RBI V-CIP Guidelines Checklist: Full Compliance Checklist for 2026

Video-based Customer Identification Process (V-CIP) lets banks, NBFCs, and other regulated entities onboard customers remotely without a branch visit while staying legally equivalent to face-to-face verification. But "equivalent to face-to-face" comes with strings attached. RBI treats V-CIP as a fully regulated process, not just a video call, and the rulebook got a major overhaul recently.

Why This Checklist Matters Right Now?

V-CIP was first introduced through an RBI amendment to the KYC Master Direction notified on 9th January 2020, permitting Digital KYC and Video-based Customer Identification as methods to verify a customer's identity. Since then, the framework has been tightened repeatedly. Most significantly, on November 28, 2025, the RBI issued sector-specific KYC Master Directions covering ten institution types, including commercial banks, NBFCs, payments banks, and cooperative banks, and payment aggregators were added to the framework under this same amendment. If your policy manual still points to the original 2016 direction, it's out of date.

Use the sections below as your working RBI V-CIP guidelines checklist — organized by regulatory scope, technical controls, process steps, and governance.

1. Regulatory Scope & Applicability

• • Confirm your entity type is covered — banks, NBFCs, payments banks, cooperative banks, and (as of the late-2025 update) payment aggregators are all in scope
• • Verify V-CIP is being treated as equivalent to face-to-face CDD in your policy documents, since Video Customer Identification Process under RBI Para 19 is treated as the equivalent of face-to-face KYC, meaning V-CIP customers carry no transaction caps and satisfy full customer due diligence
• • Cross-check that OTP-based Aadhaar eKYC customers (who are not the same as V-CIP customers) are correctly flagged for enhanced due diligence, since customers onboarded via OTP-based Aadhaar eKYC alone are classified as non-face-to-face and remain subject to a ₹1 lakh/year cumulative debit cap until they complete face-to-face or Video KYC verification
• • Update internal manuals to reflect the November 2025 sector-specific Master Directions rather than the original 2016 version

2. Technical Infrastructure Requirements

• • Use a proprietary V-CIP application — generic platforms aren't compliant, as hard requirements include the V-CIP application being proprietary, with no use of consumer platforms like Zoom or Teams
• • Implement end-to-end encryption between the customer's device and your hosting infrastructure
• • Deploy real-time liveness detection capable of identifying spoofing attempts and deepfakes
• • Capture geo-tagging and IP validation to confirm the customer is physically located in India
• • Build a concurrent audit workflow so every session is reviewed before the account goes live
• • Set up tamper-proof storage for video recordings and verified documents
• • Schedule periodic VAPT (Vulnerability Assessment and Penetration Testing) through a CERT-In empaneled auditor — not a one-time launch exercise

3. Live Session Process Controls

• • Obtain informed customer consent before initiating the video interaction
• • Capture device GPS and IP address at the point of consent
• • Route every session through a trained, authorized V-CIP officer — pre-recorded sessions are not permitted
• • Verify identity documents (PAN, Aadhaar, passport) live on camera, checking edges, fonts, holograms, and photo match using zoom/freeze-frame tools
• • Run active liveness checks (e.g., prompted head turns) alongside passive checks (micro-expression and lighting analysis)
• • Capture a clear live photograph of both the customer and their documents during the session
• • Complete Aadhaar XML/QR extraction within three working days of the session
• • Enforce the "no resume" rule — if the call drops, the session must restart from scratch; brief in-session pauses are fine, but a disconnected call cannot continue

For more information about VKYC,Read our related blog,"Video KYC in India: The Complete Guide for 2026"

4. Post-Session & Audit Requirements

• • Route every completed session to a second, qualified official for concurrent audit
• • Hold the account in "pending" status until audit sign-off — never activate straight from the live session
• • Maintain a documented, tamper-proof audit trail for every V-CIP account opened
• • Log officer credentials and training records tied to each session for inspection readiness

5. Vendor & Data Localization Checks (Critical for NBFCs/Fintechs)

• • Confirm the regulated entity — not the vendor — retains full ownership of customer data
• • Ensure cloud-based V-CIP data transfers to your own systems immediately after each call, with nothing retained on vendor servers
• • Map your setup against DPDP Act obligations, since every NBFC now functions as a Data Fiduciary responsible for how video KYC data is collected, processed, and stored
• • Confirm video recordings and customer data are stored within India, given restrictions on cross-border transfer
• • Re-audit third-party V-CIP vendors as part of your regulatory risk assessment, not just a procurement checklist

6. Ongoing Periodic KYC Alignment

V-CIP compliance doesn't end at onboarding — periodic re-verification cadences still apply. Per the RBI FAQ, periodic KYC updation is required at least once every two years for high-risk customers, eight years for medium-risk customers, and ten years for low-risk customers, with regulated entities free to set tighter internal cycles but not exceed these ceilings

• • Tag every V-CIP-onboarded customer with a risk rating at the point of account opening
• • Build automated reminders ahead of the 2/8/10-year periodic updation windows
• • Ensure advance-notice and reminder workflows meet the tightened 2025 procedural requirements

7. Governance & Penalty Exposure

• • Brief your board on penalty history — RBI penalty actions between 2024 and 2025 totaled ₹54.78 crore across 353 entities, largely tied to KYC and onboarding control failures
• • Treat "soft guidance" areas (liveness tech choice, VAPT frequency, exact encryption standard) as compliance decisions, not optional extras
• • Document your rationale wherever RBI gives implementation flexibility, so it holds up under audit

Area	Must-Have
Application	Proprietary, encrypted, no third-party video platforms
Officer	Trained, live, authorized — no pre-recorded sessions
Detection	Active + passive liveness, deepfake resistance
Location	Geo-tagging + IP validation for India presence
Review	Second-official concurrent audit before activation
Data	India-stored, RE-owned, DPDP-compliant
Continuity	No resuming a dropped call — restart required
Re-KYC	Risk-tiered periodic updation (2/8/10-year cycle)

Use Pixl to expand your business opportunities

Ready to transform? Commence your Digital Transformation journey now!

Get Started