Kaveri SFB: a video-KYC pipeline that manufactured mule accounts

The core breach is who conducts the V-CIP. Video-based customer identification must be performed by an official of the regulated entity. A vendor may supply the platform, the call centre and the tooling, but it cannot take the place of the bank's official in verifying identity. Kaveri has outsourced the decision, not the technology.

A compliant session must have:

• An official of the bank conducting the interaction, with the customer displaying original documents (PAN, or Aadhaar/OVD where used) to that official.
• Liveness detection, live - never disable-able by a product flag. A recorded or replayed video is not verification.
• Face match between the live person and the photograph on the document.
• Geo-tagging of the customer's live location captured during the session, and a check that it is consistent with the stated address.
• Captured consent, session recording with an audit trail, and retention as a KYC record.
• A clear attribute in the system recording which official verified the customer, the time, and the evidence relied on.

Also breached: periodic re-KYC - high-risk customers must be updated at least every two years, and none have been. The abandonment of verification controls also breaches the bank's own KYC policy and the requirement to have a documented, board-approved customer acceptance policy, and the missing suspicious transaction report breaches PMLA reporting obligations. The 61% late-night pattern and the shared device fingerprints are, individually and together, grounds to suspect that identity documents were procured or reused - a failure of customer due diligence, not merely a conversion problem.

What it is: a mule-account factory. Shared device fingerprints mean one operator opening many identities. Rapid in-and-out - UPI credits of ₹9,000–₹49,000 followed by 90% cash withdrawal within 48 hours - is the signature of layering, not savings behaviour. Cash withdrawal across merchant POS or ATMs converts traceable credit into untraceable currency. The geographic mismatch on 190 accounts reinforces that the documents are not the people in front of the camera. The late-night clustering is consistent with a scripted operation running to a schedule.

24 hours

• Suspend credits and debits on the 340 device-linked accounts and the 190 geo-mismatch accounts pending review; preserve all V-CIP recordings and device logs.
• Disable version 2.3 of the app and restore mandatory liveness; suspend onboarding through the vendor until re-audited.
• File an initial internal report to the principal officer under PMLA and brief the board's audit committee.

7 days

• Complete device, IP and beneficiary network analysis; identify the beneficiary accounts receiving the cash-outs; share intelligence with the cyber crime portal and affected banks.
• File suspicious transaction reports where suspicion is established - within 7 days of forming that view; consider a defensive filing for the full cohort.
• Re-KYC the high-risk population, starting with the 340 and 190 accounts.

30 days

• Independent audit of the V-CIP process and the vendor; revise the contract to give the bank control over liveness, geo-tagging and agent conduct, with audit and termination rights.
• Rule-based onboarding controls: device limits per mobile number, night-time velocity caps, mandatory step-up verification for new accounts.
• Board note on the episode, remediation and residual exposure, and a decision on whether the vendor relationship should continue.

The framing to reject is 'growth versus compliance'. The relevant framing is 'which growth is worth having'. The 4,100 accounts delivered volume with an unknown share of fraud, a supervisory finding, an STR obligation, reputational exposure and the cost of unwinding mule accounts. A third fewer openings of genuine customers is a better outcome than a book where 8% of accounts are suspect.

A risk-based approach is legitimate, but it operates on the level of due diligence and monitoring, not on whether identity is verified at all. Liveness, geo-tagging and verification by a bank official are baseline controls for remote onboarding - they are not tunable parameters. What can be tuned:

• Tiered limits for newly opened accounts: lower initial transaction ceilings, lifted after a period of clean behaviour.
• Channel economics: incentive the vendor on verified, retained, non-fraudulent accounts rather than on openings.
• Straight-through speed for low-risk customers with strong digital signals; step-up verification only where signals are weak.
• Better conversion engineering - lighting guidance, language support, session resumption - which recovers conversion without weakening verification.

Finally, put the trade-off to the board in numbers: cost per genuine account, fraud loss per 1,000 accounts, and the supervisory consequence of a repeat. Business cases that assume a fraud-free funnel should be sent back, not approved with a caveat.