Essential Compliance Checklist for AePS at Customer Service Points

Operating an Aadhaar-Enabled Payment System (AePS) at your customer service point is a vital way to serve your community, but it comes with specific compliance requirements. Following these rules ensures you offer secure and reliable financial services to your customers.

This article will provide you with a clear, actionable checklist to meet all essential AePS compliance responsibilities. You will learn how to protect your customers, safeguard your business, and maintain the integrity of India’s financial system.

Understanding Aadhaar-Enabled Payment System (AePS)

AePS is a payment service allowing bank customers to use their Aadhaar number and biometric authentication for basic banking transactions. This system makes financial services accessible even in remote areas, promoting financial inclusion across India.

Through AePS, customers can perform cash withdrawals, balance enquiries, mini statements, and Aadhaar-to-Aadhaar fund transfers. These services are processed by a business correspondent at a customer service point, eliminating the need for a physical bank branch or debit card.

Adhering to AePS rules is crucial for building trust and ensuring security for both your customers and your business. Compliance protects sensitive customer data and prevents fraudulent activities, safeguarding your operational integrity. According to NPCI (2026), strict adherence to guidelines is foundational for the continued growth of digital payments.

Common AePS services you can offer:

• Cash Withdrawal
• Balance Enquiry
• Mini Statement
• Aadhaar to Aadhaar Fund Transfer

Getting Ready for AePS: Your Setup Checklist

Before offering AePS services, you must ensure your customer service point is properly equipped and secure. This includes using only biometric devices that are approved and certified by the relevant authorities. Regularly check that all your software is updated to the latest versions to protect against security threats.

Your computer systems and network connections must also be secure, protected by up-to-date antivirus software and firewalls. This robust digital security infrastructure is essential to prevent unauthorised access and data breaches. According to RBI guidelines (2026), all systems handling sensitive financial data must meet specified security standards.

Transparency is key, so you should clearly display notices at your customer service point for customers. These notices must inform them about the types of AePS services offered and any applicable service charges. Additionally, daily transaction limits and the customer helpline number for complaints or queries should be prominently visible.

Your physical location also requires security measures to protect both staff and customers. Installing CCTV cameras to monitor transactions and deter suspicious activities is a recommended practice. Ensure your staff are well-trained in security procedures and know how to handle cash safely and discreetly.

Serving Customers: The AePS Transaction Rules

For every AePS transaction, you must correctly verify the customer’s identity to prevent fraud. This involves asking for their Aadhaar number and then using the biometric device to match their fingerprint or iris scan with the information linked to their Aadhaar. This two-step verification process ensures that only the rightful account holder can access their funds.

Before starting any transaction, you should clearly explain each step to the customer. This helps them understand what is happening and builds their confidence in your service. Make sure they clearly know the amount involved and the purpose of the transaction.

It is absolutely essential to get the customer’s explicit consent before processing any transaction. This means they must agree to the transaction details, including the amount, before they provide their biometric authentication.

Never proceed without their clear understanding and agreement. Vimala, a startup founder, always ensures her customers verbally confirm the transaction details before proceeding.

After every successful AePS transaction, you must provide the customer with a proper transaction receipt. This receipt should include details such as the transaction ID, date, time, amount, and the type of service performed. This serves as proof of the transaction for the customer and for your internal records.

Step 1: Request customer’s Aadhaar number and confirm their desired service.

Step 2: Explain the transaction steps, including the amount and any applicable charges.

Step 3: Obtain explicit customer consent for the transaction details.

Step 4: Capture the customer’s biometric authentication using an STQC-certified device.

Step 5: Process the transaction and provide a printed receipt with full details.

Keeping Good Records: Your Documentation Checklist

Maintaining accurate and complete records is a fundamental part of AePS compliance and crucial for accountability. You must keep detailed records of all AePS transactions, including transaction IDs, dates, times, amounts, and transaction outcomes. These records should be stored securely, either digitally with strong encryption or physically in a locked cabinet.

Customer Aadhaar details, though used for authentication, must only be stored in a secure, masked format if absolutely necessary for record-keeping, as per NPCI guidelines (2026). Ensure these records are retained for the period required by regulators, typically several years. This practice aids in dispute resolution and audit trails.

Any complaint received from a customer, no matter how minor, must be meticulously recorded. Document the date of the complaint, the nature of the issue, the customer’s details, and all steps taken to resolve it. This comprehensive record helps in tracking issues, improving service quality, and demonstrates your commitment to customer satisfaction.

Regulators and your partner bank may conduct regular checks or audits of your operations. Having organised and complete records will make these processes smooth and demonstrate your commitment to compliance. Be prepared to present these documents upon request to avoid penalties.

Step 1: Log all transaction details immediately after completion, including ID, date, time, amount, and outcome.

Step 2: Securely store digital records with encryption and physical records in a locked, controlled environment.

Step 3: Maintain a separate, detailed log for all customer complaints, including resolution steps.

Step 4: Regularly back up digital records to an offsite location to prevent data loss.

Step 5: Review and organise records periodically to ensure readiness for compliance audits.

Protecting Everyone: Security and Privacy Rules

You must treat customer Aadhaar numbers and biometric information with the highest level of care. This sensitive data should never be stored on your local systems or shared with anyone after the transaction is complete. It is used only for real-time authentication during a transaction and then securely discarded from your temporary memory.

Ensure your systems are designed to prevent any data leakage, employing encryption for data in transit and at rest. Implement robust security measures for all your digital systems, including using strong, unique passwords for all accounts. Regularly update security software and be vigilant against phishing attempts or malware.

Regularly back up your data to prevent loss in case of a system failure or cyber-attack. Always adhere to the data protection guidelines issued by the government and financial regulators. This means ensuring that all customer information is handled legally, fairly, and transparently, respecting their privacy rights at all times.

• Implement strong, unique passwords for all system access.
• Regularly update all operating systems, applications, and antivirus software.
• Use firewalls and intrusion detection systems to protect your network.
• Encrypt all data, both when it is being sent and when it is stored.
• Train staff on identifying and reporting phishing attempts and social engineering tactics.
• Conduct regular security audits and vulnerability assessments.

Handling Problems: Your Grievance Checklist

Even with the best practices, problems can sometimes arise, and having a clear process for handling complaints is vital. Establish a clear, easy-to-understand process for customers to raise complaints, ensuring it is prominently displayed. Your staff should be trained to listen carefully, empathise, and try to resolve issues at the first point of contact.

Aim to resolve complaints fairly and as quickly as possible, keeping the customer informed throughout the process. If a complaint cannot be resolved at your customer service point, you must have a clear escalation process. This means knowing exactly who to contact at your partner bank or the relevant regulatory body, such as NPCI, to get further assistance.

Provide the customer with the necessary contact details for these higher authorities, ensuring they know the next steps. Maintain a detailed log of every complaint, including how it was handled, the steps taken, and the final resolution. This record is essential for internal review, audit purposes, and for learning from past issues to prevent future ones.

Step 1: Receive the customer complaint and log all relevant details immediately.

Step 2: Attempt to resolve the complaint at your customer service point promptly and fairly.

Step 3: If unresolved, escalate the issue to your partner bank or NPCI as per established protocols.

Step 4: Provide the customer with the escalation contact details and a complaint reference number.

Step 5: Document the entire resolution process, including the final outcome and customer feedback.

Staying Updated: Ongoing Compliance Responsibilities

The rules and technologies surrounding AePS can change, making regular staff training crucial. Therefore, it is essential to provide regular training to all your staff members who handle AePS transactions. This ensures they are always up-to-date with the latest procedures, security protocols, and compliance requirements.

Stay informed about any new guidelines, circulars, or updates issued by the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI). These bodies regularly review and update regulations to enhance security and efficiency. You must promptly implement any changes to your operations to remain compliant.

It is important to understand the serious consequences of non-compliance with AePS rules. Failing to follow these guidelines can lead to severe penalties, including hefty fines and the suspension of your services. It can also result in the permanent loss of your authorisation to offer AePS, severely damaging your reputation and customer trust.

Conclusion

By diligently adhering to this essential AePS compliance checklist, you safeguard your operations and build unwavering trust with every customer at your service points. Following these guidelines ensures not only regulatory compliance but also a secure, efficient, and reliable transaction experience for all.