Rachel Chitra and Digbijay Mishra | TNN | Apr 5, 2018, 09:00 IST
In a move that seems to have left fintech players scrambling, Unique Identification Authority of India (UIDAI), on Tuesday revoked their access to a dozen agencies that provide e-KYC verification and authentication services. Some of these agencies -- KUAs (e-KYC user agencies) and AUAs (authorized user agencies) -- will no longer be able to provide e-KYC verification to onboard new customers or authenticate financial transactions affecting e-wallets, online lenders, NFBCs and smaller fintech players.
Many fintech players are not AUAs or KUAs themselves but sub-KUAs and sub-AUAs , routing their requests through UIDAI's network.The recent development will affect these companies, particularly e-commerce players and peer-to-peer lending platforms, which operate on a completely online model.
They will now have to change their mode of doing business and incur higher costs to physically verify the credentials of their customers.
"This is detrimental to fintech companies which rely on e-KYC for user verification and on-boarding. A physical KYC costs about Rs 100 per person while the same is roughly Rs 15 when it is done vi e-KYC. The problem started since yesterday and we are talking to all stakeholders to regarding this major problem," Jitendra Gupta, MD f digital payments company PayU India, told TOI.
PayU which has a pay later service called LazyPay on an average on-boards about 40,000-50,000 users every day and conducting physical KYC for them would be a costly affair.
Even players like payments bank Paytm, Airtel and Jio were unaffected; as is the case with some wallets like Mobikwik but three other players said their access has been revoked, but did not wish to comment.
UIDAI did not respond to a request for a comment. But UIDAI officials said they are yet to understand the situation and certain approvals might have been revoked after a CERT-In empanelled IT security audit. An earlier security audit in September 2017, saw UIDAI blacklisting 49,000 enrollment centres.
UIDAI's current list of 255 KUAs, include top banks like State Bank of India, Punjab National Bank, ICICI Bank, while its list of 310 AUAs, include players like Aircel, AIIMS, CDSL, CIBIL, among others. Many banks, including SBI, PNB, act as both AUAs (for financial authentication) and KUAs (for e-KYC verification).
On PayU's Gupta's tweet, "Aadhar stopped all KUA and sub KUA to do validations!! Suddenly, all fintech businesses banking on Aadhar left scrambling!! India stack story will crumble very soon if it continues in this manner. @India_Stack @NandanNilekani @UIDAI." Gupta later clarified he meant AUA and not KUA. A UIDAI official responded, "It is an exaggeration to say access has been revoked to all KUAs. Some KUAs might have been barred post-audit for various reasons, lack of compliance, technical lethargy, etc."
For some players like KrazyBee, their access was revoked much earlier. "In December itself, the KUA we tied-up with lost its license to operate. Since January, we have had to do physical verification or get e-signatures from our customers," said Madhusudan, CEO, KrazyBee.
"We feel the older method of e-KYC verification was more fraud-proof. With e-signatures there is a higher possibility of people forging documents before uploading it online. We've had to make our processes more stringent after we were forced to move to this," Madhusudan said.
A chief digital officer at a private bank said UIDAI's actions against KUAs are based on reports that they were storing customers' data on their devices and attempting to create parallel databases by industry-wide collaboration on the dark web.
"Finte-tech startups have largely built their businesses on the back of eKYC compared to large banks, NBFCs among others. The API access might be given back again in a week or so but that would mean significant loss of business for these companies," said founder of a company which helps several startups in e-KYC for on-boarding users.
