AEPS face authentication: what is verified

A customer comes in and says, “My fingerprint never works. I heard you can do a face scan now for AEPS.” Maybe a video told them. Maybe another shop said yes. You’d like to help, but you don’t want to say yes and then watch the withdrawal fail in front of a queue, or say no when it would have worked.

Here’s where things honestly stand. This page separates what RBI, UIDAI and the Government of India have published from what is only a claim. NPCI operates AEPS, so its circulars are the place to check any rule. To confirm what SiOnline offers for your location, ask SiOnline support.

What do RBI and the Government say AEPS is?

RBI’s circular of 27 June 2025 says AEPS is a payment system operated by NPCI that facilitates interoperable transactions using Aadhaar-enabled authentication (RBI circular RBI/2025-26/63). Its definitions section describes transactions as “enabled through Aadhaar number and biometrics or OTP authentication”. The services it names include cash withdrawal, cash deposit, fund transfer, mini statement and balance enquiry.

Two things follow, as of 17 October 2026.

First, the definition names biometrics and OTP, but not “face”. UIDAI’s FAQ lists face as a biometric mode alongside fingerprint and iris. So “biometrics” may or may not cover face for AEPS, and the circular doesn’t say.

Second, the definition describes what the system is. It isn’t a list of which authentication methods each AEPS service accepts. So its silence on face is not a ruling either way. The circular was addressed to banks and NPCI, came into effect on 1 January 2026, and deals with due diligence of touchpoint operators and fraud risk management, not with authentication modes.

What does UIDAI say face authentication is?

According to UIDAI’s authentication FAQ, last reviewed on 9 October 2026 (UIDAI authentication FAQ), face authentication is an additional Aadhaar mode. It’s consent based and available to anyone with a valid Aadhaar. It’s a 1:1 match between the face captured during authentication and the face image stored against the holder’s Aadhaar number at enrolment.

A smartphone or tablet that meets UIDAI’s Face RD specification can be used, through the entity’s own app or the Aadhaar Face RD app. If it fails repeatedly, UIDAI shows an error code and the holder should contact the entity with that code. UIDAI also advises entities to deploy alternatives such as face, iris and OTP for holders whose fingerprints are worn out or missing. That’s general guidance. It doesn’t name AEPS.

What about the September 2026 announcement?

A PIB release of 9 September 2026 describes UIDAI’s launch of an Aadhaar Face Authentication SDK and sandbox (PIB, 9 September 2026). An SDK is a software kit that app makers use. The release says it lets a user authenticate from within one app, where earlier a background FaceRD app was needed. It lists “Aadhaar-enabled payments” among the services where face authentication is widely used.

That phrase is general. The release doesn’t name AEPS, doesn’t mention business correspondent counters, and doesn’t say what NPCI accepts. So don’t read it as UIDAI confirming face for AEPS cash withdrawal.

Does RBI mention face authentication for business correspondents?

Yes, but for a different job. The RBI Know Your Customer Directions for commercial banks, 2025 (updated as on 1 October 2026), say a bank official, business correspondent or business facilitator can perform biometric-based e-KYC authentication, including Aadhaar Face Authentication (RBI KYC Directions).

That sits in the customer due diligence rules. It’s about verifying identity for KYC, not about authorising a cash withdrawal through AEPS. A fact about KYC can’t stand in for a fact about AEPS.

What is confirmed and what is not?

The last two rows decide what you can tell customers. Until you hold written confirmation from your acquiring bank, don’t say that a face scan will work for a withdrawal. And don’t say it won’t.

So what do you say to the customer?

Something like this: “I can’t promise a face scan will work for AEPS. I’m checking with the bank, and I’ll tell you once I have it in writing.” Keep it short and honest. A written reply from your bank gives you something to show if a customer later disputes what was said.

Does the Biometric Lock block face authentication?

Yes. UIDAI says the biometric lock covers fingerprint, iris and face, and that no entity can run biometric-based Aadhaar authentication for that holder while the lock is on (UIDAI authentication FAQ). So a customer who has locked their biometrics will see all three fail until the lock is turned off. UIDAI says the lock does not affect OTP authentication, and it treats the Aadhaar Lock as a different service.

If a customer’s fingerprint keeps failing, ask them whether they locked their biometrics at some point. It’s a quick question to ask.

Why do quoted AEPS limits differ?

A limit can mean several things. It can be per transaction (the most a single withdrawal can be), per day, or per month across transactions. A number someone quotes is only useful if you know which kind it is.

Trust a figure only if it comes with an NPCI or RBI circular number and date, and ask your bank for the limit it applies today. This page gives no threshold, date or method for any extra authentication step, because none appears in the RBI, UIDAI or Home Ministry texts used.

There’s one official statement on the topic, and it’s old. In a reply to the Rajya Sabha dated 31 July 2024, the Ministry of Home Affairs said NPCI advised member banks to disable AEPS for specific categories of accounts and to give customers several options to enable or disable AEPS debit (Rajya Sabha Starred Question 105). It also lists, among measures taken with NPCI and UIDAI, biometric authentication for each transaction by business correspondent agents. That reply is more than two years old, so don’t treat it as today’s rule.

What do the RBI directions expect from banks and counters?

As of 17 October 2026, RBI’s directions of 27 June 2025 require the acquiring bank to carry out due diligence and periodic KYC updation of every touchpoint operator. (A touchpoint operator is the person or shop running the AEPS counter.) A fresh KYC is due after three continuous months without a transaction. The bank must monitor operators and set operational parameters based on each operator’s business risk profile. RBI doesn’t say what these parameters cover, so ask your bank which apply to your counter.

For devices, UIDAI says it mandates only Registered Devices in the Aadhaar authentication ecosystem (UIDAI biometric devices page, last updated 16 July 2026). It also says service delivery should continue for genuine holders who are falsely rejected during biometric authentication, with exception handling logged for audit.

How do you read a provider’s AEPS guidelines page?

You’ll see pages that claim to explain “the AEPS rules”. Run five quick tests on them.

1. Does it name a circular? A rule with an NPCI or RBI circular number and date can be checked. Without one, it’s a claim.
2. Is the date visible? An AEPS rule from last year may no longer apply.
3. Does it say who sets the rule? NPCI, RBI, UIDAI and the acquiring bank each set different things.
4. Does it mix KYC with transactions? Face authentication for KYC and for a withdrawal are separate questions.
5. Does it promise an earning or a speed? RBI, UIDAI and the Home Ministry state no earning or speed for operators, so treat such figures as unsourced.

If someone sells you “NPCI AEPS guidelines” as a document, ask for the circular number and date, and read the original.

What should you ask your acquiring bank in writing?

Send these by email or message, and keep the reply.

• Which authentication modes does the AEPS touchpoint accept for cash withdrawal today: fingerprint, iris, face, OTP?
• Is any additional authentication step applied to larger withdrawals, and under which NPCI circular?
• What limits apply to my counter, per transaction, per day and per month, and who set each one?
• Which registered device and RD service version do you support?
• What charges apply to the customer and to me?
• How do I report a failed or disputed transaction, and to whom?

Keep copies of any circular the bank sends you, with its number and date. For general counter questions, see customer care or the Help Centre.

Questions counter owners ask

Is face authentication allowed in AEPS?

As of 17 October 2026, the RBI circular and UIDAI FAQ do not state it either way. Ask your acquiring bank for the NPCI circular that governs AEPS authentication.

Do I need a face scanner for AEPS?

Neither source says. UIDAI says face authentication uses a smartphone or tablet meeting its Face RD specification. Whether an AEPS touchpoint uses that route isn’t stated, so ask your bank which device it supports.

What is the AEPS withdrawal limit per day?

Ask your bank for the limits it applies now, and for the circular behind each one.

A website says face authentication is live for AEPS. Can I trust it?

Look for a circular number and date. If there isn’t one, treat it as unconfirmed.

Sources

• Reserve Bank of India, Aadhaar Enabled Payment System: Due Diligence of AePS Touchpoint Operators, circular RBI/2025-26/63 dated 27 June 2025; retrieved 17 October 2026.
• Reserve Bank of India, Commercial Banks Know Your Customer Directions, 2025 (updated as on 1 October 2026); retrieved 17 October 2026.
• UIDAI, Authentication FAQ, last reviewed 9 October 2026; retrieved 17 October 2026.
• UIDAI, Biometric Devices, last updated 16 July 2026; retrieved 17 October 2026.
• Ministry of Electronics and IT via PIB, UIDAI launches Aadhaar Face Authentication SDK and Sandbox, 9 September 2026; retrieved 17 October 2026.
• Ministry of Home Affairs, Rajya Sabha Starred Question 105, 31 July 2024; retrieved 17 October 2026.
• NPCI circulars: not cited. Ask your bank for the circular number and date.

This page reflects the sources above as of 17 October 2026. Rules, limits and circulars change; confirm them at the source before you act.