Video KYC is only as strong as the checks behind the call

On 28 November 2025 the Reserve Bank of India issued the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, bringing its KYC instructions for commercial banks into a single text. The directions cover customer due diligence, risk categorisation, monitoring and reporting to FIU-IND. The provisions on remote onboarding deserve a closer read than they usually get.

For the Video-based Customer Identification Process, the directions require face liveness or spoof detection and face matching "with high degree of accuracy". The system must be able to prevent connections from IP addresses outside India or from spoofed IP addresses. Sessions may be run only by bank officials specially trained for the purpose, and the official must reject the account opening if there is any prompting at the customer's end. Accounts opened through video KYC become operational only after a concurrent audit.

Accounts opened without face-to-face contact carry further conditions. The first transaction must be a credit from the customer's existing KYC-compliant bank account, and such customers are to be categorised as high risk. Periodic updation of KYC is due at least every two years for high-risk customers, every eight years for medium risk and every ten for low risk.

Where remote onboarding is tested

Each safeguard answers a particular way of cheating the process. The patterns worth testing for are familiar to investigators:

• The liveness check passes because a real person is on camera, but that person has been paid to open the account for someone else.
• Video is injected or replayed, which tests whether spoof detection looks beyond a blink or a head turn.
• Someone off camera coaches the customer, which only a trained and attentive official will notice.
• The same room, device or voice appears across supposedly unrelated customers, which a review of single sessions will miss.
• The first credit arrives from an account that is itself under someone else's control.

The last point links onboarding to the RBI's September 2026 draft procedure on money-mule accounts, which would sit within the same directions. When a mule account is found, the first question an investigator asks is how it was opened. A bank that cannot answer from its own records has a gap in both controls.

A video KYC journey should be tested the way a fraudster would test it, before a fraudster does.

What to do now

• Commission adversarial testing of the video KYC journey, including replayed and injected video, and keep the results.
• Train officials on coaching and prompting cues, record the training and refresh it as methods change.
• Use the concurrent audit to compare sessions with each other, not only to check each one against a checklist.
• Link onboarding records to fraud and mule monitoring, so that a flagged account can be traced back to the session that opened it.
• Where business correspondents or partners take part in onboarding, test that they apply the same standard. The responsibility stays with the bank.