Two Indian KYC rails solve the same problem differently.
eKYC verifies a customer at the source each time; CKYC stores a single profile in a central registry for consented reuse.
Accurate as of Sep 10, 2025 (Europe).
What they are — and who runs them
Aadhaar eKYC. Electronic identity verification via UIDAI with OTP or biometrics, plus paperless offline options (Secure QR/Offline XML). Each regulated entity (RE) initiates eKYC on its own and keeps the result in its systems, according to UIDAI guidance.
CKYC. Central KYC Registry operated by CERSAI across banking, credit, investments, and insurance. A customer completes full KYC once with an authorized institution; after validation, a KYC Identifier Number (KIN) is issued. With the customer’s consent, other REs can fetch that record instead of redoing primary document checks, per CERSAI.
How data flows
Aadhaar eKYC
- Customer provides informed consent and authenticates (OTP/biometrics).
- Your system (via authorized AUA/KUA rails) requests UIDAI and receives verified attributes (name, date of birth, address, photo, etc.).
- You store the result, manage periodic reviews, retention, masking, and audit.
Options. Paperless Offline eKYC (XML/Secure QR) and V-CIP (video KYC) serve as fallbacks or risk-based upgrades.
CKYC
- A “first” RE collects full KYC (documents, photo; V-CIP if applicable) and uploads to CERSAI.
- The record is validated; a KIN is issued.
- Subsequent REs, with consent and the KIN, pull the existing record instead of re-collecting documents.
- Updates (e.g., address change) should be posted back to CKYC so all downstream users see the latest version.
One-time vs every-time — the core trade-off
Aadhaar eKYC = verify at each provider. Fast and low friction for mass onboarding, but duplicative: every RE repeats verification and bears its own retention/audit obligations.
CKYC = central record. “Do it once, reuse widely.” Great for portability across banking, investments, and insurance, but quality depends on the initial upload and disciplined updates.
Strengths and gaps
Aadhaar eKYC — strengths
- Instant identity proof; smooth UX for payments and lightweight products.
- Scales for wallets, PPIs, UPI apps, and micro-credit.
- Flexible: offline Aadhaar and V-CIP fallbacks.
Aadhaar eKYC — gaps
- Duplication across REs; multiple versions can exist.
- Each RE must run strong data governance (retention, masking, access logs).
CKYC — strengths
- KIN delivers KYC portability across sectors (bank ↔ broker ↔ insurer).
- Cuts aggregate ecosystem KYC cost and time; single point to update customer data.
CKYC — gaps
- Dependent on the quality of the “first” record and timeliness of updates.
- Many segments still require additional steps (fresh eKYC/V-CIP/risk checks).
When to use which — pragmatic patterns
- Payments (wallets, PPIs, UPI apps). Lead with Aadhaar eKYC or Offline Aadhaar for instant onboarding; layer V-CIP to raise limits or when risk flags trigger. Pull CKYC when your user is likely to step into bank/credit/investments next.
- Bank accounts and credit. Hybrid. If a valid CKYC exists, fetch it; if absent or stale, refresh via eKYC/V-CIP and upload back to CKYC.
- Investments and insurance. Ask for KIN in pre-check to shrink friction; resolve mismatches with V-CIP.
- SMEs/corporates. CKYC gives structure, but you still need enhanced CDD/EDD (UBOs, source of funds, sanctions) beyond retail CKYC/eKYC.
The regulatory frame — in plain English
- UIDAI / Aadhaar provides identity rails. eKYC is available to authorized entities (AUA/KUA) with explicit consent; Paperless Offline eKYC (XML/Secure QR) is available, according to UIDAI.
- CERSAI / CKYC runs the centralized repository; records are reusable via KIN with consent, as per CERSAI.
- V-CIP (video KYC) is a regulator-recognized onboarding mode, treated on par with face-to-face when done per rules; the RBI updated KYC FAQs and amended KYC directions in June 2025, clarifying periodic updates and onboarding modes.
- KRA ≠ CKYC. KRAs are securities-market repositories (SEBI scope). CKYC spans sectors under CERSAI. In practice they coexist; your product should speak both “languages.”
Quick comparison
| Criterion | Aadhaar eKYC (UIDAI) | CKYC (CERSAI) |
| Who runs it | UIDAI via authorized AUA/KUA channels | CERSAI (Central KYC Registry) |
| Identifier | Aadhaar + your internal IDs | KIN (shared across REs) |
| Where data lives | With each RE that ran eKYC | Centrally in CKYC (+ originator) |
| Repeat onboarding | Run eKYC again with each RE | Share KIN; fetch the record |
| Keeping data fresh | Each RE updates its own copy | Update CKYC; others see it |
| Typical fallbacks | Offline XML/QR, V-CIP | V-CIP, document refresh |
| Best-fit use cases | High-volume, low-value payments | Bank/credit/investments/insurance |
By the numbers — anchored facts
- 2016 — CKYC go-live under CERSAI (RBI operationalization note; phased from July 15, 2016).
- 14-digit KIN — portable key for CKYC reuse across sectors.
- Three onboarding modes — face-to-face, non-face-to-face, and V-CIP (per RBI’s June 2025 update).
- Paperless Offline eKYC — machine-readable XML or Secure QR signed by UIDAI.
Risk & controls — build-ready checklist
- Consent UX. Be explicit on purpose, scope, and retention; log grants and withdrawals.
- Golden record & dedupe. eKYC can spawn duplicates; keep a master profile and merge rules.
- Freshness. Pipe customer changes (address, phone) back into CKYC and into your core.
- Fallback plan. Design V-CIP/offline flows for OTP failures or attribute mismatches.
- Retention & access. Central policies, masking, role-based access, and auditable trails.
- Segment nuances. Bank, NBFC, broker, insurer rules differ; maintain a mapped requirement matrix and escalation path.
Bottom line
Need speed and scale? Aadhaar eKYC wins.
Need portability across providers? Put CKYC/KIN at the center.
In the real world, the combo wins: eKYC for instant onboarding, CKYC for reuse and lower total cost.
Want the broader context of India’s digital rails? Read our explainer: [India Stack: How Digital Public Infrastructure Redefined Finance in India].
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Implementations should follow your current license requirements and regulator guidance.