Does RBI Require Deepfake Detection for Video KYC? V-CIP, Liveness and Spoof Detection

What do RBI's V-CIP rules say about liveness and spoof detection?

The Reserve Bank of India (Commercial Banks - Know Your Customer) Directions, 2025 (RBI/DOR/2025-26/169, dated 28 November 2025, updated as on 1 October 2026) define the Video based Customer Identification Process (V-CIP) as an alternative method in which an authorised bank official identifies the customer with facial recognition and customer due diligence, through a secure, live, informed-consent audio-visual interaction. Paragraph 27 sets the minimum standards. RBI issues parallel directions for other regulated entities, such as small finance banks, so confirm the version that applies to you.

The technology requirements are specific. The application shall have components with face liveness or spoof detection as well as face matching technology with a high degree of accuracy, even though the ultimate responsibility for customer identification rests with the bank. An explanation adds that specific facial gestures, such as blinking, smiling or frowning, are not mandatory for the liveness check, and that the bank must take note of customers' special needs. The bank may use appropriate AI technology to strengthen V-CIP, and based on detected, attempted or near-miss cases of forged identity it must regularly update its technology and workflows.

The procedure adds human controls. Only specially trained officials may run V-CIP, and they must be able to carry out the liveness check and detect fraudulent manipulation or suspicious conduct. The bank must vary the sequence or type of questions to establish that the interaction is real-time and not pre-recorded, reject the session if it sees prompting at the customer end, capture a photograph and verify that it matches the Aadhaar, OVD and PAN photographs, and put every V-CIP account through concurrent audit before it becomes operational.

Does RBI require deepfake detection for video KYC?

Not by name. The KYC Directions require liveness or spoof detection and face matching, and they leave the technology choice to the bank. Three provisions point toward deepfake detection anyway. Paragraph 27(1)(v) asks for spoof detection, and a face-swapped or synthetic face is a spoof of the customer's identity. Paragraph 27(1)(vi) expressly permits AI technology to strengthen the process. Paragraph 27(1)(vii) obliges banks to update their technology based on forged-identity attempts, including near misses, and to report detected cases as cyber events.

So a bank that sees deepfake attempts in its V-CIP queue, or knows its peers do, has a direct reason under its own KYC Directions to add a control for them. The bank's fraud risk management obligations, covered in our page on the RBI fraud risk management directions, point the same way. What RBI does not do is certify any detector or prescribe accuracy figures beyond "a high degree of accuracy", so each bank has to test and document the controls it chooses.

How does deepfake detection fit into video KYC in India?

Liveness and spoof detection were built for presentation attacks: a printed photo, a screen replay or a mask held up to a real camera. Face matching compares the live face with the Aadhaar, OVD or PAN photograph. A real-time face swap defeats both at once. The person on camera is alive, can blink and answer varied questions, and wears the victim's face, so the match succeeds. An injection attack goes further by feeding synthetic video into the app through a virtual camera or emulator, bypassing the physical camera entirely.

Deepfake detection analyses the video frames themselves for signs of face manipulation, generative synthesis and pixel-level editing, and returns evidence the official and the concurrent auditor can use. In a V-CIP flow it fits in three places: on frames sampled during the live session, so the official sees a risk signal while the call is still running; on the captured customer photograph before the face match is accepted; and on the recording during concurrent audit, before the account becomes operational. Pair it with device and capture integrity checks for injection, because media analysis and channel checks catch different attacks.

• Sample frames throughout the session, not only at the start, because real-time swaps can glitch during head turns, occlusion and lighting changes.
• Show the official a clear risk band with a defined action (continue, extra questions, stop and escalate) rather than a raw score.
• Run the same analysis on the captured photograph and the full recording during concurrent audit.
• Log every flagged and near-miss session and feed it into the technology update cycle paragraph 27(1)(vii) requires.

How should a bank test and evidence its V-CIP controls?

RBI already requires CERT-In empanelled auditors to run vulnerability assessment, penetration testing and security audits on V-CIP infrastructure, and functional and performance testing of the application and APIs before go-live, repeated periodically. Extend that programme to identity attacks. Test liveness, face match, deepfake detection, injection controls and official escalation together against printed photos, screen replays, masks, pre-recorded video, real-time face swaps and virtual camera feeds. Measure false acceptance and false rejection on capture conditions your customers actually have, including low-end phones and poor connectivity, and include customers with disabilities so the liveness check does not exclude them.

Keep the decision record separate from any vendor output. The official's decision, the reason for any stop or escalation, the detection result with model version, and the concurrent audit outcome should all be preserved with the geotagged recording, so the bank can show why each account was opened.

How does NeuroVerify fit into an RBI-compliant V-CIP stack?

NeuroVerify is Neural Defend's deepfake and manipulation check for faces. One API call analyses a face image, video or audio and returns one unified risk score with signal-level evidence from six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. Eligible image requests return in under 200 ms at p95 under defined test conditions, fast enough to score sampled frames while the official is still on the call. The bank's policy decides what each risk band means; the API does not decide whether to open an account.

The deployment options match paragraph 27(1)(i). NeuroVerify can run on-premises, air-gapped, as a secure container or in the bank's private cloud or VPC, so V-CIP video never has to leave the bank's controlled environment and no third party retains it. Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications for outsourcing due diligence. It works alongside an existing V-CIP vendor rather than replacing it: SDKs cover Android, iOS and Flutter on the capture side and Python, TypeScript and Node.js, Go and Java on the backend, plus a REST API. NeuroVerify does not analyse identity documents, so PAN and OVD checks stay with your document verification controls.

On the public VendorBench-100 benchmark of 100 adversarial still images, including face swaps and avatar compositing, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor. VendorBench-100 tests still images only, not live video or injection; one of its authors also co-authored Neural Defend's ARCAS 1B paper, and the corpus and results are public.