KYC document extraction for NBFCs and banks

An AI extraction agent can read the KYC documents a lender collects, such as PAN cards, masked Aadhaar copies, bank statements and address proofs, pull the fields into a structured record, check them against each other and flag mismatches for a KYC or credit officer. The officer still verifies the customer's identity and makes the onboarding decision, in line with the RBI's Master Direction on Know Your Customer (KYC), 2016, as amended, and the lender's own KYC policy.

This guide describes a design pattern. It is not legal or regulatory advice; check the current RBI text and your compliance team's reading before you build.

What the KYC desk does today

Take an NBFC in Indore lending to small traders and two wheeler buyers across Madhya Pradesh. Applications come in through branch staff and direct selling agents. Documents arrive as phone photos on WhatsApp, scanned PDFs by email and occasionally as paper. A typical MSME file has PAN for the borrower and co-borrower, a masked Aadhaar copy, six or twelve months of bank statements, a GST registration certificate or Udyam registration, and a utility bill or rent agreement.

A KYC operations team opens each file, types the details into the loan origination system, checks that the name and date of birth match across documents, scans the bank statement for salary credits, EMIs and bounced payments, and sends the file to credit. Much of the day goes on typing and on chasing agents for a clearer photo.

What the agent extracts

PAN

Name, father's name or business name, date of birth or incorporation, and the PAN itself. The agent checks the PAN format and, where your systems allow it, sends the number through your existing PAN verification service and records the response.

Masked Aadhaar

Name, year or date of birth, gender, address and the last four digits. Aadhaar copies should reach the agent masked, with the first eight digits hidden. If an unmasked copy arrives, the agent masks it before anything is stored and flags the file, so the full number never sits in your records or logs unless your organisation is permitted to hold it.

Bank statements

Account holder name, bank, branch and IFSC, account number with all but the last digits hidden, statement period, opening and closing balances, and a monthly summary of credits and debits. It picks out regular salary or business credits, existing EMI debits, cheque and ECS returns, and cash deposits above a threshold you set.

It also runs arithmetic checks. Opening balance plus credits minus debits should equal the closing balance for every page. Dates should run in order. A statement that fails these checks, or where fonts and spacing change partway through a page, is flagged for possible tampering.

Business documents

GSTIN, legal and trade name, registration date and principal place of business from the GST certificate; Udyam number and enterprise type from the Udyam certificate.

Cross checks the agent runs

Extraction is half the value. The other half is comparing:

• Name on PAN, Aadhaar, bank statement and GST certificate, allowing for initials and spelling variations, with a clear note on what differs.
• Date of birth on PAN against Aadhaar.
• Address on Aadhaar against the utility bill and the address in the application.
• Business name on the GST certificate against the account name on the bank statement.
• Whether every document the product checklist requires is present and within its validity period.

The output is a one page summary for the officer: fields extracted, matches, mismatches with the reason, missing documents, and any tampering signals, with each value linked to the page it came from.

Where a person approves

The KYC officer reviews every file. The agent prepares; it never marks a customer as KYC compliant, never rejects an applicant and never changes a record in the loan system without a person's action. Mismatches and tampering flags go to a senior officer. Requests for a fresh document go back to the branch or agent through a message the officer approves.

Credit decisions stay with credit. The bank statement summary helps the credit analyst start faster; it does not score the applicant.

Rules to design around

RBI KYC Master Direction

The Master Direction sets out customer due diligence, the officially valid documents, periodic updation and record keeping for regulated entities. Map each check the agent runs to a requirement in your KYC policy, and keep that mapping with the agent's configuration so an auditor can follow it. Video based customer identification and central KYC records registry (CKYCR) uploads follow their own steps in your existing systems.

Aadhaar handling

Aadhaar numbers carry specific restrictions on collection, storage and display. Design the flow so only masked copies are processed, and confirm with your compliance team what your organisation may store.

DPDP Act, 2023 and DPDP Rules, 2025

KYC files are personal data, and bank statements reveal a great deal about a person. Collect only what the product needs, state the purpose in your notice, limit who can see extracted data, and set retention in line with both the KYC record keeping requirements and the DPDP Act. Agents and the DPDP Act covers prompts, logs and outputs.

Outsourcing and data location

If an outside party processes the documents, your outsourcing policy and the RBI's guidance on outsourcing apply. Many lenders prefer to run the extraction inside their own cloud or data centre. Running AI on premise or in a private cloud explains the options, and the security page sets out how AksharAI handles access and logs.

Building it

In AksharAI the document extraction agent handles the reading and field checks, a workflow runs the cross checks and the officer's review screen shows the summary with source pages. Model choice can be set per document type, and models can run within your environment where policy requires it. See deployment and governance for the controls, and document extraction accuracy for how to test field by field before launch.

Limits to plan for

• Poor photos stay poor. Glare, cropped edges and blurred phone photos will be flagged, and someone still has to ask for a better copy.
• Name matching needs rules. Indian names vary across documents in order, initials and spelling. Agree with the KYC team what counts as a match and what needs a person.
• Tampering checks reduce risk. They do not catch every forged statement. Keep your existing fraud controls, such as statement fetch through account aggregators where you use them.
• Formats change. Banks change statement layouts. Keep a test set of each bank's format and rerun it regularly.
• Regulation changes. The Master Direction is amended from time to time. Review the checks whenever it is.