Did Nandan Nilekani push the RBI for Aadhaar authentication for digital payments in 2013?

On 8 January, the Reserve Bank of India set up a five-member panel headed by Nandan Nilekani, the technology billionaire who was the first chairperson of the Unique Identification Authority of India, or UIDAI—the parent agency for Aadhaar—to improve digital payments in India. The high-level panel will propose measures to “strengthen the safety and security of digital payments.” Besides Nilekani, the panel comprises HR Khan, a former deputy governor of the RBI; Kishore Sansi, a former managing director and CEO of Vijaya Bank; Aruna Sharma, a former secretary in the Ministry of Electronics Information Technology; and Sanjay Jain, the chief innovation officer at the Centre for Innovation Incubation and Entrepreneurship at IIM Ahmedabad.

In “The New Oil,” the May 2018 cover story of The Caravan, Aria Thaker reported on the mixing of public risk and private profit in the Aadhaar project. In the following excerpt, Thaker reveals the power that Nilekani wields in the Aadhaar ecosystem, and how the former UIDAI chairperson had pushed for having Aadhaar incorporated into bank-card transactions. In 2013, the RBI formed a working group to consider the use of Aadhaar to authenticate bank-card payments. According to a senior banking official, when the group’s conclusions proved to be critical of Aadhaar, Nilekani “managed to get the RBI to suppress that report.”

Nandan Nilekani, though he is no longer the chairman of the UIDAI, still wields immense power in the Aadhaar ecosystem, in both private and public realms. Aadhaar was his brainchild, and his appointment to lead the project, in 2009, was fully backed by the Congress-led government of the day. He was listed as a mentor to iSPIRT on the group’s website as late as in May 2017, though his name has been removed from it since. [iSPIRT is a non-profit entity that develops and promotes India Stack, a set of Aadhaar-specific application programming interfaces, or APIs, which are building blocks in the software architecture required by many third-party entities to use Aadhaar.] His influence and connections as a technology investor run deep, especially in Bengaluru, and only stand to get deeper—last year, he backed a new $100-million venture capital fund called Fundamentum. As a politician—Nilekani left the UIDAI in 2014 to join the Congress, and ran a failed campaign for a Lok Sabha seat from Bengaluru—his reach extends all the way to the highest circles of power at the national level.

The 2014 general election was a time of great uncertainty for Aadhaar. The BJP’s record of opposition to Aadhaar suggested the party would move against the programme now that it was in power. Narendra Modi himself, just weeks before he became prime minister, had tweeted, “On Aadhaar, neither the Team that I met nor PM could answer my Qs on security threat it can pose. There is no vision, only political gimmick.”

But Modi was quickly won over. The journalist Shankkar Aiyar, in his 2017 book Aadhaar: A Biometric History of India’s 12-Digit Revolution, wrote that the new prime minister met RS Sharma, an officer of the Indian Administrative Service and the UIDAI’s first director-general, soon after his swearing in. According to Aiyar, Modi immediately asked Sharma if it was feasible to have Aadhaar-linked biometric systems to track attendance at all central government offices. Sharma said it was, and Modi replied, “This must be done.” Shortly after this, Nilekani also met with Modi. In a television interview in 2015, Nilekani said, “I did have one meeting with him after the election, where I told him about the value” of Aadhaar.

In February 2018, the news website The Wire reported that Nilekani had had a strong hand in the appointment of a new head of the National Payments Corporation of India, or NPCI, a non-profit company created by the Reserve Bank of India and the Indian Banks’ Association to create and oversee infrastructure for electronic payments across the country. The NPCI board had voted for Uttam Nayak, a former India chief for the credit-card company Visa, to become the group CEO, but after intervention from the RBI it appointed Dilip Asbe—an associate of Nilekani’s, who was then the NPCI’s chief operating officer. According to The Wire, “Nilekani, who serves as an ‘advisor’ to NPCI but does not sit on the board, batted heavily in favour of Asbe.” Someone with knowledge of the proceedings told me that Nilekani “shadow-runs that company,” and that the NPCI board was sick of his influence.

India Stack’s Unified Payments Interface was rolled out, in 2016, by the NPCI. At a conference shortly before this, Nilekani said, “UPI’s going live in the next four, five days. … Every day I call up Dilip Asbe and say, ‘What’s going on?’ And he says, ‘Tomorrow, tomorrow—kal ho jayega, kal ho jayega.’”

In 2013, the RBI formed a working group to consider the use of Aadhaar to authenticate bank-card payments. The group prepared a report that stated, “Since this is a new technology that has not been adopted globally, the concerns related to data compromise are still unknown. Further, the remedial action in case of such a compromise needs to take into account the fact that if Aadhaar of a cardholder is compromised then the cardholder’s identity gets compromised for life unlike in the scenario where Banks replace the compromised Card+PIN with a new Card+PIN. Embedding Aadhaar in the payments ecosystem will need more stringent controls to avoid data breach at environments other than payments where Aadhaar is used.” A senior banking official told me that the RBI constituted the working group because Nilekani, then the UIDAI chief, was pushing hard to have Aadhaar incorporated into card transactions. When the group’s conclusions proved to be critical of Aadhaar, the official added, Nilekani “managed to get the RBI to suppress that report.” The document is not available in the RBI’s online archives.

Before the working group’s rebuff, Nilekani had even higher hopes for Aadhaar in banking. “He tried to get card numbers to be replaced by putting Aadhaar on the magstripe of every card,” the banking official said, “with the intention that somewhere down the line he’ll get RBI or somebody to mandate the Aadhaar, and drop the card number.” The official added that Dilip Asbe was among several of Nilekani’s associates to enthusiastically back the idea. But Nilekani ran into tremendous resistance from credit-card companies and banks, which said they were “not going to compromise any of the global standards.”

Some months after the report was finished, the RBI informed banks that all new bank-card infrastructure has “to be enabled for both EMV chip and PIN and Aadhaar (biometric validation) acceptance.” In September 2016, it directed banks to ensure that “new card acceptance infrastructure deployed with effect from January 1, 2017 are enabled for processing payment transactions using Aadhaar-based biometric authentication also.” That December, it extended “the time for deployment of Aadhaar-enabled devices till June 30, 2017.” There have been no further instructions on this so far.

The person with knowledge of NPCI proceedings said that when Nilekani, as the head of the UIDAI, was working as a public servant under the previous government, “there were checks and balances for him, because it was quite a fragmented government. In the current government, he’s just got a free run. So somebody in the government believes that this idea is so great, and they’ve just virtually given him the reins to run and hire and fire and do what he wants at the moment. Everybody knows it, but nobody wants to have the courage to speak up, because the government is seen as backing him.”

This is an excerpt from the “The New Oil,” Aria Thaker’s cover story in the May 2018 issue of The Caravan.