Government e-KYC Services: Authorized Organizations & Security Measures

The Ministry of Electronics and Information Technology in India, under the UIDAI, offers e-KYC authentication services for digital identity verification. This analysis delves into the entities authorized to use e-KYC services, both from the government and private sectors. Government organizations, such as regional rural banks and central/state government bodies, extensively utilize e-KYC services. Private entities, including cooperative banks, foreign banks, and small finance banks, are also involved under specific Acts.

The UIDAI conducts rigorous security audits before granting access to e-KYC services. Entities undergo thorough assessments by certified auditors to ensure compliance with information security standards. This process helps mitigate risks and assures data protection. Furthermore, the Aadhaar Act mandates that requesting entities maintain stringent security measures and face penalties for non-compliance.

The Indian government’s commitment to secure e-KYC authentication services is evident through its stringent authorization process and security audits. With a vast network of authorized government and private entities, this system enables seamless and secure identity verification while safeguarding Aadhaar data. The comprehensive approach underscores the importance of data privacy and protection in the digital age.

*****

GOVERNMENT OF INDIA
MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY
LOK SABHA
UNSTARRED QUESTION NO. 3432
TO BE ANSWERED ON 09.08.2023

USE OF E-KYC AUTHENTICATION SERVICES

3432. SHRI SYED IMTIAZ JALEEL:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

(a) the details of Government organisations which are authorised to use e-KYC authentication services of UIDAI under various Acts and rules;

(b) the list of private firms requesting for access to e-KYC authentication services of UIDAI under various Acts and rules;

(c) whether the UIDAI conducted security audits of these entities before the access to e-KYC was provided and if so, the details thereof; and

(d) whether the Government has taken precautions for the safety of Aadhaar data before it is shared with private firms?

ANSWER

MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY
(SHRI RAJEEV CHANDRASEKHAR)

(a) The Unique Identification Authority of India provides digital identity (Aadhaar) and digital ID authentication services to all the residents of India. Aadhaar authentication (including e-KYC authentication) by entities is provided for in sections 4 and 7 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (“Aadhaar Act”).

e-KYC User Agencies (KUAs) appointed by the Unique Identification Authority of India (UIDAI) are allowed to perform eKYC authentication. A KUA may appoint sub-KUAs under them after obtaining specific permission from UIDAI for sharing of eKYC data with its sub-KUAs.

At present, 92 government entities are KUAs and 27 government entities are operating as sub-KUAs. List of the same is at Annexure I.

(b) Private entities are allowed to use Aadhaar authentication under the provisions of other Acts of Parliament, such as the Prevention of Money Laundering Act, 2002, the Information Technology Act, 2000 and the Indian Telegraph Act, 1885. At present, 90 private entities are operating as KUAs and 24 private entities are operating as sub-KUAs. List of the same is at Annexure II.

(c) and (d): KUAs are initially on-boarded in pre-production environment. They are required to get their systems, applications and operations audited by an Information Security Auditor empanelled by the Indian Computer Emergency Response Team (CERT-In), and the Information Security Audit report is examined by UIDAI. KUAs are moved into production environment (i.e., made live) only after the Information Security Audit report is found to be as per satisfaction of UIDAI.

Further, the Aadhaar Act provides that requesting entities shall ensure the security of identity information as well as restriction on sharing information and take all necessary measures to ensure that information in their possession or control is secured and protected against access not permitted under the Act or regulations made thereunder. It also provides for penalties for non­compliance with the provisions of the Act.

*******

Annexure-I

Government Organizations using e-KYC services of Aadhaar

–

Annexure-II

List of Private Entities under Section 4(4)(b)(i) of Aadhaar Act, 2016

(i) Section 11A of Prevention of Money Laundering Act, 2002

(ii) The Indian Telegraph Act, 1885

Small Finance Bank

–

–

*******