KYC, PAN & Aadhaar Verification APIs (2027)

Quick answer: Most Indian SMBs need three checks, not an AML platform: PAN, GSTIN and bank account. Buy them as APIs from a provider such as Cashfree (bank account check listed at ₹3 each), Surepass, IDfy, Setu or Signzy. Treat Aadhaar differently: UIDAI's rules reserve Aadhaar authentication for licensed agencies and require consent, so use a consent-based DigiLocker flow rather than collecting Aadhaar numbers yourself.

How we researched this: We read UIDAI's Aadhaar (Authentication and Offline Verification) Regulations, 2021 (clean copy dated December 2025), the Prevention of Money Laundering Act as published by FIU-IND, the RBI Master Direction on Payment Aggregators, the PIB explainer on the DPDP Rules, 2025, DigiLocker's home page, and the docs and product pages of Cashfree, Surepass, IDfy, Setu, Signzy, HyperVerge, Digio and Decentro. Facts are as checked in October 2026; most providers do not publish prices and we say so where that applies.

What each check proves, and what it does not

Before choosing an API, decide what question you need answered. A 30-person Pune distributor adding 40 dealers has different needs from a lender onboarding thousands of borrowers.

For dealers and vendors (B2B), PAN, GSTIN and bank checks are normally enough. For individuals who will borrow, trade or handle money, you will also want a face or video step, and regulated businesses have extra legal duties covered below.

Aadhaar: what UIDAI's regulations allow

UIDAI's regulations, in the clean copy it hosts dated December 2025, set the structure that every Aadhaar verification API sits inside:

• Two authentication types. "Yes/No" authentication returns a digitally signed yes or no; e-KYC authentication returns demographic data and a photograph, and may be done only with OTP and/or biometrics, with the holder's consent.
• Who may authenticate. A "requesting entity" submits the Aadhaar number and OTP or biometric to UIDAI. An Authentication User Agency (AUA) uses Yes/No; a KUA is an AUA that also uses e-KYC; a Sub-AUA or Sub-KUA uses these facilities through an existing AUA or KUA. In practice an SMB typically reaches these facilities through a provider that holds the licence.
• Offline verification. The regulations list QR code verification, Aadhaar Paperless Offline e-KYC, Aadhaar Verifiable Credential verification, e-Aadhaar verification and paper-based verification, with or without offline face verification (the face option and the Verifiable Credential were inserted in December 2025). An Offline Verification Seeking Entity may use the facility only for the purpose disclosed to the holder, and "no entity shall perform Offline Verification on behalf of another entity or person".
• Notice and consent. Before authenticating or verifying, you must tell the holder what information will be shared, how it will be used and what alternative means of identification exist; no service may be denied because someone refuses or cannot do Aadhaar authentication. Consent should be taken, preferably electronically, and logs of it maintained.
• Storage. Requesting entities must mask Aadhaar numbers collected through forms or photocopies by redacting the first eight digits before storing the physical copies, and no entity may store a Virtual ID in its system. An offline-verification entity may store offline Aadhaar data only with the holder's consent, and must delete it, with an acknowledgement, if consent is revoked.

The practical test for any vendor: ask which role you would hold (sub-KUA, offline verification entity, or a plain DigiLocker requester) and get it in writing. Cashfree's docs illustrate how providers have adapted: they state that OTP-based Aadhaar verification is discontinued and point to the DigiLocker flow, and that offline KYC (OKYC) is not supported for Aadhaar. DigiLocker's own home page invites organisations to register as an Issuer or a Requester; through Cashfree's integration the flow is verify the user's DigiLocker account, create a consent link, track status (PENDING, AUTHENTICATED, EXPIRED, CONSENT_DENIED) and fetch the document. Links expire after ten minutes, and Cashfree says the supported documents include Aadhaar, PAN and driving licence. See our guides on Aadhaar eSign for the signing side.

PAN, GST and bank checks in practice

PAN. In Cashfree's PAN verification docs, the PAN is mandatory (a name alone is not enough). The response says whether the PAN is valid, the PAN type (an individual "P", company "C", firm "F" or trust "T", among eight codes) and the registered name, which "may differ from the name printed on the physical PAN card". Name match is a separate chargeable feature enabled through your account manager; it scores 100 for a direct match, 85-99 good partial, 60-84 moderate partial, 34-59 poor partial and 0-33 no match. A bulk call can verify up to 10,000 PANs at a time. Decide your threshold in advance: accept 100 automatically, send 85-99 to a person, reject below.

GSTIN. Surepass lists GST verification and PAN-to-GST lookups; Setu lists detailed GST and PAN-to-GST; IDfy has dedicated PAN and GST verification pages. For a distributor, GST verification before you add a dealer protects input tax credit; our GSTR-2B reconciliation guide covers the matching side.

Bank account. Cashfree's bank account verification page lists penny-drop, penniless, bulk, reverse penny drop and UPI penny drop, coverage of 600+ banks, ₹100 in free credits and ₹3 per verification on pay-as-you-go. Setu lists Mobile-to-Bank, VPA-to-Bank, penny drop and reverse penny drop; Signzy and Digio both list bank account verification. Method detail and payout use are in bulk vendor payouts in India. If you onboard many suppliers, RazorpayX lists an add-on vendor onboarding module with automated six-point verification checks, and accounts payable automation shows where verification fits in the payables flow.

What providers publish, and what they do not

The pattern is clear: only Cashfree prints any per-check price we could read. Everyone else prices by package, credits or quote, so ask each for the same written scenario: 500 PAN checks, 500 bank checks and 100 face matches a month. IDfy's example is useful for the model: a flow with PAN OCR, PAN verification, face comparison and face validation counts as four tasks, each billed separately, so count tasks, not applicants. Vendor claims on pages such as "2B+ verifications" or "500+ clients" are theirs, not independently checked.

AML, the PMLA and who has to comply

"Anti-money-laundering software" matters only if you are, or serve, a regulated entity. The Prevention of Money Laundering Act, as reproduced by FIU-IND, defines a reporting entity as a "banking company, financial institution, intermediary or a person carrying on a designated business or profession". Section 11A says every reporting entity shall verify the identity of its clients and beneficial owners, and Section 12 requires records of transactions and of identity documents, kept for five years (from the transaction, or from the end of the relationship for identity and account records). RBI's payment-aggregator Direction adds that a non-bank payment aggregator must register with FIU-IND, run background checks on merchants and monitor their transactions against their business profile.

If you sell software to such entities, they will ask for your KYC trail. If you are an ordinary trading or services SMB, you are not automatically a reporting entity, so ask your CA or counsel before buying a monitoring platform. Where screening is needed, the products to evaluate are the sanctions, PEP and adverse-media tools: Signzy and HyperVerge both list real-time screening with ongoing monitoring. Remember that a name match is a lead for a human to review, not a verdict.

Consent, data protection and a rollout plan

The DPDP Act, 2023 and the DPDP Rules, 2025 (notified 14 November 2025, with an eighteen-month phased compliance period, per the PIB explainer) put seven principles over everything above: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. The Rules require a separate, plain-language consent notice stating the specific purpose, breach intimation to affected people without delay, published contact details for queries, and a response to access, correction or erasure requests within ninety days. The Act's penalties reach up to ₹250 crore for failing to maintain reasonable security safeguards. Cashfree's DigiLocker page says documents are not stored on its servers after verification and recommends your own retention policy aligned to the DPDP guidelines; see our DPDP Act compliance software guide for tooling.

A workable rollout for a Coimbatore staffing agency onboarding 300 workers a month:

1. Write the minimum. Collect name, PAN and bank account; use DigiLocker only if you need an address or age proof.
2. Show the notice. One screen: what is checked, why, how long it is kept, and the alternative if the person declines.
3. Run PAN, then bank. Stop at the first failure and route to a person.
4. Store results, not documents. Keep the verification ID, outcome, timestamp and consent log; delete raw documents on your retention schedule.
5. Meter spend. Alert when checks per applicant exceed your plan; failed retries burn credits.
6. Review quarterly: false rejects at your name-match threshold, and whether the vendor's role still fits UIDAI's rules.

Our background verification software guide covers employment checks, and the background verification category and e-signature software list adjacent tools.

FAQs