A Small Step for KYC, A Giant Leap for Consent-Driven Data Governance

The real revolution often begins with a silent notification on your phone.

In April 2025, a quiet but seismic shift took place in India’s financial infrastructure — the CKYC Registry (CKYCRR) introduced mandatory OTP-based access to individual KYC records.

For most, it’s an innocuous update. For a privacy-first professional like me, who has spent years championing ethical data practices in the advertising and martech ecosystem, it signals a critical evolution — one where consent becomes the centre of identity access, not just a checkbox at the periphery.

Let me unpack why this matters — not just to banks, fintechs or regulators — but to all of us working with data, identity, personalization, and trust in a digital-first world.

The Move: OTP at the Moment of Access

Whenever a financial institution attempts to retrieve your KYC record from the CKYCR, you now receive an OTP. Only if you authenticate that OTP will your data be released.

The old system allowed entities to fetch this data with just an identifier — like PAN or Aadhaar — no real-time consent needed. That ends now.

This is not a minor tweak. It’s a complete philosophical shift.

From:

“We’re storing your data for reuse.”

To:

“We’re asking your permission every time we reuse it.”

CKYC's Bigger Message: Trust at Scale Is Possible

I’ve long argued that trust will be the ultimate currency in data-driven industries.

If we apply the same thinking to our customer journeys, we’ll be forced to redesign:

• How do we collect data

• How do we personalise communication

• How do we handle cross-channel identities

• How do we allow revocation and transparency

And that’s a good thing.

Why This Should Matter to the Adtech & Martech Industry

I’m not in BFSI. I don’t build KYC platforms.

But I am in the business of identities. Of signals. Of data.

Every time we in advertising say, “We use first-party data with consent,” I ask — what does consent look like?

Is it ongoing?

Is it revocable?

Is it granular?

CKYC’s OTP update is one of the first at-scale implementations in India of a consent model that:

• Is real-time

• Is transactional

• Is per-use, not one-time

• And leaves behind a clear audit trail

That’s what true informed consent looks like.

If BFSI can do it, why can’t Adtech?

Beyond BFSI: The Consent Model We Need

Let’s talk bigger.

This isn’t just a BFSI compliance update—it’s a blueprint for the future of identity, data governance, and trust in AdTech and MarTech.

Consent Isn’t Just Compliance—It’s Competitive Advantage

This move aligns with the spirit of India’s DPDP Act, and global standards like GDPR’s “lawful basis of processing” and CCPA’s consumer control mandates.

Imagine a world where:

• Every time your hashed email is matched on an ad platform, you get a notification.

• Every time your purchase data is used for personalization, you get a real-time nudge: “Do you allow this?”

• Brands don’t hide consent inside dark patterns but invite it — clearly, respectfully, repeatedly.

CKYC’s OTP model shows it’s technically possible.

The only question is — do we, as an industry, have the will?

Data Is No Longer Just an Asset — It’s a Responsibility

In our space, we often glorify data:

• “Data is the new oil.”

• “Data is the new gold.”

But if the last decade was about collecting, the next must be about ‘’Earning & Honouring.

The BFSI world has taken a bold, compliance-driven, and customer-respecting step.

Why This Matters Beyond Banking

The Death of "Dark Data" Access

Until now, KYC data could be fetched without real-time user approval, akin to third-party cookies silently tracking users without explicit consent. The OTP mandate mirrors GDPR’s "explicit consent" and India’s DPDPA—forcing businesses to ask, not assume.

AdTech parallel: How many CDPs, DMPs, and identity graphs still rely on implied consent? If CKYC can enforce OTP-based access, why can’t programmatic advertising?

Identity Resolution Just Got Harder (and Better)

Financial institutions now can’t reuse KYC data without fresh consent, impacting cross-selling, onboarding, and CLV modelling.

MarTech implication: If deterministic identity (CKYC) requires OTP, what does that mean for probabilistic identity graphs in advertising? First-party data just became even more valuable. Zero-party data (user-provided) is now the gold standard.

The Trust Paradox: Security vs. Friction

Banks fear drop-offs due to OTP friction. But privacy-first brands know: Trust reduces long-term churn.

AdTech lesson: Consumers abandon carts when tracking feels invasive. Yet, transparent personalisation (with consent) boosts conversions.

Solution? Design smooth, value-exchange-driven consent flows—not just compliance checkboxes.

It's time for Adtech and Martech to stop treating consent as a one-time capture and start treating it as a living, breathing interaction, just like CKYC is doing.

Implementation Realities: What BFSI is Facing, We Will Too

Of course, it’s not all roses.

Institutions must now:

• Retrain teams

• Overhaul workflows

• Upgrade APIs

• Handle OTP failures gracefully

But that’s the cost of building trust.

In our world, too — implementing real-time consent, audit trails, and selective opt-ins across media buying, personalization engines, and CDPs will take effort.

What AdTech & MarTech Leaders Should Do Now

✅ Audit Your Data Flows

• Are you relying on implied consent (IP tracking, device graphs)?

• Does your CDP/DMP have real-time consent revocation capabilities?

✅ Revisit Identity Strategies

• Deterministic IDs (email, phone) now require active consent.

• Contextual & cohort-based targeting may resurge as privacy-safe alternatives.

✅ Prepare for India’s DPDPA (Digital Personal Data Protection Act)

• If CKYC mandates OTP, AdTech will face similar scrutiny.

• First-party data onboarding (CRM syncs, logged-in users) will be critical.

The Bigger Picture: Trust as a Differentiator

CKYC’s move isn’t just about compliance—it’s about rebuilding eroded trust.

• Banks that embrace this transparently will win customer loyalty.

• Brands that prioritize consent-driven engagement will outperform those clinging to dark patterns.

• AdTech must evolve beyond "track now, ask later" models.

This Isn’t Just Compliance. It’s Culture.

What CKYCR has done isn’t just about compliance. It’s a cultural statement.

It tells every citizen: “You are not a data point. You’re a participant.”

It tells every institution: “Respect isn't optional anymore. It’s protocol.”

To my fellow marketers, data scientists, product builders, and privacy professionals — We’re next.

Let’s start designing consent like it matters.

Because in 2025 and beyond, it really, really does.

Will AdTech Follow Suit?

If financial data requires OTP consent, will behavioral data be next?

The future belongs to privacy-compliant, trust-first marketing—where consent isn’t a hurdle, but a handshake

 We must stop asking:

"What’s the easiest way to get consent?"

And start asking:

"What’s the right way to ask for it?"

 Anil Pandit

Executive Vice President

Publicis Media, India

*Disclaimer: This post is for informational purposes only and does not endorse or disapprove of any specific tools, platforms, or technologies. The views and opinions expressed in this article are those of the author and do not reflect the official policy or position of the company he is employed in.

#ConsentIsNow #CKYC #DataPrivacy #IndiaPrivacy #Adtech #Martech #TrustEconomy #DPDP #RealTimeConsent #BeyondCompliance

.