Fintech and KYC operations

Your clients' compliance is now yours too.

KYC processors, lending service providers and BPO teams handle documents for many regulated clients at once. RBI's Digital Lending Directions limit what a service provider may store and where, and every client audit asks the same question: show us the masking. A measured accuracy figure is an answer; a vendor's marketing line is not.

The documents that carry the number

Onboarding bundles from several lenders
Bulk scans from field verification
Mixed archives in ZIPs
Spreadsheets with Aadhaar numbers in cells

The edition that fits

SaaS API

Hosted API

One endpoint for every client's documents, with the per-page record each audit asks for.

Your AWS account

AWS Marketplace edition

A stack per client account where the client insists documents never leave.

Compare the editions

Why now

The problems this sector brings us

Sending documents to a vendor's cloud is its own compliance problem.

UIDAI's Circular 14 limits where Aadhaar data may be hosted. RBI's Digital Lending Directions require that "all data is stored only in servers located within India" and that anything processed abroad is deleted and brought back within 24 hours. Most masking APIs want your documents on their servers.

What Aadhaar Masking does: Run it inside your own AWS account from AWS Marketplace, or on your own servers. Nothing leaves. Nothing to explain.

Prove it was masked, before the inspector asks.

RBI's Directions require exception records "available for supervisory review", and RBI fined a public-sector bank ₹1.32 crore in 2024 for failing to preserve customer-identification records. An auditor wants to know which files were masked, when, and what was found.

What Aadhaar Masking does: Every answer carries a per-page record: Aadhaar found, number masked, QR covered; the on-premises edition writes a spreadsheet for the whole run.

Every unmasked copy in your archive is a breach waiting for a date.

The large Indian KYC exposures of 2024–25 were not live systems: they were archives. 36 million KYC files of an RBI-registered NBFC in an open storage bucket; 27 million files of a micro-lender; 4 million KYC forms of an ISP, Aadhaar copies among them.

What Aadhaar Masking does: Point the batch mode at the archive: ZIPs of up to 500 MB through the API, or a folder-in, folder-out run on your own servers, at about 500 pages a minute.

Masking the card isn't enough: the number is in the form, the deed and the QR.

Applicants write the number into forms. Sale deeds and gift deeds print both parties' numbers in running Hindi text. Maharashtra had to hide Aadhaar numbers in registered-document copies in 2024. And the QR code on older Aadhaar letters is plain XML that carries the full number.

What Aadhaar Masking does: Numbers in running text in English and Hindi, numbers split across lines, and every Aadhaar QR code, wherever it is on the page.

The rules that apply

In the regulator's words

RBI8 May 2025

“all data is stored only in servers located within India”

Reserve Bank of India (Digital Lending) Directions, 2025 · Paragraph 13(iv); data processed outside India "shall be deleted from servers outside India and brought back to India within 24 hours of processing"

Where a masking service runs, and where it keeps your files, is part of the compliance question.

MeitY13 February 2019

“Every reporting entity shall, where its client submits his Aadhaar number, ensure such client to redact or blackout his Aadhaar number through appropriate means where the authentication of Aadhaar number is not required under sub-rule (15).”

Prevention of Money-laundering (Maintenance of Records) Amendment Rules, 2019 · Rule 9(16), G.S.R. 108(E)

The root rule behind RBI, SEBI and IRDAI's wording: every reporting entity, every Aadhaar copy taken without authentication.

MeitY13 November 2025

“securing of personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to that personal data”

Digital Personal Data Protection Rules, 2025 · Rule 6(1)(a), the minimum reasonable security safeguards

Masking is named in the Rules as a minimum safeguard.

UIDAIupdated 21 August 2025

“no entity, including a requesting entity, which is in possession of the Aadhaar number of an Aadhaar number holder, shall make public any database or record containing the Aadhaar numbers of individuals, unless the Aadhaar numbers have been redacted or blacked out through appropriate means, both in print and electronic form.”

Aadhaar (Sharing of Information) Regulations, 2016 · Regulation 6(3)

Any copy that leaves your control, on paper or as a file, must already be masked.

Questions

Asked by fintech and kyc operations

Can we show the accuracy figure to our clients?

Yes. The Accuracy page is public and describes the set, the method and the misses; a client's compliance team can read it as it stands.

Does it handle Excel exports?

Yes. Twelve-digit Aadhaar numbers in cells are replaced with XXXXXXXXXXXX and everything else in the sheet is left as it is.

Get started

Judge it on one of your own files

Send a card photo, a scan or a short PDF and get it back masked by the production engine, with a per-page record of what was covered. Or book thirty minutes with a HabileLabs engineer to see it on your document types and plan a deployment in your AWS account.

Try it with your own file Book a demo View on AWS Marketplace

Or email support@habilelabs.io · Monday to Friday, 10:00–19:00 IST (excluding public holidays)