Mumbai: It was a quirk of prejudice in 2011 that gave Ashok Hariharan the push to found his second start-up. He had just moved from the U.S. to Mumbai. His Bandra landlady agreed to rent him a flat only because he was South Indian.
“Boss, there needs to be better ways to arrive at decisions,” he recalled. That was before the days of KYC took over India. From that small apartment, Hariharan and a handful of colleagues began sketching the outlines of IDfy, a company designed to turn gut instinct into something sturdier: verified trust.
Digital India is fuelled by two acronyms. The ubiquitous KYC and OTP. It’s also a massive industry that is constantly innovating to stay ahead of cyber frauds—from physical verifications to video KYC to using AI to studying behaviour, not just documents.
India is now home to more than 227 startups building software for KYC. Of these, 83 have managed to attract outside funding, and 31 have gone far enough to raise Series A or later rounds, a marker of maturity in the startup world.
No other country has as many KYC-focused companies: the United States comes next, followed by the United Kingdom. On average, India adds 17 new KYC startups every year.
The digital KYC market, currently valued at $26.3 million, is expected to grow more than fivefold to $139.3 million by 2033, At 20.3 per cent annual growth, it is racing ahead of fintech overall (15–18 per cent), e-commerce (12–15 per cent), and far outpacing legacy industries like IT services (7–10 per cent).
Aadhaar, UPI, and mobile internet remodelled how Indians transact; KYC companies closed the loop, building the last mile of trust.
According to market research firm IMARC’s India KYC Market Insights report, shared exclusively with ThePrint, the industry is now led by players like Protean, IDfy, AuthBridge, and Perfios—four of the country’s five biggest names in digital identity checks.
IDfy has raised over $60 million from marquee investors including Blume Ventures, Elev8 Venture Partners, Analog Capital, Tenacity Ventures, TransUnion, and IndiaMART, through both primary and secondary funding.
The idea for KYC came from frustration. Fake résumés were rampant, background checks unreliable, and no business could easily confirm someone’s identity. IDfy was built to be a digital “trust broker”, offering certainty in a world that relied too much on hunches. Back then, however, the market for identity verification was almost non-existent, trust in technology was shaky, and few businesses could see the value in investing in digital identities.
Fourteen years on, the picture looks very different. IDfy is now one of India’s biggest players in video-based KYC, processing 65 million verifications every month across seven countries and earning close to ₹188 crore in annual revenue.
Its growth has also drawn serious backing: IDfy has raised over $60 million from marquee investors including Blume Ventures, Elev8 Venture Partners, Analog Capital, Tenacity Ventures, TransUnion, and IndiaMART, through both primary and secondary funding. As of Tracxn’s estimates, the company is valued at about $126.5 million.
IDfy’s rise mirrors the evolution of the identity verification industry itself. By 2015, banks had modernised their back offices—core banking was centralised, payments could move in real time, algorithms were chewing through mountains of credit data—but when it came to welcoming a new customer, the system was still very much stuck in the past. Know Your Customer (KYC) meant filling forms, waiting in lines, and endless paper checks.
Looking to bridge this gap, the founders of Signzy, a Bengaluru-based regulatory tech startup, began experimenting with the idea of an onboarding journey that could run entirely on software. IDfy, meanwhile, was asking how to bring banking to the remotest towns without spending crores on new branches. “Physical verification was prohibitively expensive, which made branch expansion in places like Baramulla unviable,” said Hariharan.
The breakthrough came in 2016. Video KYC was born. Suddenly, a single video call could stand in for a bank branch. A customer would look into a phone camera, give their consent, and, within minutes, become visible to the financial system.
What began as a clever shortcut around bureaucratic hurdles soon swelled into a billion-dollar idea, drawing in investors and rewiring the very architecture of India’s digital economy.
Regulators didn’t just permit the shift to video KYC, they encouraged it. SEBI, nimbler than most banks, first allowed brokerages and mutual funds to experiment with video-based onboarding. Startups like IDfy, Signzy, and HyperVerge joined this regulatory sandbox, running live pilots that would soon shape national policy. In January 2020, the RBI rewrote its own rulebook, formally recognising video KYC as a legitimate way to verify customers.
Closing the loop of trust
That decision unlocked the industry.
In 2018–19, India logged more than 205 crore e-KYC transactions (as per the UIDAI Annual Report 2024), a sign of how quickly digital verification was taking root. The following year, regulatory tweaks briefly cut that number in half, but the setback didn’t last. With stronger digital infrastructure and innovations like video KYC, the sector roared back, recording over 416 crore transactions in 2023–24.
Aadhaar, UPI, and mobile internet remodelled how Indians transact; KYC companies closed the loop, building the last mile of trust.
Today, these companies sit at the intersection of regulation, technology, and finance, shaping how Indians access money, credit, and opportunity. By offering faster onboarding, sharper fraud detection, and cheaper customer acquisition, identity verification firms have turned compliance into their biggest advantage.
Investors, too, have taken notice. By 2025, identity-verification startups in India had drawn in more than $111 million in funding.
“KYC has become something of a private-equity favourite,” said Siddharth Pai, partner at 3one4 Capital, a venture capital firm. “It grows steadily at 10–15 per cent every year and makes for a ripe acquisition target for depositories and big financial institutions.”
The message is clear: AI-powered video KYC is no longer just a workaround for paperwork, it’s becoming the backbone of how trust is built in digital economies, in India and beyond.
But this growing centrality also comes with a paradox. While these firms are now indispensable, there is still no regulator watching them directly. Liability passes to banks, leaving KYC companies both essential and elusive.
From paperwork to powerhouse
India’s identity verification giants didn’t all start with the same playbook. Some began as scrappy experiments, others as government spinoffs.
Protean, for instance, started as a public-sector offshoot, wiring together PAN cards and pension infrastructure well before Aadhaar came along. HyperVerge was born in an IIT Madras college dorm, where students obsessed over building tech stacks to fix governance problems.
AuthBridge began in Delhi with a call-centre model, painstakingly cross-checking employment and education records for overseas clients. Signzy carved out its niche by helping banks and fintechs digitise their compliance paperwork.
The turning point came when regulators gave video KYC the green light. Each of these companies pivoted quickly, layering in tools like liveness checks and anti-spoofing safeguards.
When Parliament passed the Aadhaar Act in 2010, the architects of UIDAI turned to Protean eGov Technologies Limited—then known as NSDL e-Governance—for advice. The company already had experience running PAN validations at a national scale and building infrastructure that worked at the population level, recalled Bertman D’Souza, Chief Product and Innovation Officer at Protean.
Over time, Protean shifted its focus to identity verification and authentication. It began building a KYC stack on top of Aadhaar’s digital rails, connecting banks and financial institutions as a licensed Other Service Agency (OSA) and KYC User Agency (KUA). Its long track record with thousands of institutions gave it a natural edge. Today, Protean processes about 1.2 million e-KYC transactions every day, making it one of the country’s biggest verification players.
The company’s moat comes from scale itself—every verification adds to a learning and feedback loop that strengthens the next—but the game has also changed.
“Unlike the early days, we now play in a crowded, competitive space that demands strong go-to-market strategies to win client trust,” said D’Souza.
Take HyperVerge, for example. The biggest challenge this customer onboarding and identity verification company faced was simple: how do you meet every regulatory requirement without frustrating users into abandoning the process?
“When you have a user at your doorstep, your goal is to convert that user through all regulatory hoops without them dropping off,” explained Kedar Kulkarni, co-founder & CEO of HyperVerge. Each user who quits midway doesn’t just waste a few thousand rupees in acquisition costs, it also means losing their entire lifetime value.
HyperVerge today runs out of Bengaluru’s startup hub in HSR Layout. Its defining moment came with Jio. The company had to build an onboarding system that worked just as well on patchy 2G in rural India as it did on an iPhone in Mumbai. Every byte mattered. Its AI and computer vision had to be engineered for speed and accuracy even where the internet barely worked.
That discipline paid off. HyperVerge became the first and only Indian system to pass all benchmarks in the U.S. Department of Homeland Security’s RIVTD Track 2 test for Selfie-ID Match. Its reach now extends well beyond banking and finance, into insurance, e-commerce, and other sectors.
In Bengaluru, another experiment was also quietly taking shape. Perfios—short for “Personal Finance One Stop”—entered the scene in 2008 as a personal finance app, helping consumers track income, expenses, and investments. But founders V.R. Govindarajan and Debashish Chakraborty, both seasoned software executives, soon realised the problem wasn’t with individual consumers. The real bottleneck was inside banks and non-banking financial companies (NBFCs), where loan officers still relied on manual credit checks and slow KYC processes.
Govindarajan and Chakraborty soon pivoted to a B2B platform, and the gamble paid off. Today, Perfios processes 8.2 billion data points and 1.7 billion transactions every year, helping banks and lenders speed up credit checks, track risks, and spot fraud across 18 countries. In 2024, it crossed the $1-billion valuation mark, cementing its place as a global fintech data powerhouse.
When RBI and SEBI permitted video KYC, Perfios was quick to add liveness checks and anti-spoof features.
“Banks were terrified of fraud, but also terrified of falling behind. Since we had already been working with them, it provided us the edge,” said Govindarajan.
By 2024, Perfios had embraced generative AI to automate credit decisions. To reinforce its moat, Perfios launched CAM AI in 2025 to speed up underwriting, and bought Clari5, a risk-intelligence firm that scans billions of transactions in real time to spot anomalies and stop fraud before it spreads.
It also grew its reach with strategic acquisitions like Credit Nirvana, an AI-driven platform for debt recovery and collections, and IHX, a healthcare information exchange that acts as the crucial bridge between hospitals, insurers, and patients.
Also read: KYC tyranny. This is how my father and many others are being harassed: Karti Chidambaram
Crisis becomes catalyst
In the years after Ashok Hariharan founded IDfy, the company nearly ran aground. In 2013, a co-founder walked out, there was barely three months of money left in the bank, and their bold experiments seemed too far ahead of their time.
“When you’re going through a co-founder separation in a subscale company, raising funds is nearly impossible,” Hariharan recalled.
He gave his team the option to leave. Instead, they chose to stay.
“Sir, agar doobega, toh saath doobega,” they told him if the ship sinks, we sink together.
That conviction found a dark validation in 2014, when an Uber driver raped a passenger in Delhi. The incident forced India to confront the dangers of weak identity checks.
“We had been telling companies about the importance of verification, but in India, risk becomes a priority only after an incident,” said Hariharan.
IDfy today runs tens of thousands of video verifications a day. If someone applying for a ₹10 crore loan claims to live in Dharavi, IDfy’s systems know it’s worth a closer look, said Vivek Sasikumar, Vice President of Engineering at IDfy.
Hackathons as defence drills
At IDfy, innovation doesn’t just happen in boardrooms; it comes alive in the hum of hackathons. Engineers huddle over problem statements that sound almost like puzzles: a forged document, a skipped security question, a user trying to trick the system. Each scenario is treated like a dress rehearsal for the unexpected, a way of preparing for threats before they surface in the real world.
Sasikumar cited an example of how verification itself is structured.
“Think of it in two legs,” he explained. “The maker, where the customer is interacting, and the checker, where auditors ensure every step has been followed.” A single ten-minute call packs in dozens of micro-checks: a PAN card flashed on camera, a security question answered, a test to ensure the person on screen is really live.
Earlier, auditors had to sit through every second of these calls. Now, an AI assistant does the heavy lifting. It flags only the suspicious or unusual moments, letting auditors skip straight to the anomalies. What once took hours of review can now be done in minutes.
For Sasikumar, the hackathons are the crucible where these ideas are forged. By imagining how fraudsters might slip through the cracks and then reverse-engineering the fixes, IDfy’s team turns abstract risks into concrete product features. Each cycle feeds into the next, creating a loop where intelligence sharpens intelligence. The result is a system that keeps learning, building a network of trust designed to stop fraud long before it reaches the end user.
AuthBridge, meanwhile, has built its foundation on “truthscreen”, a flexible API platform that runs the entire KYC process through modular services. Think of it as a stack of building blocks: a large bank can integrate it seamlessly into complex onboarding journeys, while a small NBFC might use it just for basic identity verification. Either way, the service bends to fit client needs.
Micro-cues that matter
The very startups that opened the gates to India’s digital financial system are now sitting on vast reservoirs of personal data.
If AuthBridge’s modular stack shows how KYC platforms are innovating in flexibility, behaviour analytics points to how they’re innovating in depth. Instead of just checking documents or matching faces, new systems can study how a person behaves—the way their eyes move, the gestures they make, even the rhythm with which they answer questions. These micro-cues are difficult for fraudsters to fake consistently, even with deepfake technology.
“The new frontier is behavioural analytics,” said Rakesh Ranjan, Digital Transformation Specialist and a former senior official at the Reserve Bank Innovation Hub (RBIH). “Under testing conditions, it is giving very promising results.”
Early trials suggest these behavioural markers could sharply improve fraud detection, acting as an extra layer of protection alongside traditional checks.
The dark side of data
In June 2025, the Ministry of Electronics and IT (MeitY) opened an investigation into identity verification startups such as Zoop, Surepass, Digitap, and Signzy, probing whether they had gained unauthorised access to Aadhaar, PAN, and GST records. As a result, MeitY moved to block access to some of these startups’ websites through telecom networks.
Around the same time, the National Payments Corporation of India (NPCI) took action against startups that were using the UPI database not just for payments, balance checks, or settlements, but to enrich customer profiles.
It’s a telling moment. The very startups that opened the gates to India’s digital financial system are now sitting on vast reservoirs of personal data. Some of them use legitimate licences to tap into government databases; others rely on murkier methods, from scraping public records to sourcing information from the private web, and, at times, even the dark web.
This raises sharp questions: Who should have the right to access such sensitive data? How secure are these practices? And what kind of oversight is necessary?
With no clear law written specifically for identity verification companies, enforcement usually falls back on how existing IT and data protection rules are interpreted. In practice, this means firms often end up drawing their own boundaries, choosing how to balance compliance with ethics.
Ashok Hariharan of IDfy put it simply: “We only collect what’s necessary. If my age is verified as over 21, that’s enough. I will not further ask for your address, etc. We don’t mine the dark web or misuse exposed government data.” His point underscores the self-regulation that some players see as essential in an industry built on trust.
So how should KYC companies be regulated? For Vrinda Pareek, a technology lawyer who works between New Delhi and New York, the answer isn’t to rush in with new laws, but to actually make sure the existing safeguards are followed.
“Financial-sector entities”, she said, “need to reassess their partnerships with third-party providers, map data flows, and tighten contracts to ensure compliance.”
The tension between regulation and practice doesn’t just shape compliance, it also shapes capital.
Siddharth Pai of 3one4 Capital noted, “After what happened with lending companies and regulatory changes, investors aren’t keen to back models that look like regulatory arbitrage rather than true innovation. For this sector to open up, regulators need to give KYC agencies more latitude.”
The next battleground
After Innovations like eKYC and Video KYC, the spotlight has now shifted to something trickier: how to access, share, and use customer data only with explicit, verifiable consent.
This shift is being shaped both by regulation and new infrastructure. Sector-specific consent managers—the Account Aggregator framework for finance, Agristack for agriculture, Health Lockers for medical data—are moving from pilot projects into the mainstream. At the same time, the Digital Personal Data Protection (DPDP) Act is also laying down the rules of engagement, spelling out how data can be collected, processed, and shared.
In July last year, IDfy launched PRIVY—the first privacy and data-governance platform of its kind in India—designed to help businesses stay seamlessly compliant with the DPDP Act. Protean, meanwhile, worked with multiple regulators on pilots to test how consent-driven frameworks can be rolled out and scaled.
For companies on the ground, the challenge is two-fold: staying a step ahead of synthetic fraud and deepfakes, while also building the tech muscle needed to manage consent. Industry leaders like IDfy, HyperVerge, and Signzy all see this as the next big battleground.
If data alone was the moat in the past, tomorrow’s winners will be those who can turn consented data flows into analytics, insights, and personalised services that deepen trust and expand access.
Trust in translation
The KYC industry has already adapted to India’s many languages. Platforms like IDfy’s VKYC offer multilingual capabilities, while banks support regional preferences by employing video agents who guide customers through the process in their mother tongue. A customer simply selects a preferred language at the start, and the system routes the call to the right agent. Today, most major KYC players operate comfortably across regional languages.
“But beyond banking, the adoption is still very limited,” said a senior board member of a KYC company, requesting anonymity. Insurance, he pointed out, is a clear example. Penetration is still low and the business remains largely agent-driven. In fact, until just three years ago, general insurance didn’t even require KYC.
According to him, the real hurdle is language. If English continues to be the only option, citizens in smaller towns and rural areas will struggle to understand policies.
“For the government’s vision of ‘insurance for all’ to succeed, regional language support has to be at the core,” he explained. When people are given the choice to complete KYC or read an insurance policy in the language they are most comfortable with, he added, adoption rises, and with it, trust in the process.
Accessibility may drive adoption, but resilience against fraud is what will ultimately determine the sector’s long-term credibility. With the rise of sophisticated GenAI video models, the risk of synthetic identities and dummy accounts has become very real, making the process more complex and more expensive.
“No institution wants to be the first to get caught off guard,” said Pai.
This, in the end, is the paradox of KYC: the sector has raised millions on the promise of AI and automation, yet every video verification still relies on a human officer at the end. For an industry built on data, the business of trust is still, at least for now, a profoundly human one.