Mandatory Biometric Aadhaar ID for Banking in India

Aadhaar is the world’s largest biometric citizen database. It is used in India to register everyone with a face, fingerprint, and iris prints, from the age of 5. Younger citizens have to re-register every 5 years due to the constantly shifting nature of their biometric information. Aadhaar is primarily used for social welfare, keeping track of citizens’ proof of life and voting, and has been the target of many a controversy (including a hefty amount of lawsuits) in the past. However, the Indian government shows no indication of slowing down the project and has, in fact, accelerated its progress.

According to the recent governmental mandate from the Unique Identification Authority of India (UIDAI), the biometrically-enabled ID assigned to each citizen will be made a key component of banking registration, and it will be made compulsory for banks to tie each customer’s Aadhaar information to their individual account. Further, the expansion of the ABIS (Automated Biometric Identification System) to the banking sector is bound to have additional effects, increasing awareness of biometric-based Citizen Registration Systems. UIDAI’s mandates will not only boost biometrics revenues in the region but will also force biometric IDs in other internal markets (e.g. telecoms) and have a direct effect on other APAC countries with similar ABIS objectives.

Besides the initial Aadhaar-based registration required for opening and managing a bank account in India, it will also be mandatory for customers to biometrically authenticate using their Aadhaar credentials for transactions over INR50,000 (approximately US$780). There both positive and negative aspects about this. First, in a country where the national average GDP per capita is about US$1,850 (for 2017 data), the aforementioned restriction may not have an impact on everyday normal shopping for citizens but might force further delays for the enterprise segment and high-level transactions. On the other hand, the good news is that it will also force a biometric audit trail for high-value transactions. It will allow for further insights to be gathered on behalf of the government on citizens’ spending behavior while also equipping banks with a national biometric identification and registration agency, strengthening anti-fraud initiatives throughout the country.

It would be an understatement to say that forcing the link with the banking sector was an unexpected turn of events. As ABI Research has pointed out in past analysis reports and ABI Insights, the UIDAI has been flirting with numerous applications, such as consumer, telecom, and banking applications. If anything the Indian government sees a huge potential for the near future and the  UIDAI even tried to convince Microsoft, Google, and Apple to unlock their OSs and provide an Aadhaar-native encryption. The reason behind this was  to push biometric IDs even deeper to the very core of consumer digital identities, a request that has gone unapproved by the tech giants but will certainly resurface in the near future. In addition, according to a report by the India Times and after a few bumps in the Indian digital road with Facebook in the past, the company is testing out a pilot in which users will be able to log in to the social networking site by using their Aadhaar credentials. To rephrase the previous statement, this means that a government ID, which also requires biometric registration, can be used to access a free social networking site. There are very few things that can receive the following title, but this can definitely be classified as “an authentication overkill,” which will further fuel the UIDAI fires.

On the other hand, a recent (January 4^th) controversial investigation from The Tribune in India attempted to shed more light on the (un)lawful access of Aadhaar’s data. By purchasing a service from fraudsters over WhatsApp and a simple transfer of INR500 (about US$7.80), the reporters were able to gain unrestricted access to citizen information. This investigation went live at 1:58pm IST, and just a few hours later, the UIDAI accused the publication of misreporting. While the government admitted that there have been errors and certain unlawful access to the Aadhaar database, it is nowhere near the extent reported by The Tribune. If the accusations are true, this could be a significant blow to the UIDAI. The burden of proof is now on the UIDAI to prove beyond a shadow of a doubt that the database and citizens’ biometric information is secured, a significant challenge and a potentially disastrous allegation.

Aadhaar-similar programs, which include consumer, telecom, banking, and tech services, will most likely enjoy a higher penetration rate in the near future, but will not be limited to India alone with APAC moving faster towards citizen-ID biometric systems compared the rest of the world. Countries with large-scale biometric systems like China and Pakistan as well as emerging economies like Malaysia and Sri Lanka are also treading towards similar identification systems. With the FBI and DHS (Department of Homeland Security), controlling majority of the budget for biometrics in the US ABI Research predicts that unless a further budget increase is agreed within 24 to 36 months Asia-Pacific will completely overtake North America’s revenues in the biometric market.