The Unique Identification Authority of India directed private know-your-customer aggregators to mask all but the last four digits of Aadhaar numbers in stored records from October 1, tightening data-minimisation rules that fintechs use during video-based onboarding. The change lands as banks and payment apps process festive-season account openings and credit-line upgrades.
What aggregators must do
Under the revised operational circular, licensed KYC user agencies may not retain full 12-digit Aadhaar numbers in databases, logs or customer-support tickets unless law enforcement serves a specific request. Aggregators must instead store a masked identifier and route authentication through UIDAI’s offline XML or online OTP flows. MeitY officials said the rule aligns Aadhaar handling with broader digital-personal-data expectations without pausing live onboarding.
Industry response
Fintech compliance heads in Bengaluru and Mumbai said engineering teams spent September refactoring vault schemas and purging legacy exports. Several startups delayed international card launches by a week to complete audits. Incumbent banks, which already masked Aadhaar in core systems, focused on vendor attestations rather than code rewrites.
Payment aggregators that onboard merchants flagged a secondary task: reprinting QR standees that accidentally displayed full Aadhaar numbers on loan-agent pamphlets—a practice UIDAI has penalised in the past.
Consumer impact
Retail users completing KYC on Thursday’s Gandhi Jayanti holiday still saw apps functioning, though some reported slower video-KYC queues as agents revalidated scripts. Customers who previously photographed Aadhaar cards for manual reviews are being asked to use DigiLocker links instead.
Privacy advocates welcomed the masking mandate but urged faster penalties for apps that cache biometric templates outside UIDAI specifications. The authority has not announced new fines alongside this circular, relying instead on license suspensions for repeat offenders.
What comes next
Regulators are expected to pair the masking rule with tighter audit rights for the RBI’s outsourced-IT inspections of bank partners. Aggregators must submit compliance certificates by mid-October or risk being dropped from lender panels ahead of Diwali credit campaigns.
Audit trail
UIDAI will sample aggregator logs in November, checking that masked fields cannot be reversed through side-channel databases. Consultants advising non-bank lenders said the exercise resembles card-network PCI audits, with penalties for retained biometric images outside authorised templates.
State governments running welfare DBT schemes asked whether masking affects duplicate-beneficiary checks; UIDAI clarified that departmental officers retain full authentication rights through secure consoles, not through aggregator caches.
Startup impact
Early-stage neobanks that relied on quick Aadhaar scans for student accounts must now route users through DigiLocker consent screens, adding friction that product teams hope to offset with faster video-KYC agents working overtime after the holiday.
Audit trail
UIDAI will sample aggregator logs in November, checking that masked fields cannot be reversed through side-channel databases. Consultants advising non-bank lenders said the exercise resembles card-network PCI audits, with penalties for retained biometric images outside authorised templates.
State governments running welfare DBT schemes asked whether masking affects duplicate-beneficiary checks; UIDAI clarified that departmental officers retain full authentication rights through secure consoles, not through aggregator caches.
Startup impact
Early-stage neobanks that relied on quick Aadhaar scans for student accounts must now route users through DigiLocker consent screens, adding friction that product teams hope to offset with faster video-KYC agents working overtime after the holiday.
Bank partnerships
Public-sector banks with large Jan Dhan bases scheduled town-hall webinars for branch managers on Friday to explain masked Aadhaar receipts at account-opening camps planned for Diwali week.