tier: approve, send an email OTP, require additional verification, or review.
Feed confirmed fraud outcomes back to tune thresholds every month. Where BeFiSc fits: BounceProof validates syntax and domains, checks SMTP and MX records, flags disposable inboxes and catch-all domains, and categorises each address as Safe, Risky, Reject, or Unknown. Those categories drop directly into the tiered flow above. Start with 100 free email checks on your own signup data.
What can an email risk score not do?
It cannot confirm identity. A clean, long-standing Gmail address can belong to a fraudster using a stolen identity. An email risk score screens out cheap abuse and prioritises reviews; identity verification still does the heavy lifting.
Use Cases by Business Type
Digital lending signup. A personal loan app sees a burst of applications using addresses from rotating disposable domains, all from a handful of devices. Blocking disposable domains for credit products and routing reused addresses to review removes much of the noise before bureau pulls are paid for. See our overview for related patterns. BNPL checkout. Merchants want minimal friction. Here, invalid and disposable addresses trigger an OTP rather than a decline, keeping conversion high for genuine buyers. B2B lead forms. A free domain on a “work email” field, or a role address, lowers lead quality scores. Sales teams spend time on real prospects, and marketing lists stay deliverable.

Promo and referral abuse. Cashback and referral programmes attract users creating many accounts. Reuse detection, including dot and plus-tag variants, links them back to one person.

Email Signals and the DPDP Framework

An email address is personal data under the Digital Personal Data Protection Act, 2023. The DPDP Rules, 2025, notified on 14 November 2025 with an 18-month phased compliance timeline, emphasise purpose limitation, data minimisation and clear, standalone consent notices.

For email risk scoring, that translates into four practices:
State fraud prevention as a purpose in your notice when you collect the email.
Send only the email address to a verification provider, not the full application.
Retain the risk result, not the raw provider response, for as long as your fraud and audit purposes require.
Contract with providers as data processors, with clear limits on reuse of your data.
Our guide covers notice design and processor contracts in more detail.

Key Takeaways
An email risk score combines deliverability, domain and behavioural signals into a single view of how trustworthy a signup email is.
Disposable domains, non-existent mailboxes and heavy reuse across applications are the strongest individual signals.
Catch-all domains, breach exposure and free webmail are context, not reasons to decline.
Tiered friction (OTP, step-up, review) outperforms auto-decline for both fraud loss and conversion.
Email signals screen out cheap abuse; they do not replace identity verification.
Under the DPDP Rules, 2025, collect for a stated purpose, share the minimum, and limit retention.

Conclusion

The email field is the first piece of evidence a customer gives you, and it costs almost nothing to examine. Treated as a contact detail, it adds nothing to risk control. Treated as a signal, it filters out the cheapest forms of abuse before expensive checks run.

The value lies in proportion. An email risk score should decide how much friction a user sees, not whether they are a fraudster. Teams that build it into a tiered flow, alongside phone, device, and identity checks, see cleaner funnels and fewer losses.

Shop Act Licence Verification for Merchant Onboarding

BeFisc — Thu, 22 Oct 2026 02:17:39 +0000

A Shop Act license is the registration certificate or intimation receipt a business obtains under its state’s Shops and Establishments Act. India has no single national registry, so verification means checking the state labour department portal and cross-verifying the business against GST, Udyam, and other independent records.

For a kirana store, a salon or a small trading office, the Shop Act licence is often the first government document the business ever obtains. That is exactly why payment aggregators, marketplaces and lenders see so many of them during onboarding.

It is also why the document is so often misused. A licence that is decades old, issued under a repealed Act, or edited in a PDF tool still looks official to a busy reviewer. This guide explains what it proves, how to check it, and what to cross-verify it against.

What is a Shop Act license?
A Shop Act license is proof that a shop or commercial establishment has registered with, or notified, the state labour department under that state’s Shops and Establishments law.

These are primarily employment statutes, regulating working hours, holidays, and conditions of service in shops, offices, and similar premises. Registration is how the state knows the establishment exists.

Because labour is on the Concurrent List and each state legislates separately, there is no uniform national format. Validity, renewal rules, thresholds, and certificate layout all differ.

Registration versus intimation
Under the Maharashtra Shops and Establishments (Regulation of Employment and Conditions of Service) Act, 2017, establishments with ten or more workers apply for registration, while those with fewer than ten only file an intimation. Applications run through the state’s online licence management system.

Gujarat’s equivalent Act of 2019, effective 1 May 2019, follows the same split: registration for ten or more workers, intimation to the Inspector for smaller units. Registration certificates under the Gujarat Act do not require periodic renewal unless ownership or the nature of business changes.

Many small merchants therefore hold an intimation acknowledgement, not a registration certificate, and both are legitimate.

Where the Shop Act fits in RBI KYC and PA rules
For sole proprietorship firms, the KYC framework requires customer due diligence of the proprietor plus proof that the business exists.

Paragraph 28 of RBI’s 2016 KYC Master Direction listed acceptable proofs of business or activity, including a registration certificate (with Udyam), a certificate or licence issued by municipal authorities under the Shop and Establishment Act, GST and other tax registrations, IEC, professional body licences, complete income tax returns and utility bills. Regulated entities had to obtain any two.

Paragraph 29 allowed an RE to accept only one document where it was satisfied two could not be furnished, provided it conducted contact point verification. It collected information to establish the firm’s existence.

RBI repealed the 2016 Master Direction on 28 November 2025 and replaced it with entity-specific KYC Directions, including the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025. Compliance teams should map their policies to the paragraph numbering of the applicable Directions.
For payment aggregators, the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025 dated 15 September 2025 require merchant CDD in line with the KYC Directions, allot an appropriate Merchant Category Code, and require ongoing monitoring that transactions match the merchant’s business profile. Our summary covers the full framework.

How to check a Shop Act license online
There is no single national API or registry for Shops and Establishments registrations. Checking one is a state-level exercise.

Identify the state and the Act cited on the certificate.
Locate the issuing authority, typically the state labour department or municipal corporation.
Use the state portal’s certificate search or verification option, where one exists, with the registration number.
Match the establishment name, address, employer name, and nature of business against the application.
Check the issue date, validity, and whether the Act cited is current.
Where no online lookup exists, record that the document could not be verified at source and rely on independent cross-checks. Portal behaviour varies. Some states verify by certificate number; others only let the applicant download their own certificate.

Why a Shop Act licence alone is a weak signal
Even a genuine certificate proves less than many reviewers assume. These are the patterns that most often show up.

Edited certificates: name, address, or business nature altered in a PDF, often to match a newly opened bank account.
Expired or superseded registrations: legacy certificates presented for businesses that closed years ago.
Borrowed premises: a valid licence belonging to another shop at the same address.
Mismatched activity: a licence for a general store used to onboard a merchant processing high-value electronics or gaming payments.
Intimation slips presented as registration: not fraudulent, but often paired with no other trace of the business. Visual review catches only the crudest of these. Metadata and pixel-level checks belong to us, while existence checks belong to independent data sources.

Verifying Shop Act licences at scale for your business
The reliable approach treats the Shop Act licence as one input and builds confidence from records the merchant cannot easily edit.

A cross-verification model

Collect the Shop Act certificate or intimation and verify at source where the state allows it.
Ask for, or search for, a GSTIN linked to the proprietor’s PAN, and check status and filing history.
Confirm Udyam registration details, including enterprise name, address, and activities.
For companies and LLPs, match MCA records for directors and registered office.
Check digital footprint signals: an active listing, website, or marketplace presence consistent with the declared activity.
Compare the declared MCC with what the independent records describe.
Trigger contact point verification when sources conflict or when only one proof of business is available. Where BeFiSc fits: BizCheck produces a business risk report in about 60 seconds using GST, MCA, Udyam, and digital footprint data. It does not replace a state Shop Act lookup; it tells you whether the business on the certificate shows up consistently everywhere else. Try a free BizCheck report on a merchant from your current queue.

Use case: onboarding a 400-merchant batch
Consider an illustrative scenario. A payment aggregator receives 400 small-merchant applications from a distributor partner in Maharashtra, most submitting a Shop Act licence and a PAN.

The team runs every application through GST, Udyam, and digital footprint checks before manual review. Three groups emerge.

Most merchants show a Udyam registration and a GSTIN that match the Shop Act name and address. These pass with standard CDD.

A smaller group has a valid intimation but no GST or Udyam trace. These are routed to contact point verification rather than rejected, because many genuine micro-merchants sit below GST thresholds.

A handful share identical Shop Act registration numbers or addresses with different proprietor names. These are held, and the distributor relationship is reviewed.

Analyst effort concentrates on the cases that carry risk, and the licence is never asked to prove more than it can.

Key Takeaways

A Shop Act licence is a state labour-law registration or intimation, not a national business identifier.
Maharashtra (2017) and Gujarat (2019) require registration only for establishments with ten or more workers; smaller units file an intimation.
RBI KYC rules accept a Shops and Establishments certificate as one of the proofs of business for sole proprietorship firms, normally alongside a second document.
There is no national lookup, so verification is state-specific and should be backed by GST, Udyam and MCA \cross-checks, the best defence against edited, expired and borrowed certificates.

Conclusion
The Shop Act licence will remain a staple of Indian merchant onboarding because it is often the only document a small business holds. Its weakness is not the law behind it but the fragmented way it is issued and checked.

Teams that treat the certificate as a starting point, verify at source where states allow it, and confirm existence through GST, Udyam, MCA, and footprint data onboard genuine merchants faster and stop the ones whose paperwork is incomplete.

EPIC Number: What It Is, How to Find It, and How Businesses Verify Voter IDs

BeFisc — Tue, 20 Oct 2026 12:14:46 +0000

An EPIC number is the unique alphanumeric identifier printed on every Elector Photo Identity Card issued by the Election Commission of India. Most cards carry a 10-character code, usually three letters followed by seven digits. You can find it on the front of the card, search it on the ECI’s electoral search portal, and use it to download an e-EPIC.

Voters need the EPIC number to check the electoral roll, download a digital card, or update details. Banks, NBFCs and fintechs meet the same number daily, because the voter ID remains an officially valid document for KYC.

This guide covers both sides: how to find, search, and download, then what a voter ID proves for risk teams and how to verify it at scale.

What Is an EPIC Number?
EPIC stands for Elector Photo Identity Card. The EPIC number links the card to a single entry in the electoral roll of a specific assembly constituency and polling station.

The format
Cards in the current series typically carry ten characters: a three-letter prefix and seven digits. Older cards can look different, so a format check alone never proves a number is fake.

Why some voters once shared a number
In March 2025, ECI acknowledged that some Electoral Registration Officers had not used the correct series since EPIC series were allotted to states and union territories in 2000. The result was duplicate EPIC numbers held by genuine electors in different constituencies.

In May 2025, it reported the issue resolved after searching the data of more than 99 crore electors, with affected voters issued new numbers. An older photocopy may therefore carry a superseded EPIC number.

How to Find Your EPIC Number
On a physical card, the EPIC number is printed on the front, near the photograph. Without the card, use electoral search:

Open ECI’s Electoral Search portal at electoralsearch.eci.gov.in.
Choose search by details, enter your name, relative’s name, age or date of birth, state and district, and complete the captcha.
Alternatively, choose search by mobile if your number is registered with ECI, and verify with the OTP.
Read the EPIC number, part number, and serial number from your matching electoral roll entry. This is also the answer to the common “EPIC number without voter ID” query: the electoral roll entry holds the number even when the physical card is lost.

To check a known number, select search by EPIC and enter the number and state. No result usually means a typo, a replaced number, or a deleted roll entry.

The ECINET app
ECI launched ECINET on 22 January 2026, integrating more than 40 election apps and web services. It subsumes the Voter Helpline App, so it is now the official mobile route for roll search and e-EPIC services.

How to Download an e-EPIC
The e-EPIC is a digital, non-editable PDF version of the voter card. It was launched on National Voters’ Day, 25 January 2021, initially for new electors and then extended to all electors.

To download it:

Log in to the Voters’ Service Portal at voters.eci.gov.in using your mobile number registered with ECI.
Select the e-EPIC download option.
Enter your EPIC number or Form 6 reference number and select your state.
Verify with the OTP sent to the registered mobile number.
Download the PDF and store it on your phone or in DigiLocker.

If your mobile number is not linked to your electoral record, update it through Form 8 first.

Why the EPIC Number Matters Beyond Voting
For regulated entities, the voter ID card is more than an election document. RBI’s KYC framework lists “the Voter’s Identity Card issued by the Election Commission of India” among the six officially valid documents (OVDs), alongside the passport, driving licence, proof of possession of Aadhaar, NREGA job card and NPR letter.

RBI consolidated these instructions into the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, issued on 28 November 2025. Our explains how the framework applies across entity types.

That status makes it common in rural and semi-urban lending, microfinance and gold loans, and among customers who prefer not to share Aadhaar.

What a voter ID does not prove
The card proves that a person with this name and photograph was enrolled at a given address when it was issued. It does not prove:

That the address is current. Many voters move without transferring their enrolment.
That the photograph resembles the holder today. Older cards carry low-resolution photos of a much younger person.
That the name matches other KYC documents. Transliteration variations are common. A voter ID should therefore be one input to a verification decision, not the decision itself.

Verifying Voter IDs at Scale for Your Business
At volume, an agent eyeballing a photocopy is not a control. The work splits into four checks.

1. Is the document real and on the roll?
The first check confirms that the EPIC number exists on the electoral roll and that the roll entry matches the card. Our document explains the request and response patterns in detail.

Treat a “not found” result carefully. Given the 2025 renumbering and routine roll revisions, a mismatch should trigger a request for the current card or e-EPIC, not an automatic rejection.

2. Does the customer match the card?
OCR extracts the name, number, and photo from the uploaded image. A face match then compares the card photo with a live selfie, and liveness detection confirms the selfie is a real person in front of the camera rather than a printed photo or replayed video.

Old card photos lower match scores for genuine customers, so route low-confidence matches to manual review. Our guide covers threshold design.

3. Do the names agree across documents?
“Mohd. Irfan Shaikh” on a voter ID and “Mohammed Irfan Sheikh” on PAN would fail an exact match. A fuzzy scores similarity while handling initials, honorifics, and transliteration.

4. Is the address still valid?
Because the address on a voter ID can be stale, many lenders confirm the current address separately. RBI’s KYC FAQs (9 June 2025) also allow deemed OVDs, such as a utility bill not more than two months old, when the OVD does not show the current address, with the customer required to submit an OVD carrying the current address within three months.

Where BeFiSc fits: IDProof gives your team face match, liveness, name match, and DigiLocker document retrieval in one API workflow, so a voter ID submitted at onboarding is checked against a live customer and cross-matched with PAN and bank account details, with most results returned in about three seconds. Book a demo to see the workflow on your own sample cases.

A real-world scenario
Consider a microfinance lender whose borrowers mostly submit voter IDs. Branch staff once compared photocopies by eye. With roll matching, face match, and name match in the flow, mismatched cases go to a supervisor and the rest clear straight through, each with an audit trail of why it was approved.

Key Takeaways

The EPIC number is the unique identifier on an Elector Photo Identity Card, usually ten characters in the current series.
You can find it on the card, through electoral search by details or mobile, or inside the ECINET app launched in January 2026.
RBI’s KYC framework treats the voter ID as an officially valid document, but its address and photo are often outdated.
Businesses should combine roll matching, face match with liveness, name match, and current-address checks rather than relying on the card image.

Conclusion
The EPIC number serves voters as a key to the electoral roll and businesses as a reference point for identity. Those two uses demand different levels of trust. A voter needs to find their entry; a lender needs to know the person in front of them is the person on the roll, today, at the address they claim.

Teams that tie the voter ID to a live face, a matched name, and a current address onboard genuine customers faster and absorb fewer losses.

GSTR-3B Filing History as a Credit Signal for Lenders

BeFisc — Tue, 20 Oct 2026 11:57:22 +0000

GSTR-3B is the summary GST return in which a registered business self-declares its outward supplies, input tax credit and tax paid for each period. Because it is filed monthly or quarterly and cannot be revised, its filing history gives lenders a time-stamped record of how regularly a business trades, reports and pays tax.

Many MSME borrowers in India lack audited financials a credit officer can rely on. What many do have is a GSTIN and years of returns.

That trail is underused. Teams often check that a GSTIN is “Active” and move on, when the period-wise record says far more about discipline and cash flow. This guide explains what the return contains, how the 2025 changes made it a firmer data source, and how to read filing history without overreading it.
What is GSTR-3B?
The GST Portal describes Form GSTR-3B as “a simplified summary return” through which taxpayers declare summary GST liabilities for a tax period and discharge them. Normal and casual taxpayers are required to file it.
** GSTR-3 B filing frequency and due dates**
Monthly filers submit the return by the 20th of the following month. Taxpayers under the Quarterly Return Monthly Payment (QRMP) scheme, available to businesses with aggregate turnover up to ₹5 crore, file quarterly by the 22nd or 24th of the month after the quarter, depending on their state.

The GST Portal FAQ is explicit that the return “once filed cannot be revised.” Corrections flow into later periods, so each filing is a fixed, dated statement.
GSTR-1 vs 3B: why the difference matters to a lender
GSTR-1 is the invoice-level statement of outward supplies. GSTR-3B is the summary return that actually discharges tax. One tells the system what was sold; the other tells it what the business accepts as liability and pays.

A business can file GSTR-1 on time and delay the summary return because it lacks the cash to pay. That gap is one of the earlier stress indicators available to a lender.

Persistent differences between sales in GSTR-1 and liability in the summary return have historically pointed to either poor bookkeeping or under-reporting. Both matter to credit.
How the 2025 changes made GSTR-3B a firmer data source
Three GSTN measures in 2025 changed how much weight the return can bear.
Hard-locking of auto-populated liability
Through an advisory dated 7 June 2025, GSTN stated that from the July 2025 tax period the liability auto-populated from GSTR-1, IFF or GSTR-1A would be non-editable. Corrections must now be made in GSTR-1A before filing.

The lock applies to outward liability. ITC in Table 4 remains editable, so it deserves closer scrutiny than sales.
Table 3.2 remains editable
In April 2025 GSTN proposed making Table 3.2 non-editable. A subsequent advisory of 16 May 2025 said the table would remain editable for the time being. Analysts should not assume every auto-populated field is locked.
Three-year time bar on filing
The Finance Act 2023 amended the CGST Act so that returns cannot be filed after three years from their due date. GSTN advisories in June 2025 confirmed enforcement on the portal from the July 2025 tax period, covering GSTR-1, GSTR-3B, GSTR-9 and other returns.

For lenders, a gap older than three years is now permanent. A business cannot quietly regularise a dormant history just before applying for credit.
Six GSTR-3B signals lenders should read
The value lies in the pattern across 12 to 36 periods, not any single return.

Filing regularity. Count periods filed on time, late and not at all. A borrower with 30 of 36 returns on time reads differently from one with a cluster of recent late filings.
Delay trend. Rising average days-late is more informative than the absolute figure. Interest and late fee entries in Table 5.1 corroborate it.
Nil returns. Occasional nil periods are normal for seasonal businesses. Long nil runs followed by sudden high turnover can indicate a dormant GSTIN reactivated for a loan.
Turnover consistency. Compare Table 3.1 turnover with GSTR-1 totals and with bank statement credits. Timing differences are expected; persistent, material gaps warrant questions.
ITC intensity. The ratio of ITC claimed to output tax indicates margin structure. A trader claiming ITC close to its entire output liability every month, with little cash tax paid, fits a pattern seen in networks.
Cash versus credit settlement. Table 6 shows how much tax is paid in cash. Steady cash payment is a modest positive signal of genuine operating liquidity. None of these is a verdict on its own. Each becomes useful when another source corroborates or contradicts it. The broader set of works the same way. A practical use case: an MSME working capital application Consider an illustrative case. A distributor in Pune applies to an NBFC for a ₹25 lakh working capital line, declaring annual sales of ₹3.2 crore.

The credit team pulls 24 months of history. GSTR-1 was filed on time throughout. The summary return was on time for 18 months, then 25 to 40 days late in four of the last six, with interest in Table 5.1.

Table 3.1 turnover matches GSTR-1, so sales are credible. But cash tax paid in Table 6 has fallen while ITC utilisation has risen.

Read together, this is a genuine business under recent liquidity pressure, not a fraudulent applicant. The right response is a smaller limit, tighter monitoring and a review of outputs, rather than rejection.
Verifying GSTR-3B signals at scale for your business
Reading one borrower’s history manually is straightforward. Doing it for thousands of applications a month requires a defined workflow.

Verify the GSTIN, legal name and trade name against the applicant’s PAN and declared entity.
Confirm registration status and date, and whether the registration has ever been suspended or cancelled.
Pull period-wise filing status for GSTR-1 and GSTR-3B covering at least 12 months, ideally 24 to 36.
Compute on-time ratio, average delay, delay trend and nil-return runs.
Reconcile declared turnover against bank credits and, where available, consented GST return data.
Cross-check the business against MCA, Udyam and digital footprint data to confirm it operates where and how it claims.
Route exceptions to a credit analyst with the specific signal that triggered the referral. Where BeFiSc fits: BizCheck returns a business risk report in about 60 seconds, combining GST, MCA, Udyam and digital footprint data so credit teams can see a GSTIN’s status alongside the entity’s corporate and MSME records in one view. Start with a free BizCheck report on a live application.

Limits and misconceptions
GSTR-3B is a self-declaration. The hard-lock improves consistency with GSTR-1, but it does not prove that the underlying invoices reflect real goods or services.

Filing history does not replace cash flow analysis. Informal debt never appears in GST data.

Exempt sectors and businesses below the registration threshold generate thin GST data. A weak trail is not, by itself, negative for those segments.

System fields also change. The March 2026 GSTN advisory on re-computing interest in Table 5.1 shows that calculated values can be corrected later, so read interest entries as indicative.

Key Takeaways

GSTR-3B is the self-assessed summary return that discharges GST liability; it cannot be revised once filed.
From the July 2025 tax period, auto-populated outward liability is hard-locked, while ITC in Table 4 and Table 3.2 remain editable.
Returns older than three years from their due date can no longer be filed, so historic gaps are now permanent.
The most useful credit signals are filing regularity, delay trend, nil-return runs, turnover consistency, ITC intensity and cash settlement.
GST signals work best when reconciled with bank statements and entity data from MCA and Udyam.

Conclusion
GSTR-3B has become one of the more dependable public signals on Indian MSMEs. The 2025 hard-lock, the three-year time bar and the return’s non-revisable nature give lenders a dated record that is hard to retrofit.

The opportunity is to read that record as a pattern, reconcile it against cash flow and entity data, and reserve analyst time for cases where signals conflict. Done well, this approves more genuine MSMEs while catching dormant and manufactured profiles.

RBI Money Mule SOP: What the Draft Temporary Debit Hold Rules Mean for Banks and Fintechs

BeFisc — Sat, 17 Oct 2026 13:07:39 +0000

The RBI money mule SOP is a draft amendment, released on 11 September 2026, that inserts a Standard Operating Procedure on suspected money mule accounts into the RBI (Know Your Customer) Directions, 2025. It lets banks place a temporary debit hold on suspected mule transactions of Rs 1,000 and above, for up to 60 days, from 1 April 2027.

Banks handling suspected mule accounts have faced two pressures: freeze too little and fraud proceeds vanish in minutes; freeze too much and genuine customers lose access with no clear timeline. The draft codifies the middle ground.

RBI’s press release links the proposal to a Supreme Court order dated 4 August 2026. Comments close on 2 October 2026. This article covers what the draft says, what changes for banks and their partners, and what to build before 1 April 2027.
What the draft RBI money mule SOP says
The Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 add an Annex titled “Standard Operating Procedure on Suspected Money Mule Accounts to Prevent Cyber-enabled Financial Frauds”. Three definitions anchor it:

Money mule account: an account used, knowingly or unknowingly, to receive, layer or transfer proceeds of cyber-enabled financial fraud on behalf of another person.
Suspected money mule transaction: a transaction of Rs 1,000 and above, flagged by the bank’s transaction-monitoring systems (including AI/ML-based tools) as suspected proceeds of mule activity or cyber-enabled fraud.
Temporary debit hold: a temporary restriction on debits on the suspected amount(s) or on the account, pending verification.
Who it applies to
The draft covers commercial banks (including small finance banks, payments banks, regional rural banks and local area banks) and urban co-operative banks. It does not apply to nodal, pool, escrow or other special-purpose accounts such as dividend or share capital accounts. RBI says final Directions will be issued separately for each type of regulated entity.

The draft mandates the SOP from 1 April 2027, or earlier if a bank chooses to implement it sooner. Existing obligations to file suspicious transaction reports (STRs) with FIU-IND continue unchanged.

What changes for banks
Holds become proportionate by design. The definition allows a hold on suspected amounts, not only on the whole account.
Customer notice is mandatory and fast, with reasons and a named contact.
Decisions run on a clock. A bank that misses its decision window has no clear basis to keep the hold.
Escalation is standardised through NCRP-CFCFRMS rather than ad hoc letters to police stations.
Governance is explicit. **Banks must keep a centralised MIS recording, among other things, the hold date, reasons, and correspondence, retained for at least five years from the hold (ten years if the account is closed). They must designate Nodal Officers and resolve complaints arising under the SOP within 30 days.
At a Rs 1,000 threshold, alert volumes will be material and batch review of mule alerts will not keep pace.
**What it implies for NBFCs, PAs and fintech partners
The draft text applies to banks. Its effects travel further, and the points below are our reading rather than RBI language:

Disbursals and payouts land in bank accounts. An NBFC disbursing to, or a payment aggregator settling with, an account that is later held may face reconciliation breaks and customer complaints.
Partnership banks will push requirements down. Banks sponsoring fintech programmes are likely to ask partners for stronger onboarding evidence and faster responses to fraud queries.
Separate Directions may follow. RBI has said final Directions will be issued per type of regulated entity, so other REs should watch for their version.
The operational build: monitoring, notices, timers, and audit
Compliance with the SOP is mostly an engineering and operations problem.
Monitoring and triage
Monitoring must score incoming credits before funds move on, using rules and models tuned for mule patterns: rapid in-out flows, many small credits from unrelated senders, sudden activity on dormant accounts.
Notice workflow
Notices need templated reasons, the removal process, officer contact details, and delivery proof, with customer explanations captured against the case.
Timers and case management
Each hold needs clocks for the 20-day explanation window, the 10-day or 30-day decision window, the LEA referral date and the 60-day ceiling, with alerts before each deadline.
Audit trail
Every step must land in the centralised MIS with timestamps so audit, inspection or a court can reconstruct it.
Why prevention at onboarding matters
The SOP manages mule accounts after money has arrived, and every hold costs analyst time, customer friction and LEA coordination. The cheaper intervention is not opening the account at all, or opening it with evidence strong enough to support later action.
Mule accounts are frequently opened with genuine but rented identities, borrowed bank accounts, or identity documents used by someone other than the holder. Three onboarding checks address these directly:

Bank account verification with name match, confirming the account exists and belongs to the person being onboarded.
Face match against the identity document, confirming the applicant is the document holder.
Liveness detection, **confirming a live person is present rather than a photo or replay.
**Where BeFiSc fits: IDProof is BeFiSc’s identity and KYC suite, covering PAN, Aadhaar routes, DigiLocker, bank account verification, name match, face match, and liveness. Used together at onboarding, these checks make it harder to open an account with a rented or borrowed identity. Book a demo of the IDProof onboarding flow to see the checks on your own journeys.
What to do before 1 April 2027
Submit comments if your institution has views; the window closes on 2 October 2026.
Map current hold practice against the draft’s steps, timelines and notice contents.
Size alert volumes at the Rs 1,000 threshold using historical data.
Build or extend case management with timers, notice templates, and NCRP-CFCFRMS reporting.
Set up the MIS and retention **to the draft’s five-year and ten-year rules.
**Designate Nodal Officers **and update grievance handling for the 30-day resolution timeline.
**Strengthen onboarding controls so fewer mule accounts reach the monitoring stage.
Track the final Directions, which may change details, and the versions for other regulated entities.
You can also review IDProof capabilities as part of the onboarding workstream.
Key Takeaways

The RBI money mule SOP is a draft amendment to the KYC Directions, 2025, released on 11 September 2026, with comments due by 2 October 2026.
It allows temporary debit holds on suspected mule transactions of Rs 1,000 and above, capped at 60 days absent LEA instruction.
Customers get 20 days to explain; banks decide within 10 days of the explanation or 30 days if none arrives.
The SOP becomes mandatory for banks from 1 April 2027; STR obligations to FIU-IND are unchanged.
Stronger onboarding checks reduce the number of mule accounts that need to be held at all. Conclusion The draft SOP gives banks a clearer legal footing to stop fraud proceeds quickly, and gives customers a defined process and timeline in return. The cost of that balance is operational: low thresholds, short clocks and full audit trails.

Institutions that treat 1 April 2027 purely as a monitoring deadline will carry the full volume of holds. Those that also tighten onboarding will have fewer mule accounts to hold, a more durable way to meet the rule’s intent.

Signzy Alternatives in India: A Neutral Buyer's Guide for KYC and KYB Teams

BeFisc — Sat, 17 Oct 2026 12:53:05 +0000

Teams evaluating Signzy alternatives in India usually compare HyperVerge, IDfy, Perfios (which acquired Karza), Surepass, AuthBridge, Bureau, and BeFiSc. The right choice depends on your use case, not on rankings. Compare check coverage, data source, latency at p95, uptime, security certifications, DPDP readiness, and pricing model, then run a side-by-side POC on your own sample.

Signzy is a well-known name in Indian identity verification, with about 7,400 monthly brand searches in India (Ahrefs, October 2026). Yet buying teams at lenders, fintechs, and payment aggregators routinely review their verification stack, whichever vendor they use.

This guide to Signzy alternatives is written for that review. It describes how providers position themselves publicly, without judging their products, and gives you a framework and a POC method to reach your own conclusion.

Why Teams Evaluate Signzy Alternatives
Looking at Signzy alternatives is usually a governance exercise, not a verdict on the incumbent. The common triggers are practical.

Scope change. **A lender adding business loans needs KYB checks such as GST, MCA, and Udyam. A payment aggregator expanding merchant onboarding needs different checks from a consumer app.
**Cost per verified customer. Per-call pricing hides the real metric. Retries, fallbacks, and manual review all add to the cost of each customer who actually completes onboarding.
Vendor concentration. Relying on one provider for every identity check creates a single point of failure. Many risk teams now prefer a primary and a secondary vendor for critical calls.
SLAs and support. Expectations change as volumes grow: response time commitments, incident communication, and named support contacts.
Data residency and privacy. With the DPDP Rules, 2025 notified on 14 November 2025 and an eighteen-month phased compliance window, PIB says procurement teams are asking sharper questions about where data is processed and retained.
Regulation also moves. RBI released the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 for comment on 11 September 2026. Changes to KYC directions can shift which checks and evidence a regulated entity needs from its vendors.
How Signzy Positions Itself Publicly
On its website, Signzy describes itself with the headline “The Global Standard for Securing User Journeys” and frames its offer around helping companies verify, onboard, and monitor users.

Its public product areas include identity verification, business verification (KYB), background checks, credit monitoring, fraud detection, KYC journeys, transaction monitoring, contract management with e-signatures, and a no-code onboarding platform. The site presents regional offerings for the United States, the Middle East, and India.

That breadth is the context for most evaluations of Signzy alternatives. Some buyers want one platform across these categories; others want specialists for a few checks. Neither preference is inherently better.
How this guide differs from our multi-vendor comparison
Our guide looks at four vendors together. This page is for teams starting specifically from Signzy, and focuses on the method: what to measure and how to test.
How to Run a Fair POC
A proof of concept is the only way to compare Signzy alternatives on your own customers. Most POCs fail because they are not designed as experiments.

Build a representative sample. **Include clean cases, known bad cases, and the hard middle: name mismatches, old documents, regional language names, and low-quality selfies.
**Fix the ground truth first. **Label each record’s expected outcome before any vendor sees it, so results are scored against facts, not against each other.
**Send identical inputs. Same records, same order, same time window, so source outages affect all vendors equally.
Measure the full journey. Record pass rates, manual-review rates, p95 latency, error codes, and retries alongside success counts.
Calculate cost per verified customer. Include retries and the manual review effort each vendor’s output creates.
Test failure handling. Ask what each API returns when an upstream government source is slow or unavailable.
Review data handling. **Confirm retention and deletion behaviour for POC data, in writing, before you send it.
Run the POC under a signed NDA and DPA, use consented or appropriately protected data, and keep the scoring sheet with your vendor-risk file. Auditors and boards increasingly ask how you selected a vendor.
**Where BeFiSc fits: BeFiSc’s IDProof covers PAN, Aadhaar routes, DigiLocker, face match, liveness, name match, and bank account verification for Indian regulated entities. BeFiSc is ISO 27001:2022 certified and reports 99.99% uptime with about 3 seconds average response. We offer a side-by-side POC on your own sample, so you can compare IDProof with your current provider on identical records.
Key Takeaways

Evaluating Signzy alternatives is usually driven by scope, cost per verified customer, vendor concentration, SLAs, or data residency, not by a single failure.
Public positioning varies widely, from broad platforms to specialists; it shows strategy, not performance on your traffic.
Score vendors on coverage, data source, p95 latency, uptime, certifications, DPDP readiness, pricing model, and support.
A fair POC uses a labelled sample, identical inputs, and cost per verified customer as the headline metric.
Keep regulatory change in view: the DPDP Rules, 2025 compliance window and RBI’s September 2026 draft KYC amendments both affect vendor requirements.
Conclusion
The best Signzy alternative is not a name on a list. It is the vendor, or combination of vendors, that performs best for your customers at a cost and risk profile your board accepts.

Start from public positioning to build a shortlist, apply a written framework, and let a fair POC decide. That process holds up in an audit, and it keeps your options open as RBI and DPDP requirements evolve.

The PAN Alternative, Its Form 97 Successor and What Lenders Must Verify

BeFisc — Mon, 12 Oct 2026 09:32:00 +0000

Form 60 is the declaration a person without a Permanent Account Number (PAN) files when entering a transaction that otherwise requires PAN, such as opening a bank account. Under the Income-tax Rules, 2026, in force from 1 April 2026, Form 60 has been replaced by Form No. 97, and Rule 114B by Rule 159.

Customers look for it when a bank asks for a PAN they do not have. Compliance teams look for it when an auditor asks why part of a portfolio has no PAN on file.

The 2026 rules changed the form’s number, narrowed where it can be used, and raised several PAN thresholds. This guide covers what changed, what RBI still requires, and how to verify and monitor no-PAN customers.

What Form 60 Is, and Why It Is Now Form 97
Form 60 was a declaration under the second proviso to Rule 114B of the Income-tax Rules, 1962. It let a non-corporate person without PAN complete a specified transaction by giving identity, address, and income details instead.

The Income-tax Act, 2025 and the Income-tax Rules, 2026 took effect on 1 April 2026 and renumbered most forms. The Income Tax Department’s rule pages and forms FAQ confirm this mapping:

Legacy (Rules, 1962) Current (Rules, 2026) Purpose
Rule 114B Rule 159 Transactions where PAN must be quoted
Form 60 Form No. 97 Declaration by a person without PAN
Rule 114D Rule 160 Reporting of declarations received
Form 61 Form No. 98 Statement of declarations received
Rule 159 sits under section 262 of the Income-tax Act, 2025, which replaced section 139A. Customers will keep asking for “Form 60 instead of PAN”, so SOPs should say Form 97 with “formerly Form 60” alongside.

One caution: RBI’s KYC Directions, as updated on 18 September 2026, still refer to “Form No. 60 as defined in Income-tax Rules, 1962”. Until RBI aligns the wording, document how your policy maps it to Form 97.

Transactions That Need PAN or a Declaration
Rule 159 lists 16 transactions where PAN must be quoted. The key change: a Form 97 declaration is accepted for only six of them (serial numbers 11 to 16). For the other ten, a person without PAN must apply for one.

PAN mandatory, no declaration route
Credit card applications and demat account opening, for all transactions.
Cash deposits or withdrawals aggregating Rs 10 lakh or more in a financial year with a bank or post office.
Mutual fund units, RBI bonds, debentures or bonds above Rs 50,000; securities contracts and unlisted shares above Rs 1 lakh; vehicles above Rs 5 lakh.
Declaration still accepted
Opening a bank account (other than a time deposit), and time deposits above Rs 50,000 or Rs 5 lakh in aggregate in a year.
Insurance premium above Rs 50,000 in a year.
Cash payments above Rs 1 lakh to a hotel, restaurant or event venue, and goods or services above Rs 2 lakh per transaction.
Immovable property above Rs 20 lakh. Above Rs 45 lakh, the person must apply for PAN.
Thresholds rose from the legacy table. Khaitan & Co’s April 2026 analysis notes the hotel bill trigger moved from Rs 50,000 to Rs 1 lakh, and property from Rs 10 lakh to Rs 20 lakh.

Who Can File the Declaration and What It Contains
Rule 159 allows the declaration from “any person, not being a company or a firm” without PAN. That covers individuals, HUFs, trusts, associations of persons, local authorities and certain foreign companies. Minors without taxable income quote a parent’s or guardian’s PAN instead.

Form 97 asks for more than Form 60 did. It runs in six parts: the coded nature of the transaction; a declaration of PAN status and whether income exceeds the taxable limit; identity and address details including a masked Aadhaar number; transaction value, cash component and payment mode (UPI now has its own code); supporting documents for identity, address and date of birth with document numbers; and a signed verification acknowledging prosecution for false statements.

Customers searching “form 60 pdf” should use incometax.gov.in or the bank’s branch copy.

Form 61 and Form 98: Reporting Duties for Recipients
Rule 160 requires specified recipients to report what they collect:

Declarations received from April to September are reported in Form No. 98 by 31 October.
Declarations received from October to March are reported by 30 April of the next financial year.
Statements go online to the Director of Income-tax (Intelligence and Criminal Investigation).
Declarations must be retained for six years from the end of the financial year of the transaction.
Banks should confirm that reporting systems match the Form 98 schema and that retention reads six years, longer than the five-year PMLA horizon.

Form 60 in Banking KYC: What RBI Requires
For individuals, paragraph 23 of RBI’s KYC Directions requires “PAN or the equivalent e-document thereof or Form No. 60” alongside proof of identity and address. The declaration is therefore a lawful alternative at onboarding, not a gap in KYC.

Paragraph 43 covers existing customers. A bank must obtain PAN, its e-equivalent, or Form 60 by a date the Central Government notifies. If the customer does not comply, the bank temporarily ceases operations in the account until PAN is submitted. The Directions add guardrails:

Customers get accessible notice and a reasonable opportunity to be heard before suspension.
Policy should relax the requirement for customers unable to provide PAN due to age-related infirmity, with enhanced monitoring.
If a customer declines in writing, the bank closes the account after settling obligations.
These rules sit within the wider For NBFCs, the parallel Directions follow the same logic, covered in our note on.

Where BeFiSc fits: IDProof lets a lender verify PAN when one exists and, when a customer files a no-PAN declaration, check the identity and address documents behind it through Aadhaar routes, DigiLocker, face match, and name match. Book a PAN and Form 60 verification workflow demo to see the flow end to end.

Where No-PAN Declarations Are Misused
Most filers are legitimate: students, homemakers, agricultural earners, and new-to-credit customers. The risk sits in a minority of declarations used to keep activity out of view:

A customer who holds PAN files the declaration anyway, so a deposit does not attach to their PAN record.
One person files declarations at several institutions, splitting activity that would otherwise cross a PAN trigger.
The declared income is “below taxable limit” while account turnover says otherwise.
Mule accounts are opened without PAN using borrowed identity documents, then used to receive fraud proceeds.
PANs not linked with Aadhaar by 30 June 2023 became inoperative (Ministry of Finance press release, 28 March 2023), and some of those holders present a no-PAN declaration instead. That is not a valid substitute for a PAN the person already holds. Checking separates “has no PAN” from “has a PAN that needs fixing”.

Verifying This at Scale for Your Business
A no-PAN declaration should route a customer into a defined workflow, not a manual exception queue:

Attempt PAN discovery first, and run a check on any number offered.
Confirm the product falls in Rule 159 serials 11 to 16; if not, the declaration route is closed.
Verify the Part E documents at source through Aadhaar-based e-KYC, DigiLocker, or OVD checks, with name match across them.
Test the income declaration against the product. A high-limit account with “below taxable income” deserves review.
Tag the account as no-PAN so monitoring rules, Form 98 reporting, and periodic updation pick it up.
Prompt for PAN at triggers such as limit increases, cash activity approaching Rs 10 lakh in aggregate, or periodic KYC updation.
No-PAN accounts with rising cash or rapid pass-through flows belong on your enhanced list.

Key Takeaways
Form 60 is now Form No. 97 and Rule 114B is now Rule 159 under the Income-tax Rules, 2026, effective 1 April 2026.
The declaration route covers six transaction types, including bank account opening; credit cards, demat accounts, and large cash activity need PAN.
Recipients report declarations in Form No. 98 by 31 October and 30 April and keep them for six years.
RBI’s KYC Directions still accept “PAN or Form No. 60” for individuals, with the legacy reference awaiting alignment.
Treat no-PAN customers as a monitored segment and prompt for PAN at risk triggers.
Conclusion
The move from Form 60 to Form 97 is more than a renumbering. By pushing credit cards, demat accounts, and large cash activity into PAN-only territory, the 2026 Rules shrink the space where a declaration can stand in for PAN.

For regulated entities, the response is operational: update forms and SOPs, map RBI’s legacy wording, and treat every no-PAN relationship as a verified, tagged, and monitored segment. Done well, these customers become easy to serve and hard to misuse

POA Full Form in KYC: Proof of Address Rules, Deemed OVDs, and Digital Verification

BeFisc — Mon, 12 Oct 2026 09:21:39 +0000

The POA full form in KYC is Proof of Address: a document or verified data source that establishes where a customer lives. In legal contexts, POA also means Power of Attorney, an authority to act for someone else. In Indian banking and fintech onboarding, POA almost always means proof of address under RBI’s KYC rules.

Most people who look up the POA full form want to know which document will satisfy a bank. Address is also the KYC attribute that goes stale fastest. People move for jobs, rent new flats, and keep old Aadhaar addresses for years. A lender that verifies identity carefully but treats address as a formality ends up with collections, CPV, and fraud-investigation teams chasing customers who were never where the file said.

This guide explains what counts as proof of address under RBI’s KYC Directions, how deemed OVDs and the three-month rule work, how current and permanent address differ, and how regulated entities verify address digitally without inviting edited utility bills into the file.

What the POA Full Form Means in KYC
In KYC, the POA full form is Proof of Address. It sits beside POI (Proof of Identity) as one of the two pillars of customer identification. For individuals, RBI’s KYC Directions require the bank to establish both, generally through an Officially Valid Document (OVD) or its verified digital equivalent.

Why does the address matter so much? It anchors several downstream obligations:

Communication and legal notices, including periodic KYC update reminders sent by letter.
Collections and recovery, where a wrong address converts a soft bucket into a write-off.
Risk assessment, since address feeds geography-based risk and fraud clustering.
Regulatory reporting, where suspicious transaction reports need accurate customer particulars.
What RBI Accepts as Proof of Address
For banks, the current text is the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, dated 28 November 2025 and updated on 18 September 2026; other regulated entities have parallel directions. Paragraph 5(1)(xiv) defines the OVDs that serve as POA.

Officially Valid Documents
Passport.
Driving licence.
Proof of possession of Aadhaar number.
Voter’s Identity Card issued by the Election Commission of India.
Job card issued by NREGA, signed by a State Government officer.
Letter issued by the National Population Register with name and address.
Deemed OVDs and the three-month rule
When the OVD a customer holds does not show the current address, the Directions allow certain documents to be “deemed OVDs” for the limited purpose of proof of address:

Deemed OVD Condition
Utility bill (electricity, telephone, post-paid mobile, piped gas, water) Not more than two months old
Property or municipal tax receipt As issued by the local authority
Pension or family pension payment order Issued to retired employees by government departments or PSUs, containing address
Employer accommodation allotment letter or leave and licence agreement From specified employers such as government departments, PSUs, scheduled banks and listed companies
The concession is temporary. The customer must submit an OVD with the current address within three months. A sound onboarding system sets a diary date on day one and escalates on day 75, not day 95.

Our guide covers the full CDD framework around these definitions.

Current Address vs Permanent Address
Knowing the POA full form does not settle which address the proof covers. Permanent address is what the OVD says. Current address is where the customer actually lives. For many urban borrowers and migrant workers, the two differ.

The Directions handle this gap in two ways. At onboarding, where a customer submits Aadhaar and wants to record a different current address, paragraph 23 allows a self-declaration to that effect. During periodic KYC updation, paragraph 42 allows a customer to self-declare a new address, which the bank must verify through positive confirmation within two months, using methods such as an address verification letter, contact point verification, or deliverables.

A self-declared address without later confirmation is the weakest POA in your book. Treat it as a pending state, not a closed one.

POA Rules in Securities and Insurance
The POA full form and the OVD logic carry across regulators, with sector variations:

SEBI: Investors complete KYC once through a KYC Registration Agency, and intermediaries accept proof of address such as a utility bill or passport, alongside Aadhaar-based e-KYC.
IRDAI: The Master Guidelines on AML/CFT, 2022 (1 August 2022) require insurers to obtain address proof through OVDs aligned with the PML Rules, applied on a risk basis.
The practical point for groups with banking, broking and insurance arms: the document lists overlap, but freshness rules and exceptions can differ. Map each product to its regulator’s text.

How to Verify Address Digitally
Collecting a POA document is easy, and the POA full form tells you only what to collect. Proving that the address on it is genuine and current is the real work. Digital methods fall into three tiers.

Tier 1: Source-fetched address
Aadhaar offline e-KYC XML, which UIDAI digitally signs and which contains the holder’s address; the signature check detects tampering. See our guide.
DigiLocker-issued documents, such as driving licences and Aadhaar, are pulled directly from the issuer with consent. Our guide explains the flow.
Name match across the fetched record and the application to confirm the address belongs to the applicant.
Tier 2: Corroborated address
Where the address comes from a deemed OVD or self-declaration, corroborate it: compare against bureau or utility records where lawfully available, check PIN code and locality consistency, and use geo-tagged selfies or device location during onboarding where the customer consents.

Tier 3: Physical confirmation
Contact point verification, address verification letters, and courier deliverables close the loop for high-risk segments and for self-declared addresses awaiting positive confirmation.

A detailed comparison of these methods is in our guide.

Where BeFiSc fits: It retrieves identity and address data through Aadhaar routes and DigiLocker, then applies name matching so you know the address belongs to the applicant. Book an address verification demo to see source-fetched POA replace uploaded copies in your onboarding flow.

Address Proof Fraud Patterns
Whatever the POA full form promises, deemed OVDs are where most address fraud enters, because they are easy to edit and hard to check against source.

Edited utility bills: Name, address, or bill date changed in a PDF editor. Watch for mismatched fonts, misaligned fields,s and bill numbers that fail the issuer’s format.
Borrowed addresses: Genuine bills from a relative or landlord, used by a borrower who never lived there.
Rented-room clusters: Many unrelated applicants sharing one address, a common sign of mule recruitment or synthetic identities.
Stale Aadhaar addresses: Not fraud by itself, but a source of failed CPV and collections leakage when the customer moved years ago.
Agent-supplied documents: Bills sourced by DSAs or field agents rather than the customer, often reused across files.
The defence is layered: prefer source-fetched POA, run document tamper checks on any upload, and flag addresses shared across unrelated applications.

Building an Audit-Ready Address Trail
For inspectors, the POA full form is shorthand for evidence. They do not ask whether you collected a POA. They ask how you know it was valid on the day you relied on it. For each customer, the file should show:

The POA source (OVD type, deemed OVD, Aadhaar XML, DigiLocker, or self-declaration).
The verification method and timestamp, including signature validation for XML and issuer response for DigiLocker.
The consent record for any data fetched.
The three-month OVD follow-up status, where a deemed OVD was used.
The positive-confirmation evidence for any self-declared address change.
Key Takeaways
The POA full form in KYC is Proof of Address; in legal documents, POA usually means Power of Attorney.
RBI accepts six OVDs as POA, plus deemed OVDs (such as utility bills up to two months old) for current address, with an OVD due within three months.
Self-declared current addresses are permitted in defined cases but need positive confirmation.
Source-fetched address through Aadhaar offline XML or DigiLocker is stronger evidence than any uploaded copy.
Edited utility bills and shared addresses are the main fraud vectors; layered checks and a clean audit trail address both.
Conclusion
Once you get past the POA full form, proof of address looks like the simplest box in a KYC form. In practice, it is where stale data, edited documents, and borrowed identities concentrate, and where collections and compliance costs surface months later.

Regulated entities that move from uploaded copies to source-fetched addresses, treat deemed OVDs and self-declarations as time-bound states, and keep an evidence trail for each will find the POA question settled at onboarding rather than reopened in recovery.

Build smarter compliance with BeFisc.

DEV Community: BeFisc

UIDAI’s Sub-AUA/Sub-KUA LITE Framework: What the AUA KUA Change Means for Lenders and Fintechs

What UIDAI Announced on 29 September 2026

AUA, KUA, Sub-AUA, Sub-KUA and ASA Explained

The Good Governance Rules Behind Non-Government Access

What the LITE Framework Changes, and What Is Still Unknown

Access Routes Compared

What Regulated Entities Should Do Now

Key Takeaways

Conclusion

Digital Arrest Scam: How It Works, Red Flags, and the Mule Account Problem

What a Digital Arrest Is (and Is Not)

How a Digital Arrest Scam Unfolds

Red Flags That Give the Scam Away

What to Do If You Receive a Digital Arrest Call

The Supreme Court and RBI Response on Mule Accounts

RBI’s draft temporary debit hold framework

Enforcement is reaching the suppliers.

Stopping Mule Accounts at Onboarding

Mule account types and the onboarding control that helps

Illustrative scenario

Key Takeaways

Conclusion

Gig Workers in India: Onboarding Verification for Platforms

Who Counts as a Gig Worker in India

How large is the workforce?

The Legal Framework Platforms Now Operate Under

Aggregator contribution

E-Shram registration and data sharing

State laws

Why Platforms Verify Gig Workers

A Seven-Step Onboarding Verification Flow

Where flows typically break

Use Cases Across Platform Categories

Consent and Data Protection

Key Takeaways

Conclusion

MLRO Full Form: Principal Officer and Designated Director Under PMLA

What MLRO Means and Where the Term Comes From

Principal Officer and Designated Director Under Indian Law

The Principal Officer

The Designated Director

Communicating the appointments

Core Responsibilities: A Working Checklist

Penalties and Enforcement Under Section 13

A real-world scenario

Supporting the Principal Officer at Scale

Key Takeaways

Conclusion

Email Risk Score: Signals That Flag Fraud at Signup

Why Email Is a Useful First Signal

The Signals Behind an Email Risk Score

Deliverability signals

Domain characteristics

Behavioural signals

How Fraud Teams Use an Email Risk Score

What can an email risk score not do?

Use Cases by Business Type

Email Signals and the DPDP Framework

Key Takeaways

Conclusion

Shop Act Licence Verification for Merchant Onboarding

EPIC Number: What It Is, How to Find It, and How Businesses Verify Voter IDs

GSTR-3B Filing History as a Credit Signal for Lenders

RBI Money Mule SOP: What the Draft Temporary Debit Hold Rules Mean for Banks and Fintechs

Signzy Alternatives in India: A Neutral Buyer's Guide for KYC and KYB Teams

The PAN Alternative, Its Form 97 Successor and What Lenders Must Verify

POA Full Form in KYC: Proof of Address Rules, Deemed OVDs, and Digital Verification