How Video KYC Works for Demat Account Opening

Video KYC has become the standard identity-verification checkpoint for opening a demat account remotely, treated legally as equivalent to walking into a branch and showing your documents face-to-face. But what happens technically during that brief webcam session is considerably more sophisticated than it looks — and in 2026, it’s become the front line of a genuine arms race between identity verification technology and increasingly capable deepfake attacks.

Here’s the technical shift that’s genuinely reshaped how seriously this process gets treated: by 2026, sophisticated attackers no longer try to fool the camera by holding up a photograph — they bypass the camera entirely. Using a virtual camera driver, a compromised SDK, or API-level tampering, attackers inject a synthetic, AI-generated video stream directly into the verification pipeline. The system doesn’t see a real person failing to blink convincingly; it sees a flawless deepfake performing the blink and head-turn prompts exactly on cue, because the injected video was generated to do precisely that. Liveness checks built even a few years ago simply weren’t designed to catch this.

What Video KYC Actually Verifies: Two Distinct Checks

A common misunderstanding treats “video verification” as one single check, when it’s actually two separate technical processes working together.

• Face match compares your live selfie, captured during the session, against the photograph on your submitted identity document
• Liveness detection confirms separately that the person in front of the camera is a real, physically present human being, not a photograph, video replay, silicone mask, or digitally generated deepfake
• Both checks are necessary, and neither alone is sufficient — a system could pass a face match against a static photo without confirming a live person exists, or confirm liveness without verifying the face actually matches the claimed identity
• Modern V-CIP implementations run both checks simultaneously within the same live session, rather than as separate sequential steps

The Technical Requirements Behind a Compliant Session

Regulators have laid out specific, non-negotiable technical standards that a compliant Video KYC platform must meet.

• The verification application must be proprietary — platforms using generic tools like Zoom or Teams don’t satisfy regulatory requirements
• End-to-end encryption is mandatory between your device and the hosting platform throughout the entire session
• Real-time liveness detection must be capable of catching spoofing attempts and deepfakes as they happen, not after the fact
• Geo-tagging of your location, combined with IP address validation, confirms you’re actually located within India during the session
• A concurrent audit of every session must occur before the account gets activated, rather than a delayed post-hoc review
• Tamper-proof storage is required for all video recordings and verified documents, alongside logging of the liveness score, face match score, GPS coordinates, timestamp, and the verifying official’s identity for each session

SEBI’s VIPV vs RBI’s V-CIP: Which Applies to Your Demat Account

Since demat accounts fall under securities regulation rather than banking specifically, it’s worth clarifying which regulator’s framework actually governs the process you’re going through.

• RBI’s V-CIP framework governs video-based verification for banks, NBFCs, and payment aggregators
• SEBI operates its own parallel framework, VIPV (Video In-Person Verification), specifically for securities market intermediaries — brokers and depository participants opening demat and trading accounts
• IRDAI similarly runs its own version, VBIP, for the insurance sector
• These three frameworks are structurally similar in their core technical requirements — liveness detection, face matching, encrypted sessions — but operate as legally distinct regimes tailored to each regulator’s specific sector
• When you complete Video KYC for a demat account specifically, you’re going through SEBI’s VIPV process, even though the underlying technology and user experience closely resembles what a bank’s V-CIP session looks like

Why Deepfakes Changed Everything in 2026

Understanding the scale of this threat explains why regulatory requirements have tightened so significantly in recent updates.

• Deepfake-related fraud attempts reportedly rose roughly 3,000% between 2022 and 2025, a dramatic acceleration attackers have specifically targeted at remote identity verification systems
• The original 2020 V-CIP framework was designed for a simpler threat model — a fraudster holding a physical photograph in front of a webcam — not sophisticated real-time synthetic video injection
• Attackers routinely defeat older biometric checks by injecting synthetic video directly into a live call, meaning a liveness prompt asking someone to blink or turn their head provides no real protection if the injected deepfake can perform those exact actions convincingly on command
• No current liveness detection system is considered completely deepfake-proof — this is an honest limitation acknowledged even by security vendors building these systems, not a solved problem

How Regulators and Platforms Are Responding

Given the scale of this threat, regulatory requirements have specifically evolved to demand more robust, continuously updated defenses.

• Deepfake detection must happen within the live session itself — analyzing footage after the session ends doesn’t satisfy the “seamless, live” requirement regulators mandate
• Model updates for detecting new deepfake techniques are expected at minimum quarterly, since deepfake generation tools themselves evolve quickly enough that a detection model benchmarked even a year or two earlier can develop real blind spots
• Periodic VAPT (Vulnerability Assessment and Penetration Testing), conducted by CERT-In empaneled auditors, is required on an ongoing basis rather than only once at a platform’s launch
• Platforms increasingly combine multiple signals beyond just the video itself — device fingerprinting, behavioral patterns, and cross-referencing against other verification layers like Aadhaar and PAN databases — to reduce reliance on any single point of failure

What This Means for You as an Applicant

None of this technical complexity changes much about your actual experience completing the process, but understanding it explains why certain things happen the way they do.

• Complete your Video KYC session using the broker’s own dedicated app or web portal, never a third-party video calling tool, since this is both a regulatory requirement and a security safeguard
• Ensure good lighting and a stable internet connection — beyond just making the process smoother, this helps the underlying liveness detection systems capture clearer, more reliable data
• Expect the session to prompt specific real-time actions (blinking, turning your head, or holding up a code) as part of the liveness check, even knowing these checks continue evolving to catch increasingly sophisticated spoofing attempts
• Understand that your session is being recorded, geo-tagged, and logged with a timestamp as a compliance requirement, not an invasive overreach — this data trail is exactly what makes V-CIP legally equivalent to an in-person verification

This is general educational information about how Video KYC technology and regulation work, not security or investment advice. Identity verification technology and regulatory requirements continue evolving rapidly, and specific implementation details vary by broker and platform.

FAQs

Q1. Can a deepfake actually bypass Video KYC for opening a demat account?

It’s a documented, growing risk — attackers have demonstrated bypassing older liveness checks by injecting synthetic video directly into the verification pipeline, which is exactly why regulators now mandate continuously updated, in-session deepfake detection rather than static checks.

Q2. What’s the difference between face match and liveness detection in Video KYC?

Face match compares your live selfie to your identity document’s photo, while liveness detection separately confirms you’re a real, physically present person rather than a photo, video replay, or deepfake — both checks run together, and neither alone is sufficient.

Q3. Why can’t I use Zoom or Google Meet to complete Video KYC for my demat account?

Regulatory requirements mandate the use of the broker’s own proprietary, end-to-end encrypted application, since generic video calling platforms don’t meet the technical security and audit standards required for compliant identity verification.

Q4. Is Video KYC for demat accounts governed by the same rules as bank Video KYC?

Not exactly. Securities intermediaries follow SEBI’s VIPV framework rather than RBI’s V-CIP used by banks, though both frameworks share similarly strict technical requirements around liveness detection and encryption.

Q5. Is any Video KYC system completely safe from deepfake fraud?

No current system is considered entirely deepfake-proof, which is why regulators require ongoing model updates, in-session detection, and periodic security audits rather than treating any single implementation as a permanent solution.