# KYC for Online Gaming in India: What You Give Up

Source: https://cricketin.org/guides/kyc-in-online-gaming-india

[By Farhan Qureshi](/authors/payments-expert), Payments Expert. [Reviewed by Rajeev Sathe](/authors/editor-in-chief), Editor-in-Chief. Updated 26 Aug 2026. Editorial policy: https://cricketin.org/editorial-policy

18+ Betting money on cricket carries a direct risk of financial loss, and it can become an addiction. Real-money online gaming is banned across India under the PROG Act 2025, which came into force on 1 May 2026.

If betting is already costing you money you need, or sleep, or people close to you, the free Tele-MANAS helpline is **14416**, and it runs in 20 languages. Our [page on help for gambling harm](/guides/help-for-gambling-harm-india) lists what else exists.

---

What gaming apps ask for at verification, who holds those documents, which DPDP rights are not live yet, and why refusing KYC backfires.

A gaming app that runs a check asks for an identity set. That means Aadhaar or PAN, a selfie, and at times a bank statement. That is not bank KYC. The Reserve Bank calls KYC a process run by a Regulated Entity that it supervises ([RBI FAQs](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)). A gaming platform is not one of those.

This page lists what is asked for. It shows what each item gives away, and who ends up holding it. It sets out which parts of the DPDP Act are live in 2026. It also shows why saying no to the check does not keep you safe.

## What KYC really means, and who may do it

KYC is short for Know Your Customer. The Reserve Bank of India says it is a process where a Regulated Entity gets facts about you. Those facts cover your identity, your address, your business and your money. The entity must then check them ([RBI FAQs on the KYC Master Direction](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)).

Read that again. It starts with a Regulated Entity. That means a bank, or another firm the Reserve Bank oversees ([RBI](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)). A gaming platform is not on that list.

So an app that asks for papers and calls it KYC is borrowing a word. The word sounds official. The work behind it may be nothing of the kind.

Real bank KYC comes with plumbing you can use. There is a central store of records called CKYCR. There is a KYC Identifier. Your bank must ask you first, in clear terms, before it pulls your records from that store ([RBI](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)). An app that collects selfies and card photos has none of that behind it.

## What gets asked for, and what each item exposes

The list is much the same from app to app. What differs is how much each item gives away once it leaves your phone.

**Table 1. Each document, and what it opens up**

| What is asked | What it links to | Why it is hard to undo |
|---|---|---|
| Aadhaar copy | Your identity across many services | The number does not change; a copy can be reused elsewhere |
| PAN card | Your tax record and financial history | PAN is permanent by design |
| Selfie or a video | Your face, tied to the other documents | A face cannot be reissued |
| Bank statement | Your salary, rent, loans, spending pattern | It exposes other people you pay too |
| Phone number | Your OTP route and your messaging apps | It becomes the key to reaching you |

One item needs its own warning. UIDAI has told the public not to share a photocopy of Aadhaar with any organisation. A copy can be misused ([UIDAI advisory, PIB](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1828797)).

UIDAI is also clear on who may use Aadhaar at all. Only a body with a User Licence from UIDAI may use Aadhaar to prove who a person is. A private firm without that licence may not collect or keep copies. The advisory calls that an offence under the Aadhaar Act 2016 ([PIB](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1828797)).

A masked Aadhaar exists for this very problem. It shows only the last four digits of the number ([PIB](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1828797)). Whether an app will take one is a different question. That is part of the point.

## Who is holding your documents afterwards

You upload to an app. The app is just a screen. Behind it sits a chain, and you never see its shape.

- The firm that runs the platform, which may sit outside India.
- A vendor that checks papers for many clients at once.
- A cloud host, in some country, on a contract you cannot read.
- A payment partner, if you added a card or an account.
- A support team of real people, who can open your file to close a ticket.

One blunt fact makes this matter. The PROG Act 2025 came into force on 1 May 2026. It applies across India, and it reaches offshore firms that serve Indian users ([Nishith Desai analysis](https://nishithdesai.com/research-and-articles/hotline/gaming-law-wrap/setting-the-rules-of-the-game-indias-online-gaming-law-comes-into-force-15586)). A firm that already breaks Section 5 is not a firm that is careful with your papers ([Act text, MeitY](https://www.meity.gov.in/static/uploads/2025/10/8a7f103cefc68ed8aaa2ebc9a2ed7c13.pdf)).

Our page on [offshore apps and Indian law](/legal/offshore-betting-apps-india) covers where those firms sit. The [data privacy page](/guides/data-privacy-on-gaming-apps) covers what they do with data day to day. This page stays on the papers you hand over yourself.

## What the DPDP Act asks of them, and from when

India has a data law. It is the Digital Personal Data Protection Act, 2023, Act No. 22 of 2023 ([Act text, MeitY](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). The catch is the calendar.

A notice called G.S.R. 843(E), dated 13 November 2025, switched the Act on in three stages ([commencement notification](https://cadp.in/resources/official-texts/dpdp-notification-commencement-2025/)). Only some parts are live today.

**Table 2. When each part of the DPDP framework starts**

| Stage | Date | What begins |
|---|---|---|
| At once | 13 November 2025 | Definitions, the Data Protection Board and its machinery, rule-making powers |
| After 1 year | 13 November 2026 | Rules for registering and running consent managers |
| After 18 months | 13 May 2027 | Consent rules, duties of data fiduciaries, and your own rights |

So here is the true position in August 2026. Section 11 gives you a right to ask for a summary of your data. Section 12 gives you a right to fix it or wipe it ([DPDP Act](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). Both are written into law. Neither is live yet. They start on 13 May 2027 ([Khaitan and Co](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf)).

The duties are real once they land. Section 8(5) tells a data fiduciary to take fair steps to keep data safe. The Schedule allows a fine of up to 250 crore rupees if it does not ([DPDP Act](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). A breach must be told to each person hit, with no delay. The Board must be told within seventy-two hours ([DPDP Rules, Rule 7](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).

Now hold that next to this market. A fine on a firm that is already unlawful here, and may not even be based here, is a thin shield for your papers.

## Why an Aadhaar or PAN leak lands differently

Most leaked data ages out. A password can be changed. A card can be reissued. These items cannot be.

Your Aadhaar number stays yours for life. Your PAN is meant to be permanent. Your face is not replaced. So a copy that gets out today can still be used in five years.

There is a second, quieter effect. A full set of papers is enough for someone to pose as you. That risk does not sit with the app. It sits with you, in a fight you did not start.

The DPDP Act puts a duty on your side too. Under Section 15 you must not pose as another person. You must not file a false or silly complaint. Breaking those duties can cost up to ten thousand rupees ([DPDP Act, Section 15 and the Schedule](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).

Say your papers are being misused now. Online money fraud can be reported on the national helpline 1930 ([National Cyber Crime Reporting Portal](https://cybercrime.gov.in/Webform/Crime_NodalGrivanceList.aspx)). That is a route for the misuse. It is not a route to get the copies back.

## Refusing KYC does not protect you

There is a tempting move here. Skip the papers, stay a stranger, keep the risk low. It does not work. It fails in one clear direction.

- **The money still leaves.** A deposit needs no papers from you. The demand shows up when you try to take money out.
- **An account with no checks is the easiest one to refuse.** A payout can be held for checks, and you have no contract to point at.
- **No papers means no proof the account was yours.** That cuts against you in every later fight.
- **Tax does not go away.** Tax is cut from net winnings from online games under Section 194BA. There is no floor below which it stops ([Income Tax Department](https://www.incometaxindia.gov.in/w/winnings-from-online-games)).

So both doors are bad. Give the papers, and your identity sits where you cannot check on it. Hold them back, and the balance on screen is even less likely to reach your bank. That is the real shape of the choice. It is worth seeing before you upload a thing.

Our page on [why payments get frozen](/guides/payment-freeze-and-chargebacks) shows what follows a refusal to pay out. The [agent account page](/guides/cricket-id-and-agent-accounts) shows the case with no checks at all, and no record of you either.

## Where a complaint can actually go

Few doors are open. So it helps to know which is which.

- **Your bank.** The Reserve Bank Integrated Ombudsman Scheme runs from 1 July 2026. You must write to the regulated entity first. Then you need a reply you dislike, or 30 days of silence ([RB-IOS 2026 salient features](https://webassets.rbl.bank.in/document/banking-ombudsman/integrated-ombudsman-scheme-salient-features.pdf)).
- **The Data Protection Board.** Its own parts are live from 13 November 2025 ([G.S.R. 843(E)](https://cadp.in/resources/official-texts/dpdp-notification-commencement-2025/)). The user rights it would enforce are not ([Khaitan and Co](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf)).
- **The police, for misuse.** Money fraud goes to helpline 1930 ([cybercrime portal](https://cybercrime.gov.in/Webform/Crime_NodalGrivanceList.aspx)).

We do not give legal advice on any of this. If your papers are already out, ask a lawyer who works on data and cyber cases. Our [editorial policy](/editorial-policy) sets out what we will and will not tell you. The [guides hub](/guides) lists the rest of these explainers.

## What this page will not give you

It gives no names of platforms, and none of the vendors that check papers. It gives no way to pass a check with less data. It ranks nobody as safer with your files.

The reason sits in Section 6 of the PROG Act 2025. That section bans ads for a money game, direct or indirect ([MeitY](https://www.meity.gov.in/static/uploads/2025/10/8a7f103cefc68ed8aaa2ebc9a2ed7c13.pdf)). Naming a smoother sign-up route points at the service. Our [page on the advertising rules](/legal/advertising-rules-online-gaming) maps that line for you.

## Questions people ask

### Is the KYC an offshore betting app does the same as bank KYC?

No. Bank KYC is run by a Regulated Entity that the Reserve Bank oversees ([RBI FAQs](https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782)). A gaming platform is not one. It may use the same word and the same list of papers, with none of the same oversight.

### Can I ask a gaming app to delete my Aadhaar copy?

Section 12 of the DPDP Act gives a right to erasure. That section starts on 13 May 2027 ([Act text](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf), [Khaitan and Co](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf)). You can still ask today. There is just no legal duty behind the ask yet.

### Is a private company even allowed to keep my Aadhaar photocopy?

UIDAI says only a body with a User Licence from UIDAI may use Aadhaar to prove identity. A private firm without one that collects copies commits an offence under the Aadhaar Act 2016 ([UIDAI advisory via PIB](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1828797)). How that is enforced on an offshore app is not clear. What we still need: a UIDAI or MeitY statement on enforcement against firms based outside India.

### If my documents leak, who pays for it?

The Schedule of the DPDP Act allows a fine up to 250 crore rupees for a failure to take fair steps to keep data safe ([DPDP Act](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). That fine goes to the state. It is not a payout to you. Whether a person can claim damages under this Act is not settled. What we still need: a Board order or judgment on private compensation.

### Does giving less information protect me at withdrawal time?

It tends to do the opposite. The deposit needs nothing from you. The payout is where checks are demanded, and an unchecked claim is the easiest to hold. Tax is still cut from net winnings, with no floor ([Income Tax Department](https://www.incometaxindia.gov.in/w/winnings-from-online-games)).

## More from the guides

- [ODI Cricket Rules Explained](/guides/odi-rules-explained)
- [Frozen Payments in Online Gaming](/guides/payment-freeze-and-chargebacks)
- [Self-Exclusion and Deposit Limits in India 2026](/guides/self-exclusion-and-limits)
- [Signs of Gambling Addiction](/guides/signs-of-gambling-addiction)
- [T20 Cricket Rules Explained](/guides/t20-rules-explained)
- [Test Cricket Rules Explained](/guides/test-cricket-explained)
- [UPI and Online Gaming Payments in India](/guides/upi-and-online-gaming-payments)
- [Wagering Requirements](/guides/wagering-requirements-explained)
- [What Is a Session Bet in Cricket](/guides/what-is-a-session-bet)
- [Online Gaming Ad Rules in India](/legal/advertising-rules-online-gaming)
- [GST on Online Gaming in India](/legal/gst-on-online-gaming)
- [Caribbean Premier League 2026 — live schedule and table](/leagues/cpl)