Resources Categories
INDUSTRY FACT FILE · DIGITAL IDENTITY, TRUST & ESIGN
Market Landscape and the Drivers of Cybersecurity Demand in Digital Identity
The business, technology, regulatory, legal and statutory forces that create audit, testing, monitoring and investigation work for Aadhaar ecosystem entities, certifying authorities, eSign providers and KYC platforms.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: UIDAI, CCA, RBI KYC, CERT-In and DPDP 5. Legal and statutory drivers 6. How the drivers differ by organisation type 7. What this means for buyers and for Codec Networks |
1. Market landscape
Digital identity in India is public infrastructure with a large private market built on top of it. UIDAI provides the identity and authentication backbone, the CCA provides the root of trust for digital signatures and MeitY runs DigiLocker; around them sit the requesting entities that use Aadhaar authentication and e-KYC, the authentication service agencies that carry their traffic, registrars and enrolment agencies, licensed certifying authorities and eSign service providers, and a fast-growing group of onboarding, video-KYC and identity verification vendors. Volumes are enormous and still rising: UIDAI recorded 231 crore authentication transactions in November 2025, about 8.5% more than a year earlier, and e-KYC transactions rose more than 24% year on year to 47.19 crore. Demand for onboarding is driven by banking, lending, insurance, securities, telecom, benefits and, since the January 2025 amendment to the good-governance rules, approved private services such as travel, hospitality, e-commerce and health.
Cybersecurity demand follows five pressures. Audits: UIDAI expects annual information systems audits of requesting entities by CERT-In empanelled auditors against role-specific checklists, and the CCA audits CAs and ESPs. Data protection: Circular 14 of 2025 tightened the rules for Aadhaar Data Vaults and HSMs, and the DPDP Rules bring breach intimation and safeguards from May 2027. Fraud: cloned fingerprints, deepfakes, synthetic identities and mule accounts turn weak controls into direct losses and regulatory scrutiny. Partners: banks, lenders and insurers ask KYC vendors and ASPs for security evidence before integration, and ESPs set security terms for ASPs. Reporting: CERT-In's six-hour rule applies to all of them. Most sub-AUAs, ASPs and verification start-ups have small security teams and rely on external auditors, testers and SOC providers for depth.
|
231 crore Aadhaar authentications in November 2025 (UIDAI) |
47.19 crore e-KYC transactions in November 2025 (UIDAI) |
72.43 crore DigiLocker registered users (August 2026) |
Nov 2025 UIDAI Circular 14 revises vault and HSM hosting |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
AUAs and KUAs |
Banks, telecom, lenders, insurers and departments; annual audit cycles |
UIDAI IS audits, vault and HSM reviews, SOC, data discovery |
|
Sub-AUAs and ASPs |
Fintechs, agent networks and SaaS firms with small security teams |
Checklist gap reviews, API and app testing, consent reviews |
|
Authentication service agencies |
Few, network-heavy operators with high availability demands |
Infrastructure VAPT, resilience reviews, monitoring |
|
Registrars and enrolment agencies |
Distributed centres and operators under UIDAI processes |
Operator access reviews, kit and centre assessments |
|
CAs and eSign service providers |
Licensed, audited and HSM-centred; integrated with UIDAI as KUAs |
CA and RA control reviews, CCA audit readiness, red teaming |
|
Video-KYC and IDV platforms |
Venture-funded SaaS selling to regulated entities |
Deepfake testing, SOC 2 and ISO 27001, API security |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Passing UIDAI and CCA audits |
Annual IS audits and licence or empanelment audits |
Role-specific audits, gap reviews, evidence packs |
|
Winning regulated clients |
Banks and insurers ask vendors for security evidence |
ISO 27001, SOC 2 readiness, VAPT reports |
|
Becoming a requesting entity |
Private entities seeking Aadhaar authentication approval |
Readiness assessments, vault design, policies |
|
Cutting identity fraud |
Spoofing, deepfakes and mule accounts drive losses |
Fraud testing, anomaly monitoring, investigations |
|
Launching apps and integrations |
New SDKs, eSign flows and partner APIs |
API and mobile testing, secure SDLC |
|
Protecting reputation and licences |
Suspension of authentication or e-KYC is existential |
Board reporting, crisis exercises, IR retainers |
|
Resolving disputes |
Signers and customers contest transactions |
Evidence reviews, log integrity, forensics |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Biometric and face authentication |
Spoofing, replay and presentation attacks |
Device and liveness reviews, anomaly monitoring |
|
Video-KYC and AI face match |
Deepfakes, injected video, model evasion |
Deepfake and injection testing, AI risk reviews |
|
Aadhaar Data Vaults and HSMs |
Key misuse, cloud misconfiguration, stray copies |
Vault, HSM and cloud reviews, data discovery |
|
APIs, SDKs and mobile apps |
Broken authorisation, tampering, scraping |
API and mobile testing, secure SDLC |
|
PKI, RA and signing services |
Key compromise, rogue issuance, consent gaps |
CA, RA and signing control reviews, red teaming |
|
Offline QR and app-based verification |
Forged QR codes, unvalidated signatures, over-collection |
Verifier integration testing, privacy reviews |
Figure 3: The four groups of drivers behind cybersecurity spending in digital identity, trust and eSign.
4. Regulatory drivers: UIDAI, CCA, RBI KYC, CERT-In and DPDP
|
Instrument |
Key requirements |
|
Aadhaar Act and Authentication Regulations 2021 |
Consent and purpose limitation; no storage of core biometrics; annual IS audits of requesting entities (Regulation 14(1)(h)); role-specific UIDAI compliance checklists with audits by CERT-In empanelled auditors |
|
UIDAI Circular 14 of 2025 |
Aadhaar numbers and e-KYC data only in an Aadhaar Data Vault; keys in HSMs; on-premises and approved cloud hosting; reference keys or tokens in other systems |
|
IT Act Second Schedule and CCA eSign guidelines |
Aadhaar e-KYC-based eSign by licensed CAs empanelled as ESPs after audit; e-authentication guidelines and API specifications; ESP terms for ASPs |
|
RBI KYC Directions, 2025 |
V-CIP by an official of the regulated entity with live video, geotagging, liveness and spoof detection and face matching; outsourcing terms for technology vendors |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs in India; risk-based independent audits |
|
IT Rules amendment (February 2026) |
Labelling and provenance for synthetic content; three-hour takedown of unlawful content on official orders |
|
Confirm applicability Obligations depend on your role and agreements with UIDAI, any CA licence or ESP empanelment, the regulated entities you serve and their KYC rules, listing status and the contracts you hold. Confirm against the official instruments and your agreements. |
Figure 4: Legal and regulatory timeline shaping digital identity and eSign security, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
Aadhaar Act, 2016 (amended 2019) |
Consent, biometric protection, offline verification and penalties |
Consent reviews, vault controls, audits |
|
IT Act, 2000 and Second Schedule |
Electronic signatures, CA licensing and offences against computer systems |
CA, ESP and ASP security reviews |
|
Puttaswamy (Aadhaar) judgment, 2018 |
Upheld the Act; struck down Section 57 on private-sector use |
Careful scoping of who may authenticate |
|
PMLA, 2002 and PML Rules |
Customer due diligence and record-keeping for reporting entities |
KYC process and record retention reviews |
|
DPDP Act, 2023 and Rules, 2025 |
Identity, KYC and document data of residents and customers |
Privacy programmes, data maps, safeguards |
|
DigiLocker Rules, 2016 |
Issued documents at par with originals; partner obligations |
API, access and retention reviews |
|
Companies Act, 2013 and SEBI LODR (listed firms) |
Board risk responsibility; quarterly cyber incident disclosure |
Board reporting, incident records |
6. How the drivers differ by organisation type
|
Organisation type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
AUAs and KUAs |
Onboarding scale, fraud, audits |
Vaults, HSMs, biometric devices |
Aadhaar Act, UIDAI checklists, sector KYC rules |
|
Sub-AUAs and ASPs |
Integrations, partner trust |
APIs, mobile apps, SDKs |
Parent AUA and ESP terms, CERT-In, DPDP |
|
Authentication service agencies |
Availability, contracts |
Networks, encryption |
ASA agreements and checklists, CERT-In |
|
Registrars and enrolment agencies |
Process integrity |
Kits, operator access |
UIDAI enrolment processes, CERT-In |
|
CAs and eSign service providers |
Licence standing, trust |
PKI, HSMs, RA systems |
IT Act, CCA guidelines and audits |
|
Video-KYC and IDV platforms |
Client wins, fraud losses |
AI models, video, cloud |
RBI, SEBI and IRDAI KYC rules via clients, DPDP |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Our annual UIDAI IS audit is due and the checklist has changed.” |
Role-specific UIDAI audit by a CERT-In empanelled team |
Annual audit cycle with quarterly checks |
|
“We have been approved to use Aadhaar authentication.” |
Readiness assessment, vault and HSM design review, policies |
Annual UIDAI audit and monitoring |
|
“We are not sure where Aadhaar numbers sit outside the vault.” |
Data discovery across applications, logs, reports and cloud |
Periodic discovery scans |
|
“Our ESP needs an ASP security assessment before go-live.” |
ASP application security assessment and consent tests |
Release-by-release testing |
|
“A bank client wants proof our video-KYC resists deepfakes.” |
Deepfake and injection testing with evidence report |
Model and release retesting |
|
“Our CCA audit is approaching.” |
CA, RA and HSM control readiness review |
Continuous compliance support |
|
“Customers dispute transactions they say they never made.” |
Forensic investigation and evidence review |
IR retainer and fraud monitoring |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by role in the Aadhaar ecosystem (AUA, KUA, sub-AUA, ASA, registrar or enrolment agency), by certifying authority licence and eSign empanelment, by sector regulator, by contract and by the data each organisation handles; confirm them against the official UIDAI, MeitY, CCA, RBI, CERT-In and Data Protection Board instruments and your agreements. UIDAI-specified audits are carried out as UIDAI prescribes, by auditors eligible under its requirements.