Can an NBFC use Aadhaar OTP eKYC?

Generally only if the NBFC is notified by the Central Government under Section 11A of the PMLA and registered with UIDAI as a KUA or sub-KUA, according to Vinod Kothari Consultants. Banks have a statutory route. Otherwise NBFCs use offline verification or DigiLocker. Confirm your route with your compliance team.

Does DPDP apply to Aadhaar verification?

Yes. An Aadhaar number and the demographic data returned with it are personal data, so DPDP applies alongside the Aadhaar Act and RBI's KYC rules. The core obligations start from 13 May 2027 and cover notice, consent, security safeguards, breach reporting and erasure unless a law requires retention.

Do you need consent for Aadhaar verification under DPDP?

Plan for it. The legitimate uses in Section 7 are largely written around the State, and the Act's own KYC illustration describes a bank giving notice before asking for consent. The Aadhaar Act also requires consent for authentication. Have counsel confirm your basis, and rely on legal-obligation carve-outs for retention.

Can we store the Aadhaar number?

Only where you need to, and only in an Aadhaar Data Vault. UIDAI's circular says the actual number should not be stored in business databases other than the vault, and the VID should not be kept in logs. For most flows, a masked reference and the verification outcome are enough.

What is the difference between Aadhaar verification and Aadhaar masking?

Verification confirms who a person is by checking their Aadhaar through authentication or offline methods. Masking hides the Aadhaar number on a document, typically all but the last four digits, so copies can be stored with less risk. Lenders usually need both: verification at onboarding and masking for documents and archives.

How much does an Aadhaar verification API cost?

It depends on volume, method mix, retries and what the provider includes. Most public vendor pages, FinHub's included, do not list a rate, so request a quote. Model your monthly calls with a retry allowance, ask what is billable, and add your own costs for consent storage, audit logs and any vault.

What should you look for in an Aadhaar verification API provider?

Look for clear answers on which methods they can run for you, how consent is bound to each call, what they store and for how long, what audit evidence you can pull, and what happens when UIDAI or the OTP fails. Be cautious of claims like 100% accurate or fully compliant with no method behind them.

Aadhaar Verification Under DPDP: BFSI Guide

Pranshi Mittal

13 November 2026 · 9 min read

Key takeaways

Which Aadhaar method you may use depends on your institution: banks have a statutory route under the PMLA, while NBFCs generally need a Section 11A notification and KUA or sub-KUA registration to run OTP eKYC themselves.
Treat consent as a record rather than a checkbox: give notice before the Aadhaar screen, create the artifact before the call, and store consent, result and decision together so one lookup answers an audit question.
Keep the full Aadhaar number out of logs and business databases. A masked reference and the verification outcome are enough for most flows, and archives and log files are where teams usually find it hiding.
No API makes an institution compliant on its own, so judge a provider on which methods it can lawfully run for you, how consent binds to each call, and what evidence you can pull later.

In short: Aadhaar verification under DPDP means confirming identity with a method your institution is allowed to use, after the customer has been told what you collect and has agreed, then keeping only what you need and being able to prove each step. Our Aadhaar verification API is built around that pattern.

Want this checked against your own onboarding flow? Request a 30-minute architecture review

A DPDP-ready Aadhaar check in five steps, in this order every time: notice telling the customer what is collected, why, and how to withdraw; consent as a clear yes for one purpose, recorded as an artifact; verify with a method the institution is allowed to use; minimise to a masked number and only the fields needed, with nothing in logs; and evidence, with consent, result and decision stored together. No step is skipped, and no check runs without a consent artifact.

Picture a branch officer at a mid-sized NBFC onboarding a two-wheeler loan customer. The customer reads out an Aadhaar number, an OTP arrives, KYC clears and the file moves on. Six months later that number sits in the CRM, in a log file and in an email to a collections partner. Nothing broke under the old rules. Under the DPDP Act, each of those places is something your compliance head may have to explain. (This is an illustrative scenario, not a specific customer.)

The core DPDP obligations start applying from 13 May 2027, so there are roughly six months to fix flows that have run for years. This guide is for the CXOs, compliance heads and CTOs who will be asked about it at NBFCs, banks and other BFSI firms. It is not legal advice, so have your counsel confirm the specifics for your institution.

What Do CXOs Actually Risk With Aadhaar Verification Under DPDP?

Four things tend to land on a CXO's desk.

Penalty exposure: The DPDP Act's penalty schedule goes up to ₹250 crore for failing to maintain security safeguards and ₹200 crore for failing to report a breach.
Vendor mistakes are yours: You stay responsible for personal data processed on your behalf, so a vendor's slip becomes your problem.
Audit questions: Someone will ask you to show the notice, the consent and the result for one customer. If the answer is three systems and two spreadsheets, that is the finding.
Drop-offs and rework: A clumsy consent screen, or an OTP that fails with no fallback, costs you applications as well as compliance points.

What Is Aadhaar Verification, and Which Kind Can You Use?

Aadhaar verification is any check that uses the Aadhaar system to confirm who someone is. A bare format check, sometimes sold as an Aadhaar validation API, only tells you the number looks right. It does not prove the person owns it. The real options are these.

Method	What happens	Who can use it
UIDAI authentication (OTP or face)	UIDAI confirms the customer's details live	Eligible entities only
Offline verification	The customer shares a UIDAI-signed QR, XML or credential, with no live call to UIDAI	RBI-regulated entities generally, with registration for some modes
DigiLocker documents	The customer shares Aadhaar from DigiLocker	A common route where OTP eKYC is not open to you

If you are an NBFC, the first question is not which vendor but whether you are allowed to run OTP eKYC yourself. Banks have a statutory route under the PMLA. For NBFCs, OTP eKYC generally needs a Section 11A notification from the Central Government and registration with UIDAI as a KUA or sub-KUA, according to Vinod Kothari Consultants. Many NBFCs therefore use offline verification or DigiLocker, or work through a regulated partner. Treat this as a reading of public sources and confirm it with your compliance team.

One more point: RBI's KYC Directions say the Aadhaar number is not mandatory for KYC, so keep another route open for customers who prefer not to share it. For how a Video KYC journey runs end to end, see our complete guide to the Video KYC process, or see how FinHub is set up for NBFCs.

Which Aadhaar method fits which institution, as a reading of public sources. Banks: Aadhaar authentication is allowed by statute under the PMLA, and offline verification and DigiLocker are also available. NBFCs and regulated lenders: authentication generally needs notification and KUA or sub-KUA status, and offline verification is open to RBI-regulated entities. Fintechs and platforms: usually work through a regulated partner, with offline verification and DigiLocker where the partner's policy allows. The methods are authentication by OTP or face, offline QR, XML or credential, and DigiLocker documents.

Start with the Act's own example: a bank customer opens an account and completes KYC, and the bank gives notice before asking for consent. Your onboarding screen is exactly the case it has in mind.

Treat consent as a record, not a checkbox. For every Aadhaar verification:

Notice first: Show it before the Aadhaar entry screen, separate from your terms and conditions, in plain language.
Consent artifact: Create it before the call is made and send its ID with the request, so no check runs without one.
Withdrawal: Make it as easy as giving consent, and say on screen that it does not delete a KYC record you must keep by law.
Evidence: Store the artifact, the result and the decision together, so one lookup answers an audit question.

Do not assume KYC is exempt. The legitimate uses in Section 7 are largely written around the State, so many private lenders take the cautious route of notice plus consent. Ask your counsel to confirm your basis. Our ConsentGuard is built around this pattern, and our DPDP guide for BFSI has the full timeline.

What Does Data Minimisation in KYC Look Like in Practice?

It means collecting only the fields the check needs, keeping only what a rule makes you keep, and never letting a full Aadhaar number spread into systems that do not need it. It is the cheapest control in this guide, because data you never collected cannot leak.

Keeping less at every stage, from the first form field to the last deletion. Collect only the fields the check needs; enter a VID or offline credential, not the raw number; process with no Aadhaar numbers in logs or analytics; store a masked reference, or a vault for full numbers; and erase when the purpose is served, unless law says keep. The data held gets smaller at every step: full number, then masked number, then nothing.

Collect less: Offline verification and UIDAI's Aadhaar app, launched in January 2026, let residents share only the fields a verifier asks for.
Store less: UIDAI's circular says the actual number should not sit in business databases other than an Aadhaar Data Vault, and the VID should not be kept in logs. For most flows, a masked reference and the result are enough.
Erase on time: Delete data when the purpose is served, unless a law such as KYC record-keeping says keep it.

The places teams forget are archives and logs. Years of onboarding files often hold Aadhaar copies with the number fully visible. A real example: Utkarsh Small Finance Bank had around 2.8 lakh Aadhaar documents to mask. According to our case study, FinHub's Aadhaar masking API workflow got it done in a week, at 99% masking accuracy, inside the bank's offline environment.

How Do You Choose an Aadhaar Verification API Provider?

Skip the slogans. "Compliant", "consent-based" and "100% accurate" are easy to print and hard to test. Ask these five things instead:

Which methods can you lawfully run through them, given your own eligibility?
How is consent tied to each call?
What do they return and store, and for how long?
What evidence can you pull later for an audit?
What happens when UIDAI or the OTP fails?

No API makes an institution compliant on its own. That part stays with you.

On cost, expect a quote based on volume and method rather than a flat price, and count retries, a possible Aadhaar Data Vault, and consent and audit storage on your side. Most public vendor pages, ours included, do not list a rate. As rough arithmetic: 10,000 applications a month, 60% using Aadhaar and a 15% retry allowance comes to about 6,900 calls. That is an illustration, not a benchmark, so use your own numbers.

What Does FinHub's Aadhaar Verification API Do?

Our Aadhaar verification API takes a masked Aadhaar number or VID, an OTP or offline XML, and a consent artifact ID. It returns the verification status, the details the customer consented to, a masked Aadhaar reference and, optionally, a photo, with each check written to an audit trail.

It does not decide whether your institution may use the OTP route, and it does not make you DPDP compliant, because notice wording, retention and withdrawal stay with you. What it does is make the right pattern the default: no check without consent, and no unmasked number travelling.

What If Aadhaar Verification Fails, or Is Not Enough?

Decide the fallback before launch, because the Aadhaar Act expects an alternate means of identification when authentication fails. Most failures are a customer or connectivity problem, not fraud, so route people onward instead of rejecting them.

Also remember that Aadhaar proves the person holds a valid Aadhaar. It does not prove the person on screen is the holder, so pair it with a face match and liveness check, match the name against PAN, and run AML screening.

Is Your Aadhaar Verification Flow Ready for DPDP?

Six questions for your next review:

Do we know which Aadhaar methods we are allowed to use?
Do customers see a notice, separate from our terms, before the Aadhaar screen?
Is a consent record created before every check, not after?
Can we find full Aadhaar numbers in logs, the CRM, email or archives?
Can we pull consent, result and decision for one customer in a single lookup?
Do we have a non-Aadhaar route and a plan for failed OTPs?

Each "no" is a task for product, engineering or compliance before 13 May 2027.

What Does DPDP-Compliant Aadhaar Verification Come Down To?

Five habits. Use only the method you are allowed to use. Give notice and record consent before every check. Keep the number out of logs and business databases. Store the outcome, the consent and the decision together. Plan the failure paths before launch. None of it needs a new product category, only a flow designed with the Act in mind.

If you would like a second pair of eyes on yours, Request a 30-minute architecture review. Bring your onboarding journey and your retention rules, and the FinHub team will walk through where consent, masking and evidence sit today.

Aadhaar Verification Under DPDP: What BFSI and NBFC Leaders Need to Get Right