Through February, we watched Paytm plunge into a full-blown crisis. With the Reserve Bank of India’s crackdown—imposing sweeping restrictions on Paytm Payments Bank—and the Enforcement Directorate reportedly probing its banking arm for alleged foreign exchange violations, the fintech major certainly had its hands full.

One of the major lapses the RBI found against Paytm was negligence on know your customer, or KYC, processes. KYC is a basic requirement wherein customers must verify their identity and personal details to avail financial services or instruments. The purpose is to minimize risks for financial institutions and prevent crimes. Lapses by Paytm facilitated misuse of funds, including instances of money laundering. Reports also indicated slip-ups by the fintech firm that allowed several accounts to be linked to a single PAN card and accounts being opened using fake PAN cards.

In cracking down on Paytm, the RBI seems to be sending a strong signal to the broader fintech sector to get its act together, especially when it comes to KYC norms. In fact, adherence to KYC norms seems to be at the centre of regulatory focus. This week, finance minister Nirmala Sitharaman is reportedly slated to meet with about 20 representatives of fintech firms—excluding Paytm— to emphasize KYC compliance. Even the Financial Stability and Development Council is looking to finalize a strategy to streamline and modernize the customer verification procedure within the financial sector in an attempt to curb unauthorized lending through online applications.

The situation on KYC compliance is grave. But the process is not new. So, why are fintech companies struggling with it? First, let’s understand why the KYC norms are important.

The ABC of KYC: In the global banking landscape, KYC regulations serve as a shield against fraud, scams, money laundering and other financial crimes. Mandated by regulatory bodies across the globe, the RBI laid down its first KYC guidelines in 2002, later enforcing full compliance from all banks by the end of 2005.

Traditional KYC processes were heavily reliant on paperwork and manpower for verification. The whole process was very time-intensive until a few years ago. However, with Aadhaar and video KYC mechanisms coming into the picture, the process has become relatively faster, although it still requires significant time and effort on the part of customers.

Regulatory bodies, including the central bank, the Securities and Exchange Board of India and the Insurance Regulatory and Development Authority of India have all introduced regulations to keep a check on frauds and scams.

According to the RBI’s Master Direction on KYC (2016), customer details must be periodically updated. The direction lays out stringent protocols for video customer identification processes (V-CIP), including thorough testing of V-CIP software before it can be used for the KYC process and the ability to reject connection requests from spoofed or non-Indian IP addresses. The framework also requires such video recordings to be geo-tagged with live coordinates and a date-time stamp; ideally, the software must also be able to detect spoofs, face liveness and conduct face matching. The guidelines also mandate that trained officials oversee the process.

These regulations stem from global standards set by the inter-governmental body—Financial Action Task Force—to combat money laundering and terrorism financing.

Enter fintech startups. While traditional banks continued to adhere to stringent KYC norms, fintechs onboarded customers rapidly. These startups were investing heavily in advertising their apps to attract potential customers, to encourage them to download and sign up. A quick check with peers and younger customers clearly indicates that the draw of fintech apps is partly the simplified KYC process.

But here’s the catch. For fintechs, this simplification meant cutting corners. A full KYC would slow down the process and lead to many abandoning the task of account creation—resulting in what the industry calls “drop-offs”. And so they began adopting partial KYC measures, often limited to just mobile number verification.

Fintechs and KYC: One of the main reasons why fintechs trim KYC processes and prioritize customer onboarding is fundraising. Venture capital firms that heavily invest in the fintech sector expect rapid growth. This is often measured by client acquisition volume. Now, to acquire clients and minimize drop-offs, the entire onboarding process must be swift, quick and easy. In such a scenario, KYC takes a back seat.

The central bank has been issuing compliance directives to fintechs for two years now. Meanwhile, the industry’s focus has primarily remained on expanding customer base and revenue, with several firms adhering to minimal compliance standards.

KYC compliance also comes with significant costs and fintechs at the moment seem more focused on scoring investments first. Video KYC can cost between Rs 15-30 per customer, while physical KYC expenses can escalate to around Rs 100 per customer, according to industry estimates.

“Generally, fintechs have other fish to fry. Because they have issues of cash flow and they have to figure out their investments, that have dried up,” Wriju Ray, co-founder and chief business officer at regulatory technology company IDfy, told The Morning Context.

Explaining why fintechs are more keen on getting investments, Ray says, “Imagine you’re a lender and you’ve given out Rs 100 in cash. At the end of the year, given the amount of interest you can charge, you’ll probably make Rs 110 from your book. Now, that is a 10% increase. Which fintech can survive with that? This basically means that they will need to get more loans going, so their asset size has to increase from Rs 100 to Rs 200. In turn, this means they need to borrow from somewhere.”

They may turn to banks or non-banking financial companies (NBFCs) for loans or seek equity investments. But borrowing from an NBFC or a bank is constrained by regulatory requirements that mandate maintaining specific debt-to-equity ratio. On the fund infusion front, Ray explains, “Getting equity is becoming harder for fintechs... And because they can’t raise funding, they can’t give more loans.”

Squeezed for funding and in an attempt to cut KYC costs, fintechs use data from the central know your customer (C-KYC) registry, which is free, to onboard customers. Downloading such data incurs a nominal fee of one rupee. C-KYC is a centralized database of KYC information across the financial sector. And this is where trouble arises.

To be clear, RBI’s KYC master direction allows using C-KYC and digital KYC processes, as well as options like DigiLocker, to onboard customers.

Now, fintechs that are registered NBFCs simply download documents from the C-KYC registry, requiring only a PAN number and date of birth. Do note that some fintechs are not NBFCs and don’t have access to this centralized database. However, they might rely on their NBFC lending partner to get access to the registry. While this is legally permissible, it means that identities are being verified without robust measures such as live selfies. There's a risk of fraudulent onboarding, leading to potential non-performing assets, or bad loans, for companies and damage to individuals' credit ratings. Similar frauds could take place with DigiLocker, where reliance on linked phone numbers for authentication (via one time password) poses risks of identity fraud.

In fact, last year, the central bank labelled the C-KYC database and DigiLocker high risk. Simply put, using them for verification is risky. Accounts opened without the use of face-to-face methods would be subject to heightened scrutiny until customer identities are confirmed via video KYC or face-to-face interactions.

Despite RBI's emphasis on enhanced due diligence, many fintech firms continue to opt for shortcuts to avoid the cost and complexity of video KYC procedures, says Ray. “These kinds of fintech firms basically survive because they think that in terms of the significance of audits, etc. they fall very low in the pecking order, so RBI will never come after them. So, they just carry on doing what they are doing.”

But did the Paytm fiasco not create some sense of urgency to get their KYC compliance act in order? “If you are asking me specifically if fintech firms are asking lots of questions on KYC compliance, that is not happening. Fintechs are not scrambling all over the place trying to fix their KYC. If you ask me if they should fix their KYC? The answer is yes. I am not implying that all of them are negligent, but some of them are. They are not really following the protocol that they are supposed to and are taking all kinds of shortcuts,” says Ray.

While fintech firms are fixated on boosting their customer acquisition metrics, the cautionary tale of Paytm serves as a stark reminder that speed thrills but kills…business operations, in this case. As for how many fintechs are (not) following these norms and to what extent, that calls for another explainer. But it is clear that the priorities of several of these players remain elsewhere.