22 October 2013, 12:59 AM IST
Banks and the government’s Aadhhar project have had a symbiotic relationship since its launch in 2009. For the government, banks were integral to the concept of direct benefit transfer – the raison d'être for Aadhaar and banks on their part supported the scheme as this would open up a whole new market for them.
The regulator Reserve Bank of India’s attitude has however swung from ambivalence to being a strong supporter. In September 2011, it told banks that they must obtain proof of address even if an applicant produces an Aadhaar card. But soon thereafter it said that the Aadhaar card was good enough for both address and identity proof. More recently, it approved eKYC where the bank does not even need the Aadhaar card but the number and a biometric authentication which will be good enough for opening a new bank account without any other document. It has also asked banks to ensure that all ATMs have the capability to facilitate Aadhaar authentication. In his opening statement, RBI governor Raghuram Rajan articulated how he foresaw Aadhaar being used to build up individual credit profiles by linking credit histories to Aadhaar numbers.
It is true that Aadhaar opens endless possibilities in financial inclusion. Biometric authentication would allow even those with mere numeric literacy operate ATMs and withdraw funds without cards. To an unbanked segment that is illiterate, it is superior to the PIN feature as the concept of password secrecy and liability for sharing passwords need not be instilled on the customer. Linking credit profiles to Aadhaar would allow borrowers to walk into a branch and verify his loan eligibility with a mere thumb scan. Banks can using eKYC do away with detailed application forms or photocopies as they would be pulling all information including photograph into their systems without having to bother about even data entry.
But at some level there are concerns. By tying up so many aspects of banking to an infant system the headroom for errors are considerably reduced. This is risky as history has demonstrated that well intended security measures have the potential to fail. For instance a decade ago, Sony had launched copy-proof CDs in its battle against copyright violation. As it turned out the CDs could be copied by scribbling around the rim of the disk with a marker pen. In June this year, Jacob Appelbaum, computer security researcher and a spokesperson for WikiLeaks had claimed in an interview that it costs less than a dollar to get a transferable fingerprint.
A banker in the credit card division of bank points out that when credit card gets skimmed it can be hot listed and replaced but a biometric print is for life. The other weakness appears to be that a system does not appear to be in place for constant updation of individual information. At present individuals are enrolled into the UIDAI through camps there are no permanent channels that are available for individuals. A system is not in place yet for issuing Aadhaar numbers along with a birth certificate. RBI’s norms require that banks periodically verify an individuals address as part of know your customer guidelines. UIDAI however has not put in place an infrastructure for periodic checks for any change in address of those who are issued a number.
In the case of security of transactions, RBI has historically not dictated any format but merely said that banks need to have in place multi-factor authentication. This means that a card transaction should require a card swipe, a signature and a pin. Rather than dictate what the additional factor should be the best way forward would be to allow banks decide on the factor that works best. Translated into English Aadhaar stands for base or foundation. Before building superstructure on it, the government needs to let Aadhaar set properly.
