Aadhaar-Based e-KYC: Every Rule, Limit, and Exception in One Page
Aadhaar-based e-KYC lets a customer prove identity electronically using their Aadhaar number. Its legal basis is the Aadhaar Act, 2016; the 2018 Supreme Court judgment struck down mandatory private-sector use; and the 2019 amendment enabled voluntary Aadhaar authentication by notified entities. OTP-based accounts carry balance and credit limits, and Aadhaar is never the only route.
This is an explainer, not legal advice. For binding obligations, refer to the Aadhaar Act, the RBI Master Direction, and the relevant UIDAI circular.
What Is the Legal Basis for Aadhaar-Based e-KYC?
Aadhaar-based e-KYC sits on three legal pillars, each of which corrected or extended the one before.
The Aadhaar Act, 2016. The foundational statute is the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (18 of 2016), effective 25 March 2016. It created the Unique Identification Authority of India (UIDAI), the Aadhaar number, and the authentication framework that e-KYC relies on.
The 2018 Supreme Court judgment. In its judgment dated 26 September 2018 (W.P. (Civil) No. 494 of 2012, Justice K.S. Puttaswamy v. Union of India), the Supreme Court upheld Aadhaar as constitutionally valid but read down or struck down several provisions to protect privacy — most importantly Section 57, which had allowed private/body-corporate entities to use Aadhaar. The practical effect: banks and telecom companies could no longer mandate Aadhaar-based e-KYC.
The 2019 amendment. To restore a lawful, consent-based route, Parliament passed the Aadhaar and Other Laws (Amendment) Act, 2019 (14 of 2019), effective 25 July 2019. It deleted Section 57 and amended the Prevention of Money Laundering Act (PMLA) — inserting Section 11A — to permit entities notified by the Central Government (in consultation with UIDAI and RBI) to carry out Aadhaar authentication on a voluntary basis. As the government explained, the amendments also prevent denial of services for refusing to, or being unable to, undergo authentication.
Is Aadhaar e-KYC Mandatory?
No — it is voluntary. This is the single most misunderstood point. After the 2018 judgment and the 2019 amendment, a customer may choose to submit their Aadhaar number for e-KYC, but cannot be compelled to. Under the RBI's Master Direction – Know Your Customer (KYC) Direction, 2016, a customer completing Customer Due Diligence (CDD) may submit an Aadhaar number voluntarily, the proof of possession of Aadhaar, or any other Officially Valid Document (OVD) — plus a Permanent Account Number (PAN) or Form 60. Aadhaar is one lawful option among several, not a gate.
What Are the Limits on OTP-Based e-KYC?
When onboarding is done purely on a One-Time-Password (OTP)-based Aadhaar e-KYC — with no in-person or video verification — the RBI Master Direction places the resulting account in a restricted category. These limits exist because OTP-only authentication is a lighter form of due diligence.
Rule | Limit / condition |
|---|---|
Aggregate balance across all deposit accounts | Not to exceed ₹1 lakh |
Aggregate credits in a financial year (all accounts together) | Not to exceed ₹2 lakh |
Time to complete full CDD | Within one year, else the account is closed |
Customer consent | Specific consent required for OTP-based authentication |
To lift these caps, the customer must complete full KYC — for example through V-CIP or in-person verification. Read how that end-to-end flow works in our explainer on Aadhaar-based e-KYC and digital onboarding.
What Are the Offline and Exception Routes?
Not every customer wants online authentication, and not every RE is permitted to use OTP-based Aadhaar e-KYC. The framework therefore provides offline and alternative routes.
Offline Aadhaar verification. The customer can share a UIDAI-generated Aadhaar Paperless Offline e-KYC (XML) file or an Aadhaar Secure QR code, which the RE verifies without a live UIDAI authentication call. Where these are used in a Video-based Customer Identification Process (V-CIP), the Master Direction requires that the XML or QR generation date be no older than three days from the date of the V-CIP.
Alternatives for those who decline Aadhaar. A customer who does not wish to use Aadhaar can complete KYC with another OVD — passport, driving licence, Voter's Identity Card issued by the Election Commission of India, a NREGA job card signed by a State Government officer, or a letter from the National Population Register — along with PAN or Form 60. No one can be denied service solely for declining Aadhaar authentication.
Who can use what. Under the Master Direction, banks may use OTP-based Aadhaar e-KYC or offline verification; REs other than banks are restricted to offline verification of Aadhaar for V-CIP. For the precise, current position, refer to the Master Direction and the relevant UIDAI circular.
How AI Helps With Aadhaar e-KYC
YuAccess automates the mechanics of compliant Aadhaar e-KYC — validating an Aadhaar Paperless Offline XML or Secure QR code, checking that its generation date is within the permitted window, redacting the Aadhaar number as the Master Direction requires, running face match and liveness during V-CIP, and logging every step for audit. Because Aadhaar is voluntary, YuAccess also routes customers who decline it straight to an OVD-based path without friction. The Regulated Entity keeps responsibility for identification; AI makes each check faster, consistent, and fully traceable.
See related workflows in our guides on CKYC and VKYC automation and how AI supports AML and KYC compliance in banks.
FAQ
Q1. Can a bank refuse to open my account if I don't give Aadhaar? No. Aadhaar authentication is voluntary. You can complete KYC with another Officially Valid Document plus PAN or Form 60, and cannot be denied service solely for declining Aadhaar.
Q2. What did the 2018 Supreme Court judgment change? The judgment dated 26 September 2018 upheld Aadhaar but struck down Section 57, ending mandatory Aadhaar use by private entities. The 2019 amendment then created a voluntary, consent-based route for notified entities.
Q3. What are the account limits for OTP-based Aadhaar e-KYC? The Master Direction caps aggregate balance at ₹1 lakh and aggregate credits in a financial year at ₹2 lakh, and requires full CDD within one year or the account is closed.
Q4. What is offline Aadhaar verification? It uses a UIDAI-generated Aadhaar Paperless Offline e-KYC (XML) file or Secure QR code that an entity verifies without a live UIDAI authentication call — useful when online e-KYC is not available or permitted.
Q5. Which law enables voluntary Aadhaar authentication by banks? The Aadhaar and Other Laws (Amendment) Act, 2019 amended the PMLA (Section 11A) to permit entities notified by the Central Government, in consultation with UIDAI and RBI, to perform Aadhaar authentication voluntarily.
Q6. Is this article legal advice? No. It is an explainer. For binding requirements, refer to the Aadhaar Act, the RBI Master Direction, and the applicable UIDAI circular, and consult your compliance team.
Conclusion
Aadhaar-based e-KYC is powerful but bounded: voluntary by law, limited when done via OTP alone, and always accompanied by non-Aadhaar alternatives. Getting the rules right — the ₹1 lakh and ₹2 lakh caps, the three-day offline window, the OVD fallback — is what separates fast, compliant onboarding from regulatory risk.
Make Aadhaar e-KYC fast and fully compliant. Talk to the YuVerse team to see YuAccess in action.
References
- The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (as amended) — https://uidai.gov.in/images/Aadhaar_Act_2016_as_amended.pdf
- Supreme Court judgment, 26 September 2018 (Puttaswamy) — https://uidai.gov.in/images/news/Judgement_26-Sep-2018.pdf
- The Aadhaar and Other Laws (Amendment) Act, 2019 — https://uidai.gov.in/images/news/Amendment_Act_2019.pdf
- PIB: Cabinet approves Aadhaar and Other Laws (Amendment) Ordinance, 2019 — https://www.pib.gov.in/PressReleasePage.aspx?PRID=1566745
- RBI Master Direction – Know Your Customer (KYC) Direction, 2016 — https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=11566
