KYC in Insurance: Balancing Verification Speed With Data Protection

Most conversations I have with insurance operations leaders about KYC start with the same question: how do we make it faster? It is a reasonable question. For years, KYC was the step that slowed every sale, frustrated every agent and filled every processing centre with paper.

But having worked inside new business and verification desks through this whole transition, I think that question has largely been answered. The better question today is a different one: now that KYC is fast, is it still safe? This piece sets out how I see the shift, what the industry underestimated, where AI is taking KYC, and why security has moved from the edge of KYC to its centre.

Why KYC became mandatory for all insurance policies

For a long time, rigorous KYC was mainly a life insurance concern. Health, motor and travel policies were often sold with lighter checks.

That ended on 1 January 2023. Under the IRDAI Master Guidelines on Anti-Money Laundering and Counter Financing of Terrorism, KYC became mandatory for every insurance policy in India, across life, health, motor, travel and home, for new purchases and for renewals where it had not been done.

The effect was not just regulatory. It was operational. The number of KYC checks the industry had to run multiplied almost overnight, and a process built for a few lakh life proposals could not absorb crores of policies a year on paper. In my view, the 2023 mandate did more to modernise insurance KYC than any technology vendor did. It made the old way physically impossible.

How insurers now verify KYC at the source

The change that mattered most was not video calls or AI. It was a change in philosophy: instead of asking customers to bring proof, insurers started fetching proof from where it already lives.

A customer who has completed KYC with any regulated entity now has a KYC identifier in the Central KYC Records Registry, so the next institution can fetch the verified record. Aadhaar e-KYC and face authentication confirm identity against UIDAI’s data. DigiLocker pulls documents straight from the issuing authority. PAN is checked live against the tax database. IRDAI brought insurers into the Account Aggregator framework in 2022, so income data can now flow digitally with the customer’s consent, and it is increasingly used to underwrite term insurance. Bank accounts are confirmed through penny-drop checks, and proposals are signed with Aadhaar e-sign.

Most people describe this as a speed improvement. I see it as a data protection improvement first. When the source of truth lives in CKYC, DigiLocker or UIDAI, the insurer does not need to hold a copy of every document. Every scan you never collect is a scan you can never leak. The insurers I respect most in this space have understood that verifying at the source is not just faster. It is the single best privacy control they have.

How video KYC and automated checks made KYC faster

The remaining gains came from two directions: moving human verification onto video, and moving routine checking onto systems.

Video changed the in-person step. In-person verification used to mean a field visit that was slow, expensive and impossible to audit. IRDAI allowed video-based identification in 2020, and a recorded video session with face matching and liveness checks replaced it. The same idea moved to the end of the sale: many insurers now run an instant video verification before a policy is issued, where the customer confirms the product, premium and term on camera. That shifts mis-selling protection from after the damage to before it.

Systems changed the checking step. New business quality checks used to mean a person reading every page of every proposal. Electronic QC now runs first and sends only exceptions to a human. Dedupe moved from a name search to matching across name, date of birth, PAN, phone, address and CKYC identifier. And KYC stopped being a one-time event, with periodic re-KYC for higher-risk customers.

New KYC risks: deepfakes, wrong matches and data leaks

Here is where I think the industry got ahead of itself. Each improvement in speed quietly created a new kind of risk, and most KYC operations were not redesigned to handle them.

Video verification was built on the assumption that a face on camera proves a person is present. Deepfakes have broken that assumption. Fraudsters no longer hold a photo up to a camera; they inject a synthetic video feed directly into the session. Research shows people identify deepfake video only slightly better than chance, which means the official on the call cannot be the last line of defence. Yet in many operations, that official is still exactly that.

Smarter dedupe created the opposite risk. An engine tuned too aggressively merges two different people who share a common name and city. That looks like an operations error, but it is actually a privacy breach, because one customer can end up seeing another’s policy details.

And digitisation created a quieter exposure. Paper was slow, but it was hard to copy at scale. A scanned Aadhaar card in a shared folder, an attachment forwarded once too often, or a vendor portal with loose access can expose thousands of identities in one incident.

In my view, the industry moved the risk from paper to data without moving its controls along with it.

How AI is changing insurance KYC

AI is already doing much of the routine work in KYC: reading documents, matching faces against IDs, checking liveness, matching names across spellings, and flagging patterns such as one device being used for many applications.

My reading is that the next phase will change KYC more than the last one did, in four ways:

• Document reading without templates: generative AI can read almost any document, including handwritten and regional-language ones, without being configured for each format
• Risk-based KYC: AI scoring each case so simple, low-risk customers pass in minutes while unusual ones receive deeper checks
• Deepfake and injection detection: AI checking whether a video feed is coming from a real camera or a synthetic source
• Continuous KYC: instead of a one-time check, AI monitoring for changes such as a new address, an unusual payout request, or a new sanctions match

Taken together, these move KYC from a gate at the start of the relationship to an ongoing process that runs quietly for its entire life. That is a genuine improvement. It also means the quality of the AI matters far more than it used to.

Common AI errors in KYC and how to handle them

Every KYC process makes mistakes. People make them too. What concerns me about AI in KYC is not that it is wrong sometimes. It is that it is wrong with complete confidence.

A tired human checker who cannot read a blurred date of birth usually flags it. A generative model may simply produce a date that looks right, with nothing to show it was invented. That is what hallucination looks like in KYC: a cleanly formatted value that never existed on the document. It passes every format check because it is perfectly formatted.

The principle I would apply everywhere is simple: AI suggests, people decide. High-confidence cases can pass automatically. Low-confidence and high-value cases should always reach a named person. Every AI output and every human decision should be logged. And if a vendor cannot explain why its model flagged a case, nobody inside the insurer can defend that decision to a regulator. Accountability for a KYC outcome stays with the insurer, whether a person or a model made it, the same principle I argued in our piece on agent assist in insurance contact centers.

The security rules that govern KYC data

Before getting into controls, it helps to be clear about what insurers are actually required to do, because three sets of rules now overlap.

IRDAI Information and Cyber Security Guidelines, 2023. This is the most operational of the three. IRDAI strengthened it through a circular in March 2025. Insurers and licensed intermediaries must report cyber incidents to IRDAI and CERT-In within six hours of identifying them, down from the earlier 24 hours. ICT infrastructure and application logs must be kept and monitored for a rolling 180 days, within Indian jurisdiction. Insurers also need a Cyber Crisis Management Plan, forensic experts empanelled in advance, and board-level oversight, with compliance minutes submitted to IRDAI.

The DPDP Act 2023 and DPDP Rules 2025. The Rules were notified in November 2025, and most substantive duties for Data Fiduciaries, including consent notices, reasonable security safeguards, breach notification and retention limits, apply 18 months later.

Anti-money laundering rules. The IRDAI AML/CFT Master Guidelines and the Prevention of Money Laundering Act require KYC records to be kept for a prescribed period and suspicious transactions to be reported to FIU-IND.

The practical consequence is worth stating plainly. A KYC breach is no longer just a privacy problem. It starts a six-hour cyber reporting clock, a DPDP breach obligation, and potentially an AML review, all at once. In my view, most insurers have not yet run a drill that tests all three together.

How insurers keep KYC data secure

From the KYC operations I have helped design and run, security that holds up under audit is built in layers. Each layer assumes the one before it might fail.

Protecting Aadhaar data

Aadhaar is the most sensitive identifier in any KYC file, and UIDAI’s rules are stricter than most teams realise.

• Masking by default: only the last four digits are shown on screens, letters and reports
• Aadhaar Data Vault: where an entity is permitted to store full Aadhaar numbers, UIDAI requires them to sit in a separate, encrypted Aadhaar Data Vault. Other systems hold only a reference token that points to the vault, never the number itself
• Keys in hardware: encryption keys for the vault are kept in a Hardware Security Module, not in application code or config files
• Verify signatures, not images: offline Aadhaar files and the secure QR code on Aadhaar letters are digitally signed by UIDAI. Validating that signature proves the data is genuine. Accepting a photo of an Aadhaar card proves nothing

Encryption and key management

• At rest: documents, KYC records and video recordings encrypted with strong standards such as AES-256
• In transit: all traffic between apps, vendors and core systems over current TLS
• Field-level encryption: PAN, Aadhaar references and bank details encrypted individually, so a database dump does not expose them in readable form
• Tokenisation downstream: claims, renewal and servicing systems work with tokens rather than raw identifiers
• Key separation and rotation: different keys for different data types, rotated on a schedule, managed in an HSM or a cloud key management service

Access control

• Least privilege: a renewal agent sees policy details, not the full KYC file; a dedupe analyst sees match fields, not documents
• Multi-factor authentication for every user who can view KYC data
• Privileged access management: administrator sessions are approved just in time and recorded
• Maker-checker on changes: any edit to a verified KYC record, such as a name or address correction, needs a second person to approve it
• Quarterly access reviews: managers recertify who still needs access; leavers are removed the same day

Monitoring and logging

• Central logging into a SIEM: every view, download, edit and export of KYC data is recorded, with clocks synchronised across systems so the timeline holds up in a forensic investigation
• Tamper-proof storage: logs written to immutable storage so they cannot be altered after an incident
• Behaviour alerts: a user opening 300 KYC files in an hour, downloading at 2am, or searching for a specific person they have no case for triggers an alert
• Retention aligned to rules: logs kept for at least the 180 days IRDAI and CERT-In require

Securing the operations floor

This is where BPO-run KYC lives or dies, and it is the part I care most about. In the KYC desks we run, the controls on the floor matter as much as the controls in the software:

• Virtual desktops: processors work inside a virtual desktop; KYC data never lands on the local machine
• No exit routes: USB ports, printing, clipboard copy and screen capture disabled on KYC workstations
• Data loss prevention: outbound email and uploads scanned for Aadhaar, PAN and bank account patterns
• Phone-free floors: personal mobiles stay outside the processing area, so nobody can photograph a screen
• Background verification for every person who handles KYC data, refreshed periodically
• Clean desk and CCTV on processing floors, with footage retained for investigations

Securing video KYC sessions

Video KYC is now the most targeted part of the journey, so it needs its own controls:

• Encrypted sessions and recordings, with recordings stored in India and access logged
• Presentation attack detection tested against the international standard ISO/IEC 30107-3, which covers photos, masks and replayed videos held up to the camera
• Injection attack detection, which checks whether the video stream comes from a real camera or from a virtual camera, emulator or tampered app. This is the main deepfake defence, and most older liveness tools do not cover it
• Device integrity checks: rooted or jailbroken phones, emulators and modified apps flagged or blocked
• Location and network checks: geo-tag and IP address compared with the customer’s declared address
• Unpredictable questions from the official that a scripted or pre-generated video cannot answer

Controlling vendors

The insurer remains the Data Fiduciary even when a BPO or KYC platform does the work, as I argued in our piece on data privacy in outsourcing. The contract has to match the regulatory clocks. If the insurer must report to CERT-In and IRDAI within six hours, a vendor contract that allows 48 hours to report a breach guarantees a missed deadline. Vendor notice should be measured in hours, from the moment of detection. Sub-vendors should need approval, not just notification. Certifications such as ISO 27001, ISO 27701 and SOC 2 Type II are a starting point, and the right to audit should actually be used.

A layered framework to stop KYC fraud

Security keeps the data safe. A fraud framework stops the wrong people from getting through KYC in the first place. The approach that works is layered: each layer catches a different kind of fraud, and no single layer is trusted on its own.

Tuning the framework

Two numbers decide whether a fraud framework works in practice: how many fraudsters it lets through, and how many genuine customers it wrongly stops. Face match and liveness tools call these the false acceptance rate and the false rejection rate, and tightening one almost always loosens the other.

My view is that one setting for every customer is the wrong answer. A low-risk renewal through CKYC can run on lighter thresholds. A high sum assured, a first-time customer, a mismatch between declared address and device location, or a policy that will pay out to a newly verified bank account should face stricter thresholds and a human reviewer.

Good operations also test the framework the way fraudsters would. That means running deepfake and injection attempts against your own video KYC on a schedule, trying a new fraud model alongside the current one before switching over, and feeding every confirmed fraud case back into the rules.

Measuring whether it works

The metrics that tell you the framework is working are rarely the ones on a standard KYC dashboard:

• False acceptance and false rejection rates for face match and liveness, tracked by customer segment
• Manual review rate, and how many reviewed cases turn out to be genuine fraud
• Fraud caught before issuance versus after, because every case caught after issuance is far more expensive
• Early claims: claims made within the first year of a policy are one of the clearest signals that KYC or underwriting let something through
• Linked-entity alerts: how many new applications connect to known fraud networks

In my experience, the early claims ratio is the most honest measure of all. If KYC fraud is getting through, it shows up there first. Our piece on insurance fraud in India covers the fraud patterns that most often begin with weak onboarding.

Where insurers should focus KYC efforts next

If an insurance leader asked me where to focus KYC investment over the next two years, my answer would not be more speed. Clean-case turnaround is already measured in minutes.

I would point them to three things. First, push as much verification as possible to the source, because every document you do not collect is one you cannot lose. Second, design AI into KYC with human checkpoints from day one, rather than adding oversight after the first incident. Third, treat KYC data as something you are accountable for until the day it is deleted, including at every vendor that touches it.

Speed has stopped being the differentiator in insurance KYC. Speed with control is the new standard, and in my view, it is the one regulators and customers will judge insurers by.

Venturesathi runs new business, KYC and verification desks for insurers working toward that standard. If it is where you are heading, we can help.