Video KYC Rules Just Got Stricter: Liveness, Geo-Tagging & Anti-Spoofing

Video-based KYC has become the default for remote onboarding. But after SEBI’s recent circular, the technical requirements for Video In-Person Verification (VIPV) have become significantly stricter.

The goal is clear: make sure the person on the other side of the camera is real, present in the declared location, and not using pre-recorded videos or location-spoofing tools.

Why the Rules Have Tightened#

Earlier video KYC processes often relied mainly on a live video call and basic face match. Fraudsters found ways around this using:

• Pre-recorded videos
• Deepfake or face-swap tools
• VPNs and proxy servers to hide actual location
• Screen sharing or virtual cameras

SEBI has now prescribed a clear set of technical safeguards that intermediaries must follow, especially when onboarding clients who are not physically present in India.

Key Technical Safeguards Now Expected#

1. Live Geo-Tagging (GPS Coordinates)

The video session must capture the customer’s live GPS location in real time.
This location should match the country or city declared in the KYC form.
Static or manually entered locations are not acceptable.

2. Uninterrupted Live Video + Timestamps

The entire verification must be recorded as a continuous live stream.
The recording should carry accurate date and time stamps that cannot be altered later.
Any break or pause in the video can raise compliance questions.

3. Face Liveness Detection

Simple face match is no longer enough.
The system must confirm that a live person is present using liveness checks such as:

• Blink detection
• Head movement
• Random facial gestures
• Active challenge-response prompts

This helps block photos, videos, and many deepfake attempts.

4. Random Prompts / Challenge-Response

The customer should be asked to perform random actions during the session (for example, turn head left, raise hand, or read a random number).
This proves the session is live and not a pre-recorded clip.

5. Anti-VPN / Anti-Proxy Controls

The system should detect and block connections coming through:

• VPNs
• Proxy servers
• Spoofed IP addresses

The IP address of the customer should reasonably match the location declared in the KYC form (India or the FATF-compliant country).

6. End-to-End Encryption

The video stream and related data must travel through encrypted channels so that the session cannot be intercepted or tampered with.

7. Authorised Official + Concurrent Audit

An authorised official of the intermediary should be present during the verification.
The process is also expected to be subject to concurrent audit so that compliance can be checked later if needed.

What This Means for Platforms and Intermediaries#

If you are running video KYC today, you will need to review your current setup against these points:

• Does your video stack support real-time GPS capture?
• Is liveness detection strong enough against current deepfake tools?
• Can you detect and block VPN/proxy traffic?
• Are random challenges built into the flow?
• Is the entire session recorded with tamper-proof timestamps?
• Do you have proper consent logging and audit trails?

Many older video KYC solutions will need upgrades to stay compliant.

Practical Implementation Tips#

• Prefer solutions that combine liveness + face match + GPS in a single flow
• Log every challenge given to the customer and their response
• Store the GPS coordinates, IP address, device details and timestamp with the KYC record
• Keep the full video recording securely for the required retention period
• Make sure the customer gives clear, auditable consent before the session starts

Build Compliant Video KYC#

Strong video KYC now needs more than just a video call. It requires liveness detection, location verification and proper audit trails.

• Face match + advanced liveness checks
• Ready for regulated onboarding flows
• Built for both domestic and overseas customers