The directive comes weeks after multiple complaints from people that they had stopped receiving cooking gas subsidies in their specified bank account after they linked their Aadhaar number to a second bank account or an Airtel mobile number.
Inquiries by the Aadhaar body revealed that when customers went to banks to link their Aadhaar number to their accounts, the banks also passed on details of the Aadhaar-linked bank account to the government's central database of bank accounts for transferring subsidies under various schemes.
The system had been designed in a way that the central database would replace the old bank account with the new. "So if a person was getting his cooking gas subsidy in one bank account and went to update a different bank account, he would get the subsidy in the account linked with Aadhaar last," a government official explained.
Except that the customer did not know that he had 'requested' for updating his account details for government subsidy.
But this wasn't a technical glitch. Many banks, the official said, used this design to shore up deposits.
Airtel had also recently got into trouble with UIDAI, or the Unique Identification Agency of India, for similar reasons.
"There have been complaints that, when an Aadhaar holder visits the telecom service provider for verifying his mobile number with Aadhaar, Airtel is opening his payment bank account and putting that bank account on NPCI's APB mapper overriding the existing bank account mapping without the informed consent of the Aadhaar holder," the UIDAI order on the new rules issued on Tuesday said.
This means the consent can't be part of the fine print on a form that nobody reads, or understands.
UIDAI also told the National Payments Corporation of India, or NPCI, which manages the central depository of bank account for government subsidies, to stop updating new bank account details sent by banks unless it declares that it had the "explicit informed consent" of the customer to switch its bank account.
And just to make sure that no one pulls a fast one on the customer again, banks will also have to give the last four digits of the customer's older bank account that was registered for receiving the subsidy.
Banks have also been told to "inform each account holder through SMS and email within 24 hours that such a request had been made.
The message shall also contain details of how customers can get his account details removed. For people who don't have a phone or mobile number, the consent has to be taken on paper.
As an additional safeguard, banks and NPCI will have to retain the record of all the consents for the seven years to enable the UIDAI to carry out an audit at any point, the order by UIDAI chief executive officer Ajay Bhushan Pandey said.