UIDAI appoints Deloitte for information security audits, banks question decision

The decision to make Unique Identification Authority of India (UIDAI) mandatory for welfare schemes has already irked the people of India. But now the decision to appoint Deloitte as the sole authority to do the mandatory audits of Information Security (IS) in financial institutions, banks and telcos using Aadhaar-based authentication regime, has made the make the bankers angry.

The problem started from April 4, last year, when  UIDAI asked the banks and other Aadhaar agencies to ‘enter a contract’ with Deloitte since the firm has been ‘empanelled’ by it. According to the communique, every year Deloitte would perform the assessment and they would have to be paid a fixed fee of ₹1,94,700 a unit by ecosystem partners for conducting the mandatory IS audit. Along with the fees, banks will also need to pay for the travel, boarding and lodging of Deloitte officials, it added.

ALSO READ: CBDT extends PAN-Aadhaar linking deadline till March end next year

The reason for the opposition from the banks have been specified as high cost and monopoly. The bank state that not only the charge for assessment is too much, but giving UIDAI’s move has also created a monopoly situation for the firm. Banks feel allowing more individual user agencies of the Aadhaar ecosystem will help them negotiate better rates and services and they have already conveyed these views to the UIDAI.

According to reports the controversy started since November last year with UIDAI’s first circular mandating Deloitte as the sole agency for the audit, but was kept on hold following requests from banks, on December 11.  It is also to be known that small lenders like cooperative banks have described the mandate as unwanted and unjust, questioning the rationality of uniform charges for all entities irrespective of the size, business, income and profitability.

However, an official said that only Deloitte met the stiff conditions laid by UIDAI for empanelment of agencies to conduct the IS audits. Adding that, with data security in consideration, it was decided only agencies with a track record should be given the contract.

ALSO READ: Now get an instant e-PAN based on Aadhaar