Account opening, V-CIP recordings, locker agreements, loan files: a bank's Aadhaar copies arrive through many doors and end up in several systems. RBI's 2025 Directions keep the duty on the bank and want exception records available for review. Co-operative banks carry the same duty with smaller teams.
Your AWS account
Inside the bank's own AWS account, with its own IAM, logging and retention.
Your own servers
For a data centre or an air-gapped network: a Docker image on a CPU server.
RBI, SEBI and IRDAI each put the duty on the regulated entity: it "shall ensure" the Aadhaar number is redacted. In practice customers hand over full copies, field staff photograph full cards, and the duty lands on whoever stores the file.
What Aadhaar Masking does: Masking happens at the point of capture or ingestion, by the API or inside your DMS, so the stored copy is the redacted one.
RBI's Directions require exception records "available for supervisory review", and RBI fined a public-sector bank ₹1.32 crore in 2024 for failing to preserve customer-identification records. An auditor wants to know which files were masked, when, and what was found.
What Aadhaar Masking does: Every answer carries a per-page record: Aadhaar found, number masked, QR covered; the on-premises edition writes a spreadsheet for the whole run.
UIDAI's Sharing of Information Regulations forbid keeping Aadhaar numbers "for longer than is necessary", and Circular 14 of 2025 tells requesting entities the actual number lives in the Aadhaar Data Vault and nowhere else. A loan file that still shows the full number years later fails both.
What Aadhaar Masking does: Masked copies can be kept for the life of the loan; the vault keeps the number, the file keeps the last four digits.
UIDAI's Circular 14 limits where Aadhaar data may be hosted. RBI's Digital Lending Directions require that "all data is stored only in servers located within India" and that anything processed abroad is deleted and brought back within 24 hours. Most masking APIs want your documents on their servers.
What Aadhaar Masking does: Run it inside your own AWS account from AWS Marketplace, or on your own servers. Nothing leaves. Nothing to explain.
“The bank shall, where its customer submits a proof of possession of Aadhaar Number containing Aadhaar Number, ensure that such customer redacts or blacks out his Aadhaar number through appropriate means”
Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025 · Paragraph 23, Explanation 1 (the same text stood in Section 16 of the KYC Master Direction, 2016)
The duty to ensure redaction sits with the regulated entity. It is not the customer's job.
“RE shall ensure to redact or blackout the Aadhaar number in terms of Section 16.”
RBI amendment to the KYC Master Direction (Video-based Customer Identification Process) · RBI/2019-20/138, DOR.AML.BC.No.27
Video KYC captures are covered too: the Aadhaar shown on camera must end up redacted in the record.
“Actual Aadhaar number should not be stored in any business databases other than ADV”
UIDAI Circular No. 14 of 2025 (Aadhaar Data Vault) · Directions to requesting entities
For requesting entities the full number belongs in the Aadhaar Data Vault alone; documents elsewhere should carry the masked form.
“Whoever, intentionally discloses, transmits, copies or otherwise disseminates any identity information collected in the course of enrolment or authentication to any person not authorised under this Act … shall be punishable with imprisonment for a term which may extend to three years”
Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 · Section 37
Disclosure of identity information is a criminal offence, not only a regulatory one.
Upload a card photo, a scan or a short PDF and the production engine masks it while you wait, with a per-page record of what was covered. Or book thirty minutes with a HabileLabs engineer to see it on your document types and plan a deployment in your AWS account.
Or email support@habilelabs.io · Monday to Friday, 10:00–19:00 IST (excluding public holidays)
