Video KYC for Lenders: RBI-Compliant V-CIP That Converts
Video KYC for Lenders: Building an RBI-Compliant V-CIP Journey That Converts
Last reviewed: November 2026
Video KYC for lenders is RBI's Video-based Customer Identification Process (V-CIP): a live, recorded video interaction in which a trained official identifies a customer remotely. Done properly, it lets lenders onboard customers fully online with the same standing as an in-person check.
This guide is for COOs, heads of digital and compliance heads at NBFCs and other lenders. It maps RBI's minimum standards to build decisions, shows where journeys lose customers, and covers the fraud controls that now matter most.
Key Takeaways
- V-CIP rules for NBFCs sit in the NBFC Know Your Customer Directions, 2025, updated on 29 December 2025.
- Infrastructure needs end-to-end encryption, India-only connections, geo-tagging, liveness detection and VAPT by CERT-In empanelled auditors.
- Accounts opened through V-CIP become operational only after a concurrent audit.
- RBI explicitly permits AI to make V-CIP robust, while the lender stays responsible for identification.
Who Can Lenders Onboard Through V-CIP?
V-CIP covers most retail and small business onboarding. RBI allows it for new individual customers, sole proprietors, authorised signatories and beneficial owners of legal entities.
It can also convert accounts opened through Aadhaar OTP e-KYC, which carry tight limits, into fully compliant accounts. For borrowal accounts opened through OTP e-KYC, RBI limits lending to term loans with sanctions of up to ₹60,000 a year until full due diligence is done.
That makes V-CIP the upgrade path for small-ticket digital loans. RBI also says that where a lender has introduced V-CIP, it should offer it as the first option for non-face-to-face onboarding.
What Infrastructure Does RBI Require?
RBI sets minimum standards for technology, and each one shapes a build decision. The table maps them.
| RBI Standard | Build Implication |
|---|---|
| Hosted on the lender's premises, or cloud with lender-owned data | Data and video move to lender servers immediately after each session |
| End-to-end encryption, auditable consent | Encrypted media path and tamper-proof consent logs |
| Block non-India and spoofed IP addresses | IP intelligence at session start |
| Live GPS geo-tagging and date-time stamps | Location capture embedded in the recording |
| Face liveness or spoof detection, accurate face match | Detection models tuned for Indian lighting and devices |
| Update based on forgery attempts and near misses | Feedback loop from fraud cases to the model |
| VAPT and security audit by CERT-In empanelled auditors | Test before rollout and periodically after |
| Functional and performance testing of app and APIs | Load testing before peak campaigns |
| Records stored securely in India | Retrievable, time-stamped archive with activity logs |
Detected forged identities must be reported as cyber events. That links V-CIP to your wider incident reporting process.
What Records Must Be Kept?
All V-CIP data and recordings must be stored securely in India, with date and time stamps that allow easy retrieval. The activity log, including the credentials of the official who ran the session, must also be preserved.
Plan retrieval as a product feature. Auditors, investigators and the concurrent audit team all need to find a session in seconds, not days.
How Do You Design a Journey That Converts?
Compliance sets the floor, and design decides conversion. Each procedural rule has a design response.
| Step | RBI Requirement | Conversion Tip |
|---|---|---|
| Pre-call data | OTP Aadhaar e-KYC, offline Aadhaar, CKYCR records or DigiLocker documents | Pre-fill from CKYC where a record exists |
| Data freshness | Offline Aadhaar no more than three working days old | Schedule the call before the data expires |
| Call | Trained official, varied questions, no prompting | Short scripts and visible wait times |
| PAN | Clear image, verified with the issuer, including via DigiLocker | Offer e-PAN through DigiLocker to skip image capture |
| Interruptions | Fresh session after a call drop | Save progress so restarts are quick |
| Completion | Concurrent audit before the account operates | Fast audit queue, clear status messages |
Printed copies of e-documents, including e-PAN, are not valid during V-CIP. Telling customers that before the call avoids failed sessions.
Who Can Run the Call?
Only specially trained officials may conduct V-CIP, following a documented workflow and standard operating procedure. They must be able to carry out liveness checks and spot fraud, while making sure persons with special needs are not excluded.
That makes official capacity a hard constraint on volume. Forecast session demand by hour, and train enough officials to cover campaign peaks and evenings.
Where Do Customers Drop Off?
Most losses happen before the call starts or while customers wait for an official. Agent availability, scheduling and clear instructions matter more than video quality alone.
Digiqt's onboarding drop-off recovery AI agent shows how abandoned journeys can be followed up with the right nudge at the right time.
Do you know at which V-CIP step your applicants abandon the journey?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build digital onboarding and video KYC journeys for lenders.
Which Fraud Controls Does Video KYC Need?
Video KYC is a target because it replaces physical presence. Deepfake video, replayed recordings and coached applicants are the main threats.
RBI's rules address each one. Questions and their sequence must vary to confirm the session is live, applications must be rejected if the customer appears to be prompted, and liveness and spoof detection are mandatory.
Digiqt's post on deepfakes in the fintech industry explains why synthetic video has become a practical fraud risk. The voice deepfake detection AI agent shows how audio checks can add a second layer.
- Layer the checks. Combine liveness, face match against the Aadhaar or OVD photo, and PAN data matching.
- Use risk context. RBI expects officials to consider whether the customer was previously rejected or appears on a negative list.
- Learn from attempts. Feed detected and near-miss forgeries back into the models.
- Watch for synthetic identities. Digiqt's guide to synthetic identity fraud detection covers patterns that a single video call can miss.
How Much Does Journey Design Matter?
This is an illustrative funnel with assumed rates. A lender sends 10,000 applicants to V-CIP, and 85%, or 8,500, complete the pre-call data step.
With long waits, 80% of those connect to an official (6,800), 90% pass the call (6,120), and 97% clear concurrent audit, giving 5,936 accounts, or 59.4%. Raising the connect rate to 90% through scheduling gives 7,650 connected, 6,885 passed and 6,678 accounts, or 66.8%.
That is 742 more customers from the same traffic, with no change to compliance standards. The lesson for leadership: staff and schedule around demand peaks before spending more on acquisition.
How Should Lenders Choose a V-CIP Platform?
Most lenders buy or license the video layer and build the journey around it. Select on compliance evidence first and features second.
| Criterion | What to Ask the Vendor |
|---|---|
| Data ownership | Is every recording moved to our servers after each session, with nothing retained? |
| Security assurance | Can you share recent VAPT and audit reports from CERT-In empanelled auditors? |
| Liveness and face match | How are the models tested, and how are forgery attempts fed back? |
| India controls | How are foreign and spoofed IP addresses blocked? |
| Integration | Do your APIs connect to our onboarding, CKYC and audit systems? |
| Scale | What concurrency has the platform handled under load testing? |
| Audit tools | Can the concurrent audit team review, tag and approve sessions quickly? |
Ask for evidence, not slides. A vendor that cannot show test reports or data-flow diagrams adds risk the lender will carry.
Which V-CIP Mistakes Do Lenders Make?
These mistakes recur in audits and customer complaints.
- Letting vendors retain video. Data must move to lender-controlled servers immediately after each session.
- Skipping CERT-In empanelled audits. VAPT and security audit are required before rollout and periodically after.
- Slow concurrent audits. Customers who finished the call still cannot use the account.
- Static question scripts. Fixed questions make pre-recorded or coached sessions easier to pass.
What Is Changing Next?
RBI's explicit permission to use AI points towards more automated liveness and fraud checks, with officials focusing on judgement. Expect auditors to ask how models are tested, tuned and updated after fraud attempts.
The Central KYC registry is also being revamped by CERSAI. Since CKYCR records are an accepted data source for V-CIP, better registry access could shorten the pre-call step, so keep that integration flexible.
Most obligations under the DPDP Rules apply from May 2027, so review how long recordings are kept and who can access them. Keep V-CIP retention aligned with KYC record-keeping rules and your privacy notices.
Would your V-CIP set-up pass a CERT-In audit and a deepfake attack test this quarter?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build secure onboarding and lending platforms for regulated lenders.
