Two paths to Aadhaar-based KYC

UIDAI offers two methods for non-biometric Aadhaar-based identity verification: OTP Authentication and Offline XML (also called Aadhaar Paperless Offline eKYC). They serve the same goal — confirming a customer's identity against UIDAI records — but differ significantly in latency, data returned, regulatory requirements and user experience.

Aadhaar OTP authentication

The customer enters their 12-digit Aadhaar number. UIDAI sends a one-time password to the mobile number registered with Aadhaar. The customer enters the OTP, and UIDAI returns a digitally signed XML containing verified demographic data.

Data returned: Full name, date of birth, gender, address (broken into sub-fields), photo (optional, requires separate permission), email hash, mobile hash.

Latency: 800ms–1.5s for the OTP delivery; 200–400ms for the verification call.

AUA/KUA requirement: Yes. Your verification provider must hold a UIDAI Authentication User Agency licence. Veriflow is AUA/KUA licensed.

Best for: Real-time onboarding flows where the customer's registered mobile number is available and expected to be active. Standard choice for fintech, NBFC, logistics and HR KYC.

Aadhaar Offline XML

The customer downloads a signed XML file from the UIDAI Offline eKYC portal (or the mAadhaar app) and uploads it to your platform. The XML is cryptographically signed by UIDAI and can be validated without a live UIDAI API call.

Data returned: Same demographic fields as OTP, but the XML is generated at download time — data may be up to 90 days old.

Latency: Near zero for your validation (offline). But the customer must download the XML file from UIDAI separately, adding 2–5 minutes of user-side friction.

AUA/KUA requirement: No. Offline XML validation does not require UIDAI licensing, which is why some smaller platforms use it as an alternative.

Best for: Scenarios where real-time UIDAI connectivity cannot be guaranteed, or where the customer does not have their registered mobile number active. Less common in production flows due to high drop-off from the manual download step.

Side-by-side comparison

  • Latency: OTP ~1s live · Offline XML ~0ms validation (customer download adds friction)
  • Data freshness: OTP — real-time · Offline XML — up to 90 days old
  • AUA/KUA licence required: OTP — yes · Offline XML — no
  • Mobile number needed: OTP — yes (registered with Aadhaar) · Offline XML — no
  • Photo returned: OTP — optional, requires permission · Offline XML — included in XML
  • DPDP consent: Both require explicit consent and logging
  • Typical conversion rate: OTP ~85–92% · Offline XML ~60–72% (manual download friction)

Which should you use?

For most production flows — fintech onboarding, gig worker verification, NBFC KYC — Aadhaar OTP is the right choice. The higher conversion rate and real-time data freshness outweigh the AUA/KUA licensing requirement, which your verification provider handles.

Offline XML is useful as a fallback for customers whose Aadhaar-registered mobile number is no longer active, or for scenarios where you need to accept a pre-downloaded XML from a document archive. Some HR background check platforms accept Offline XML as part of a document upload bundle.

Veriflow supports both. The aadhaar_otp module handles live OTP flows; digilocker can pull the Aadhaar Offline XML from DigiLocker with user consent, removing the manual download step entirely.