Video KYC exists because RBI needed a way to authorize fully remote, paperless account opening that still met the in-person verification standard the KYC framework was originally built around. The result the Video-based Customer Identification Process, or V-CIP is one of the more procedurally specific parts of RBI’s KYC Master Direction, and a video KYC API that doesn’t map cleanly onto its requirements creates compliance risk that a smooth user interface can mask but not eliminate.
This guide covers what V-CIP actually mandates step by step, how a video KYC API is technically architected to meet those requirements, and where most implementations fall short of full compliance without realizing it.
What RBI’s V-CIP Guidelines Require
RBI’s V-CIP provisions specify not just that a video call must occur, but how. The customer-facing official conducting the video interaction must be a trained employee of the regulated entity (not an outsourced call-center agent operating without that status), and the session must include live capture of the customer’s photograph and a real-time, geotagged verification of the customer’s location.
The process also requires a liveness check to confirm the person on camera is physically present and not a photograph, recording, or deepfake being presented to the camera a requirement that has grown more consequential as deepfake generation tools have become more accessible, and one regulators have flagged with increasing specificity in recent guidance.
Critically, V-CIP requires the entire session audio, video, and the displayed document to be recorded and securely stored for the regulatory retention period, creating an auditable record distinct from a simple pass/fail verification result. An implementation that only stores the outcome, not the session recording, does not meet this requirement.
The Technical Architecture of a Compliant Video KYC Flow
A production video KYC system is built from several distinct components that a basic video-calling integration doesn’t provide on its own.
Identity capture and OCR. Before or during the call, the system captures the customer’s identity document (typically PAN, and Aadhaar via one of its verification methods) and extracts the data via OCR, which is then cross-checked against the details the customer provides verbally or on-screen.
Real-time liveness and face-match. The system must confirm both that the person on camera is live (not a static image or a screen replay) and that their face matches the photograph on the identity document being verified typically using a combination of active liveness prompts (asking the customer to turn their head or blink) and passive liveness detection running continuously in the background.
Geolocation capture. The customer’s device location is captured and geotagged as part of the session record, satisfying RBI’s requirement to establish the customer’s physical presence in India (or a permitted jurisdiction) at the time of verification.
Session recording and secure storage. The full audio-video session, along with the displayed documents, is recorded and stored with the access controls and retention period the Master Direction requires, and must be retrievable for audit purposes well after the onboarding event itself.
Agent-assist tooling. Because a trained employee (not an unsupervised bot) must conduct the interaction, a compliant system needs a structured interface for that employee scripted prompts, real-time document display, and a clear accept/reject decision flow rather than treating the human agent as an afterthought to an otherwise automated pipeline.
Where Video KYC Fits Relative to Other Verification Methods
Video KYC is not a replacement for Aadhaar or PAN verification it’s a customer identification process that typically incorporates them. A well-architected V-CIP flow verifies the identity document (via OCR and, often, an Aadhaar or PAN API call) as one component inside the broader video session, rather than treating the video call as a standalone substitute for document verification.
It exists specifically for scenarios where a fully in-person or branch-based process isn’t practical: digital-first NBFCs and fintechs without extensive branch networks, or account categories where OTP-based eKYC alone isn’t sufficient under RBI’s rules but a physical branch visit isn’t required either. For low-risk, low-value account categories, OTP-based eKYC alone may remain sufficient and considerably cheaper to run video KYC should be deployed where the regulation or risk category actually calls for it, not as a default for every onboarding flow.
Implementation Challenges Most Teams Underestimate
Agent availability and queue management. Because a trained human employee must conduct each session, video KYC doesn’t scale the way a fully automated API call does. Peak-hour queuing, agent training consistency, and multilingual support (given India’s linguistic diversity) are operational problems, not just technical ones, and a vendor’s API can only partially solve them the rest is staffing and process design on the client side.
Deepfake and presentation-attack resistance. As synthetic media generation has become more accessible, liveness detection has had to keep pace. A video KYC provider’s liveness technology should be evaluated against current presentation-attack techniques, not just the basic “blink and turn your head” checks that were sufficient several years ago this is an area where vendor capability varies meaningfully and merits direct technical due diligence.
Connectivity-dependent completion rates. Video KYC requires sustained video bandwidth, which is a real barrier for customers in lower-connectivity areas. A well-designed implementation offers graceful degradation (audio-only fallback with alternate verification, for instance) rather than simply failing the session, since abandonment at this stage is a direct revenue and inclusion cost.
Evaluation Criteria for a Video KYC API Provider
- Does the provider’s liveness detection address current deepfake and presentation-attack techniques, with evidence beyond a marketing claim?
- Is session recording, storage, and retrieval built to the retention period RBI’s Master Direction requires, with clear audit-export functionality?
- Does the platform support agent-assist tooling (scripted flows, real-time document overlay) or only the raw video infrastructure?
- What is the platform’s behavior under poor connectivity graceful degradation or session failure?
- Does the provider support multiple Indian languages for the agent-customer interaction, matching the business’s actual customer base?
Key Takeaways
- RBI’s V-CIP guidelines specify not just that video verification occur, but who conducts it, what must be captured (photograph, geolocation, liveness), and that the full session be recorded and retained for audit.
- A compliant video KYC API combines identity document capture, real-time liveness and face-match, geolocation, and full session recording not just a video call.
- Video KYC should be deployed where risk category or regulation requires it, not as a default replacement for lower-cost methods like OTP-based eKYC where those remain sufficient.
- Agent availability, multilingual support, and connectivity-dependent completion rates are operational challenges that persist regardless of API quality.
- Liveness detection capability against current deepfake techniques varies meaningfully between vendors and merits direct technical evaluation, not just a feature-list comparison.
Frequently Asked Questions
How does video KYC handle deepfake or spoofing attempts?
Through liveness detection a combination of active prompts (such as asking the customer to move or blink) and passive, continuous analysis designed to distinguish a live person from a photograph, recorded video, or synthetic media presented to the camera. Detection capability varies by vendor and should be evaluated directly.
How long must video KYC session recordings be retained?
Retention periods are set by RBI’s KYC Master Direction and related record-keeping requirements; regulated entities should confirm the current mandated period, as it is tied to broader KYC record-retention rules rather than a separate video-specific rule.
Can a chatbot or automated system conduct video KYC without a human agent?
No. RBI’s V-CIP guidelines require a trained employee of the regulated entity to conduct the live video interaction a fully automated, agentless video verification does not meet the current regulatory standard.
Is video KYC mandatory for all account types?
No. Requirements vary by account category and risk classification some lower-risk, lower-value accounts can be opened through OTP-based eKYC alone, while others require video KYC or full biometric in-person verification. Regulated entities should confirm current requirements against RBI’s Master Direction for each account category they offer.
What is V-CIP under RBI’s KYC guidelines?
V-CIP (Video-based Customer Identification Process) is RBI’s framework allowing regulated entities to complete customer identity verification through a live, recorded video interaction with a trained employee, as an alternative to in-person, branch-based verification.
Conclusion
Video KYC sits at the intersection of regulatory procedure and real-time media technology, which is why it’s harder to implement well than either a document-verification API or a video-calling SDK alone. The providers worth evaluating are the ones that treat V-CIP’s specific requirements trained-agent conduct, geolocation capture, deepfake-resistant liveness, and full session retention as the specification, not as optional enhancements to a generic video product.
As synthetic media generation continues to improve, the gap between video KYC implementations that merely record a call and those that genuinely verify presence and authenticity will widen, and regulators can reasonably be expected to keep raising the bar on liveness and presentation-attack resistance accordingly.
