VICARIOUS LIABILITY FOR V-KYC FAILURES: RESOLVING THE“AUTHORISED VENDOR” PARADOX UNDER INDIA’S DIGITAL BANKING FRAMEWORK

The 450,000 fake accounts and ₹17,000 crore laundered that were part of India’s 2024 mule account saga have, at last, revealed the main defect in the whole regulatory structure of video-based Know-Your-Customer processes. Besides, the use of deepfake technology to bypass the banks’ “authorised vendors” facial recognition systems brought up the urgent question: who is responsible when outsourcing of identity verification goes wrong catastrophically? The present study is aimed at unveiling the tension between the Reserve Bank of India granting permission to outsource V-KYC and the non-delegable legal duties that come with Section 12 of the Prevention of Money-Laundering Act, 2002 (PMLA) and Section 35A of the Banking Regulation Act, 1949. The bank’s vicarious liability, statutory interpretation, and comparative legal doctrines have been thoroughly analysed to prove that the bank would not be able to avoid its responsibility by treating V-KYC vendors as independent contractors. The research applies the control test, integration test, economic-reality test, and the ostensible authority doctrine, as laid down in various landmark cases, to show that the vendors are actually acting as bank agents and performing important regulatory roles. Legal principles of non-delegable duty and estoppel bar banks from denying liability by resorting to contractual indemnity clauses, which are meant for the parties to the contract only and do not protect the victims of fraud. Our recommendations include modifications in the law to provide for joint and several liabilities, compulsory insurance, vendor certification processes and a fund for consumer compensation, resulting in a liability framework that is coherent and that not only accommodates technological progress but also safeguards the customers in the digital world of India.

Continue Reading