The government was allowing banks to verify individual transactions that exceed a certain annual limit using facial recognition and an iris scan in some cases in a bid to reduce fraud and tax evasion, three sources told the Reuters on Friday. 

A few large private and public banks had begun using the option, said one of the sources, a banker, who declined to name the banks. The advisory allowing the verification is not public and has not previously been reported. 

The verification is not mandatory and is intended for cases where another government identification card used for tax purposes, the Permanent Account Number (PAN) card, is not shared with banks. 

The prospect of banks using facial recognition has concerned some privacy experts. 

“This raises substantial privacy concerns, especially when India lacks a dedicated law on privacy, cybersecurity and facial recognition,” said Pavan Duggal, an advocate and cyber law expert. 

The government has said that it is targeting Parliamentary approval of a new privacy law by early 2023. 

The new measures could be used to verify identities of individuals making deposits and withdrawals exceeding Rs 20 lakh in a financial year, where the Aadhaar identity card was shared as proof of identify, said two government officials, who asked not to be named because the information was not public. 

Responding to the Reuters’ queries, a UIDAI spokesperson said that Aadhaar verification and authentication happened only with the explicit consent of the user. Use of Aadhaar-based biometric authentication helped in guarding against possible misuse, he said.