Aadhaar Masking Compliance for Lenders: Redact at Scale
Last reviewed: November 2026
Aadhaar masking compliance for lenders is the set of controls that keeps full Aadhaar numbers out of loan files, systems and screens except where the law allows them. In practice it means redacting the first eight digits on stored documents, restricting full numbers to approved stores and proving coverage to auditors.
This guide is for chief compliance officers, CISOs and COOs at NBFCs, banks, HFCs and fintech lenders. It covers what UIDAI and RBI rules require, where Aadhaar numbers hide in a loan book, and how to find and redact them at scale.
Key Takeaways
- Regulation 6 of the Aadhaar (Sharing of Information) Regulations, 2016 bars publishing Aadhaar numbers and requires redaction before any record is made public.
- RBI's NBFC KYC Directions, 2025 require customers who submit proof of possession of Aadhaar to redact or black out the number, including in video KYC.
- UIDAI's 2025 Aadhaar Data Vault (ADV) rules apply to requesting entities that store numbers from authentication, not to every lender.
- Most DPDP Rules obligations apply from May 2027, after an 18-month phase-in from November 2025.
Why Is Aadhaar Masking a Leadership Problem?
Aadhaar masking is a leadership problem because the exposure is spread across every team that touches a loan file, not just KYC. Sales, credit, operations, collections and outsourced partners all handle documents that may carry a full number.
The legal basis is clear. Regulation 7 of the sharing regulations says breaching regulations 3 to 6 is a violation of section 29(2) of the Aadhaar Act, which restricts how identity information is shared.
A leak of loan files is also a data breach. Unmasked Aadhaar numbers make it more serious, both for affected borrowers and for the regulator's view of your controls.
What Do UIDAI and RBI Rules Require?
UIDAI and RBI rules set four requirements that matter for lenders: do not display Aadhaar numbers, redact them in records, keep them only as long as needed, and protect any full numbers you are allowed to store. Each comes from a specific instrument.
| Requirement | Source | What It Means in Practice |
|---|---|---|
| Do not publish or display numbers | Sharing Regulations, regulation 6(1) | No full numbers on screens, letters or portals |
| Redact before making records public | Regulation 6(3) | Redaction in both print and electronic form |
| Customer redacts on proof of possession | RBI NBFC KYC Directions, para 23 | Masked copies when offline verification is not used |
| Redact in video KYC | RBI NBFC KYC Directions, para 27 | Mask the number in V-CIP captures |
| Retain only as long as necessary | Regulation 6(5) | Retention tied to the stated purpose |
| Store authenticated numbers in an ADV | UIDAI 2025 ADV circular and FAQs | Applies to requesting entities only |
Video-based customer identification process (V-CIP) is RBI's term for video KYC. A requesting entity is an organisation that submits Aadhaar numbers to UIDAI for authentication, directly or through a partner.
Where Do Unmasked Aadhaar Numbers Hide in Loan Files?
Unmasked Aadhaar numbers hide in at least six places beyond the KYC folder: loan agreements, mandate forms, property documents, video KYC captures, field app photos and partner-shared files. Most compliance programmes cover the first place and miss the rest.
| Location | How the Number Gets There | Typical Owner |
|---|---|---|
| KYC copies | Customer uploads an unmasked card | Sales and credit operations |
| Loan agreements | Borrower details block copied from KYC | Legal and operations |
| Sale deeds and property papers | Deeds may list the parties' Aadhaar numbers | Legal and technical |
| Video KYC screenshots | Card shown on camera without masking | KYC team |
| Field and collections app photos | Agent photographs the card | Collections |
| Partner and DSA files | Documents shared by email or messaging | Sales |
Older Aadhaar letters may also carry QR codes that encode the number. Treat QR codes as in scope when you scan.
How Do Lenders Mask Aadhaar Numbers at Scale?
Lenders mask Aadhaar numbers at scale in four steps. Discovery and detection find the numbers, and masking and governance keep them hidden.
- Discover: inventory every store that holds loan documents and images.
- Detect: find Aadhaar numbers in text, scans, handwriting and QR codes.
- Mask: redact the first eight digits in the underlying file and flatten it.
- Govern: restrict full numbers to approved stores, log access and enforce retention.
Step 1: Where Are Your Documents?
Start with a map, not a tool. List the loan origination system, document management system, email archives, shared drives, call-centre systems and partner portals.
Include test and analytics copies. Production documents often leak into lower environments, a risk covered in test data management for banking PII.
Step 2: How Do You Find the Numbers?
Detection combines optical character recognition (OCR) with pattern rules. Aadhaar numbers have 12 digits and a check digit, so validating that digit cuts false matches from phone or account numbers.
Field detection matters too, because a number printed under a label such as "Aadhaar No." is easier to confirm. Digiqt's intelligent document extraction AI agent shows how labelled fields can be found across varied layouts.
Step 3: How Do You Redact Safely?
Redaction must change the file itself. Replace the first eight digits in the image or text layer, then flatten the document so nothing remains underneath.
Keep the last four digits visible, the pattern UIDAI uses for masked Aadhaar. Staff can still match a document to a customer without seeing the full number.
Step 4: Who Can See Full Numbers?
Very few people should. Where your institution is a requesting entity, full numbers from authentication belong in the ADV, with reference keys used everywhere else.
Log every access to full numbers, and review the list of people with access each quarter. Align this with your controls under RBI IT governance directions for NBFCs.
Could you prove today that no unmasked Aadhaar number sits in your loan document archive?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how DocuEye extracts data from scans and PDFs to locate sensitive fields across loan files.
How Does Aadhaar Masking Compliance for Lenders Work on a Real Loan Book?
On a real loan book, the problem is volume, and automation turns an impossible manual task into a review queue. In this illustrative scenario, an NBFC has 2,40,000 active loan files, each with an average of three documents that may carry an Aadhaar number.
That is 7,20,000 documents. At two minutes per document, manual review and masking would take about 24,000 staff hours.
| Step | Illustrative Result |
|---|---|
| Automated detection | All 7,20,000 documents scanned for Aadhaar patterns and labels |
| Low-confidence matches | 4%, or 28,800 documents, sent to human review |
| Review effort | 28,800 × 2 minutes = 57,600 minutes, about 960 hours |
| Unexpected location | Full numbers found in the borrower block of older loan agreements |
The review effort falls from about 24,000 hours to about 960. The scan also shows that agreement templates copied numbers from KYC, so the template is fixed at source.
The lesson for leadership: masking new uploads is not enough. The archive and the templates that create documents need the same treatment.
Which Approach Fits Your Lending Model?
The right approach depends on how you verify Aadhaar and how many legacy documents you hold. Requesting entities need an ADV, while every lender needs masking.
| Situation | Recommended Approach |
|---|---|
| Sub-KUA using Aadhaar e-KYC | ADV for authentication data, masking everywhere else |
| Offline verification only | No ADV requirement, masking at capture and in archives |
| Large legacy scanned archive | One-time discovery and batch masking, then mask at upload |
| Heavy DSA or partner sourcing | Masked copies only, written into partner agreements |
| Field collections | Mask at capture in the mobile app |
Should You Stop Collecting Aadhaar Copies?
Where you can, yes. RBI's KYC Directions give lenders several routes, and identity details can often be drawn from CKYC registry integration or verified digitally.
Every copy you don't collect is a copy you never have to mask, store or delete. Digiqt's KYC document verification AI agent shows how verification can work without manual handling of copies.
Where Does DocuEye Fit in the Masking Workflow?
Digiqt's DocuEye fits the detection step. Its product page describes OCR with a logic-based extraction engine, smart field detection, handwriting recognition, multi-language support, custom extraction templates and built-in validation rules across PDFs, images and scans.
Those capabilities locate Aadhaar fields in mixed loan documents and return structured output. The page does not list redaction as a feature, so pair it with a redaction step in your document pipeline that burns the mask into the file.
For video KYC captures, review your process against video KYC for lenders.
Which Metrics Show Masking Is Working?
Five metrics show whether masking is working: exposure rate, archive coverage, detection recall, time to mask and full-number access count. Report them to the risk committee each quarter.
| Metric | Formula | What a Weak Number Signals |
|---|---|---|
| Exposure rate | Documents with unmasked numbers ÷ documents scanned | Masking is missing at capture |
| Archive coverage | Stores scanned ÷ stores in the inventory | Blind spots remain |
| Detection recall | Numbers found by the system ÷ numbers in an audit sample | Detection rules need tuning |
| Time to mask | Hours from upload to masked copy | Unmasked files sit in queues |
| Full-number access count | People who can view full numbers | Access is too broad |
Which Mistakes Leave Aadhaar Numbers Exposed?
Four mistakes leave most Aadhaar numbers exposed, and each is easy to miss in an audit.
- Drawing boxes instead of redacting. An annotation over a PDF can be removed, and the number is still there.
- Masking only KYC folders. Agreements, sale deeds and screenshots often carry the same number.
- Fixing uploads but not the archive. Years of older files remain unmasked.
- Leaving numbers in systems. Free-text fields, logs and test copies can hold full numbers long after documents are masked.
What Is Changing Next?
Data protection obligations are tightening on two fronts. The DPDP Rules, notified on 14 November 2025, phase in most duties by May 2027, and UIDAI's 2025 ADV circular and FAQs tightened hosting and encryption for requesting entities.
Expect auditors to ask for evidence of Aadhaar masking compliance for lenders, not just policies. For the wider programme, see DPDP Act compliance for lenders.
Want every loan document checked for unmasked Aadhaar numbers before it reaches your archive?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how DocuEye and custom document workflows help lenders find and protect sensitive data.
