KUA and sub-KUA

Aadhaar authentication cannot be done by just anyone. Only entities permitted by law can ask UIDAI to confirm a person's identity.

For the securities market, that permission is structured in two tiers. A small set of market institutions register with UIDAI as KYC User Agencies (KUAs). The thousands of brokers, depository participants and other intermediaries do not each deal with UIDAI directly — they sign up with one KUA and act as its sub-KUA, authenticating their own clients through it.

The reason intermediaries want this is spelt out in the workbook: online on-boarding, client convenience, increased efficiency and reduced time for onboarding.

The legal route. The e-KYC service launched by UIDAI is accepted as a valid process for KYC verification. Under the process outlined by the Department of Revenue, Ministry of Finance, circular dated 9 May 2019, entities in the securities market notified by the Central Government are allowed to undertake Aadhaar authentication under section 11A of the PMLA, registered with UIDAI as KUA or sub-KUA.

The nine KUAs named in the workbook:

The sub-KUA step. A SEBI registered intermediary that wants Aadhaar authentication through a KUA shall enter into an agreement with any one KUA and get itself registered with UIDAI as a sub-KUA. The agreement is as prescribed by UIDAI.

Rules that travel with it.

• Under Rule 9(15)(a), where a client submits his Aadhaar number to a reporting entity notified under the first proviso to section 11A(1), that entity carries out authentication using UIDAI's e-KYC authentication facility.
• Usage of Aadhaar is optional and purely voluntary for the client.
• Offline verification through the Aadhaar XML file or Secure QR Code is allowed if it was generated not more than 3 days before the KYC.
• Where authentication is not required, the client must redact or black out the Aadhaar number (Rule 9(16)).
• IPV is not required where KYC has been completed using Aadhaar authentication or verification of UIDAI.

Illustrative intermediary and dates.

Malabar Shares Pvt Ltd, a small Kozhikode broker, wants to onboard clients entirely online.

Setting up. It signs UIDAI's prescribed agreement with one KUA — NSDL — and registers with UIDAI as a sub-KUA. It does not register as a KUA itself; it is not one of the nine.

Client 1. Mr Rahul Varghese chooses Aadhaar e-KYC. Authentication through the KUA succeeds, and because his KYC was completed using Aadhaar authentication, no IPV is required.

Client 2. Ms Sneha Joseph uploads an Aadhaar offline XML file generated on 2 March, for KYC carried out on 7 March. That is 5 days old — more than the 3-day limit — so the broker asks her to generate a fresh file.

Client 3. Mr Abdul Kareem does not want to use Aadhaar at all. Usage of Aadhaar is optional and purely voluntary for the client. He completes KYC with another officially valid document, and IPV or VIPV is carried out in the ordinary way.

Client 4. Mrs Latha Menon submits a copy of her Aadhaar card as address proof where authentication is not being done. The broker ensures the Aadhaar number is redacted or blacked out.

Chapter 7 (SEBI Guidelines for KYC Norms in Securities Market), section 7.2.2, "KUA and Sub KUA mechanism", carries the list of nine KUAs and the one-agreement rule, with the Aadhaar rules in section 7.1.10 and Rules 9(15) and 9(16) in Chapter 3. Expect "which of the following is not a KUA?", a question on whether an intermediary registers as KUA or sub-KUA, and the section 11A anchor.

• Intermediaries are sub-KUAs, not KUAs. The KUAs are the nine named entities.
• An agreement with any one KUA — not with all of them, and not with UIDAI alone.
• Both exchanges, both depositories and both CAMS entities appear on the list, as do CDSL Ventures, NSDL Database Management and NSE Data and Analytics.
• The statutory hook is section 11A of the PMLA, and the process circular is the Department of Revenue's of 9 May 2019.
• Aadhaar is voluntary. A client who does not use it completes KYC through the other permitted documents.
• 3 days is the maximum age of an Aadhaar XML or Secure QR code.