Video In-Person Verification

Video in-person verification is in-person verification done at a distance. It exists to let an investor in a small town open an account with a broker who has no branch there, without giving up the assurance that a real person was on the other end.

Everything that makes ordinary IPV credible has to be rebuilt in software: that the person is live rather than a recording, that the face matches the document, and that what happened can be produced months later exactly as it occurred. The conditions SEBI attaches are all attempts to do one of those three things.

The process. The intermediary, through an authorised official specifically trained for this purpose, may undertake live VIPV of an individual client after obtaining his or her informed consent. The requirements:

• The activity log along with the credentials of the person performing the VIPV shall be stored for easy retrieval
• The VIPV shall be in a live environment
• It shall be clear and still; the client shall be easily recognisable and shall not be covering the face in any manner
• The process shall include random question and response from the investor, including displaying the officially valid document, the KYC form and the signature — or it could be confirmed by an OTP
• The photograph downloaded through the Aadhaar authentication or verification process must match the investor in the VIPV
• The recording shall be digitally saved in a safe, secure and tamper-proof, easily retrievable manner and shall bear date and time stamping

The app it runs on. A registered intermediary may implement its own app for online KYC. The app must facilitate taking a photograph, scanning, acceptance of an officially valid document through DigiLocker, video capturing in a live environment, and use of the app only by an authorised person of the intermediary. It must also have random action initiation so as to establish that interactions are not pre-recorded, time stamping and geo-location tagging — so that requirements such as the physical location being in India are enforced. The process must be seamless, real-time, secured and end-to-end encrypted, with communication quality adequate to identify the client beyond doubt, and the intermediary must carry out a liveliness check to guard against spoofing. The app must be software and security audited and validated before rollout and periodically thereafter.

One related timing rule. Where offline Aadhaar verification is used, the XML file or Aadhaar Secure QR Code generation date must not be older than three days from the date of carrying out KYC.

Ratnagiri Broking Ltd onboards Mr Imran Shaikh, resident in Ratnagiri, with no branch within 90 km.

The session, 14 March, 11:04 IST. He consents in the app to a video verification. A trained officer joins a live call. The app:

Why each control matters. Fifteen months later SEBI inspects. The question will not be "did you verify him?" but "show me". The intermediary retrieves a time-stamped recording and the credentials of the officer who conducted it. Without the activity log the recording proves the client was verified but not by whom, which is the same gap that makes an unsigned IPV entry on a paper KYC form worthless.

What would have invalidated it. A recorded video sent by the client in advance — not a live environment. A session where the client kept a scarf across his face — he must be easily recognisable and must not cover his face. An Aadhaar XML generated on 9 March and used on 14 March — older than three days. A session conducted by an operations executive who had never been trained for VIPV — the official must be specifically trained for the purpose.

Chapter 7 (SEBI Guidelines for KYC Norms in Securities Market), section 7.2.1, introduces VIPV as the remote route to IPV, and section 7.2 sets out the features required of the online KYC app. Expect "which of the following is NOT a requirement of VIPV?", a question on the liveliness check and random action initiation as anti-spoofing controls, and the three-day Aadhaar XML or QR code rule from section 7.1.10, which is asked on its own.

• VIPV is a way of doing IPV, not an exception to it. The two cases where IPV is not required are Aadhaar-based KYC and online submission with DigiLocker-verified documents — VIPV is neither.
• It is available for individual investors. The workbook frames the process as live VIPV of an individual client, after informed consent.
• Live is the whole point. Random action initiation exists specifically to establish that the interaction is not pre-recorded; a video file supplied by the client fails.
• Three days, not three months. The Aadhaar XML file or Secure QR Code generation date must not be older than three days from the date of carrying out KYC.
• The activity log is as important as the recording. Storing the video without the credentials of the person who conducted the VIPV leaves the verification unattributable.
• Geo-tagging is a compliance control, not a convenience. It is what evidences requirements such as the physical location being in India.