Resources Categories
INDUSTRY FACT FILE · DIGITAL IDENTITY, TRUST & ESIGN
Industry Overview: Digital Identity, Trust and eSign in India
Who runs India's identity, authentication, KYC and electronic signature services, the obligations that apply, who buys cybersecurity in the sector and why each role needs its own approach.
|
In this document 1. Why digital identity and trust security matters now 2. The ecosystem at a glance 3. Categories of digital identity, trust and eSign organisations 4. The identity, signature and cyber framework at a glance 5. Authorities, infrastructure and ecosystem participants 6. Who buys cybersecurity inside an identity or trust service provider 7. Why each role in the ecosystem needs a different approach 8. How Codec Networks works with digital identity and trust providers |
|
Sector scope Sector: Aadhaar ecosystem entities, certifying authorities and eSign providers, video-KYC and identity verification platforms, DigiLocker issuers and requesters. Primary service proposition: role-specific UIDAI assessments, eSign onboarding security and authentication and API testing. Banking and fintech have separate fact files. |
1. Why digital identity and trust security matters now
India runs the largest digital identity infrastructure in the world, and almost every regulated digital service now leans on it. A PIB release of March 2026 put the number of live Aadhaar holders at about 134 crore and the number of Aadhaar authentication transactions completed since launch at more than 17,000 crore. In November 2025 alone UIDAI recorded 231 crore authentication transactions, 47.19 crore e-KYC transactions and 28.29 crore face authentications, more than double the 12.04 crore face authentications of November 2024. DigiLocker had more than 72.43 crore registered users by August 2026, according to a reply in the Rajya Sabha, with 5,437 document types available from central and state issuers. Since 2015, the IT Act's Second Schedule has allowed Aadhaar e-KYC-based eSign, offered by licensed certifying authorities acting as eSign service providers and built into loan, insurance, HR and government applications by application service providers. RBI has allowed video-based customer identification since January 2020, and since January 2025 approved non-government entities can seek permission to use Aadhaar authentication for services such as e-commerce, travel, hospitality and health.
|
134 crore Live Aadhaar holders (PIB, March 2026) |
17,000 crore+ Aadhaar authentication transactions to date |
28.29 crore Face authentications in November 2025 (UIDAI) |
6 hours To report cyber incidents to CERT-In |
Each layer of that infrastructure is a target, because each one converts a technical control into a legal or financial fact. A successful fingerprint authentication releases cash at an agent outlet; an e-KYC response opens an account or a SIM; a video-KYC session creates a bank customer; an eSign binds a borrower to a loan. Fraudsters have copied fingerprints onto silicone pads, and the government has told Parliament that UIDAI introduced an in-house AI and machine-learning fingerprint liveness check to detect cloned fingerprints, alongside face authentication for Aadhaar-enabled payments. Deepfake faces and injected video streams are aimed at video-KYC and face-match systems, forged and synthetic identities at onboarding, and broken authorisation at the APIs that connect relying parties, KYC vendors and DigiLocker. Just as often, the weakness is ordinary: full Aadhaar numbers copied into logs and reports, an over-privileged operator account or an application that shows the signer one document and signs another.
The ecosystem has already seen what misuse looks like. In February 2017 UIDAI filed a police complaint alleging that Axis Bank, its business correspondent Suvidhaa Infoserve and eMudhra had carried out authentication transactions by replaying stored biometrics, which the firms disputed or described as testing, and authentication for the three was suspended. In December 2017 UIDAI temporarily suspended the e-KYC licences of Bharti Airtel and Airtel Payments Bank after allegations that payments bank accounts had been opened through SIM verification without informed consent. International cases carry the same lessons for trust providers: the Dutch certifying authority DigiNotar went bankrupt in 2011 after an intrusion in which at least 531 rogue certificates were issued, Okta disclosed in 2023 that an attacker had used session tokens in support files to reach 134 of its customers, and the engineering firm Arup confirmed in 2024 that an employee in Hong Kong had transferred HK$200 million after a video call populated by deepfakes of colleagues.
The obligations are explicit and role-specific. The Aadhaar Act 2016 requires consent and purpose limitation, prohibits storage of core biometric information and, since the 2019 amendment, allows adjudicating officers to impose civil penalties of up to ₹1 crore on entities, with up to ₹10 lakh a day for continuing non-compliance. Regulation 14(1)(h) of the Aadhaar (Authentication and Offline Verification) Regulations 2021 requires requesting entities to have their operations and systems audited annually by a certified information systems auditor, and UIDAI's compliance checklist V3.0 of November 2022 calls for that annual audit to be done by a CERT-In empanelled auditor. UIDAI Circular 14 of 2025, issued on 4 November 2025, revised the rules for hosting Aadhaar Data Vaults, hardware security modules and authentication applications on premises and in the cloud. eSign service providers must be licensed CAs empanelled by the CCA after audit, RBI's KYC Directions of November 2025 expect liveness and spoof detection in video-KYC, CERT-In's Directions require six-hour incident reporting, the DPDP Act covers the personal data involved and the IT Rules amendment of February 2026 brings deepfakes and other synthetic content under intermediary due diligence.
|
Key takeaway In digital identity and trust services, a security failure is fraud committed in a real person's name. Protecting biometrics and e-KYC data, keeping Aadhaar numbers inside the vault, testing every authentication, KYC and signing flow and proving consent for every signature are now audit, licence and partner expectations, not optional extras. |
2. The ecosystem at a glance
Figure 1: India's digital identity, trust and eSign ecosystem.
3. Categories of digital identity, trust and eSign organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
AUAs and KUAs |
Requesting entities that use Aadhaar authentication or e-KYC: banks, telecom operators, lenders, insurers, government departments and approved private entities |
Public and private, many listed |
Aadhaar Act and Regulations 2021; UIDAI agreements and checklists; sector regulator KYC rules; CERT-In; DPDP |
|
Sub-AUAs and sub-KUAs |
Entities that reach Aadhaar authentication through an AUA or KUA, such as agent networks, fintechs and ASPs |
Private, often start-ups or service partners |
Agreements with the parent AUA or KUA; UIDAI checklists; CERT-In; DPDP |
|
Authentication service agencies |
Agencies providing secure network connectivity between requesting entities and UIDAI's Central Identities Data Repository |
Telecom and network service companies |
Aadhaar Regulations; ASA agreements and audit checklists; CERT-In |
|
Registrars and enrolment agencies |
Organisations that enrol residents and process updates through operators, kits and centres |
Banks, post offices, state governments, contracted agencies |
Aadhaar (Enrolment and Update) Regulations; UIDAI processes; CERT-In |
|
Certifying authorities and eSign service providers |
CAs issuing digital signature certificates and running PKI, timestamping and online eSign services |
Private and public, licensed by the CCA |
IT Act 2000 and Second Schedule; CCA licence and eSign guidelines; KUA status for e-KYC; CERT-In |
|
Application service providers |
Lending, insurance, HR, legal-tech and government applications that integrate eSign |
Private and public |
Agreement with the ESP; ESP onboarding and security terms; CERT-In; DPDP |
|
Video-KYC and identity verification platforms |
Vendors and in-house teams running V-CIP, face match, liveness, document checks and fraud scoring |
Private, often SaaS |
RBI, SEBI and IRDAI KYC rules via regulated clients; outsourcing terms; CERT-In; DPDP |
|
DigiLocker issuers and requesters |
Departments, boards and universities that issue documents, and organisations that accept them |
Public and private |
DigiLocker Rules 2016 (Rule 9A); DigiLocker partner terms; CERT-In; DPDP |
4. The identity, signature and cyber framework at a glance
|
Instrument or expectation |
What it means for identity and trust organisations |
|
Aadhaar Act, 2016 (amended 2019) |
Informed consent and purpose limitation for authentication; core biometric information not stored or shared; offline verification without collecting the Aadhaar number; civil penalties of up to ₹1 crore on entities, with up to ₹10 lakh a day for continuing non-compliance |
|
Aadhaar (Authentication and Offline Verification) Regulations, 2021 |
Obligations of requesting entities and ASAs; annual audit of operations and systems by a certified information systems auditor (Regulation 14(1)(h)); UIDAI compliance checklists by role, with the annual IS audit by a CERT-In empanelled auditor |
|
UIDAI Circular 14 of 2025 |
Issued on 4 November 2025; Aadhaar numbers and connected e-KYC data stored only in an Aadhaar Data Vault; reference keys or tokens elsewhere; encryption keys in HSMs; rules for on-premises and cloud hosting |
|
Aadhaar Authentication for Good Governance Rules, 2020 (amended January 2025) |
Approved non-government entities may use Aadhaar authentication for specified public-interest services after assessment by UIDAI and notification by the relevant ministry |
|
IT Act, 2000 and the Second Schedule |
Legal recognition of electronic signatures (Section 3A); licensing of CAs by the CCA; Aadhaar e-KYC-based eSign by licensed CAs empanelled as eSign service providers; CCA e-authentication guidelines and eSign API specifications |
|
RBI KYC Directions, 2025 |
Consolidated on 28 November 2025 from the 2016 Master Direction; V-CIP with live video, liveness and spoof detection and face matching; similar video-KYC routes exist under SEBI and IRDAI rules |
|
DigiLocker Rules, 2016 (Rule 9A, 2017) |
Documents issued into DigiLocker and shared from a subscriber's account accepted at par with physical originals |
|
CERT-In Directions (28 April 2022) and audit guidelines (25 July 2025) |
Cyber incidents reported within six hours; ICT logs kept for 180 days in India; risk-based independent audits |
|
IT Rules amendment, February 2026 |
Synthetic content, including deepfakes, labelled and traceable; unlawful content removed within three hours of an order |
|
DPDP Act 2023 and Rules 2025 |
Identity, KYC and document data; reasonable security safeguards and breach intimation; most obligations from May 2027 |
|
How these apply UIDAI obligations follow your role and agreement as an AUA, KUA, sub-AUA, ASA, registrar or enrolment agency; CCA obligations follow your CA licence or ESP empanelment; video-KYC rules reach vendors through regulated clients; CERT-In's Directions apply to body corporates and government organisations. Confirm against the official instruments and your agreements. |
5. Authorities, infrastructure and ecosystem participants
- UIDAI issues Aadhaar numbers, runs the Central Identities Data Repository, appoints and audits AUAs, KUAs and ASAs, issues circulars and compliance checklists and adjudicates penalties through its adjudicating officers.
- MeitY administers the IT Act, the Aadhaar good-governance rules, DigiLocker and the IT Rules; the Controller of Certifying Authorities licenses CAs, runs the root certifying authority and empanels eSign service providers.
- Sector regulators such as RBI, SEBI, IRDAI and the Department of Telecommunications set KYC rules that rely on Aadhaar e-KYC, video-KYC and eSign; NPCI runs Aadhaar-enabled payments and eMandate rails that use identity and signatures.
- CERT-In and NCIIPC handle incident reporting, advisories and protected systems; STQC certifies biometric devices used with UIDAI's registered device framework.
- AUAs, KUAs and ASAs connect relying services to the CIDR; registrars and enrolment agencies run enrolment and update centres; CAs, ESPs and ASPs issue certificates and carry signing into applications.
- Video-KYC and identity verification vendors supply onboarding, face-match and fraud tools to regulated entities, while DigiLocker issuers and requesters exchange verified documents through its APIs.
6. Who buys cybersecurity inside an identity or trust service provider
|
Stakeholder |
What they care about |
What they buy |
|
Board, CEO and MD |
Licence and agreement standing, fraud losses, reputation |
Board briefings, maturity assessments, crisis exercises |
|
CISO and head of information security |
UIDAI and CCA audits, vault and HSM security, incidents |
Role-specific audits, VAPT, SOC, incident response retainers |
|
Aadhaar or KYC compliance officer |
UIDAI checklists, consent, sub-AUA oversight |
Checklist gap reviews, consent flow reviews, sub-AUA assessments |
|
CTO and product engineering |
Secure APIs, SDKs, apps and integrations |
API and mobile testing, secure SDLC, release testing |
|
Head of fraud and risk |
Biometric spoofing, deepfakes, mule accounts |
Video-KYC fraud testing, anomaly monitoring, investigations |
|
CA operations and RA heads |
Certificate issuance integrity, key ceremonies, CCA audits |
RA and CA control reviews, PAM, HSM and key management reviews |
|
Data protection officer and legal |
DPDP obligations, retention, disputes and evidence |
Privacy programmes, data discovery, evidence handling |
7. Why each role in the ecosystem needs a different approach
|
Organisation type |
Highest-consequence risk |
Starting point for assurance |
|
AUAs and KUAs |
Aadhaar numbers outside the vault; cloned biometrics; sub-AUA misuse |
Annual UIDAI IS audit, vault and HSM review, sub-AUA assessments |
|
ASAs |
Outage or compromise of links carrying authentication traffic |
Network and infrastructure VAPT, resilience review, SOC |
|
Registrars and enrolment agencies |
Operator credential misuse and forged documents at enrolment |
Operator access review, kit and centre assessment, monitoring |
|
CAs and eSign service providers |
Key or RA compromise; signing without consent |
CA and RA control reviews, HSM and key review, CCA audit readiness |
|
ASPs integrating eSign |
Document swapped after consent; weak app security |
ASP security assessment, document-binding tests, API testing |
|
Video-KYC and IDV platforms |
Deepfakes, injected video, synthetic identities |
Deepfake and injection testing, liveness review, fraud monitoring |
8. How Codec Networks works with digital identity and trust providers
Codec Networks is a CERT-In empanelled information security auditing organisation, empanelled with NICSI for application audit and compliance services (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For digital identity, trust and eSign organisations we deliver role-specific UIDAI assessments for AUAs, KUAs, sub-AUAs, ASAs and enrolment agencies against UIDAI's compliance checklists, Aadhaar Data Vault, HSM and key management reviews under Circular 14 of 2025, data discovery for Aadhaar numbers outside the vault, security assessments of ASP applications and reviews of ESP, CA and RA controls ahead of CCA audits, testing of authentication, e-KYC, eSign, DigiLocker and partner APIs, mobile apps and SDKs, deepfake and injection testing of video-KYC and face-match systems, consent and DPDP programmes, 24x7 managed SOC with authentication and fraud anomaly monitoring, and forensics for identity fraud and data exposure incidents. Each proposal confirms auditor eligibility and independence against UIDAI's and CCA's requirements.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by role in the Aadhaar ecosystem (AUA, KUA, sub-AUA, ASA, registrar or enrolment agency), by certifying authority licence and eSign empanelment, by sector regulator, by contract and by the data each organisation handles; confirm them against the official UIDAI, MeitY, CCA, RBI, CERT-In and Data Protection Board instruments and your agreements. UIDAI-specified audits are carried out as UIDAI prescribes, by auditors eligible under its requirements.