INTRODUCTION
The onset of COVID-19 pandemic in 2020 saw businesses undergo tremendous changes, with digitalization being the most significant transformation to suit the changing circumstances. With the uncertainty arising from the COVID-19 situation in India, businesses shifted their activities online to create a niche in the consumer market and reap the rewards.
Similarly, banks and financial institutions have also shifted towards the digital path, incorporating significant digitalized changes in its day-to-day working, including the customer onboarding process by way of Know Your Customer (“KYC”) and Video KYC.
The Reserve Bank of India [Know Your Customer (KYC)] Directions, 2016 (hereinafter referred to as “the KYC Master Directions”) previously required in-person visits for customer onboarding process. However, with the onset of the pandemic, this requirement was shifted to virtual presence through video conferencing vide the Amendment to KYC Master Directions, providing a new method of conducting KYC, i.e., the Video KYC.
Video KYC, as a form of customer due diligence (“CDD”), strikes a balance between customer security, customer experience and compliance with regulatory requirements. Despite being a well-regulated mode of CDD, the concept and procedure of conducting Video KYC is likely to be susceptible to certain legal implications, including data privacy and data security concerns.
This article shall delve into the basics of Video KYC, regulatory framework and its consequential impact on individuals and entities alike.
WHAT IS VIDEO KYC?
KYC refers to the process of verification of a customer’s identity and determination of any potential risks associated with that customer. Video KYC or Video-Based Customer Identification Process (“V-CIP”) is an enhanced form of KYC, wherein face-to-face identity verification of the customer is undertaken through video call. It enables a seamless, real-time, secured, end-to-end encrypted audiovisual interaction with the customer.
Clause (xx) of Section 3 of the KYC Master Directions define V-CIP as:
“Video based Customer Identification Process (V-CIP) is an alternate method of customer identification with facial recognition and customer due diligence by an authorised official of the RE by undertaking seamless, secure, live, informed-consent based audio-visual interaction with the customer to obtain identification information required for CDD purpose, and to ascertain the veracity of the information furnished by the customer through independent verification and maintaining audit trail of the process. Such processes complying with prescribed standards and procedures shall be treated on par with face-to-face CIP for the purpose of this Master Direction.”
Physical presence of the customer at the site of verification is no longer required for the CDD process for customer onboarding. Institutions can authenticate their customers’ paperwork and capture digital signatures through video call, obviating the requirement for human interactions or branch visits.
REGULATORY FRAMEWORK FOR VIDEO KYC
The Reserve Bank of India (“RBI”) vide Circular No. RBI/2019-20/138 dated 09.01.2020 issued an Amendment to the KYC Master Directions allowing banks to conduct the verification of customers’ identity and onboarding process through V-CIP.
The RBI further amended the KYC Master Directions vide Circular No. RBI/2021-22/35 dated 10.05.2021 to leverage the scope of V-CIP to cover other customer types and services, and to simplify and rationalise the process of periodic updation of KYC.
The Amendment stipulates that V-CIP, as specified in Section 18 of the KYC Master Directions, can be conducted for the establishment of an account-based relationship with an individual customer only after obtaining his informed consent. Such consent is to be recorded in an auditable and alteration-proof manner.
As per the Amendment, the audiovisual interaction must trigger from the concerned Regulated Entity’s (“RE”) domain itself, and not from a third-party service provider. Further, in compliance with Section 16 of the KYC Master Directions, the customer’s Aadhar number must be redacted or blacked out by the RE during the V-CIP.
Through Circular No. SEBI/HO/MIRSD/DOP/CIR/P/2020/73 dated 24.04.2020, the Securities and Exchange Board of India (“SEBI”) has further approved the use of Video In-Person Verification for digital KYC of an investor.
IMPACT OF VIDEO KYC ON RELEVANT SECTORS
- Banks and Financial Institutions
The REs of Banks and Financial Institutions are subject to the constant regulatory supervision of RBI and SEBI. Customer verification throughout the onboarding process is a mandatory requirement for all REs under the KYC Master Directions. Video KYC may prove to be a useful tool for verifying customers’ identity and ensuring compliance with the KYC Master Directions.
In the coming years, a major shift may be seen in the banking ecosystem as more customers have easy access to banking services, without the requirement of physically visiting the premises of such banks and financial institutions.
- Digital Payment Platforms
Digital payment platforms rely on Aadhaar to on-board clients, and previously had to use time-consuming and inconvenient methods of KYC verification. Video KYC has enabled such platforms to digitally carry out the process of identification in a smooth and hassle-free manner, in compliance with the regulatory requirements of KYC prescribed by the KYC Master Directions.
LEGAL ISSUES CONCERNING VIDEO KYC
The usage of Video KYC as a form of customer identity verification may attract certain legal issues, including the following:
- Consent
The KYC Master Directions stipulate that the REs must obtain “informed consent” from the customer. In such circumstances, a customer may provide explicit consent, however, it is difficult to ascertain whether such consent is an informed consent given after appreciation and understanding of its implications. Hence, another subject of concern is the manner and procurement of consent from layman customers unaware of the legal and regulatory consequences of such consent.
- Right to Privacy
After the decision of the Supreme Court in K.S. Puttuswamy v. Union of India (2017) 10 SCC 1 declaring the Right to Privacy is a fundamental right under Article 21 of the Constitution of India, it is of utmost importance that REs ensure that each customer’s fundamental right to privacy is preserved to the highest degree possible. Accordingly, the entire process of V-CIP should be conducted in conformity with the safeguards enshrined under Article 21 of the Constitution.
- Data Privacy and Security
Data Privacy is a major concern surrounding KYC verification, and becomes more relevant when such KYC is undertaken through V-CIP. REs are required to store the audiovisual interaction, along with its geo-tagged location, in their secure servers. However, storage of such sensitive personal information on servers owned and operated by REs can be vulnerable to data leaks, data breach or other grave implications.
The need of the hour is to implement stringent norms for storage of such V-CIP data on secure servers regulated by the concerned authorities in compliance with the Information Technology Act, 2000 and the Rules made thereunder.
AMLEGALS REMARKS
Video KYC is an alternative method of customer identity verification on the basis of audiovisual interaction in conformity with the KYC Master Directions. A compelling necessity arose for a virtual method for verification of customer’s identity with the onset of the pandemic, when physical paperwork and verification of a customer’s identity became impossible due to the Lockdown norms.
To come in terms with the “new normal” era of working amidst the pandemic, the RBI approved the usage of Video-based KYC for the verification of customer identity from the comfort of one’s home without any requirement of physical presence at the RE’s premises.
Needless to say, KYC plays a crucial role in an individual’s daily affairs as it is a pre-requisite for undertaking any financial activity, including making payments, sanction of loans, investment in shares, etc. Video based KYC is an optimistic step forward addressing the needs of both the individual and the REs.
However, it is pertinent to note that Video KYC is susceptible to major concerns having legal implications, including protecting the individual’s right to privacy, provision of informed consent, possibilities of data breach and data leak and so on. Such probable issues need to be addressed by the concerned regulatory authorities, including the RBI, by stipulating norms that are in line with the prevalent data privacy principles.
For any query or feedback, please feel free to connect with arushi.vyas@amlegals.com or tanmay.banthia@amlegals.com.
Leave a Reply