An AUA (Authentication User Agency) uses UIDAI’s Yes/No Aadhaar authentication, while a KUA (e-KYC User Agency) uses its e-KYC facility. A Sub-AUA or Sub-KUA accesses those services through an existing AUA or KUA. UIDAI’s new LITE framework aims to make that route faster for low-volume entities.
On 29 September 2026, UIDAI announced five initiatives at Aadhaar Samvaad in Kolkata. Most coverage focused on face authentication for ration distribution. For fintechs and lenders, the more consequential item is a lighter Sub-AUA/Sub-KUA onboarding route.
This briefing explains the AUA KUA structure, what UIDAI has said about LITE, what it has not yet said, and what regulated entities should do while the details arrive.
What UIDAI Announced on 29 September 2026
According to the PIB release, UIDAI launched five initiatives:
Face Authentication: Face Authentication for ePDS, built with the Department of Food and Public Distribution and NIC, for consent-based, contactless authentication in the public distribution system.
SWIK Portal 2.0: Allows non-government entities to submit Aadhaar authentication proposals directly to the concerned ministries or departments.
Sub-AUA/Sub-KUA (LITE) Framework: Designed for government and eligible non-government entities with lower authentication volumes.
Token Management System: Introduced for UIDAI's state and regional offices.
-
Revamped UIDAI Website: Supports 13 languages, with expansion to 23 languages planned.
PIB says the LITE framework lets such entities use “the authentication infrastructure of an existing AUA/KUA, enabling simpler and faster onboarding in real time without establishing any authentication infrastructure.” Minister of State Jitin Prasada and UIDAI CEO Saurabh Vijay spoke at the event.AUA, KUA, Sub-AUA, Sub-KUA and ASA Explained
The Aadhaar (Authentication and Offline Verification) Regulations, 2021 define the roles precisely:
Authentication Service Agency (ASA): "A licensed entity providing necessary infrastructure for ensuring secure network connectivity and related services." ASAs carry requests between requesting entities and UIDAI's data centre.
AUA (Authentication User Agency): "A requesting entity that uses the Yes/No authentication facility provided by the Authority." The answer is only a match or no match.
KUA (KYC User Agency): "A requesting entity which uses e-KYC authentication facility provided by the Authority." A successful e-KYC returns demographic data and a photograph, with the resident's consent.
Sub-AUA: A requesting entity that uses Yes/No authentication "through an existing AUA".
Sub-KUA: A requesting entity that uses e-KYC "through an existing KUA".
The KUA full form, e-KYC User Agency, explains the difference: a KUA receives identity data, so its obligations on storage and security are heavier.
Two rules matter for Sub-AUAs. Regulation 14 requires an AUA or KUA to obtain UIDAI’s approval before appointing a third party as a Sub-AUA or Sub-KUA. Regulation 15 makes the requesting entity jointly and severally liable with its Sub-AUAs for non-compliance. In February 2025, UIDAI’s Circular 2 of 2025 tightened the Sub-AUA application and joint undertaking, including Aadhaar Data Vault and HSM requirements.
The Good Governance Rules Behind Non-Government Access
On 31 January 2025, MeitY notified the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Amendment Rules, 2025. PIB said the amendment enables “both government and non-government entities to avail Aadhaar authentication service” for public-interest purposes, including e-commerce, travel, tourism, hospitality and health.
The process: the entity applies to the concerned ministry or department, UIDAI examines the application, MeitY approves on UIDAI’s recommendation, and the ministry notifies the entity. SWIK Portal 2.0 is the upgraded front end for that process.
This matters because it widened the pool of non-government entities that can seek Aadhaar authentication at all. The LITE framework addresses the next question: how a low-volume entity can start without building AUA-grade infrastructure.
What the LITE Framework Changes, and What Is Still Unknown
What is known from the PIB release:
Low Authentication Volumes: LITE targets government and "eligible" non-government entities with low authentication volumes.
Shared Infrastructure: It relies on an existing AUA/KUA's infrastructure rather than the entity's own.
Real-Time Onboarding: UIDAI describes the onboarding process as real-time.
What is not yet public, as of 7 October 2026:Eligibility Criteria: What are the eligibility requirements and the volume threshold that defines "low volume"?
Sub-AUA Codes and Licence Keys: Will LITE entities hold their own Sub-AUA codes and licence keys?
Liability, Audit, and Data-Vault Obligations: How will these responsibilities be divided between the AUA/KUA and the LITE entity?
Regulated Financial Entities: Do regulated financial entities fall within the definition of "eligible" entities?
Fees: What fees will apply to entities using the LITE framework?
There is a precedent. UIDAI’s Circular 03 of 2023 allowed government entities with under 50,000 annual transactions to use their AUA/KUA’s licence keys without a separate Sub-AUA/Sub-KUA code. LITE may extend similar logic, but until UIDAI publishes operating rules, no entity should assume eligibility. Watch UIDAI circulars and the SWIK portal.
Access Routes Compared
| Route | Who it suits | Infrastructure needed | Main obligations | Status |
|---|---|---|---|---|
| Own AUA/KUA | High-volume entities permitted by law | ASA connectivity, HSM, Aadhaar Data Vault, audits | Full UIDAI compliance | Established |
| Sub-AUA/Sub-KUA | Entities using a partner AUA/KUA | Integration with AUA/KUA; vault and security per joint undertaking | UIDAI approval; joint and several liability | Established, tightened Feb 2025 |
| Sub-AUA/Sub-KUA LITE | Low-volume government and eligible non-government entities | Uses existing AUA/KUA infrastructure | Not yet published | Announced 29 Sep 2026 |
| Offline verification (paperless e-KYC XML, QR code) | Entities verifying without authentication | XML/QR validation, consent capture | Consent and offline verification obligations under the 2021 Regulations | Established |
Offline verification is defined in the 2021 Regulations as verifying identity “without authentication, through offline modes”. For many fintech journeys, it and DigiLocker remain the practical routes.
What Regulated Entities Should Do Now
Map your current route: Are you an AUA/KUA, a Sub-AUA/Sub-KUA, or using offline verification or DigiLocker? Document the legal basis under your sector rules, with reference to RBI's 2025 KYC Directions.
Review AUA/KUA partner contracts: Check them against Circular 2 of 2025, especially vault, HSM, audit, and incident clauses.
Audit Aadhaar number handling: Masking, vault storage, and log retention are the controls an audit will test first.
Align consent with DPDP: The DPDP Rules' notice and consent provisions apply from 14 May 2027.
Keep alternatives live: Maintain offline XML, QR, and DigiLocker options, reducing dependence on any single verification route.
Watch for LITE rules: Wait for the LITE framework rules before making changes to your existing architecture.
For broader context, our pillar covers the full stack, and the guide covers proof of address options.
Where BeFiSc fits: IDProof gives onboarding teams Aadhaar-based routes, DigiLocker document fetch, face match, and liveness through one integration. That lets you run several verification paths side by side while UIDAI finalises LITE. Book an IDProof demo to see these routes on a sample journey.
Key Takeaways
UIDAI's LITE Framework: UIDAI announced a Sub-AUA/Sub-KUA LITE framework on 29 September 2026 for low-volume government and eligible non-government entities.
Existing Infrastructure: LITE uses an existing AUA/KUA's infrastructure for real-time onboarding. Eligibility, thresholds, and liability rules are not yet published.
Good Governance Amendment Rules: The 2025 rules opened Aadhaar authentication to non-government entities through ministry approval. SWIK 2.0 streamlines this process.
Sub-AUA Liability: Sub-AUAs already carry joint and several liability with their AUA, with tighter undertakings since February 2025.
Action for Regulated Entities: Audit current verification routes, partner contracts, and Aadhaar data handling now. Wait for the LITE rules before re-architecting.
Conclusion
The LITE framework signals that UIDAI wants Aadhaar authentication to reach smaller entities without each building heavy infrastructure. For the financial sector, it could lower the cost of the Sub-AUA route, but only once eligibility and liability rules are clear.
Until then, the sensible posture is preparation: know your AUA KUA route, tighten Aadhaar data handling, align consent with DPDP, and keep alternative KYC paths working.
Top comments (0)