CKYC Compliance on Autopilot

Three changes stand out:

• Real-time Create/Update: APIs with no maker-checker flow (Upload needs an undertaking document).
• Face Authentication download: plus lifetime consent validity.
• Rebuilt security: mTLS, OAuth 2.0, JWE/JWS and RSA-OAEP-256 replace the old XML-signature model.

• Individuals: three new search methods added.
• Legal Entities: document-ID search now spans PAN, GSTIN, LLPIN, CIN, DOI and Mobile; entity search by GSTIN/LLPIN/CIN and formation date is new.
• searchKey: responses return a stateful token (valid 15 days) that must be passed to the Create API to link a search to record creation.
• Results now include a wrapper with pagination (a search can return multiple candidates), and email is masked.

Three consent types are supported — OTP, PHYSICAL and FACEAUTH:

• Individuals: OTP on mobile and email (if linked); FaceAuth as backup where mobile/email exist; Physical verification where neither exists.
• Legal Entities: consent type not applicable, but OTP is required (validate step skipped).
• If a customer has no relation with the RE, they get an email/SMS and must act via ‘Public Access’ on the CKYC website (OTP + last 4 digits of Aadhaar) within 48 hours, else it auto-rejects.

It is the most important Download behaviour change:

• Consent is obtained only once per CKYC record against an RE.
• Once consented, the initiate call returns consentCheck = true and you go straight to /download/get — no OTP, no re-consent.
• Re-pulling the same customer's record for a later product or refresh does not re-trigger the consent journey, saving time and friction.

The API path now validates and processes inline — no separate checker stage:

• POST /create returns a status; POST /create/status returns Approved, Rejected or Probable_Match.
• On a probable match, POST /create/action resolves it in the same session (accept/reject candidates).
• x-idempotency-key ensures a retry never creates a duplicate; Update mirrors this flow.

Note: the real-time API path is new and avoids the maker-checker batch — but SFTP has not been removed.

CKYCRR 2.0 exposes a dozen-plus endpoints; Digio collapses them into a small, stable interface with 2.0 support already built in — so moving to 2.0 is not a fresh build. Digio:

• Exposes one upload API for both create and update (runs search first, passes searchKey through automatically).
• Pushes outcomes over webhooks instead of polling.
• Surfaces unsolicited KYC-update notifications, reuses pre-existing data, and retries automatically on registry downtime.

Yes — both:

• On-Premise (Docker): the RE runs the platform; Digio shares connectivity.
• Managed SaaS: Digio operates servers, databases, monitoring, zero-downtime upgrades and CKYC 2.0 migration — no DevOps needed.
• Data isolation: each RE's data is kept logically separate with its own credentials and access controls; CKYC content is encrypted, no sensitive data sits in the operational database, and all data stays in India.
• Network: secure, access-controlled connectivity with IP whitelisting.

The advisory (23 July 2025) followed complaints of unauthorized downloads and repeated updates caused by a vendor glitch. CERSAI stressed that a third-party service provider (TSP) acts at the RE's own risk — a glitch does not absolve the RE — and advised REs to:

• Exercise enhanced due diligence and oversight over their TSP.
• Review internal processes and access controls to prevent unauthorized access.
• Ensure compliance with information-security and data-access guidelines.

A well-architected TSP supports this with strong access controls, full audit logging and safeguards against duplicate transactions — but accountability always stays with the RE.

Read the advisory (PDF)

CKYC (CERSAI's central repository) lets a customer's KYC be done once and reused, so only one entity does full KYC; others retrieve the verified record via the CKYC number.

• Time saved: onboarding becomes a lookup, not a document-collection cycle — near-real-time retrieval instead of days; real-time update alerts remove manual re-KYC drives.
• Cost saved: no duplicate document collection, data entry, verification or storage per RE; freed staff, less rework, lower compliance overhead.

With Digio, a single upload API, webhook status, sticky consent and data reuse compress this further.