Insurers can collect KYC documents on WhatsApp safely if the flow follows the rules. Explain why Aadhaar is needed, offer alternatives and get consent first. Accept a photo or secure upload, never a typed ID number. Read it with OCR, keep only the last four Aadhaar digits in the CRM, and send unclear documents to a person.
Why insurers want KYC on WhatsApp, and where it goes wrong
Policies stall on paperwork: a renewal waits for a PAN card, a new policy waits for address proof. Customers in India and the UAE already live on WhatsApp, so asking them to send the document there feels obvious, and it is far easier for them than email or a branch visit.
The trouble is how it is usually done. Someone messages “please send your Aadhaar”. The customer sends a photo, or types the number. A staff member keys the details into the CRM, and the full image sits in a chat history and a CRM attachment for years. That one habit can collide with UIDAI’s regulations, IRDAI’s KYC guidelines, India’s data protection rules and WhatsApp’s own business policy at the same time. None of it is hard to fix if you design the flow around the rules from the start.
The rules a WhatsApp KYC flow has to respect in India
Four sets of rules overlap. This is a plain-English summary of what we design around.
UIDAI: say why, offer alternatives, get consent
Under the Aadhaar (Sharing of Information) Regulations, 2016, anyone who collects an Aadhaar number, or any document containing one, must tell the holder the purpose, whether giving Aadhaar is mandatory or voluntary, and what the alternatives are. They must also get the holder’s consent. The number may not be used for any other purpose, must be kept secure, and customers may not be required to send it over the internet unless the transmission is secure and encrypted. Nor may it be kept longer than the stated purpose needs.
IRDAI: several KYC routes, and only four digits go to CKYC
IRDAI’s Master Guidelines on AML/CFT (2022, as amended) let insurers complete KYC through Aadhaar authentication or offline verification, digital KYC, Video KYC, a CKYC identifier or officially valid documents, together with PAN or Form 60 where applicable. Customers who do not wish to use Aadhaar may submit other officially valid documents. For Aadhaar-based KYC, only the redacted number, the last four digits, is uploaded to the Central KYC Registry.
DPDP Act and Rules 2025: notice, safeguards, processors
India’s DPDP Rules were notified in November 2025, and most of their obligations apply eighteen months later, around May 2027. They expect a standalone notice listing the data and purpose, safeguards such as encryption, masking and access control, access logs kept for a year, and breach reporting to the Data Protection Board. Under the Act, a company may use a data processor only under a valid contract. An AI vendor that reads ID documents for you is a processor, so that contract matters.
WhatsApp’s policy: never ask for an ID number in the chat
WhatsApp’s Business Messaging Policy tells businesses not to share or ask people to share “personal ID card numbers, or other sensitive identifiers”. So a bot must never say “please type your Aadhaar number”. A photo of the card still shows the number, so many insurers prefer a secure upload link for Aadhaar; your counsel should decide which route fits. Our guide to WhatsApp Business API AI integration covers the wider platform rules.
A safe WhatsApp KYC verification flow, step by step
Here is the flow we build, whether the request starts on a call or in a chat.
1. Consent and a purpose notice first
Before asking for anything, the agent explains in one short message which document is needed and why, and that PAN, passport, driving licence or voter ID are accepted alternatives to Aadhaar where your process allows. The customer agrees, or picks another document, before anything is collected, and the message links to your privacy notice and how to withdraw consent.
2. A photo or a secure upload link, never typed numbers
The customer either sends a photo in the open conversation or taps a secure upload link that sends the image to your systems over an encrypted connection. Either way, the agent never asks for a number to be typed or repeats one back in the chat.
3. Aadhaar OCR and PAN extraction
An Aadhaar OCR API, or a PAN card reader, recognises the document type and pulls the printed fields from the image, such as name, date of birth and number. Our agent combines OCR with AI to recognise Aadhaar and PAN cards and read their details. Treat this as data capture, not identity verification. Proof of identity still comes from your IRDAI KYC route, such as CKYC, Aadhaar offline verification, Video KYC or officially valid documents with PAN.
4. Mask Aadhaar before anything reaches the CRM
The full Aadhaar number should never land in a CRM field. We configure masking so only the last four digits are written to the record. That matches the masked Aadhaar format UIDAI describes and the last four digits IRDAI’s guidelines use for CKYC uploads. The stored image should be redacted too, or deleted once it has been checked. If your company authenticates Aadhaar with UIDAI as a requesting entity, UIDAI Circular 14 of 2025 requires full numbers to sit in a separate Aadhaar Data Vault, with reference keys in other systems. Keeping full numbers out of the CRM fits that model.
5. A person reviews anything unclear
Blurry photos, expired cards or a name that does not match the policyholder are never guessed at. The agent flags the document, queues the ticket for review and tells the customer someone will check it. Only checked data goes into the customer record.
6. Keep it only as long as needed
Agree a retention rule with your compliance team and enforce it in software: raw images are deleted once the purpose is met, the CRM keeps only what the process needs, and every access is logged. UIDAI’s regulations say the same: no longer than necessary.
Want to see a KYC document go from WhatsApp to the CRM?
We built this flow for an insurance company. Book a walkthrough and we will show the consent message, the masked record in Zoho CRM or Salesforce, and the review queue for unclear documents.
See the Insurance Voice AgentWhen the customer says “I’ll send it tomorrow”
Many KYC requests end with a promise rather than a document. The agent records the promise and the time on the ticket and, if nothing has arrived by then, sends a reminder. When the document comes in, it is read and checked, and the ticket moves on by itself. We cover this loop in detail in our post on insurance document follow-up automation.
Reminders outside the 24-hour window need approved templates
WhatsApp lets a business reply freely only within 24 hours of the customer’s last message. After that, and for any conversation the business starts, it must use a message template that Meta has approved. A reminder sent the next morning will often fall outside the window, so reminder wording is set up as templates in advance. Customers must have opted in to messages from you, can opt out at any time, and every automated conversation needs a quick route to a person.
KYC document extraction for insurance: what the CRM should hold
The goal is a clean, checked record in the system your team already uses. The agent works with Zoho CRM, Salesforce or a custom CRM with an API, and writes the extracted details to the customer record and the ticket. A sensible field set is the document type, the name as printed, the last four Aadhaar digits or the PAN, the review status and reviewer, and the KYC route used. Our post on AI voice agent CRM ticketing for insurance explains how tickets are created and updated along the way.
The agent reaches the CRM and your cloud systems through an MCP server, a controlled layer that decides exactly which records and actions the AI may use. For example, the agent can update KYC fields without being able to delete records. See our Zoho MCP server, Salesforce MCP server and WhatsApp MCP server pages for how that layer works on each platform.
WhatsApp KYC in the UAE: Emirates ID
The logic carries over to the UAE with a different document. The Central Bank of the UAE’s guidance on using digital ID for customer due diligence, issued in January 2023, applies to insurance companies, agents and brokers. When verifying an Emirates ID, it expects firms to use the online validation gateway of the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP), the UAE Pass app or another government-supported solution, and to keep a copy of the Emirates ID and its digital verification record.
So in the UAE the agent collects and files: it receives the Emirates ID on WhatsApp or by secure link, reads the fields, and files the copy and verification record against the customer. Verification runs through those official channels, and WhatsApp’s rule on ID numbers applies there too. Which data protection law covers your entity, the federal law or a free-zone regime such as DIFC’s or ADGM’s, is a question for your counsel.
What we built, and what it does not do
Inwizards, building software since 2009 with teams in Dubai, the US and India, built an AI voice agent for an insurance company that answers customer calls, opens and updates CRM tickets, receives KYC documents on WhatsApp, recognises Aadhaar and PAN cards, extracts the details into the CRM, and follows up when a customer promises a document later. We do not name the client without permission and will publish results once measured. For the wider picture, see AI voice agents for insurance.
It does not make underwriting or claim decisions, it does not guess at unclear documents, and it holds no regulator’s certification. It supports your KYC process; your compliance team signs it off.
A short checklist before you switch it on
- A consent and purpose message approved by compliance, with alternatives to Aadhaar listed.
- No prompt anywhere asks a customer to type an ID number.
- Aadhaar masked to the last four digits before the CRM; images redacted or deleted on schedule.
- Reminder templates approved by Meta, and opt-outs honoured.
- A processor contract with security clauses, and access logs kept.
- A route to a person in every chat and every call.
This summarises published rules as of November 2026. It is not legal advice; confirm current requirements with your compliance team and counsel.