{"id":1175,"date":"2026-08-10T10:28:40","date_gmt":"2026-08-10T09:28:40","guid":{"rendered":"https:\/\/www.befisc.com\/fintechsherlock\/?p=1175"},"modified":"2026-08-17T06:35:20","modified_gmt":"2026-08-17T05:35:20","slug":"aadhaar-offline-ekyc-xml-guide","status":"publish","type":"post","link":"https:\/\/www.befisc.com\/fintechsherlock\/aadhaar-offline-ekyc-xml-guide\/","title":{"rendered":"Aadhaar Offline eKYC: How Paperless XML Verification Works"},"content":{"rendered":"\n

Not every business can or should hit the Aadhaar database<\/a>. Online Aadhaar authentication is restricted to specific categories of entities, and the Supreme Court\u2019s Puttaswamy judgment sharply limited private-sector access. Yet millions of onboarding journeys<\/a> still need Aadhaar-grade identity assurance. Aadhaar offline eKYC exists precisely for this gap.<\/p>\n\n\n\n

The mechanism is elegant: the customer downloads a digitally signed XML file from UIDAI and shares it, along with a share code, with the verifying business. The business validates UIDAI\u2019s signature and reads the data without any live connection to the Aadhaar database, without the full Aadhaar number, and without UIDAI ever learning where the customer applied. This guide covers how Aadhaar offline eKYC works, why it is privacy-preserving by design, and how to run it in production.<\/p>\n\n\n\n

What Is Aadhaar Offline eKYC?<\/h2>\n\n\n\n

Aadhaar offline eKYC, formally Aadhaar Paperless Offline<\/a> e-KYC, is a UIDAI mechanism that lets an Aadhaar holder prove identity by sharing a digitally signed data file instead of undergoing live authentication against the Aadhaar database.<\/p>\n\n\n\n

The customer generates the file from the UIDAI portal, protecting it with a four-digit share code of their choosing. The file is a ZIP containing XML data signed by UIDAI. Any verifier can validate that signature using UIDAI\u2019s published public certificate. If the signature validates, the data inside is authentic; no API call to UIDAI is required.<\/p>\n\n\n\n

Because verification is cryptographic and local, Aadhaar offline eKYC is available to a far wider set of businesses than online authentication, and it works even where connectivity to UIDAI systems is unavailable or impermissible. UIDAI\u2019s QR code on e-Aadhaar and PVC cards operates on the same signed-data principle in a compact form.<\/p>\n\n\n\n

Why Offline eKYC Exists: The Legal and Privacy Background<\/h2>\n\n\n\n

Two forces produced Aadhaar offline eKYC.<\/p>\n\n\n\n

The first is legal. After Puttaswamy (2018), private entities<\/a> lost broad access to online Aadhaar authentication. The Aadhaar Act\u2019s amended framework confines online eKYC largely to banking, telecom, and entities specifically permitted under law. Everyone else needed a lawful alternative that did not query the central database.<\/p>\n\n\n\n

The second is privacy architecture. Online authentication creates a record at UIDAI every time it runs, which builds a trail of where a citizen transacted. Offline eKYC breaks that trail. UIDAI signs the data once, when the citizen downloads it. Subsequent sharing happens entirely between the citizen and the verifier. UIDAI cannot see who verified the file, when, or why.<\/p>\n\n\n\n

The design also enforces data minimisation. The file carries a reference ID ending in the last four digits of the Aadhaar number never the full number. The verifier gets identity assurance without acquiring the persistent identifier, which aligns cleanly with the [Aadhaar masking obligations] that govern storage.<\/p>\n\n\n\n

What the Aadhaar XML Contains<\/h2>\n\n\n\n

The signed XML delivers the fields most KYC policies need.<\/p>\n\n\n\n