In a bid to curb Aadhaar-enabled Payment System (AePS) frauds, the Reserve Bank of India (RBI) on Wednesday, July 31, issued draft directions for banks to follow while onboarding agents who operate AePS touchpoints.
The draft directions have been proposed following the central bank’s February 2024 notification which said that the RBI is looking into streamlining the onboarding process of AePS touchpoint operators for banks and considering additional fraud risk mitigation measures.
While onboarding AePS touchpoint operators, banks are required to carry out updation of KYC in cases where an AePS touchpoint operator has not performed any financial transaction for a continuous period of six months, before enabling them to transact further.
An AePS touchpoint operator can only be onboarded by one bank, as per the draft rules.
Under due diligence norms, RBI has proposed that banks should set limits on the number of transactions undertaken by each AePS touchpoint operator based on their risk profile. Banks would also be required to ensure that the transactions of AePS touchpoint operators are consistent with their risk profile and where they are operating from.
AePS is overseen by the National Payment Corporation of India (NPCI). It is a mechanism to make payments based on Aadhaar authentication i.e. customers can transfer money by entering their Aadhaar number into a swipe machine and placing their finger on the scanner.
Since two-factor authentication such as entering an OTP is not needed to make payments via AePS, it has led to several cases of fraud where scammers are able to siphon money out of bank accounts by cloning or fraudulently obtaining the fingerprints of victims.
While scammers have been able to access victims’ biometrics through land records and other property registration papers, police have said that agents who carry out AePS transactions on behalf of banks could also hand over fingerprint impressions to scammers.
In response to a parliamentary question by Rajya Sabha MP Derek O’Brien during the ongoing Budget session, the government laid out the following steps taken by RBI to mitigate AePS frauds:
1. UIDAI provides a facility to lock a user’s Aadhaar which ensures biometrics cannot be misused.
2. UIDAI has advised banks to implement Finger Minutiae Record – Finger Image Record (FMR-FIR) for fingerprint authentication modality.
3. AePS member banks have been advised to disable AePS for specific categories of accounts.
4. Banks have to provide multiple options to the customers to enable or disable AePS debit transactions.
5. Cumulative AePS limits for cash withdrawal and BHIM Aadhaar Pay have been set to a maximum of Rs 50,000 per month.