India's Digital Identity Stack: Aadhaar, DigiLocker, and the Future of Verification

Aadhaar: The Foundation

What Aadhaar Is

Aadhaar is a 12-digit unique identification number issued by the Unique Identification Authority of India (UIDAI) to every Indian resident. The number is linked to biometric data — ten fingerprints, two iris scans, and a facial photograph — along with demographic information including name, date of birth, gender, and address.

With over 1.4 billion enrollments, Aadhaar covers virtually the entire Indian population. It serves as the foundational identity layer for financial services, government benefits distribution, tax compliance, and increasingly, private sector verification.

eKYC: Electronic Know Your Customer

Aadhaar enables eKYC — a real-time identity verification method where the customer authenticates against the Aadhaar database and the verified identity data is shared directly with the requesting institution. No physical documents change hands.

eKYC operates through two methods. Biometric eKYC requires the customer to authenticate using their fingerprint or iris scan at an authorized device. The biometric is matched against the Aadhaar database, and upon successful authentication, the customer's identity data is shared with the institution. OTP eKYC sends a one-time password to the mobile number registered with Aadhaar. Upon entering the correct OTP, the identity data is shared.

Biometric eKYC provides higher assurance than OTP eKYC because it confirms physical presence. However, OTP eKYC enables fully remote verification, which is critical for digital-first platforms serving customers without access to biometric devices.

Video KYC

The Reserve Bank of India introduced Video KYC in 2020, allowing financial institutions to verify customer identity through a live video interaction. During the call, the customer presents their identity document, the agent verifies the document and matches it against the customer's face, and the session is recorded for audit purposes.

Video KYC bridges the gap between fully remote eKYC and in-person verification, providing higher assurance than OTP eKYC while remaining accessible to customers without biometric devices. It has become the standard for high-value account openings and financial product applications.

DigiLocker: The Digital Document Vault

DigiLocker is a government-backed platform that allows Indian citizens to store and share verified digital copies of their identity documents. Documents stored in DigiLocker are issued directly by the originating government agencies and carry the same legal validity as physical originals.

The platform supports a growing range of documents including Aadhaar, PAN card, driving license, vehicle registration, educational certificates, and insurance policies. For verification purposes, DigiLocker provides a secure channel for customers to share authenticated documents without the risk of physical document forgery.

For verification providers, DigiLocker integration means receiving documents that are pre-authenticated by the issuing agency — eliminating one layer of fraud risk. However, DigiLocker adoption is still growing, and most verification flows must continue to support traditional document capture alongside DigiLocker-sourced documents.

The PAN Card Problem

India's Permanent Account Number (PAN) card is the country's tax identification document, issued by the Income Tax Department. It is required for most financial transactions above specified thresholds and is widely used as identity documentation.

It is also the single most targeted identity document on the planet, accounting for 27% of all document fraud attempts globally.

The PAN card's vulnerability stems from its design. Compared to modern passports with NFC chips, holographic security features, and machine-readable zones, the PAN card is relatively simple: a laminated card with a printed photo, name, date of birth, and PAN number. Older PAN cards have minimal security features, and the lamination degrades over time, making legitimate cards appear questionable while sophisticated forgeries appear pristine.

The Income Tax Department's PAN verification API allows real-time validation of PAN numbers against the official database — confirming that the number exists, is active, and matches the provided name. This database check is essential but not sufficient: it confirms the PAN number is real, not that the physical card presented is genuine. Document authentication that evaluates the card's visual characteristics, print quality, and security features must supplement database verification.

CKYC: Central KYC Registry

The Central KYC Registry (CKYC), operated by the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI), is designed to eliminate redundant KYC. When a customer completes KYC with one financial institution, the verified data is uploaded to CKYC. Subsequent institutions can retrieve the verified data using the customer's CKYC Identifier (KIN), avoiding the need for the customer to repeat the verification process.

CKYC reduces friction for customers who interact with multiple financial institutions and reduces the compliance burden on institutions that can rely on a previously verified identity. For verification providers, CKYC integration enables a "verify once, use many times" model that is particularly valuable in India's fragmented financial services landscape.

The Privacy Dimension

India's approach to digital identity has not been without controversy. The Supreme Court of India's landmark 2017 judgment in Justice K.S. Puttaswamy v. Union of India affirmed the right to privacy as a fundamental right under the Indian Constitution. The court held that Aadhaar could be required for government benefits and tax filing but could not be mandated for all private sector transactions.

The Digital Personal Data Protection Act, 2023, establishes India's data protection framework, governing how personal data — including biometric and identity data — is collected, processed, and stored. For businesses verifying Indian identities, this legislation imposes obligations around consent, purpose limitation, data minimization, and cross-border data transfer.

Verification providers operating in India must navigate the balance between leveraging India's rich identity infrastructure and respecting the privacy constraints that govern its use. The practical implication is that verification systems should collect only the data necessary for the specific verification purpose, process biometric data with appropriate security controls, and comply with cross-border data transfer restrictions when serving Indian customers from outside India.

The Diaspora Verification Challenge

India's diaspora — estimated at over 32 million people across the Middle East, North America, Europe, and Southeast Asia — creates a significant verification market for platforms serving Indian nationals abroad. Remittance services, international lending, overseas employment platforms, and diaspora-focused financial services all need to verify Indian identity documents.

The challenge is that many diaspora verification scenarios involve Indian documents presented outside India, where the Aadhaar eKYC infrastructure is not directly accessible. Verification must rely on document authentication (validating the PAN card, Aadhaar card, passport, or driving license as physical or digital documents) and biometric matching, without the convenience of real-time database verification against Aadhaar.

This makes forensic document authentication — the ability to evaluate whether an Indian identity document is genuine based on its visual and structural characteristics — critical for diaspora-serving platforms. The verification model must handle the full range of Indian document types, formats, and conditions without requiring database connectivity to Indian government systems.