Video-KYC architecture: WebRTC pipelines that satisfy regulators

A video KYC architecture is two systems wearing one interface: a real-time WebRTC communication pipeline, and an evidence factory that must satisfy an auditor replaying the session months later. Teams that treat it as “a video call with a checklist” fail audits; teams that treat it as an evidence pipeline that happens to use video get certified. We have built video platforms for German banks and studied India’s V-CIP regime closely — this is the architecture that works in both worlds.

What regulators actually require

India (RBI V-CIP). The RBI’s video-based Customer Identification Process, set out in the Master Direction on KYC, is the most prescriptive regime and a useful design target even outside India. In substance it requires: the session runs on the entity’s own application and domain (consumer video apps are explicitly not acceptable); a trained officer conducts a live, entity-initiated interaction with randomized questions; identity documents are captured live on camera, not uploaded; liveness checks and face matching are performed; the customer’s GPS location is captured and the IP verified as originating in India, with VPN/proxy use flagged; and the whole session produces an encrypted, timestamped, geo-tagged recording with a maker-checker review step, retained in India (KYC records carry a minimum five-year retention under the KYC framework). Since November 2025 this sits alongside the DPDP Rules 2025, which put the recording itself — biometric-adjacent personal data — under a statutory consent, retention and breach-notification regime phasing in through 14 May 2027.

Germany/EU. BaFin Circular 3/2017 (GW) is the live instrument and demands trained agents, integrity-checked ID documents (holograms tilted on camera), recording with consent, and end-to-end encryption. Two things are moving under it, and both are dated:

• The AMLR reranks the whole method. Regulation (EU) 2024/1624 applies from 10 July 2027 and makes eIDAS-based means — national eID, qualified electronic signatures, EU Digital Identity Wallet credentials — the primary route for remote identification, demoting video identification to a defined fallback used where an eIDAS method is unavailable or disproportionate (practitioner summary). Germany’s draft GwVideoIdentV is queued to replace Circular 3/2017 in that new hierarchy (draft overview).
• The AI Act reaches the frame taps. Under the AI Act, remote biometric identification and biometric categorisation sit in the regulated tiers. The Digital Omnibus agreed in June 2026 deferred stand-alone Annex III high-risk obligations to 2 December 2027, but Article 50 transparency obligations were not deferred and still apply from 2 August 2026 — meaning a customer interacting with an automated liveness or face-match step must be told so. Design that disclosure into the session script now; retrofitting consent language into a certified onboarding flow is expensive.

The convergent principle across all of it: the session is evidence. Every design decision follows from that — and, from 2027, so is the choice of the session: you will need to record why video was used instead of a wallet.

Reference architecture

Customer browser/app ──WebRTC──► Media server (SFU/pipeline) ──► Agent console
                                      │
                                      ├─► Recording sink (encrypted, WORM-style storage, in-jurisdiction)
                                      ├─► Frame taps ──► liveness / face match / document checks
                                      └─► Metadata bus ──► audit-event store (geo, IP, event times, check results)

Key decisions, with our reasoning:

1. Route media through a server you control. Peer-to-peer WebRTC is tempting for latency, but V-CIP-class compliance needs server-side recording, frame analysis, and jurisdiction control. A media server (Kurento-style processing pipelines, or an SFU like LiveKit/mediasoup with a recording/analysis egress — see our media server comparison) gives you one enforcement point for recording, encryption, and residency. Host it in-country: media path location is a compliance property.

2. Record at the server, not the client. Client-side recording can be tampered with, dropped, or lost with the session. Server-side recording with immediate encryption and write-once storage semantics produces the artifact an auditor trusts. Timestamp it from a synchronized clock and hash the artifact at write time — you want to prove later that nothing changed.

3. Build the audit trail as a first-class event stream. Geo-coordinates, IP-origin check results, consent capture, question/answer markers, liveness scores, face-match scores, document-capture frames, officer identity, maker-checker outcomes — each an immutable event correlated to the recording timeline. When the auditor asks “show me how you verified this customer,” the answer is a replay, not a database archaeology project.

4. Treat AI checks as assistants with recorded outputs. Liveness detection, face matching against the document photo, and document-quality checks run on frame taps from the media pipeline. Three rules now: their scores go into the evidence stream (the auditor will ask); a human officer stays in the loop, because both regimes are explicit that automation supports rather than replaces the trained agent; and the customer is told an automated check is running, per AI Act Article 50 from August 2026. If these models process biometric data, GDPR and the AI Act’s logging duties both push strongly toward running them on infrastructure you control — our self-hosted AI guide covers that decision.

5. Design the unhappy paths deliberately. Most real-world V-CIP failures are environmental: bad light, dropped bandwidth, a customer on VPN, an officer’s checklist derailed. The pipeline needs adaptive bitrate with a minimum quality floor (below which the session must not count as compliant — blurry document frames are worthless evidence), scripted retry/reschedule flows, and hard stops when mandatory checks (geo, IP origin) fail. A session that cannot be completed compliantly must terminate cleanly, with that fact recorded too.

Pitfalls we see repeatedly

• Quality floors ignored. Teams tune for call continuity (degrade video, keep going) — correct for meetings, wrong for KYC. Below evidentiary quality, pause and recover instead.
• Storage as afterthought. Recording five years of encrypted video is a storage-lifecycle project: key management across years, format longevity, retrieval SLAs for audits, in-jurisdiction replication.
• Third-party SDKs with opaque media paths. If you cannot state where every media packet flows, you cannot make the residency claim. This is why “on the entity’s own application” is written into V-CIP.
• Testing only the happy path. Audit findings hide in the edges: mid-session reconnects splitting recordings, clock drift between the media clock and the event log, geo capture failing silently on desktop browsers.

We build these pipelines as part of our real-time communication engineering practice, with the regulated-industry context from our banking & insurance work — experience earned on live banking video platforms for German banks.

FAQ

Will the EU Digital Identity Wallet replace video KYC? It will outrank it rather than remove it. From 10 July 2027 the AMLR makes eIDAS-based identification — eID, QES, EUDI wallet credentials — the primary route, with video identification permitted as a defined fallback where an eIDAS method is unavailable or disproportionate. Video stays in the stack for enrolment, device loss, non-wallet customers and higher-risk cases, but the choice becomes an auditable decision. Build the ranking into the flow, not into a policy PDF.

Does the EU AI Act apply to the liveness and face-match checks in a KYC session? Yes, and sooner than most teams assume. The Digital Omnibus deferred stand-alone Annex III high-risk obligations to 2 December 2027, but Article 50 transparency duties still apply from 2 August 2026 — the customer must be told an automated system is assessing them. Treat that disclosure as part of the session script and record that it was given, alongside the check scores.

Can we build video KYC on Zoom or another consumer video tool? No. RBI’s V-CIP explicitly requires the session to run on the regulated entity’s own application, and you cannot meet recording-integrity, residency and audit-trail requirements on media paths you don’t control. Build on WebRTC with your own media infrastructure.

Rajan Jain is the CEO of Vaagmodo and leads our video-platform engineering for banking clients in Germany. Talk to us about your KYC pipeline: contact or info@vaagmodo.com.