Log in
Use Cases

RBI Video KYC & SMS OTP: Building Compliant e-KYC Flows 2026

Build an RBI-compliant Video KYC and SMS OTP verification flow in Node.js. Learn V-CIP guidelines, Aadhaar OTP rules, volume costs, and fraud prevention.

StartMessaging Team
RBI Video KYC & SMS OTP: Building Compliant e-KYC Flows 2026

When Meera, principal backend architect at digital lending platform RupeeLend, analyzed onboarding funnels for personal loan applicants, she discovered an expensive operational leak. During Video Customer Identification Process (V-CIP) verification, user completion rates stalled at 52%. Applicants connected to live video calls with bank verification officers were dropping off midway through the call. The bottleneck was not video streaming quality or document upload failures; it was delayed SMS verification codes. Reserve Bank of India (RBI) guidelines mandate that live Video KYC sessions must bind customer identity using real-time SMS OTP verification while the video call remains active. Because RupeeLend’s legacy SMS gateway suffered 45-second delivery lags during peak hours, bank compliance officers—limited to 3-minute video verification windows—were forced to terminate calls, resulting in compliance timeouts and thousands of abandoned loan applications.

To eliminate this onboarding friction, Meera re-engineered RupeeLend’s V-CIP engine around high-throughput rbi video kyc otp verification india patterns. By integrating a sub-3-second SMS OTP delivery pipeline, her team cut video session drop-offs by 88% and raised Video KYC completion to 94%. This guide breaks down the RBI Master Direction on Video KYC, details multi-stage OTP verification checkpoints, provides a complete Node.js implementation, and models real-world volume costs for Indian banks, NBFCs, and fintech platforms.

Understanding RBI Video-Based Customer Identification Process (V-CIP) Requirements

Under the Reserve Bank of India (RBI) Master Direction on Know Your Customer (KYC), Regulated Entities (REs)—including commercial banks, Non-Banking Financial Companies (NBFCs), prepaid payment issuers (PPIs), and wealthtech platforms—are permitted to perform remote digital onboarding using the Video-based Customer Identification Process (V-CIP).

┌────────────────────────────────────────────────────────────────────────────────────────┐
│                              V-CIP Three-Stage Verification                            │
├───────────────────┬───────────────────┬───────────────────┬────────────────────────────┤
│ Stage 1: Pre-Call │ Stage 2: Live     │ Stage 3: Post-Call│ Final Contract             │
│ Aadhaar / Mobile  │ Video Session OTP │ Document Matching │ E-Sign OTP                 │
│ Verification      │ Identity Binding  │ & Liveness Check  │ Disbursal Approval         │
└───────────────────┴───────────────────┴───────────────────┴────────────────────────────┘

The Three OTP Checkpoints in an RBI Video KYC Journey

An RBI-compliant V-CIP workflow requires authentication codes at three distinct stages of customer onboarding:

  1. Pre-Session Mobile & Aadhaar Verification: Before starting a video call, the application verifies the user’s mobile number and fetches offline Aadhaar XML or DigiLocker data using an initial 6-digit SMS OTP.
  2. Concurrent Live-Session Identity Binding: While the live WebRTC video call is active between the customer and the RE official, an automated OTP is dispatched to the customer’s registered mobile number. The customer must read out or type the received OTP during the live video stream. This step proves that the person on camera controls the SIM card tied to the application.
  3. Contract E-Sign & Loan Disbursal OTP: Once the video call completes, the customer signs the digitally generated loan agreement or account opening form using a final SMS OTP.

Why Latency Destroys Live Video KYC Conversions

During a live V-CIP session, third-party video SDKs (such as WebRTC or Agora) consume active video bandwidth while bank compliance officers run timer scripts. If an SMS OTP takes more than 15 seconds to arrive while a customer is on a video call:

  • Video Window Timeouts: Compliance officers operate under strict SLAs (typically 180 seconds per call). A delayed OTP forces the officer to abort the session.
  • Wasted Video SDK Minutes: High-definition video streaming costs ₹1.50 to ₹3.50 per minute. Stalled OTPs burn expensive video infrastructure minutes without completing verification.
  • Customer Anxiety & Call Drops: Users toggling between video call screens and SMS inbox screens frequently disconnect their WebRTC video streams.

The Architecture of an RBI-Compliant Video KYC + OTP Pipeline

Building a high-concurrency V-CIP engine requires coordinating video streaming servers, identity verification APIs, Redis session stores, and low-latency SMS dispatchers.

[User App (Web/Mobile)] ──(WebRTC Video Stream)──> [V-CIP Video Gateway]
           │                                                │
           ├──(1. Request Live OTP)                          │
           ▼                                                ▼
[Fintech Backend Engine] ──(State Tracking)───────> [Redis Store]
           │
           ├──(2. POST /otp/send)
           ▼
[StartMessaging OTP API] ──(Sub-3s Route)─────────> [User Mobile Handset]

Key Architectural Guidelines

  • Isolated Session State: Video call tokens, Aadhaar reference IDs, and live OTP request hashes must be linked under a single session ID in Redis with an automated 5-minute expiration TTL.
  • Independent Delivery Route: Live-session OTPs must bypass general marketing SMS channels, utilizing dedicated, pre-approved DLT transactional headers (STARTM) to guarantee sub-3-second delivery.
  • Atomic Verification: The backend must validate the live OTP instantly while the video call state remains ACTIVE, emitting a WebSocket or SSE event to the officer console upon success.

Step-by-Step Implementation: Node.js V-CIP Session & OTP Engine

Let’s implement an RBI-compliant Video KYC session controller in Node.js and Express using StartMessaging’s low-latency OTP API (at ₹0.25/OTP) and Redis state tracking.

Step 1: Environment Setup

Configure your environment variables:

# .env
PORT=3000
REDIS_URL=redis://127.0.0.1:6379
STARTMESSAGING_API_KEY=sm_live_xxxxxxxxxxxxxxxxxxxx
STARTMESSAGING_BASE_URL=https://api.startmessaging.com

Step 2: V-CIP Live Session & OTP Service

Create vcip-service.ts to manage video call state, live OTP generation, and validation:

import crypto from 'crypto';
import Redis from 'ioredis';

const redis = new Redis(process.env.REDIS_URL || 'redis://127.0.0.1:6379');
const API_KEY = process.env.STARTMESSAGING_API_KEY!;
const BASE_URL = process.env.STARTMESSAGING_BASE_URL || 'https://api.startmessaging.com';

interface VcipSession {
  sessionId: string;
  applicantId: string;
  phoneNumber: string;
  videoChannelRoom: string;
  status: 'INITIATED' | 'VIDEO_ACTIVE' | 'OTP_VERIFIED' | 'COMPLETED' | 'FAILED';
  otpRequestId?: string;
  createdAt: number;
}

export class VcipOtpEngine {
  /**
   * Initializes a Video KYC session and generates video room tokens
   */
  static async createVcipSession(applicantId: string, phoneNumber: string) {
    const sessionId = `vcip_${crypto.randomBytes(12).toString('hex')}`;
    const videoChannelRoom = `room_${crypto.randomBytes(8).toString('hex')}`;

    const session: VcipSession = {
      sessionId,
      applicantId,
      phoneNumber,
      videoChannelRoom,
      status: 'INITIATED',
      createdAt: Date.now(),
    };

    // Store session state in Redis with 15-minute TTL (900 seconds)
    await redis.setex(`vcip:session:${sessionId}`, 900, JSON.stringify(session));

    return session;
  }

  /**
   * Dispatches a high-priority SMS OTP to the customer while on the live Video KYC call
   */
  static async dispatchLiveSessionOtp(sessionId: string) {
    const rawSession = await redis.get(`vcip:session:${sessionId}`);
    if (!rawSession) {
      throw new Error('VCIP_SESSION_EXPIRED: Video KYC session has timed out.');
    }

    const session: VcipSession = JSON.parse(rawSession);

    // Call StartMessaging OTP API for instant sub-3s delivery
    const response = await fetch(`${BASE_URL}/otp/send`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-API-Key': API_KEY,
      },
      body: JSON.stringify({
        phoneNumber: session.phoneNumber,
      }),
    });

    const payload = await response.json();

    if (!response.ok) {
      console.error(`[V-CIP OTP Error] Gateway rejected request for session ${sessionId}:`, payload.message);
      throw new Error(payload.message || 'Failed to dispatch live session OTP.');
    }

    // Attach OTP Request ID to V-CIP session state
    session.otpRequestId = payload.data.requestId;
    session.status = 'VIDEO_ACTIVE';

    await redis.setex(`vcip:session:${sessionId}`, 900, JSON.stringify(session));

    return {
      success: true,
      sessionId,
      requestId: payload.data.requestId,
      expiresAt: payload.data.expiresAt,
    };
  }

  /**
   * Verifies the live OTP entered during the Video KYC stream
   */
  static async verifyLiveSessionOtp(sessionId: string, code: string) {
    const rawSession = await redis.get(`vcip:session:${sessionId}`);
    if (!rawSession) {
      throw new Error('VCIP_SESSION_EXPIRED: Video KYC session timed out.');
    }

    const session: VcipSession = JSON.parse(rawSession);

    if (!session.otpRequestId) {
      throw new Error('INVALID_STATE: No active OTP request found for this Video KYC session.');
    }

    // Verify code via StartMessaging verification endpoint
    const response = await fetch(`${BASE_URL}/otp/verify`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-API-Key': API_KEY,
      },
      body: JSON.stringify({
        requestId: session.otpRequestId,
        otpCode: code,
      }),
    });

    const payload = await response.json();

    if (!response.ok || payload.data?.verified !== true) {
      throw new Error(payload.message || 'Incorrect verification code.');
    }

    // Update V-CIP session status upon successful live verification
    session.status = 'OTP_VERIFIED';
    await redis.setex(`vcip:session:${sessionId}`, 900, JSON.stringify(session));

    return {
      verified: true,
      sessionId,
      status: 'OTP_VERIFIED',
      message: 'Live-session identity successfully bound via SMS OTP.',
    };
  }
}

Step 3: Express Route Controllers

Expose routes for the client application and bank compliance officer console:

import express, { Request, Response } from 'express';
import { VcipOtpEngine } from './vcip-service';

const app = express();
app.use(express.json());

// 1. Create Video KYC Session
app.post('/api/vcip/initiate', async (req: Request, res: Response) => {
  try {
    const { applicantId, phoneNumber } = req.body;
    const session = await VcipOtpEngine.createVcipSession(applicantId, phoneNumber);
    return res.status(200).json({ success: true, session });
  } catch (error: any) {
    return res.status(400).json({ error: error.message });
  }
});

// 2. Dispatch Live Session OTP (Triggered by Officer Console or App during Video Call)
app.post('/api/vcip/send-live-otp', async (req: Request, res: Response) => {
  try {
    const { sessionId } = req.body;
    const result = await VcipOtpEngine.dispatchLiveSessionOtp(sessionId);
    return res.status(200).json(result);
  } catch (error: any) {
    return res.status(400).json({ error: error.message });
  }
});

// 3. Verify Live OTP during Video Call Stream
app.post('/api/vcip/verify-live-otp', async (req: Request, res: Response) => {
  try {
    const { sessionId, code } = req.body;
    const result = await VcipOtpEngine.verifyLiveSessionOtp(sessionId, code);
    return res.status(200).json(result);
  } catch (error: any) {
    return res.status(400).json({ error: error.message });
  }
});

app.listen(3000, () => console.log('Video KYC OTP Engine running on port 3000'));

Volume Estimates & Sample Cost Calculation for Video KYC

To evaluate authentication costs for digital lending, personal loans, or credit card onboarding, let’s model a fintech platform executing 100,000 Video KYC sessions per month.

Monthly OTP Volume Breakdown for 100,000 Initiated Video KYCs

┌────────────────────────────────────────────────────────────────────────────────────────┐
│                        Monthly OTP Volume Model (100,000 Applicants)                   │
├──────────────────────────┬──────────────────────────┬──────────────────────────────────┤
│ Stage 1: Pre-Call SMS    │ 100,000 Applications     │ 100,000 SMS OTPs                 │
│ Stage 2: Live Video Call │ 90,000 Reach Video Stage │ 90,000 Live Session OTPs         │
│ Stage 3: Contract E-Sign │ 80,000 Pass Video Check  │ 80,000 E-Sign Disbursal OTPs     │
├──────────────────────────┼──────────────────────────┼──────────────────────────────────┤
│ Total Monthly OTP Volume │                          │ **270,000 Total OTP Dispatches** │
└──────────────────────────┴──────────────────────────┴──────────────────────────────────┘

Cost Calculation Table

Comparing StartMessaging’s flat-rate ₹0.25/OTP API against legacy SMS gateways charging ₹0.40/OTP with hidden DLT fees:

Expense ElementStartMessaging DLT-Free APILegacy SMS Gateway RouteMonthly Cost Savings
Pre-Call OTPs (100,000)₹25,000 (@ ₹0.25)₹40,000 (@ ₹0.40)₹15,000 saved
Live Session OTPs (90,000)₹22,500 (@ ₹0.25)₹36,000 (@ ₹0.40)₹13,500 saved
Contract E-Sign OTPs (80,000)₹20,000 (@ ₹0.25)₹32,000 (@ ₹0.40)₹12,000 saved
DLT Portal Maintenance Fees₹0₹2,500 / month₹2,500 saved
Wasted Video SDK Minutes₹0 (Sub-3s delivery prevents timeouts)₹45,000 (15,000 min dropped @ ₹3/min)₹45,000 saved
Total Monthly Spend₹67,500₹155,500₹88,000 / month saved

By eliminating delayed delivery timeouts, StartMessaging saves digital lending platforms nearly ₹88,000 per month in combined SMS costs and wasted Video SDK streaming minutes.

RBI Compliance, Fraud Prevention & Audit Readiness Checklist

To ensure your V-CIP implementation withstands mandatory RBI compliance audits and prevents deepfake/identity spoofing attacks, implement these technical safeguards:

┌────────────────────────────────────────────────────────────────────────────────────────┐
│                        RBI V-CIP Security Control Layers                               │
├───────────────────┬───────────────────┬───────────────────┬────────────────────────────┤
│ Geo-Location      │ Facial Liveness   │ Cryptographic     │ Immutable Audit    │
│ Geotagging        │ & Aadhaar Matching│ OTP Hash Storage  │ Log Retention              │
│ Verifies user     │ Ensures facial    │ Prevents session  │ Retain video & logs        │
│ is within India   │ match vs e-KYC    │ hijacking         │ for 10 years               │
└───────────────────┴───────────────────┴───────────────────┴────────────────────────────┘
  1. Mandatory Geotagging: RBI V-CIP guidelines require catching the customer’s exact GPS geo-coordinates. Verify that the user is physically located within the territorial boundaries of India during the video call.
  2. Facial Liveness & Aadhaar Matching: Match the live video stream against the customer’s Aadhaar photo using AI facial recognition with a minimum 80% confidence score.
  3. Cryptographic OTP Session Binding: Hash OTP codes with session tokens to prevent an attacker from reusing an OTP obtained in a separate login flow to bypass a live Video KYC check.
  4. 10-Year Audit Trail Storage: Store video recordings, concurrent SMS OTP dispatch logs, DLR timestamps, and officer notes in encrypted, immutable cloud storage for a minimum of 10 years per RBI audit directives.
  5. Multi-Operator Fallback Routing: Ensure your SMS provider uses multi-carrier failover. If Reliance Jio or Bharti Airtel experiences local tower congestion, the API must instantly switch pipelines to deliver the live OTP under 3 seconds.

Frequently Asked Questions

Q: Is an SMS OTP mandatory during an RBI Video KYC (V-CIP) session?

A: Yes. The RBI Master Direction on KYC mandates that Regulated Entities (REs) must validate the customer’s identity during a live V-CIP video call using real-time authentication factors, including an SMS OTP sent to the customer’s registered mobile number, alongside facial liveness checks and Aadhaar e-KYC validation.

Q: What is the maximum acceptable SMS OTP delivery latency during a live Video KYC call?

A: In a live V-CIP session, SMS OTP delivery latency must strictly remain under 5 seconds (ideally 2 to 3 seconds). Because bank compliance officers operate under a strict 3-minute video verification window per applicant, delivery delays beyond 15 seconds lead to WebRTC video call disconnections, compliance timeouts, and wasted Video SDK streaming fees.

Q: How does StartMessaging guarantee fast OTP delivery during Video KYC calls?

A: StartMessaging routes authentication messages through direct, enterprise-grade carrier channels pre-configured with 6-character DLT headers (STARTM). By bypassing standard promotional queues and utilizing multi-operator carrier failover, StartMessaging achieves sub-3-second P95 delivery SLAs across Jio, Airtel, Vi, and BSNL networks.

Q: How long must banks and NBFCs retain Video KYC recordings and OTP audit logs under RBI rules?

A: RBI regulations mandate that Regulated Entities must retain full V-CIP video recordings, facial matching logs, geotagging coordinates, and timestamped SMS OTP delivery receipts for a minimum of 10 years from the date of account closure or loan tenure completion.

After integrating StartMessaging’s sub-3-second OTP API into RupeeLend’s V-CIP engine, Meera reduced live Video KYC call disconnections by 88%. Loan applicants received authentication codes instantly while on video calls, boosting onboarded completion rates to 94% and saving RupeeLend over ₹88,000 monthly in wasted video streaming minutes and SMS fees.

Building an RBI-compliant onboarding flow for your app? Sign up for StartMessaging to access high-speed, DLT-free SMS OTP delivery at ₹0.25/OTP, or explore our OTP API documentation to ship fast e-KYC verification in under 5 minutes.

S

StartMessaging Team

StartMessaging Team

Related posts