AePS lets a bank customer withdraw cash, check a balance or pay a merchant using only their Aadhaar number and a fingerprint, at any interoperable counter, not only their own bank's. That interoperability is exactly why AePS carries more due-diligence obligations than almost any other retail rail: the counter belongs to one party, the authentication infrastructure to UIDAI, and the money to a bank the customer may never have visited. This checklist sets out the roles, the 2025-26 due-diligence rules for touchpoint operators, and what a platform needs to build to support them.
Four roles in every AePS transaction
Whatever the software layer looks like, an AePS transaction always has four parties behind it.
| Role | What it does |
|---|---|
| Acquiring bank | Owns the BC relationship and carries the due-diligence duties for the touchpoints in its network |
| BC or aggregator | Signs up and manages touchpoint operators on the acquiring bank's behalf |
| Platform | The software layer: onboarding, transaction routing, device integration, records |
| Operator | The person at the counter who runs the transaction for the customer, including any sub-agents further down the chain |
A platform sits between the BC or aggregator and the operator. It never becomes the acquiring bank, and describing it as one is the kind of overreach that gets a partnership terminated.
RBI/2025-26/63: what acquiring banks must now do
RBI's AePS touchpoint due-diligence directions (RBI/2025-26/63, issued 27 June 2025, effective 1 January 2026) require acquiring banks to:
- run KYC on every touchpoint operator, including sub-agents, not only the BC's own registered staff
- re-run that KYC after three consecutive months of inactivity
- restrict the APIs issued to a touchpoint to AePS use only
- monitor operators on a risk basis, covering location, volume and velocity
The detail above follows a secondary summary by Mondaq. Read the directions themselves and confirm the requirements with your acquiring bank.
None of this is optional for the bank, and a platform that cannot produce the records a bank needs to meet these obligations will struggle to keep an AePS relationship.
What the platform must build
Sub-agent KYC records
A record for every operator down to the sub-agent level, in a form the acquiring bank can audit, not only the top-level BC
A dormancy clock
Tracks days since an operator's last transaction and flags the three-month mark automatically, before the bank asks
Geo-tagging
Captures where each transaction was initiated, tied to the registered touchpoint location
Device binding
Ties an operator's credentials to a specific registered device, so a login from an unrecognised device is a signal, not a routine event
Velocity alerts
Flags unusual volume or frequency per operator or per Aadhaar number for review
BC details in every transaction
Every AePS record carries the BC/agent identity, in line with NPCI's circular 83 on BC agent details in AePS transactions, as summarised in industry sources
L1 devices and daily authentication
AePS runs on UIDAI-compliant biometric devices. Registered devices come in two levels: L0 devices protect their keys in software, while L1 devices keep them in a hardware-backed trusted environment, and the ecosystem has been moving to L1. Confirm the current device requirements on uidai.gov.in and with your acquiring bank. A platform needs to support registration and updates for these devices, from brands such as Mantra, Morpho or Startek, and should not assume a device compliant last year still is this year.
Separately, most AePS deployments require the operator to authenticate once per working day before any customer transaction can run at that counter, on top of whatever authentication each individual transaction needs. Build daily authentication as its own state, checked before the first transaction of the day, rather than folding it into the first customer's own biometric capture.
Step-up OTP above ₹5,000, and the ₹50,000 rolling window
Two separate limits, from two separate circulars, get confused often enough to state apart:
- NPCI OC 087 recommends that banks cap cash withdrawal and BHIM Aadhaar Pay together at ₹50,000 over a rolling 30 days, rather than a calendar month (NPCI, confirmed via TeamLease).
- A circular indexed on NPCI's AePS circulars page as OC 096 is reported by industry summaries to add a step-up Aadhaar OTP for cash withdrawal and Aadhaar Pay transactions past a threshold, with a mid-2026 deadline. This article has not confirmed OC 096's contents against NPCI's own text; verify the current requirement with your acquiring bank before building against it.
Design the step-up OTP so it can be switched on independent of the biometric flow, since exactly where and how it applies is still being confirmed across sources.
Reconciliation and resolving pending transactions
An AePS transaction can time out on your side while the switch or the issuing bank still processed it, so a daily reconciliation between your own records and your acquiring bank's or aggregator's reports is not optional. Build a pending-transaction resolver that checks the authoritative record before marking anything failed or refunded, using a unique reference per attempt so a resolver run twice never double-processes the same transaction.
The Payonclick AePS module
Payonclick has no public AePS API. AePS is built into the Payonclick platform for its own retailers, and offered as a module inside a white-label build or a custom build. What ships in the platform today:
- merchant onboarding through OTP plus biometric eKYC, with bank eKYC tracked as a separate step
- daily two-factor authentication, checked per user, per service and per day
- a step-up OTP above ₹5,000, carried inside the RD device's PID options rather than sent in the clear
- fingerprint or iris authentication for the transaction itself; face authentication is used only for the daily check, not for individual transactions
- a registry covering 16 RD device models
- a nightly reconciliation run, and logic to resolve transactions still pending after the fact
For the related counter services, see our Micro ATM module and UPI cash withdrawal module. Retailers can also read our AePS operator KYC guide for the shop-level view of the same 2025-26 rules.