Modifications under the International Financial Services Centres Authority (Anti Money Laundering, C

The International Financial Services Centres Authority (“IFSCA” or “Authority”) has released a Circular on modifications to the International Financial Services Centres Authority (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022 vide reference number IFSCA-DAC/7/2024-AMLCFT dated October 31, 2025 (“Circular”), pursuant to the earlier consultation paper and the market feedback received thereinafter.

The key modifications introduced in the International Financial Services Centres Authority (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022 (“Guidelines”) from this circular are as follows:

1. Insertion in Clause 1.3.43 – Definition of V-CIP

The definition of Video-based Customer Identification Process (V-CIP) is expanded to permit V-CIP to be conducted not only by an authorised official of the Regulated Entity but also by a financial group entity in India supervised by a financial regulator or a KYC Registration Agency (KRA), subject to the conditions set out in the substituted Part-A of Annexure II.

2. Substitution of Part-A of Annexure II – V-CIP Process for Onboarding Indian Nationals

Part-A of Annexure II has been wholly substituted to set out a detailed V-CIP framework. The principal features and practical implications are summarised below:

V-CIP Infrastructure and Baseline IT/Cyber Standards

• A Regulated Entity may undertake the V-CIP process to carry out Customer Due Diligence (“CDD”) for onboarding new customers and perform periodic KYC updates for eligible customers.
• A Regulated Entity shall comply with the Authority’s “Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs,” dated March 10, 2025, and other applicable IT laws.
• V-CIP technology infrastructure needs to be housed within the premises of the Regulated Entity, its Financial Group supervised by a financial regulator, or a KRA. Connections for V-CIP shall originate from the Regulated Entity’s secured network domain.
• Where cloud deployment is used, ownership of data shall rest with the Regulated Entity or its Financial Group.
• Video recordings and other V-CIP data are to be transferred immediately after completion of the V-CIP process to servers/cloud servers owned or leased by the Regulated Entity or its Financial Group.
• Third-party/cloud providers are not permitted to retain such data. Where infrastructure is housed outside India with the Financial Group, the Regulated Entity is required to inform the Authority and ensure access to such data.
• End-to-end encryption between the customer device and the V-CIP hosting point shall be maintained such that the application is capable of preventing connections from spoofed IPs, VPNs, or proxy servers, and must deploy face-liveness/anti-deepfake and face-matching capabilities. Any detected forged-identity incident shall be reported as a cyber event under extant guidance.
• Video recordings are required to include live GPS coordinates (geo-tagging) and date-time stamps using tamper-proof technology, with video quality sufficient to facilitate unambiguous identification.
• NRI customers may be onboarded via V-CIP only where the customer is classified as low-risk and resides in one of the specified jurisdictions (United States, Japan, South Korea, United Kingdom (excluding British Overseas Territories), France, Germany, Canada, UAE, Singapore, Australia, and the European Union excluding Croatia). Regulated Entities must ensure the IP address originates from the jurisdiction shown in the customer’s address proof and capture bank account details in the stated jurisdiction for address verification. Debit-freeze account activation and first-credit verification rules apply before operationalisation.
• V-CIP infrastructure and applications shall undergo Vulnerability Assessment, Penetration Testing and Security Audit (by empaneled CERT-In auditors or suitably accredited agencies) and functional/performance testing before rollout and periodically thereafter; any critical gaps must be remediated prior to live use.

V-CIP Procedure

• Regulated Entities shall have a documented policy, workflow, and SOPs for V-CIP.
• The V-CIP technology infrastructure must be housed within the premises of the Regulated Entity, its Financial Group supervised by a financial regulator, or a KRA; connections must originate from the Regulated Entity’s secured network domain. Cloud deployment is permissible only where ownership of data rests with the Regulated Entity or its Financial Group.
• Trained officials shall detect deepfakes, perform liveness checks (including for persons with special needs), or test for such other manipulations.
• Disruptions such as pauses, reconnects, and call drops require a fresh session to avoid creation of multiple files.
• Questions used to establish liveness should be randomised. Where prompting to the customer is observed, it shall lead to rejection of account opening.
• Regulated Entities shall also capture a clear image of the PAN card (or e-PAN) and verify PAN details online (including via DigiLocker). Where the customer’s OVD address differs from the current address, suitable records of the current address shall be captured. The authorised official must ensure that photographs in Aadhaar/OVD and PAN/e-PAN match the customer undertaking the V-CIP.
• The Aadhaar XML/QR or CKYCR/Aadhaar authentication used for V-CIP shall not be older than three working days, and where the V-CIP cannot be completed in one seamless session, the video must be completed within three working days of obtaining the identification artefact.
• The Regulated Entity is also required to comply with other applicable statutes such as the Information Technology (IT) Act and the Digital Personal Data Protection Act, 2023, or such other rules and regulations.

V-CIP Records and Data Management

• Video recordings, activity logs, and credentials of authorised officials performing V-CIP shall be securely preserved with searchable time/date stamps in accordance with the Guidelines’ record management requirements. All accounts opened through V-CIP shall be made operational only after being subjected to concurrent audit to ensure process integrity.

3. Legal Basis and Effective Date

The Circular is issued by the IFSCA under the powers conferred by Section 12 read with Section 13 of the International Financial Services Centres Authority Act, 2019, and Rule 9(14) of the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005. The modifications came into force with immediate effect.

4. Pilot Phase

The V-CIP is restricted to a limited number of jurisdictions during the pilot phase of four months, after which expansion of jurisdictions shall be considered.