AMLR Solutions 
AMLR Consultation
EUDI Wallet
Onboarding
Ongoing Monitoring
FRAML
KYC
KYB
KYI
Age Assurance
Workforce IAM
Candidate Verification
Account Takeover
Bonus/ Promotion Abuse
Chargeback Fraud
Deepfake
Document Fraud
Fraud Networks
Impersonation Fraud
Money Mule Activity
Multi-Accounting
Party Fraud
Regulatory & Compliance Risks
Synthetic Identity Fraud
Adult Content
Banking
Crypto
Fintech
Forex
Compliance
Fraud prevention
Trust & safety
Global expansion
Compliance Officers
Developers
Fraud Analysts
Product Managers
Journey Builder 
Global Trust Platform
Customer Profiles
Vendor Comparison
IDV Case Management
AML Case Management
Regulatory Reporting
Agentic Rule Builder 
AI Compliance Co-Pilot 
Fraud Analytics
Fraud Hub 
OCR
Shufti AI
Bank Account Verification 
Biometric Duplication
Database Checks
Document Intelligence
Government ID
Mobile Driver's License
NFC
Selfie Liveness
Brand Personalisation
Deployment Options
Identity Methods
IDV Modes
Multi-tenancy
On-Premise IDV
Secure Capture
Shufti MCP
- Argentina
- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Cambodia
- Canada
- Chile
- China
- Colombia
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- UAE
- Uganda
- Ukraine
- UK
- USA
- Vietnam
Scale Identity Verification and KYC Operations in India
Verify residents through Aadhaar offline verification, DigiLocker and PAN, and NRIs and foreign nationals through 10,000+ foreign ID document types, run KYB on companies and real owners, and monitor transactions and sanctions lists. One platform runs compliance and fraud prevention across the full customer lifecycle for RBI-, SEBI-, IRDAI- and IFSCA-supervised firms.
Operational Performance for India KYC
Our Numbers Speak Volumes
96.76%
Pass
Rates
Under 5 secs
IDV
Verification
100%
eIDV
Coverage
India IDV/KYC Challenges
Aadhaar Is Voluntary, So Every Journey Needs a Fallback
Section 11A of PMLA keeps Aadhaar optional for KYC and bars storing the Aadhaar number, so firms must offer other officially valid documents alongside it. Shufti runs every route in one flow and masks Aadhaar numbers at capture.
Keeping Customer Risk Current Requires Continuous Monitoring
RBI requires ongoing due diligence and periodic KYC updation, at least every two years for high-risk customers. Shufti checks transactions against each customer's profile, rescreens whenever watchlists change and flags MCA21 director and ownership changes as they happen.
Each Regulator Sets Its Own KYC Rulebook
RBI, SEBI, IRDAI, PFRDA and IFSCA each issue their own KYC rules, and IFSCA demands six-year record retention against five elsewhere. Shufti's AI Journey Builder configures checks and retention by regulator, product and risk tier.
Thin Case Files Weaken FINGate 2.0 Reports
STRs filed to FIU-IND need the identity evidence, transaction history and reasoning behind a suspicion, and any gap invites a follow-up request. Shufti's case management keeps that evidence in one file, structured for FINGate 2.0 submission.
Documents and Languages
Individual Documents Shufti Verifies in India
Shufti verifies 60+ Indian identity documents plus passports and ID cards from other countries. The cards below cover the core documents Indian onboarding relies on, with the full list on the supported documents page.
View All Supported DocumentsAadhaar and DigiLocker Records
Shufti verifies Aadhaar through UIDAI's offline verification, checking the digital signature on the Secure QR code or paperless XML. It also accepts Aadhaar, PAN and driving licence records fetched from DigiLocker, which carry the same standing as physical documents.
Aadhaar Letter and Card
For printed Aadhaar, the proof of possession named as an officially valid document, Shufti reads the English and regional-script fields, matches them to the Secure QR data, detects edits and reprints, and matches the photo to a live selfie.
PAN Card
PAN, allotted under Section 262 of the Income-tax Act, 2025, links a customer's tax and financial records. Shufti reads the card, checks the PAN format and validates the name and date of birth through approved PAN verification routes before an account opens.
Indian Passport and e-Passport
Shufti reads the chip in Indian e-passports by NFC and checks every passport across nine forensic detection layers, from MRZ checksum validation to hologram analysis, so a cloned or altered passport fails before onboarding.
Voter ID, NREGA Job Card and NPR Letter
These officially valid documents under Rule 2(1)(d) of the PML Rules serve customers without a passport or driving licence. Shufti handles their varied print formats and cross-checks the name and address against the customer's other records.
Indian Driving Licence
State-issued licences vary in layout across India. Shufti checks authenticity, expiry and facial match, then confirms licence status against the Parivahan Sarathi database, which helps ride-hailing, delivery and vehicle-rental platforms vet drivers.
Foreign Passports and National ID Cards
Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. NRIs, Overseas Citizens of India and foreign nationals onboard with these documents when Aadhaar is not an option.
Proof of Address
Electricity, water and piped gas bills, property tax receipts and bank statements are verified in the same step as the ID, with the extracted address matched against Aadhaar or the driving licence.
Entity Identity
Certificate of Incorporation and MCA21 Master Data
Shufti checks the CIN or LLPIN against live MCA21 data at every check, confirming the company's status, registered office and directors, and flags any certificate that does not match the registry.
Memorandum and Articles of Association
AI-OCR reads ownership, capital and signing authority, and flags GAN-generated or edited pages.
Board Resolutions and Authorised Signatory Letters
Named signatories are matched to MCA21 directors and verified with ID and face checks before they can act for the company.
Partnership Deeds, Trust Deeds and Udyam Certificates
Registration certificates and deeds are read for partners, trustees and beneficiaries, and Udyam registrations confirm MSME status against the government portal.
Business Address Proof
GST registration addresses, utility bills and rent agreements are cross-checked against the registered office held on MCA21.
Tax Identity
Entity PAN
Shufti validates the company, partnership or trust PAN through approved PAN verification routes and matches the registered name to MCA21.
GSTIN
Issued under the Central Goods and Services Tax Act, 2017. Shufti confirms the GSTIN is active, extracts the legal and trade names and principal place of business, and checks that the PAN embedded in the GSTIN matches the entity PAN.
Foreign Tax Registrations and FATCA/CRS Self-Certification
Foreign-owned entities and overseas parents are verified with their home-country tax registrations, and FATCA and CRS self-certifications are captured in the same flow.
Ownership and Control
Beneficial Owners under Rule 9(3) of the PML Rules
Rule 9(3) sets the threshold at more than 10% for companies and partnership firms, more than 15% for unincorporated associations and 10% or more for trust beneficiaries. Shufti identifies every owner at the threshold that applies and screens each one.
Significant Beneficial Owner Filings
Section 90 of the Companies Act, 2013 requires companies to identify significant beneficial owners and file their details with the Registrar of Companies. Shufti reconciles those filings with the shareholding it maps.
Shareholder Register and Ownership Chart
Shufti maps ownership through intermediate holding companies and screens every person and entity in the chain against MHA's UAPA designations, UN Security Council lists and global watchlists.
Directors, Partners, Trustees and Authorised Signatories
Each person is identity-verified and screened, and Shufti alerts the case owner when MCA21 records a change to the board or signatories.
Languages We Cover
Devanagari, Regional Scripts, English and Expat Document Parsing
Aadhaar prints details in English and a regional language, and NRIs and foreign nationals bring documents in many more scripts. Shufti's OCR reads 150+ languages and scripts at 99.7% accuracy, handles Devanagari natively and averages 93% against Google Vision's 78.4% in its published benchmark. Zero-shot document intelligence reads layouts it has never seen on first sight, without waiting for a template.
Indian Name Matching
Native phonetic models for Hindi, Bengali, Tamil and 80+ languages match transliteration variants, initials-first names and single-name customers in sanctions and PEP screening.
Cross-Document Consistency Checks
Names, dates of birth and identifiers are reconciled across Aadhaar, PAN, passport, voter ID and MCA21 director records, so a spelling variant gets resolved instead of rejected.
Independent Validation
Shufti's Recognition Across Independent Evaluations
Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read More
Regulatory Update
Every Verification Route Indian Regulators Recognize, in One Platform
RBI's Know Your Customer Directions, 2025 recognise Aadhaar authentication and offline verification, DigiLocker documents, CKYCR records, Digital KYC and V-CIP for customer due diligence. Shufti supports each of them, plus chip, document and biometric routes for NRIs, foreign nationals and customers who choose not to use Aadhaar.
Aadhaar Offline Verification
LiveShufti validates UIDAI's digital signature on the Secure QR code or paperless XML, matches the photo to a live selfie and keeps only masked details, with no Aadhaar number or core biometrics stored, as Section 11A(4) of PMLA requires.
Aadhaar OTP and Face Authentication
LiveFor banks and entities notified under Section 11A of PMLA, Shufti runs Aadhaar OTP and face authentication through the entity's own UIDAI AUA/KUA licence, returns the e-KYC data in seconds and logs the response in the case file.
DigiLocker Document Fetch
LiveWith the customer's consent, Shufti pulls issuer-signed Aadhaar, PAN and driving licence records from DigiLocker. These records are accepted at par with physical documents, which removes image capture and forgery risk from the step.
CKYCR Retrieval and Upload
LiveShufti retrieves existing records with the customer's KYC identifier and prepares new records for upload within the ten-day window in Rule 9(1A) of the PML Rules, so returning customers skip repeat checks.
Video-based Customer Identification (V-CIP)
LiveAgent-led sessions in the language your customers use capture live geo-tagging, liveness and face matching, block non-Indian IP addresses and record the full session, following paragraphs 26 and 27 of RBI's KYC Directions. The same flow covers SEBI's VIPV and IRDAI's VBIP.
Digital KYC
LiveFor assisted onboarding, Shufti captures the customer's live photo watermarked with latitude, longitude, date and time, as paragraph 24 of RBI's KYC Directions sets out, and verifies the officially valid document in the same session.
NFC Chip Verification
LiveShufti reads the chip in Indian e-passports and most foreign biometric passports and checks it against the printed data page, the high-assurance route for NRIs and foreign nationals who cannot use Aadhaar or DigiLocker.
Document and Face Biometric
LiveDocument checks paired with iBeta Level 3 liveness and face matching cover every officially valid document, including voter IDs, NREGA job cards and driving licences, the route most customers outside Aadhaar and DigiLocker take.
Fraud Prevention Across the Indian Customer Journey
Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help Indian businesses act on risk while keeping legitimate customers moving.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Capture guidance for Aadhaar, PAN and state-issued licences catches glare, cropping and bilingual field errors before submission, so customers rarely repeat a step.
Cleaner Audit Trails
Shufti's case management records sources, results, timestamps, evidence, analyst notes and decision history, packaged as report-ready bundles for STR and CTR filing through FINGate 2.0.
One Workflow, One Back Office
Unify KYC, KYB, AML screening and transaction monitoring in one case file. Perpetual KYC/KYB tracks ownership, director and transaction changes across the compliance lifecycle.
Aadhaar and DigiLocker-First Flow Design
Residents verify through Aadhaar offline verification or DigiLocker first, while NRIs and foreign nationals move to passport and NFC checks in the same flow.
Shufti's IDV/KYC Solutions for India
KYC Solutions
Indian onboarding serves residents who use Aadhaar, residents who decline it, NRIs and foreign nationals. One Shufti flow routes each by risk, so nobody faces checks they don't need.
Explore More
Face Verification
Remote onboarding in India depends on a selfie matched to an Aadhaar, passport or licence photo. Shufti's face matching delivers a 99.5% first-try pass rate, and DHS RIVR 2025 testing measured a false match rate below 0.001, so impostors stop at the first step.
.
Age Verification
India's online gaming rules expect registered platforms to age-gate users, and many services restrict minors. Shufti estimates age from a selfie in under 5 seconds, blocks 99.8% of underage attempts and falls back to a document check when needed.
.
Bank Account Verification
Payouts and loan disbursals fail when an account number, IFSC or holder name is wrong. Shufti validates Indian account numbers and IFSC codes and matches the account holder's name in real time, so funds reach the verified customer.
.
Address Verification
Utility bills, property tax receipts and bank statements vary by state and provider. Shufti's layout-aware extraction and fuzzy matching verify them against the ID address at a 99.3% pass rate, with docless checks in under 3 seconds.
.
Document Verification
Indian onboarding draws on Aadhaar, PAN, passports, voter IDs, NREGA job cards and state licences. Shufti verifies each within seconds, reading bilingual fields and catching edits, reprints and synthetic documents before they reach a reviewer.
.
Identity Verification
Separate tools for documents, selfies, Aadhaar and addresses split one customer across several records. Shufti runs document, biometric, NFC, address and eIDV checks in one API session, so each customer has one verified identity and one audit trail.
.KYB Solutions
Indian corporate onboarding means reconciling MCA21 records, GSTINs and ownership that often runs through several holding companies, measured against the beneficial owner thresholds in Rule 9(3) of the PML Rules.
Explore More
Business Verification
Onboarding an Indian company means confirming its CIN, PAN, GSTIN, signatories and everyone who owns or controls more than 10%. Shufti's live registry call pulls that picture together in one check, putting corporate onboarding under two minutes.
.
Enhanced Due Diligence
Layered ownership, high-risk sectors, PEP links and mismatched GST and MCA21 data call for a deeper review. Shufti's branching questionnaires, configurable risk scoring and UBO verification links gather the evidence, and every answer lands in the case file.
.AML Screening
A customer who is clean at onboarding can land on a list next week. Shufti's perpetual KYC rescreens every customer against 4,000+ watchlists, including MHA's UAPA designations and the UN Security Council lists, refreshed every 15 minutes, with every hit kept in one case file.
Explore More
Business AML Screening
A company's risk often sits with its owners and directors. Shufti screens entities, beneficial owners and directors against sanctions lists including MHA's designations, PEP lists and 50,000+ adverse media sources in 80+ languages, and perpetual KYB rescreens the portfolio when any of them change.
.
Transaction Monitoring
Real-time UPI and IMPS payments leave little time to catch layering before funds move on. Shufti's library of 500+ pre-built rules covers structuring, smurfing and mule activity with 60% fewer false positives, and alerts flow into case management ready for FIU-IND reporting.
.
Travel Rule
FIU-IND's guidelines for virtual digital asset service providers require originator and beneficiary details to accompany VDA transfers. Shufti's single integration connects to major Travel Rule networks, exchanges IVMS101 data and confirms unhosted wallet ownership.
.
AI Compliance Co-Pilot
One common name can return 140+ screening hits. Shufti's AI Compliance Co-Pilot reviews every hit and gives a confidence score with a written reason, while the Principal Officer keeps the final call and every override is logged.
.Built To Fit India's Compliance Landscape
PMLA and the PML Rules apply to every reporting entity in India, while RBI, SEBI, IRDAI, PFRDA and IFSCA each add their own KYC rulebook. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each licence your group holds.
Prevention of Money-Laundering Act, 2002 and PML Rules, 2005
PMLA sets identity verification options in Section 11A and record keeping in Section 12, keeping transaction records five years and identity records five years after a relationship ends. Rule 9(3) of the PML Rules defines beneficial owners, and Rule 3 lists reportable transactions, including cash above INR 10 lakh.
Reserve Bank of India (RBI)
On 28 November 2025, RBI issued separate Know Your Customer Directions for each type of regulated entity, replacing the 2016 KYC Master Direction. They govern V-CIP, Digital KYC, CKYCR use and ongoing due diligence, with periodic updation every two, eight or ten years depending on risk.
Financial Intelligence Unit - India (FIU-IND)
FIU-IND receives reports through FINGate 2.0, part of its FINnet 2.0 system, including suspicious transaction reports, cash transaction reports and cross-border wire transfer reports. Rule 8 of the PML Rules requires suspicious transactions to be reported promptly, and each day of delay counts as a separate violation.
Securities and Exchange Board of India (SEBI)
SEBI's KYC Master Circular of 12 October 2023 governs client onboarding through KYC Registration Agencies, Aadhaar e-KYC, DigiLocker documents and video in-person verification. Its AML and CFT Master Circular of 6 June 2024 sets intermediaries' monitoring, reporting and five-year record-keeping duties.
Insurance Regulatory and Development Authority of India (IRDAI)
IRDAI's Master Guidelines on AML and CFT, 2022, in force since 1 November 2022, set customer due diligence, beneficial ownership and five-year record-keeping duties for insurers. They also permit an optional Video Based Identification Process for remote onboarding and set conditions for relying on KYC carried out by third parties.
International Financial Services Centres Authority (IFSCA)
IFSCA regulates financial firms in GIFT City under its own AML, CTF and KYC Guidelines, 2022, last updated on 2 January 2026. These guidelines form a regime separate from the mainland rules and require records to be kept for at least six years, a year longer than PMLA.
Pension Fund Regulatory and Development Authority (PFRDA)
PFRDA's Master Circular on KYC, AML and CFT, updated on 25 September 2025, covers subscriber onboarding for pension intermediaries. It recognises video-based KYC, DigiLocker documents, Aadhaar e-KYC including face authentication, and Digital KYC as onboarding routes, with records kept for five years in line with PMLA.
FIU-IND Guidelines for Virtual Digital Asset Service Providers
VDA service providers became PMLA reporting entities on 7 March 2023 and must register with FIU-IND. FIU-IND's AML and CFT guidelines, updated on 8 January 2026, require originator and beneficiary details to travel with VDA transfers and set controls for unhosted wallets and anonymity-enhancing tokens.
Designated Non-Financial Businesses and Professions
Dealers in precious metals and stones became reporting entities on 28 December 2020 for cash transactions of INR 10 lakh or more. Real estate agents, trust and company service providers and, for specified transactions, chartered accountants, company secretaries and cost accountants also carry PMLA duties.
Unique Identification Authority of India (UIDAI)
UIDAI issues Aadhaar under the Aadhaar Act, 2016 and governs authentication and offline verification under the Aadhaar (Authentication and Offline Verification) Regulations, 2021. Section 11A of PMLA keeps Aadhaar voluntary for KYC and bars reporting entities from storing the Aadhaar number or core biometrics.
DigiLocker
Documents issued into DigiLocker are accepted at par with physical documents under Rule 9A of the Digital Locker Rules, 2016. The PML Rules treat them as equivalent e-documents for KYC, and both RBI and SEBI accept them for customer onboarding, so a fetched record can replace a scanned copy.
Ministry of Corporate Affairs (MCA)
MCA holds company and LLP records on MCA21, including the CIN, LLPIN, registered office, directors and filing status. Section 90 of the Companies Act, 2013 requires companies to identify their significant beneficial owners and file those details with the Registrar of Companies.
Central KYC Records Registry (CKYCR)
CERSAI operates the CKYCR, authorised by Gazette notification S.O. 3183(E) of 26 November 2015. Rule 9(1A) of the PML Rules requires reporting entities to file a customer's KYC record with the registry within ten days of starting an account-based relationship, after which other institutions can retrieve it by KYC identifier.
Ministry of Home Affairs (MHA)
MHA publishes the individuals and organisations designated under the Unlawful Activities (Prevention) Act, 1967, and its Section 51A order of 2 February 2021 sets the asset-freezing process. RBI's KYC Directions also require screening against the UN Security Council ISIL, Al-Qaida and Taliban lists.
India Data Residency and Deployment
Shufti runs in Indian cloud regions, including AWS Asia Pacific (Mumbai and Hyderabad) and Google Cloud (Mumbai and Delhi NCR), or on-premises for stricter localisation needs. Hosting locations and any transfer arrangements are set in the agreement, which supports RBI's rule that payment system data stays in India.
Digital Personal Data Protection Act, 2023 (DPDP Act)
The DPDP Rules, 2025 were notified on 13 November 2025, with most duties applying from May 2027. Shufti protects identity and biometric data with encryption, role-based access controls and configurable retention, and supports consent records and erasure requests once a purpose ends.
Aadhaar Data Handling
Section 11A of PMLA bars storing the Aadhaar number or core biometrics, and RBI requires the number to be redacted on stored copies. Shufti masks Aadhaar numbers at capture, keeps only the reference data a check needs and logs every access to the record.
Retention Controls
Retention is configurable by client and licence, covering PMLA's five-year minimum and IFSCA's six years. Statutory minimums are not automatic deletion dates, and legal holds keep records under investigation or litigation for as long as they are needed.
Encryption and Security
Data is encrypted in transit and at rest, with role-based access and audit logging throughout. ISO 27001:2022 and SOC 2 Type 2 reports support vendor assessments under RBI's outsourcing directions, and security logs are kept within India for CERT-In's 180-day period.
Explainable Decisions and Grievances
The DPDP Act gives every individual a right to grievance redressal. Shufti returns verification results and supporting reasons through the API and back office, so support teams can explain an outcome, answer a grievance and escalate a disputed result to a reviewer.
Scope of Our Role
Shufti processes personal data as a Data Processor on the firm's instructions under Section 8(2) of the DPDP Act. The firm remains the Data Fiduciary responsible for notice, consent and compliance, and Shufti's privacy notice identifies any activity it carries out independently.
Data Residency and Privacy Controls in India
India AML Sources That Strengthen Decisions
Financial Intelligence Unit - India (FIU-IND)
Reserve Bank of India (RBI)
Securities and Exchange Board of India (SEBI)
Directorate of Enforcement (ED)
Ministry of Home Affairs: Banned Organisations (UAPA)
Ministry of Finance, India
Ministry of Corporate Affairs (MCA)
Goods and Services Tax Network (GSTN)
Insurance Regulatory and Development Authority of India (IRDAI)
International Financial Services Centres Authority (IFSCA)
Financial Action Task Force (FATF)
Asia/Pacific Group on Money Laundering (APG)
United Nations Security Council Consolidated List
Egmont Group of Financial Intelligence Units
Basel Committee on Banking Supervision
Turn India Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.
Certified to Global Standards
PROVEN WORKFLOWS
Identity Verification Built Around Your Industry in India
Onboard And Re-KYC Customers Under RBI's 2025 Directions
Commercial banks now follow RBI's Know Your Customer Directions, 2025, which cover V-CIP, CKYCR uploads and risk-based periodic updation. Shufti runs Aadhaar offline verification, DigiLocker fetches and V-CIP in one flow, prepares CKYCR uploads and rescreens customers continuously, so re-KYC falls due on schedule instead of piling into a backlog.
Frequently Asked Questions
Does Shufti support Aadhaar, and what happens when customers cannot use it?
Yes. Shufti verifies Aadhaar through offline verification, DigiLocker and, for eligible entities, OTP or face authentication. Section 11A of PMLA keeps Aadhaar voluntary, so customers without it, or who decline it, move to passport, voter ID, driving licence or V-CIP in the same flow.
Is a photo of an Aadhaar card enough, or should verification check its digital signature?
A photo shows what is printed, which can be edited. Shufti validates UIDAI's digital signature on the Secure QR code or paperless XML and compares the signed data with the printed fields and the customer's selfie, so an altered card fails the check.
Can Shufti verify foreign documents or identity formats it has not encountered before?
Yes. Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new formats in minutes. NRIs, Overseas Citizens of India and foreign nationals can onboard with their own passports or national IDs, with NFC chip reads where available.
How does Shufti read bilingual Aadhaar cards and regional-script documents?
Shufti's OCR reads both the English and regional-language fields on Aadhaar and handles Devanagari natively, across 150+ languages at 99.7% accuracy. Names are then reconciled by transliteration across PAN, passport and voter ID, so spelling variants do not trigger false rejections.
How does Shufti verify ownership when an Indian company has several corporate layers?
Shufti pulls MCA21 records for each company in the chain, maps shareholdings through every holding entity and identifies owners above the Rule 9(3) thresholds, more than 10% for companies. Each owner is identity-verified and screened, and the chart is stored with its sources.
Does Shufti's ongoing monitoring cover more than sanctions screening?
Yes. RBI's KYC Directions require ongoing due diligence and a review of risk categorisation at least every six months. Shufti monitors transactions against each customer's profile, tracks MCA21 director and ownership changes, and triggers periodic updation when risk or documents change.
How does Shufti keep screening current and handle Indian name variations?
Watchlists, including MHA's UAPA designations and UN Security Council lists, refresh every 15 minutes. Native phonetic models for Hindi, Bengali, Tamil and other Indian languages match transliterated spellings, initials and name-order differences, and the AI Compliance Co-Pilot clears obvious false positives with written reasons.
Can we choose India hosting or run verification inside our own infrastructure?
Yes. Shufti runs in Indian cloud regions in Mumbai, Hyderabad and Delhi NCR, or on-premises inside your own infrastructure, including air-gapped deployments. Hosting locations are written into the agreement, which helps firms keep payment data in India under RBI's localisation rule.
What controls help us protect identity and biometric data?
Shufti encrypts data in transit and at rest, applies role-based access controls and logs every access. Aadhaar numbers are masked at capture and never stored, retention is configurable, and ISO 27001:2022 and SOC 2 Type 2 reports support your vendor due diligence.
Can we configure different retention periods for different Indian licences?
Yes. Retention is set per client, licence and record type, so a group can keep records five years under PMLA and six years for its IFSCA entity in GIFT City. Legal holds extend retention for records under investigation or litigation.
What does Shufti provide when our compliance team needs to file a report on FINGate 2.0?
Shufti's case file holds the customer's verified identity, screening results, transaction history, alerts and analyst notes in one place. Report-ready bundles let your Principal Officer file STRs and CTRs on FINGate 2.0 without rebuilding the evidence by hand.
Can we add verification checks without rebuilding our onboarding journey?
Yes. The AI Journey Builder adds or reorders checks such as DigiLocker, PAN validation, V-CIP or address verification without code changes. Routing rules apply them by product, risk tier or customer type, so existing journeys keep running while new steps go live.
How does Shufti make verification queries easier for our customer support team?
Every decision is shown in the back office with the reason, the failed check and the captured evidence. Support teams can tell a customer exactly what to resubmit, such as a glare-free Aadhaar image, and escalate disputed results to a reviewer.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
16 April, 2026
Face Verification: APAC
Covers APAC's biometric rules, from India's DPDP Act to Korea's AI Framework Act and China's facial recognition provisions, and how Shufti deploys face checks.
Regional Brief
