The start-up ecosystem in India has experienced remarkable growth over the past decade. From just 471 start-ups in 2016, there are now over 143,000 enterprises recognised by the Department for Promotion of Industry and Internal Trade (DPIIT), including more than 100 unicorns. This surge is primarily driven by the Fintech sector, which is projected to reach a market size of $150 billion by 2025. By the end of this year, the sector's Assets Under Management (AUM) are expected to surpass $1 trillion. With the help of integrated ecosystems like Unified Payments Interface (UPI), Immediate Payment Service (IMPS), prepaid payment instruments (PPIs), and the National Electronic Toll Collection (NETC), India recorded over 80 billion digital transactions worth $36.5 trillion in FY22. This growth trajectory paints a promising future for the Fintech sector in India.
However, the sector's promising growth has been marred by instances of financial misconduct and improprieties. The Reserve Bank of India's (RBI) Annual Report for 2021–22 noted a 34% increase in frauds involving cards and internet banking, with 3,596 reported cases in FY22. The industry has faced issues such as fraudulent UPI transactions, e-wallet thefts, KYC data breaches, and loan app scams, leading to a trust deficit. To combat these challenges, regulators like the RBI, the Securities and Exchange Board of India (SEBI), and the Insurance Regulatory and Development Authority (IRDAI) have implemented regulations such as the RBI Master Direction on Know Your Customer (KYC), SEBI's KYC Registration Agency Regulations, and IRDAI's AML/CFT guidelines.
The RBI's master directions require companies to adopt a risk-based approach to KYC, with board-approved policies for periodic updates. They must test the Video Customer Identification Process (V-CIP) application software before use and establish standard operating procedures (SOPs) to ensure the integrity of the process. The V-CIP software must be capable of rejecting connection requests from spoofed or foreign IP addresses, and video recordings must include geo-tagging and date-time stamps. The system should also be able to detect spoofing and verify the authenticity of the interaction. Trained officials must conduct these processes.
KYC procedures are not just a formality, but a crucial step for verifying transaction authenticity and the identity of individuals involved. These guidelines align with the Financial Action Task Force's (FATF) recommendations on Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) standards. They help institutions avoid transactions related to corruption, terrorism financing, fraud, and money laundering. Therefore, regulators must ensure these regulations are implemented both in letter and spirit, as they are the cornerstone of a secure and trustworthy financial system.
The Fintech sector is heavily funded by Venture Capital (VC) firms, which expect high growth rates. This often translates into a focus on rapid client acquisition, incentivising shorter onboarding processes. Lengthy onboarding can result in high drop-off rates, where users abandon the process before becoming customers. Some Fintech companies have been known to cut corners with KYC requirements to expedite onboarding, allowing incomplete verifications. This has led to unethical practices, such as mis-selling, high-interest charges, and aggressive loan recovery tactics. Recently, the RBI imposed monetary penalties on several financial service providers for violating KYC and AML regulations. In her 2023 budget speech, the Finance Minister announced plans to simplify the KYC process by adopting a risk-based approach.
Current KYC regulations require customers to provide proof of both current and permanent addresses, which can be challenging for certain groups, such as migrant workers and nomadic communities, who may lack permanent addresses or valid documents. Technological solutions like electronic KYC (eKYC) and video KYC have been introduced to streamline the process. However, only ID documents authenticated by the DigiLocker e-Sign facility are accepted for video KYC, limiting access for those without a DigiLocker account, which requires an Aadhaar number. Additionally, bank officials must conduct video KYC in real-time, making it resource-intensive and challenging to scale. The digital divide further complicates video KYC adoption.
KYC regulations need to be more flexible to accommodate the Fintech industry's fast-paced nature. Expanding the scope of the Central KYC Registry (CKYCR), a centralised repository of customer KYC information, could help streamline the process. Currently, only regulated entities can access CKYCR data for customers with existing relationships. Allowing moderated access to this registry could enable Fintech companies to expedite onboarding. As more individuals complete their KYCs, the need for individual verifications will diminish. Additionally, Fintech companies could share and access KYC data for customers already using or interested in other financial services, leveraging the Digital Personal Data Protection Act, which permits individuals to consent to sharing sensitive personal data, to facilitate a smoother onboarding process.