ETtech Explainer: Behind crackdown on unauthorised use of govt databases for user onboarding

The Union government is restricting private firms from using official databases like Aadhaar to offer identity verification services to their clients as part of a crackdown on unauthorised access to sensitive databases.

According to two people in the know, officials of the Ministry of Electronics and Information Technology (MeitY) have conveyed to the executives of multiple technology-led startups to abstain from offering offline Aadhaar-based KYC services because they have been doing it through unauthorised channels.

ET had reported on June 9 that startups like Zoop, Surepass, Digitap and Signzy were impacted by a government order restricting access to their websites through telecom networks.


While the government is tightening scrutiny of data platforms, industry insiders are trying to find regulated channels through which Aadhaar verification can be done.

ET explains identity verification services provided by these startups and the issues around them.

What are the core services being provided?

As the customer onboarding journey goes digital, it is critical for financial services companies, consumer technology firms to validate customers. That is where ID verification startups come in, offering verification of documents submitted by consumers. They also help authenticate customers’ identity numbers by cross-checking with government databases. Players like IDfy, Signzy, DigiO and others offer services like video KYC, Aadhaar e-Sign and others.

What is the problem here?

The Centre is trying to find out whether these services are being provided through legal channels and lawful means. Industry sources told ET that while large venture-funded startups stick to the rules and are also regulated in most of the cases, many smaller players in the ecosystem gain unauthorised access to some of the government databases. “Some of the platforms are also involved in scraping from government websites, getting consumer data through unregulated means,” chief executive at an ID verification startup said on condition of anonymity. Some of the data contained in Aadhaar are personally identifiable information (PII), while some of the GST data might not be classified as PII.

Who is looking into the issue?

MeitY, which is in charge of all the digital properties of the government, restricted access to some of these websites through certain telecom networks. Once executives of these firms met officials, they were told to follow designated channels for access to the Aadhaar database, so that consumers can be verified by only regulated platforms through their Aadhaar numbers. Similar services are also provided by the GST (goods and services tax) database and through the income tax database.

Why do startups need these platforms?

Fraud prevention is one of the key areas for which startups are dependent on these platforms. Mostly for fintech services like digital lending, insurance, payments and merchant KYC, backend customer verification is extremely useful. They integrate with these service providers to offer verification on the go. “If there are too many hops, then the customer might drop off. Once these verifications happen via API integrations, the customer experience gets smoother,” founder of a fintech startup said.

Other issues

As the online verification sector has grown, startups have also been scouting for as many alternate data points as possible for these enrichment services. Going beyond the GST database or PAN database, platforms have been offering enrichment services on top of customers’ UPI IDs. The National Payments Corporation of India (NPCI) cracked down on such unauthorised use of the UPI IDs in October last year. Now, the government is also trying to crack down on the use of Aadhaar through unauthorised means.