The government dropped its plan to build a single, shared database - called the Biometric Identity Verification System (BIVS) - that would have assigned a unique ID to every user and let every telecom company check a customer’s identity against every other company’s records. This was the central change in the newly notified Telecommunications (User Identification) Rules, 2026 by the Department of Telecommunications (DoT) on August 21.
Under section 3(7) of the Telecommunications Act 2023, an entity has to identify the person to whom it provides telecommunication services through verifiable biometric based identification. With BIVS gone, no more cross-industry biometric matching would happen and verification will happen through e-KYC and D-KYC.
The final rules come 11 months after the DoT published the draft rules on September 19, 2025.
Critiquing the BIVS system, the Internet Freedom Foundation (IFF) in October 2025 had said it had been introduced “without any reasonable justification,” calling it a “parallel collection of biometric data by the DoT…in addition to that which is already being collected under the Aadhaar by UIDAI.” IFF had said that the new repository would have none of the safeguards on protection of information required under the Aadhaar Act, 2016.
HT emailed the DoT for reasoning behind scrapping the BIVS, but did not immediately get a response.
{{/usCountry}}HT emailed the DoT for reasoning behind scrapping the BIVS, but did not immediately get a response.
{{/usCountry}}The final rules spell out how phone companies must confirm who a user is before giving them a SIM card, updating details, or disconnecting the phone number. They apply to all telecom operators including Airtel, Jio, Vodafone Idea, BSNL and others, and came into effect immediately, though companies have three months, extendable to six, to get the required systems running.
For Aadhaar holders, under Rule 4, e-KYC would be outsourced to UIDAI’s authentication facility. For non-Aadhaar users, the D-KYC mechanism under Rule 5 would apply, where the entity would first determine whether the user needs to undergo D-KYC or e-KYC. Then the entity would capture a live face image and an electronic image of the original ID/address-proof documents, provide alternative means to provide biometric information in case the user is unable to undergo live capture of face due to impairment, disfigurement or injury. It can additionally do a field visit or get police assistance to verify identity/address.
Other changes to the final rules include an alert mechanism under rule 10, which would allow entities to send an alert to the user whenever a new connection/SIM/update/disconnection request is made in their name, asking them to confirm they made the request. Entities must also report to government any instance of failure of biometric identification.
Biometric identification is now also required before disconnection, which wasn’t the case in the draft rules, and not just during enrollment or an update.
Some draft provisions quietly disappeared with no replacement, like explicit self-KYC via website or app, biometric of new user to be carried out within seven days failing which the authorised entity shall disconnect such connection after seven days from the date of intimation of such change.
Separately, the DoT in a circular issued on August 17, created a different version of the cross-company checking in place, in which its Digital Intelligence Platform would pull subscriber data and photos from all the telecom companies to spot people who hold more than the permitted nine mobile connections nationwide (six in Jammu & Kashmir, Assam and the North-East), with photo-based checks going live from August 23.