PAN, Video KYC, and Identity Verification Under RBI’s Digital Lending Rules

The regulated bank or NBFC issuing the loan holds sole legal accountability for verifying the borrower.

In digital lending setups, banks and NBFCs often partner with technology firms called Lending Service Providers (LSPs). These partners run consumer-facing Digital Lending Apps (DLAs). These apps collect borrower details, run credit checks, and display loan offers.

Under central bank rules, hiring an LSP does not transfer legal duty. The balance-sheet lender remains solely responsible for Customer Due Diligence (CDD) and KYC compliance. An LSP acts only as an outsourced vendor. If a partner app fails to verify an applicant properly, the regulatory penalty hits the lender, not the app maker.

To protect borrowers, the central bank set up a public directory on its Centralised Information Management System. Lenders must log all active lending apps on this portal. Borrowers can use it to verify whether an app links to a licensed bank or NBFC.

Digital lending apps may access camera, microphone, and location hardware only for a one-time onboarding check, and only with explicit borrower consent.

In the past, predatory loan apps accessed phone contact lists, photos, call logs, and continuous GPS location. The 2025 digital lending rules ban this practice entirely.

Loan apps cannot demand broad phone access. Apps may only request access to the camera, microphone, and location during the live verification check. Once the borrower takes the live selfie or finishes the video call, the app must stop accessing those sensors.

Loan apps and tech partners are also strictly barred from saving applicant biometric data. Fingerprint scans and iris data must never touch an LSP server. In addition, all borrower records must stay on physical servers located within India.

Aadhaar OTP verification enables fast online onboarding, but statutory rules cap borrowal accounts at small term loans.

Under Section 17 of the Reserve Bank of India KYC Directions for commercial banks, lenders can onboard individuals remotely using Aadhaar OTP. This non-face-to-face method verifies identity via a one-time code sent to the mobile number registered with UIDAI.

Because this channel has no live human check, the central bank sets strict limits:

• Term loan cap: Total term loans sanctioned through OTP e-KYC cannot exceed ₹60,000 per year.
• Deposit limits: Total deposits cannot exceed ₹1,00,000 across all accounts, and yearly credits cannot exceed ₹2,00,000.
• Single account rule: A borrower can open only one OTP-based account with an institution.
• One-year time limit: The borrower must complete full customer due diligence within one year.

If one year passes without full checks, the account freezes. The lender cannot allow further debits or new loan disbursals until the borrower completes an in-person check or a video verification session.

Lenders must run a Video-based Customer Identification Process (V-CIP) whenever loans exceed the ₹60,000 yearly cap, or when an OTP account reaches the one-year mark.

Section 18 of the KYC directions treats V-CIP as a full digital equivalent to branch visits. Completing V-CIP removes the ₹60,000 cap. It lets lenders grant higher credit lines and personal loans.

Under central bank rules, V-CIP requires a live video call run by an authorized bank or NBFC staff member. The video system must meet five core requirements:

The video call recording must be encrypted, tamper-proof, and date-stamped. Lenders cannot store raw video files on unapproved third-party servers.

Permanent Account Number (PAN) validation is required by tax law for all credit accounts to verify borrower identity and stop synthetic fraud.

Under Section 139A of the Income-tax Act, 1961, every person opening an account or taking credit must quote a PAN. In addition, Rule 114B of the Income-tax Rules, 1962 lists loan applications as transactions where quoting a PAN is compulsory.

In digital lending, manual checks take too long. Lenders connect through automated APIs to official databases. These systems match the applicant’s name, birth date, and status in seconds. This step confirms the tax profile is real and stops fraudsters from using fake identities.

When multiple lenders share an app platform or co-lend funds, each institution must maintain clear compliance boundaries.

Digital loan aggregators often list offers from several banks or NBFCs. A legal analysis from Cyril Amarchand Mangaldas notes that the 2025 digital lending directions require multi-lender apps to show an unbiased list of all approved loan options. This prevents apps from secretly favoring one partner.

In co-lending setups under the Reserve Bank of India Co-Lending Directions, a bank and an NBFC fund a loan together. Both lenders remain legally responsible for proper due diligence. One lender may run the customer collection steps, but both balance-sheet partners must ensure the verification followed central bank rules.

Identity files, V-CIP call tapes, and consent records cannot be erased when a loan is paid off.

Under Rule 9 of the Prevention of Money-Laundering Rules, lenders must keep customer identification documents and transaction logs for at least five years after the account closes.

The digital lending rules give borrowers the right to withdraw consent and ask for data deletion. However, this right does not override statutory record laws. A borrower can ask a lender to delete promotional data, but the lender must keep core KYC files, PAN logs, and V-CIP video files for five full years.

The balance between borrower convenience and strict regulatory compliance shapes digital lending workflows across India.

Read together, the digital lending rules and KYC directions point to three clear practical lessons:

• Automated upgrade paths: OTP-based Aadhaar signups work well for small, instant loans, but they are a temporary step. Lenders that issue loans under the ₹60,000 cap need automated upgrade paths. When a borrower needs a larger loan or nears the one-year mark, the app should guide them into a live V-CIP call without drop-off.
• Charter alignment: Rule books differ by lender charter. As detailed in the Reserve Bank of India KYC Directions for NBFCs, paragraph numbering and compliance details differ between banks and NBFCs. Tech platforms working with multiple lenders must ensure their verification journeys fit each partner’s specific rule set.
• Coordinated fraud prevention: Checking a PAN, validating Aadhaar data, running liveness scans, and verifying GPS tags must work together in real time. Top digital lenders treat identity checks as a connected chain that prevents synthetic fraud while keeping approvals fast.

To learn more about electronic verification methods, read our guides on eKYC and digital KYC verification, the technical process behind Video KYC and V-CIP, and automated PAN verification standards.