Physical, in-person KYC is the original process: a customer visits a branch, or a representative visits them, carrying original Officially Valid Documents (OVDs) — Aadhaar, passport, voter ID, driving licence, or NREGA job card — which are physically checked, copied, and countersigned by an authorised official who also does a live face match against the document photo.

It's slow and doesn't scale, but it's still the benchmark every other method gets measured against. That's exactly why V-CIP was built to be "equivalent to face-to-face" rather than a lesser substitute — the regulator's baseline is still physical verification.

Where physical KYC still shows up in 2026

• No valid OVD on file: if Aadhaar isn't available or the customer opts out of Aadhaar-based verification, digital paths aren't available and physical verification becomes the fallback.

• Non-resident onboarding: where Aadhaar-linked authentication doesn't apply, banks typically rely on physical or attested document verification instead.

• High-risk and PEP categories: politically exposed persons and certain high-risk-rated customers usually get enhanced due diligence with an in-person element, even when the initial touchpoint was digital.

• Complex legal entities: partnerships, trusts, and companies with layered ownership are harder to verify end-to-end over video, so document-heavy in-person checks remain common.

• Agent-assisted rural banking: in BC/AEPS networks, biometric authentication at the point of service works much like an in-person check — the customer is physically present and authenticated on the spot, minus the branch visit.

The honest framing: physical KYC isn't the old way being phased out. It's the fallback tier every digital-first fintech still needs wired up, because a meaningful slice of applicants will land there — no Aadhaar, a mismatch needing human judgment, or a risk category that mandates it.

eKYC gets used as a catch-all term, but it covers a few distinct paths RBI treats quite differently — and getting that distinction right matters more than most teams realise.

Aadhaar OTP-based eKYC

The customer enters their Aadhaar number, an OTP goes to the UIDAI-linked mobile, and on verification, demographic details are shared back. It's fast — under two minutes — and needs nothing more than a phone. But RBI treats this as a lighter-touch method: accounts opened purely on OTP-based eKYC in a non-face-to-face setting must be placed under closer transaction monitoring, and full customer due diligence has to be completed within one year of opening. OTP-based eKYC alone gets you a provisional relationship, not a fully risk-cleared one.

Aadhaar biometric eKYC

Here the customer's fingerprint or iris is matched against UIDAI through a registered Authentication User Agency, typically at a physical or agent-assisted touchpoint — the mechanism underpinning most AEPS and BC-network transactions. Because it's a biometric match rather than just phone possession, RBI treats it as materially stronger assurance, closer to physical verification, without the monitoring overhang OTP-based eKYC carries.

Offline Aadhaar / DigiLocker verification

The customer shares a UIDAI-issued offline XML/QR share or a DigiLocker document, digitally signed and verifiable without hitting UIDAI's live servers. Useful where connectivity is unreliable, and accepted as a valid OVD-equivalent path — though it still needs a liveness or facial-match step for full digital KYC assurance rather than just document collection.

The pattern across all three: eKYC is fast and low-friction, but its regulatory weight depends heavily on which variant you use. Treating "Aadhaar-based" as automatically equal to full KYC is the most common misreading of the rules teams make.

Video-based Customer Identification Process — V-CIP — is RBI's answer to getting face-to-face assurance without a branch visit. It's a live, two-way audio-visual session between the customer and a trained official, and RBI has been explicit that a properly conducted V-CIP session counts as equivalent to in-person verification. That equivalence is the whole point, and it's also why the operational bar is set high.

A compliant flow generally runs: Customer-initiated session on the entity's own app or domain → Consent and identity capture → Live document and face capture with liveness check → Randomised verification questions → Maker-checker review of the recording → Approval or rejection logged with an audit trail.

• It has to be live: a pre-recorded video, or one initiated via a third-party aggregator rather than the entity's own channel, doesn't qualify — a recurring RBI inspection finding.

• Geo-tagging is mandatory: GPS-level location must be captured and cross-checked against IP address; IP-only location capture is treated as a gap.

• No rehearsed script: questions must vary session to session so the process can't be gamed.

• A second officer reviews every session: the interviewer isn't the approver — RBI expects that separation documented.

• Recordings must be stored in India for the mandated retention period, with access logged and restricted.

Because of the live-session and maker-checker requirements, V-CIP costs more per verification than eKYC — you're paying for trained officer time, not just an API call. But it buys full regulatory equivalence to physical verification, for a customer who never visits a branch.

This is the part worth getting precisely right, because it's where audit findings actually happen. RBI's KYC Master Direction, and its mid-2025 amendment, doesn't say "use Video KYC for everything" or "eKYC is always fine." It builds a tiered structure based on risk and the strength of the underlying authentication.

Non-face-to-face onboarding is permitted, with conditions

Entities can onboard customers entirely digitally, with no branch visit, using Aadhaar OTP-based eKYC. But the resulting account has to be flagged for enhanced monitoring, and full CDD — typically biometric authentication, V-CIP, or physical verification — has to be completed within one year. It's a grace period, not a permanent substitute.

V-CIP is the accepted substitute for a branch visit

Where an entity wants full face-to-face-equivalent verification without the OTP monitoring conditions, V-CIP is the path built for exactly that. It's available to banks, NBFCs, and payment aggregators, and treated the same as a branch visit — provided the operational controls above are actually followed.

Biometric Aadhaar authentication at agent touchpoints

For BC-network and AEPS-style transactions, biometric Aadhaar authentication at the point of service is the backbone of the model — the customer is physically present and authenticated in real time against UIDAI, so no separate video step is generally needed.

Physical KYC remains mandatory in specific situations

Customers without Aadhaar, non-resident onboarding, high-risk or PEP categories, and cases where a customer declines digital verification still require physical, document-based verification. There's no digital bypass for these.

Periodic re-KYC runs on its own clock

Independent of the onboarding method, RBI's 2025 amendment gave low-risk customers — broadly, salaried individuals with low balances and transaction volumes — an extended re-KYC window, up to one year from their due date or June 30, 2026, whichever is later, provided the entity sends the required reminders first. This is a periodic-updation rule, not an onboarding-method rule, and it's worth keeping the two separate in your compliance documentation.

The cost curve is intuitive once separated from compliance. eKYC is close to a pure API cost — no human labour in the loop — which is why it scales to millions of onboardings without a proportional rise in headcount. Physical KYC sits at the other end: every verification consumes staff time, and that cost doesn't compress much regardless of volume.

Video KYC lands closer to the physical end than most teams expect. A live session still needs a trained officer's time, even if that officer handles several sessions an hour instead of one branch visit a day. Add the maker-checker step, video storage, and agent-training overhead, and V-CIP's per-verification cost is meaningfully higher than eKYC's — though still far lower than sending someone to a customer's doorstep.

Speed follows the same pattern: eKYC completes in the time it takes to type an OTP, Video KYC needs a scheduled or on-demand live session bound by agent availability and connectivity, and physical KYC is bound by whatever the branch's or field agent's calendar allows — which can stretch to days.

Each method fails differently, and knowing the specific failure mode matters more than ranking them on a single fraud score.

• Physical KYC fails through forged or altered documents and inconsistent human judgment — two branch officers can apply very different scrutiny to the same document.

• OTP-based eKYC fails through SIM-swap fraud and unauthorised phone access — control of the registered mobile is enough to complete the step without being the actual Aadhaar holder, which is exactly why RBI mandates enhanced monitoring for accounts opened this way.

• Biometric eKYC is comparatively hard to spoof at scale, since it needs a live fingerprint or iris match against UIDAI, though it depends on the integrity of the capture device at the point of service.

• Video KYC is exposed to a newer, faster-moving risk: deepfake and synthetic-video injection, where a fraudster feeds a manipulated stream instead of appearing live. This is exactly why liveness detection, randomised questioning, and maker-checker review aren't bureaucratic overhead — they're the controls that counter this specific failure mode.

Customer experience runs roughly opposite to the fraud-risk pattern. eKYC has the least friction and the highest completion rates. Physical KYC has by far the worst drop-off — asking a digitally-acquired customer to visit a branch reliably loses them mid-funnel. Video KYC sits in between: it converts better than a branch visit, but still asks for a scheduled slot, decent lighting, a stable connection, and a few minutes of undivided attention — which costs some percentage of applicants who'd have sailed through an OTP flow without a second thought.

Most serious fintechs don't pick one method — they build routing logic that sends different customer segments down different paths based on risk, product type, and regulatory requirement.

Digital lending NBFCs

For low-ticket, short-tenure loans to existing, previously-verified customers, Aadhaar eKYC (ideally biometric, or paired with a liveness check) is usually sufficient and keeps disbursal turnaround low. For first-time, higher-ticket, or higher-risk borrowers, V-CIP is the safer default — the loan book risk justifies the extra cost, and RBI's equivalence treatment gives a cleaner compliance position if the loan is later scrutinised.

Payments and wallet businesses

High-volume, low-balance wallet onboarding is the classic case for OTP-based eKYC, since transaction limits and monitoring absorb the risk RBI flags for this method. As wallet limits rise or usage crosses into higher-risk territory, that's the trigger point to upgrade the customer to V-CIP rather than leaving them permanently "under monitoring."

Deposit accounts (banks and small finance banks)

Full-service savings and current accounts generally warrant V-CIP or physical verification, given the broader product access — cheques, higher limits, linked cards — that comes with them. OTP-based eKYC left unresolved past the one-year CDD window becomes a compliance liability rather than a convenience.

BC/AEPS and assisted-banking networks

Biometric Aadhaar authentication at the point of service is usually the right and sufficient method — the customer is physically present with the agent, and the match itself delivers strong assurance without needing a separate video layer.

HR, payroll, and employee verification contexts

For employee onboarding and background checks — the kind of workflows a product like Samay handles around attendance and HR data — a lighter identity-verification layer paired with document checks is typically proportionate. The RBI-specific V-CIP/eKYC framework is built for regulated financial relationships, not employment verification, so it's worth not over-engineering that flow to bank-grade KYC.

The common thread: match the method to the actual risk and regulatory requirement of the relationship, not to whichever is cheapest to implement. A routing layer that applies eKYC by default, escalates to V-CIP when risk signals demand it, and falls back to physical verification for genuine edge cases, is far more defensible than forcing every customer through one method.

None of these three methods is universally "better" — they solve different problems at different points on the cost, speed, and assurance curve, and RBI's rules are built around exactly that tradeoff rather than a preference for one technology. The practical move isn't picking a single method for your entire onboarding flow; it's building a routing layer that applies eKYC where risk and product type support it, escalates to Video KYC when full face-to-face-equivalent assurance is warranted, and keeps a physical fallback ready for the genuine edge cases digital paths can't cover. If you're evaluating how to wire that logic into your onboarding stack without maintaining three separate integrations, take a look at Verify Edge, or get in touch with SecureEdge to walk through what your specific product and risk profile actually needs.