KYC API and Fraud Check APIs for Indian Lenders: Complete Guide 2026

UIDAI-authorised real-time identity verification using the Aadhaar database. Borrower
enters their Aadhaar number, receives an OTP, and their demographic details (name, DOB,
gender, address) are fetched directly from UIDAI servers. Legally acceptable as full KYC
for loans up to ₹60,000 under RBI norms.

Borrower downloads their Aadhaar XML from the UIDAI portal or DigiLocker and shares the
digitally signed file. Lower cost than OTP eKYC. Widely used for higher-ticket loan
products where Aadhaar OTP limits are a concern (UIDAI restricts high-volume OTP eKYC).
XML contains an UIDAI-signed data packet verifiable without hitting UIDAI servers.

Verifies a PAN number against the Income Tax Department’s database (via NSDL / Protean
APIs). Confirms that the PAN is active, the name matches, and the PAN has not been
de-linked. Also used to check PAN–Aadhaar linking status, which is mandatory for NBFCs
under current RBI KYC guidelines. A separate API call checks PAN-Aadhaar link status for
₹1–3.

Compares a live selfie captured during the loan application against the photograph
extracted from the Aadhaar or PAN document. Active liveness detection (asking the user
to blink, turn their head) prevents spoofing with printed photos or replay attacks.
Accuracy benchmarks for leading Indian providers (HyperVerge, IDfy) are above 99.5% on
Indian faces.

RBI’s Video-based Customer Identification Process (V-CIP) — a live video call between a
trained agent and the borrower, during which identity documents are verified in real
time. Mandatory for full KYC on certain products (e.g., credit cards, loans above
₹60,000 for certain NBFCs). Asynchronous AI-assisted V-CIP reduces agent dependency and
brings per-session cost down. 3–5 minutes per session.

Fetches existing KYC records from the Central KYC Registry (CKYC / CKYCR) operated by
CERSAI. If a borrower has been KYC-verified by any regulated entity before, their CKYC
record is stored centrally. Lenders can retrieve it instead of re-performing KYC,
reducing cost and friction. RBI requires CKYC check before undertaking fresh KYC.

Optical Character Recognition extracts structured data from unstructured document images
— PAN cards, Aadhaar, driving licences, passports, GST certificates, rent agreements.
Modern OCR APIs for Indian documents achieve >98% field accuracy. Used to pre-fill
application forms, cross-validate borrower-entered data, and flag tampered documents via
metadata analysis.

Validates that a bank account number and IFSC code are live and belong to the declared
borrower. A Re. 1 penny deposit is made to the account via IMPS/NEFT, and the name
registered with the bank is returned. Used to verify disbursal accounts at origination
and repayment accounts before NACH setup. Reverse penny drop (₹4–9) validates without
actual credit.

Automated parsing and analysis of 3–12 months of bank statements (PDF or via Account
Aggregator). Extracts income patterns, average monthly balance, EMI obligations, salary
credits, irregular debits, and bounce history. Categorises transactions into 100+
buckets. Output: structured JSON with income, obligations, and risk signals. Critical
for income assessment in unsecured lending.

Aadhaar-based eSign enables borrowers to digitally sign loan agreements, NACH mandates,
and sanction letters using their Aadhaar OTP as authentication. Legally valid under the
IT Act, 2000. Accepted by courts and regulators as equivalent to a wet signature.
Significantly reduces TAT vs. physical signing and courier. Providers: eMudhra, Digio,
SignDesk, Leegality.

Retrieves a borrower’s full credit history from India’s four credit bureaus. Includes
CIBIL score (300–900), total outstanding debt, number of active loans, EMI obligations,
DPD (days past due) history, written-off accounts, and settled accounts. Lenders are
required to report to at least one bureau under RBI guidelines. Multi-bureau pulls (all
four) cost ₹120–180 but significantly improve fraud detection for thin-file borrowers.

Captures device metadata at the time of application: OS version, browser, screen
resolution, installed fonts, GPS coordinates, IP reputation, VPN/proxy detection,
emulator detection, and device history. A single device associated with multiple PAN
numbers or applications is a strong fraud signal. Providers like Bureau.id assign a
device risk score that persists across lenders.

Validates a mobile number against telecom data: whether the number is active, its age
(SIM age is a key fraud signal — SIMs <30 days old are high-risk), whether it is
linked to the declared Aadhaar/PAN, operator, and whether it has been ported recently.
Also checks for SIM swap events in the last 30–90 days, which indicate account takeover
risk.

Checks a borrower’s PAN, Aadhaar, mobile number, or email against internal and external
fraud lists: RBI’s defaulter lists, SEBI debarred entities, CIBIL’s fraud registry,
CERSAI’s securitisation database, and lender-contributed negative databases. Also
includes PMLA watchlist checks (OFAC, UN sanctions) for regulated lenders. A match
triggers automatic rejection or manual review.

Checks whether a borrower has an existing active loan with the same lender or, through
consortium platforms, with other lenders. Detects serial applicants who apply with
slight variations in name spelling, different phone numbers, or alternate addresses to
bypass rejection. Critical for NBFCs doing microfinance and group lending where
over-indebtedness is a major risk.

A specialist layer on top of bank statement analysis that detects income manipulation:
round-number salary credits, credits immediately followed by withdrawals (cash cycling),
unusually regular patterns inconsistent with stated employment, identical credit amounts
on multiple accounts, and forged PDF metadata. Detects both borrower-side and
DSA-facilitated income fabrication.

For MSME and business loans: validates GSTIN against GSTN’s database, retrieving business
name, address, registration date, filing status, and HSN/SAC codes. Detects dormant GST
registrations being used to inflate business credentials. GST return filing data
(GSTR-3B) provides an independent revenue signal that can be compared against declared
income in the loan application.

Assesses email address risk: age of the email account, whether it appears in breach
databases, whether it is a disposable/temporary address, domain reputation, and whether
it is associated with known fraud patterns. Some providers also offer social graph
analysis — checking whether the declared employer’s name matches LinkedIn data, or
whether an address is associated with a known fraud cluster.