KYC and Onboarding UX Copy: Microcopy That Cuts Drop-off Without Breaking India’s KYC Norms

By Yamm Labs · Updated September 2026 · 9 min read

A 26-year-old in Indore downloads a broking app on a Sunday evening. Screen one asks for her mobile number. Screen four asks for camera permission with the sentence “Allow access to your camera to continue”. She taps “Don’t allow”, because nobody told her why, and the app has no way forward. She is now one of the drop-offs in a funnel chart that a product team in Bengaluru will look at on Monday and label “camera step: 31 per cent”. The fix is not a bigger button. It is one sentence, written before the permission dialog, that says what the camera is for and how long it takes.

What does the Indian KYC journey look like from the user’s side?

Regulators define KYC by documents and checks. Users experience it as a sequence of screens, each with a chance to quit. The typical journey for a broking, lending, wallet or bank account in India runs through these steps, though the order varies by product and by whether the account is a full-KYC or a limited one.

1. Mobile number and OTP. The first commitment, and the first place jargon appears.
2. PAN. Ten characters, validated against the income-tax database. Most errors are typing errors.
3. Aadhaar-based verification. Either OTP-based e-KYC through UIDAI, which returns name, address, date of birth and photo, or the offline XML route where the user downloads a file from the UIDAI site with a share code.
4. CKYC check. A lookup against the Central KYC Registry run by CERSAI. If the user already has a 14-digit KYC identifier, the entity can pull the record and skip document capture.
5. DigiLocker. An alternative route to fetch Aadhaar, PAN or driving licence as verified documents, with consent given on the DigiLocker screen.
6. Video KYC (V-CIP). RBI permitted video-based customer identification in 2020. An agent or an assisted flow verifies the user live, checks the PAN on camera, captures location, and records the session.
7. Bank account verification. A penny drop of ₹1 to the user’s account to verify the name matches, or a reverse penny drop where the user pays ₹1 via UPI.
8. Selfie and liveness. A face capture with a liveness check, matched to the Aadhaar or PAN photo.
9. Signature, nominee, declarations. FATCA declaration, politically exposed person declaration, nominee details, and an e-sign via Aadhaar OTP.

For a limited account opened only with Aadhaar OTP e-KYC, RBI’s KYC directions cap the balance and require full KYC within a set period, which is why so many apps ask the user to “complete KYC” months later. That second ask is usually worse written than the first.

SIGNALNewsletter by Yamm Labs

The next piece, straight to your inbox.

New writing on BFSI brands, B2B and influencer marketing, and AI search.

Email *

Subscribe

Subscription form is not available at the moment

One click to unsubscribe. Privacy policy

Where do users drop off, and why?

In onboarding audits for fintech clients, the drop-off points are consistent. The cause is almost never the regulation. It is the framing.

• Permission dialogs with no preamble. The OS camera, location or SMS permission appears cold. The system dialog cannot be rewritten, so the explanation must come on the screen before it. A sentence before the dialog explaining the selfie, its duration and what is stored changes the acceptance rate.
• The camera itself. Poor light, a face oval that is too strict, no feedback on why the capture failed. Users retry twice and leave. The copy has to coach: “Move to a brighter spot”, “Hold the phone at eye level”, “Remove your glasses for this one photo”.
• Waiting screens without a clock. “Verifying your details” with a spinner and no time estimate. If PAN verification takes 8 seconds, say “This takes about 10 seconds”. If video KYC has a queue, say the queue position or offer a scheduled slot.
• Jargon. “CKYC”, “KRA”, “V-CIP”, “e-Sign”, “FATCA”, “PEP”. A compliance team knows them; a user does not and need not. Describe the action instead.
• Name mismatches. Bank account name “S KUMAR” versus PAN name “SURESH KUMAR” fails the penny drop. The error “Name mismatch” gives the user nothing to do. “The name on this bank account does not match your PAN. Try another account, or use the account where your name appears as on your PAN card.” gives them a path.
• The consent wall. A screen of 400 words of legal consent with a checkbox. Users either quit or tick without reading, and neither is what the regulation intends.
• Coming back later. A user who quits at video KYC and returns on Tuesday is often sent to the start. Re-entry copy should say “You are 2 steps from done”, not “Welcome”.

What are the microcopy principles for each KYC step?

Six principles cover most of what goes wrong.

• Explain before you ask. Every permission and every document request gets one sentence of why, one of what happens to the data, and one of how long.
• Name the action, not the regulation. “Confirm your identity with Aadhaar” rather than “Complete e-KYC”. “Verify your bank account” rather than “Penny-drop validation”. The regulatory term can live in the help text.
• Tell them what you already know. After Aadhaar OTP returns the name and address, show them and say “We fetched this from Aadhaar. Check that it is correct.”
• Give every error a next step. An error message that ends without an action is a drop-off. Every error has a cause the user can understand and one thing they can do now.
• Count down, not up. “Step 3 of 6” on every screen. “2 steps left” on re-entry. Progress is copy, not just a bar.
• Make the pause safe. If the user has to wait for video KYC or a manual review, say what they can do meanwhile, when they will hear back, and how. “Your account is under review. We will send you an SMS within 24 hours. You can add money now and invest once it is approved” is a retention message; “Pending verification” is not.

How do you write consent that is plain and still compliant?

Consent for Aadhaar e-KYC, CKYC lookups, DigiLocker pulls, credit bureau checks and data sharing under the Digital Personal Data Protection Act has to be explicit, informed and specific. None of that requires it to be unreadable. The pattern we use with legal and compliance teams:

• Lead with the purpose in one line. “To open your account, we need to verify your identity with UIDAI using your Aadhaar number.”
• State what is fetched and what is not. “We will receive your name, date of birth, address and photo. We do not receive or store your Aadhaar number after verification.” Use whichever is accurate for your entity’s permitted mode.
• Say who else sees it. “This information is shared with the Central KYC Registry as required by RBI.” The user needs the name of the party, not the citation.
• Keep the legal text available, not mandatory. A “Read the full consent” link that expands the regulator-approved wording. The checkbox sits under the plain version; the full version is one tap away and is what the audit trail records.
• Separate consents that the law separates. Aadhaar e-KYC consent, bureau pull consent and marketing consent are different things. One combined checkbox is both a compliance risk and a trust problem. Three checkboxes with plain labels, with marketing unticked by default, is the honest design.
• Record the exact wording shown. The version of the consent text the user saw, with its timestamp, is part of the record. Copy changes therefore need a version number, which is unusual for microcopy and essential here.

The broader creative constraints on financial services communication, including what can and cannot be promised in an app, are covered in our guide to SEBI, IRDAI and RBI advertising rules.

How should error and retry states be designed?

Error states are where onboarding copy earns its keep, because the user is already frustrated. Four rules.

• Classify errors by who can fix them. User-fixable (typo in PAN, wrong bank account), system-fixable (UIDAI timeout, bureau downtime), and blocked (PAN not linked to Aadhaar, user under 18, name mismatch that requires a bank visit). Each class gets a different template. Never show a system error as if it were the user’s fault.
• Retries have a limit and the copy says so. Aadhaar OTP attempts, selfie captures and penny drops are all rate-limited. “You have 2 more tries” prevents the fourth attempt that locks the user out for 24 hours.
• Blocked is not the end. If PAN and Aadhaar are not linked, the message links to the income-tax portal and says what to do after. If the user needs a branch or an agent, say which and when.
• Save state before every error. The user should never re-enter PAN because the selfie failed.

Step, copy and design: the working table

What changes when the user is not reading in English?

A large share of new fintech users in India onboard in Hindi, Tamil, Telugu, Marathi, Bengali or Kannada, and many read English at a level where “authenticate” is a barrier and “confirm” is not. Four things to build in from the start.

• Write the English at a level that translates. Short sentences, one clause, common words. “Verify” becomes “check”. “Proceed” becomes “next”.
• Keep regulatory nouns stable. “Aadhaar”, “PAN”, “OTP”, “UPI” and “DigiLocker” are the same in every language and should not be translated or transliterated inconsistently. Keep one glossary for engineering, legal and translators.
• Allow for length. Hindi and Tamil strings run 20 to 40 per cent longer than English. A button that says “Continue” fits; its Tamil equivalent may not. Design buttons and error banners to two lines from the start.
• Test spoken, not just read. Many users will have a family member read the screen aloud. Read every string aloud in every language before release.

Onboarding copy is also where a lending brand proves it is not predatory: the tone of the consent screens and the honesty of the error states are part of the brand, which is the argument we make in lending app branding that is trustworthy, not predatory. The underlying mechanics of why users trust a flow that explains itself are covered in the psychology of trust in financial brand design.

KYC is fixed by regulation. Drop-off is fixed by the sentence before the permission dialog.

People also ask

Can KYC consent language be simplified without breaking RBI norms?

Yes. Regulators require consent to be explicit, informed and specific, not to be written in legal language. The working pattern is a plain-language summary above the checkbox, with the full regulator-approved text one tap away and recorded in the audit trail with a version number.

What is video KYC (V-CIP) and why do users drop off there?

Video-based customer identification lets a regulated entity verify a customer over a live, recorded video call with checks such as PAN display and location capture. Users drop off because of unexplained waiting, a lack of guidance on what to keep ready, and no way to resume later. Queue estimates, slot booking and an SMS resume link fix most of it.

Why does penny-drop bank verification fail with a name mismatch?

The name held by the bank for the account is compared with the name on the PAN, and abbreviations, initials or spelling differences cause a mismatch. Good copy states the name-match rule before the user enters the account and, on failure, offers them the option of another account where the name matches.

Should KYC onboarding be offered in Indian languages?

Yes, for any product with users outside the metros. Write the English copy in short, plain sentences that translate well, keep regulatory nouns such as Aadhaar and PAN untranslated, design for 20 to 40 per cent longer strings, and read every screen aloud in each language before release.