What is AEPS? How an Aadhaar withdrawal works

You’ve probably seen a shop with a board offering cash withdrawal using Aadhaar. A customer walks in without a bank card, a fingerprint gets scanned, and cash comes out of the drawer. If you run a counter yourself, you may have wondered how that works, who’s behind it and what could go wrong.

Here’s the plain version. AEPS stands for Aadhaar Enabled Payment System. The Reserve Bank of India (RBI) describes it as a payment system operated by the National Payments Corporation of India (NPCI), in which transactions are enabled through an Aadhaar number and biometric or OTP authentication (RBI circular of 27 June 2025).

The Unique Identification Authority of India (UIDAI) runs Aadhaar authentication. The bank that onboards the person at the counter is called the acquiring bank, and it’s the one to ask about the operating rules that apply to your counter. To find out what SiOnline offers for your location, ask SiOnline support.

What does AEPS let a customer do?

RBI’s definition names five services. It introduces them with “such as” and ends the list with “etc.”, so read them as examples, not a closed list. Three move money and two don’t.

The same circular says transactions are “enabled through Aadhaar number and biometrics or OTP authentication”. So the Aadhaar number always travels with an authentication step. It’s never the number alone.

Who does what in an AEPS transaction?

Five parties take part.

RBI defines a touchpoint as “the terminal deployed by acquirer banks to facilitate AePS transactions”, mobile or fixed. So the person at the counter is an operator, and a bank onboards that operator after due diligence. More on that checking below.

How does one cash withdrawal work?

This is a general outline. The steps and screens differ between banks and providers, so ask yours for its screen-by-screen steps.

1. The customer asks for a cash withdrawal at an AEPS touchpoint. Cash withdrawal is one of the services in RBI’s definition.
2. The customer gives the Aadhaar number to the operator.
3. The customer authenticates by fingerprint or OTP. For fingerprints, UIDAI “mandates usage of only Registered Devices” (UIDAI biometric devices page). A registered device signs the biometric data inside the device, so the data is captured live and can’t be replayed later.
4. UIDAI checks the request and notifies the holder. It verifies the details against its Central Identities Data Repository. Every time UIDAI receives a biometric or OTP authentication request, it sends a notification to the email registered with that Aadhaar. If the check fails, an error code comes back.

After that, the customer’s own bank controls the account, and the counter may not see what the bank sees. A decline can come from the customer’s bank, so tell the customer to ask the bank for the reason.

There’s one more thing worth knowing. Parliament was told in July 2024 that NPCI advised member banks to disable AEPS for specific categories of accounts, and to give customers options to switch AEPS debit transactions on or off (Rajya Sabha reply, 31 July 2024). So a customer’s bank may have AEPS switched off for their account. If a withdrawal fails, that’s one more thing to ask the bank about.

What does RBI require of banks and operators?

RBI’s directions of 27 June 2025 on due diligence of AEPS touchpoint operators came into effect on 1 January 2026. In plain words, they say this:

• The bank checks the operator before onboarding. It uses the customer due diligence process RBI sets for individuals. If the operator was already checked as a business correspondent or sub-agent, the bank may adopt that earlier check.
• KYC is repeated. The bank must carry out periodic updation of the operator’s KYC.
• Going quiet triggers a fresh check. If an operator has done no financial or non-financial transaction for a customer for three continuous months, the bank must carry out the operator’s KYC before allowing further transactions.
• The bank keeps watching. It monitors the operator through its transaction monitoring systems and reviews its parameters from time to time to reflect new fraud trends.
• APIs stay within AEPS. Technology integrations such as APIs must be used only for AEPS operations.

For a shop owner, the relationship that matters is with the acquiring bank. RBI’s directions don’t set out the operating parameters, so ask your bank which ones it applies.

What device does the counter need?

A biometric device that UIDAI has registered, with its software kept up to date. Registered Device (RD) service is the software from the device maker that captures and signs the fingerprint.

UIDAI’s biometric devices page explains two levels. Level 0 devices rely on software-based key storage. Level 1 devices are chip-based and encrypt inside secure hardware. The page says UIDAI has moved from Level 0 to Level 1 fingerprint registered devices, and that since 2025 Fake Finger Detection runs in Level 1 fingerprint devices.

A UIDAI letter dated 16 April 2025 asks entities to keep the RD service of Level 1 fingerprint devices upgraded to the latest version. UIDAI changes its approved-device list over time, so ask your acquiring bank or provider in writing which registered device it supports.

Is AEPS safe?

Fraud through AEPS has been reported, and you should know what the numbers do and don’t say before you repeat them to anyone.

RBI’s circular refers to “reports of frauds perpetuated through AePS due to identity theft or compromise of customer credentials”. The Ministry of Home Affairs told the Rajya Sabha on 31 July 2024 that around 29,000 incidents of AEPS fraud had been reported by citizens on the National Cyber Crime Reporting Portal up to that date (Rajya Sabha reply).

That figure counts reported incidents up to July 2024. It isn’t a rate, and it’s more than two years old, so don’t quote it as today’s total.

What is the biometric lock?

Customers have a control of their own, the UIDAI Biometric Lock. As of 17 October 2026, UIDAI says the lock covers fingerprint, iris and face. After locking, no entity can run biometric-based Aadhaar authentication for that holder by any means (UIDAI authentication FAQ).

Only holders with a registered mobile number may lock their biometrics. UIDAI lists AEPS as an example of a service for which a holder who doesn’t currently need biometric authentication may keep the lock on.

It’s not the same as the Aadhaar Lock, which restricts all Aadhaar-based authentication. UIDAI says biometric locking doesn’t affect OTP-based authentication.

Switching the lock off is only temporary. UIDAI says it generally lasts 15 minutes or one authentication transaction, after which the biometrics lock again.

What can you do at the counter?

• Tell customers the biometric lock exists. If a customer has locked their biometrics, fingerprint, iris and face authentication fails until they switch the lock off. Whether a withdrawal can go ahead another way depends on what the bank accepts.
• Use only a UIDAI Registered Device with a current RD service, and follow the bank’s instructions on using it.
• Never ask a customer to repeat a fingerprint capture outside the transaction screen.
• If a customer says a withdrawal wasn’t theirs, point them to the reporting routes below. Don’t argue the case at the counter.

What can a customer do after suspected AEPS fraud?

If money left the account but no cash was paid out, the customer should raise it with their bank first. The bank handles the account.

RBI’s 2019 turnaround-time circular has an AEPS row for an account that’s debited when confirmation isn’t received at the merchant location. It says the acquirer is to start a “Credit Adjustment” within T + 5 days, with ₹100 per day of delay beyond that (RBI circular of 20 September 2019). RBI may have revised it since, so ask the bank which timeline applies today.

For cyber fraud, the National Cyber Crime Reporting Portal (cybercrime.gov.in) and the helpline 1930 take complaints, and the Home Affairs reply names both. UIDAI lists its toll-free number as 1947.

Questions shop owners ask

Can someone withdraw my money with only my Aadhaar number?

RBI’s definition pairs the Aadhaar number with biometric or OTP authentication. It doesn’t describe the number alone as enough. But RBI also notes reported frauds through identity theft or compromised credentials, so think about locking your biometrics when you don’t need them.

How do I lock my biometrics?

UIDAI says a holder with a registered mobile number can lock biometrics from the UIDAI website or the Aadhaar app, and that an OTP is needed to switch the feature on or off. A holder without a registered mobile number has to update it first at an enrolment or update centre or an Aadhaar Seva Kendra. Use the official UIDAI website or app only, and never share an OTP with anyone.

Can anyone become an AEPS operator?

RBI’s directions say an acquiring bank onboards the operator after due diligence. Ask the bank or provider which onboarding route applies to you, and get its terms in writing.

Is there a daily or per-transaction limit?

Ask your acquiring bank in writing which limits, if any, apply to your counter and to the customer. Limits can change.

What does AEPS cost the customer or the operator?

Ask the acquiring bank or provider for the charges, and for the operator’s share, in writing before you commit money or counter space.

What to do next

If you’re thinking about adding banking services to a shop counter, collect three written answers first: which bank onboards the operator, which registered device it supports, and which limits and charges apply. To confirm what SiOnline offers for your location, ask SiOnline support or see the customer care page. For general counter questions, there’s also the Help Centre.

Sources

• Reserve Bank of India, Aadhaar Enabled Payment System: Due Diligence of AePS Touchpoint Operators, circular RBI/2025-26/63 dated 27 June 2025, in force from 1 January 2026; retrieved 17 October 2026.
• UIDAI, Authentication FAQ, last reviewed 9 October 2026; retrieved 17 October 2026.
• UIDAI, Biometric Devices, last updated 16 July 2026; retrieved 17 October 2026.
• UIDAI, letter F. no. HQ-13021/1/2021-AUTH-I HQ, 16 April 2025; retrieved 17 October 2026.
• Reserve Bank of India, Harmonisation of Turn Around Time and customer compensation for failed transactions, 20 September 2019; retrieved 17 October 2026.
• Ministry of Home Affairs, Rajya Sabha Starred Question 105, 31 July 2024; retrieved 17 October 2026.

This page reflects the sources above as of 17 October 2026. Rules, limits and circulars change; confirm them at the source before you act.