DigiLocker Opens to Banks and Gets an AI Assistant
New Delhi wants private intermediaries to plug banks, insurers, colleges and hospitals into its document wallet, and is building an assistant that fetches and shares papers on request. The safeguards are strict on paper; the consent questions are not settled.
North Block of the Central Secretariat on Raisina Hill, New Delhi, photographed in September 2024 (illustrative).
Photo: BhuyanBhaskar, CC BY-SA 4.0 · source
India’s National e-Governance Division (NeGD) is moving its state document wallet, DigiLocker, in two directions at once: towards private-sector users such as banks, insurers, colleges and hospitals, and towards software that acts on a citizen’s behalf rather than merely answering questions. Scale makes both moves consequential. The DigiLocker website claims more than 70 crore (700m) registered users and more than 900 crore (9bn) issued documents.
What the Draft Asks of Private Intermediaries
On 21 September 2026 NeGD, part of the Ministry of Electronics and Information Technology (MeitY), invited comment until 10 October on a draft Request for Empanelment (RFE) for Specialized Ecosystem Enablement Partners for DigiLocker. Empanelled agencies would work for “Requesters”, the organisations that pull documents from DigiLocker with a citizen’s consent: they would find use cases, take proposals to NeGD, integrate the services and drive transaction volumes. The first sectors are financial services, education and health. MediaNama reported that the indicative uses include know-your-customer checks for lending and account opening, verifying marksheets for admissions, and patient registration.
Agencies would be paid only per transaction, nothing for onboarding work, once a requester clears a monthly floor of 5,000 successful transactions in finance, 2,500 in education or 1,000 in health, for 12 months from go-live. Empanelment would last three years.
The table below, built from the draft’s security and exit clauses (sections 2.9 and 2.10), sets out the main conditions.
| What the draft RFE requires | Why it matters |
|---|---|
| No retention, storage, caching, profiling, analytics or secondary use of document content by the agency | The intermediary cannot build its own store of citizens’ certificates |
| Citizen consent is “a platform function and shall not be replicated or bypassed” | The consent record stays with DigiLocker, not with a reseller |
| Agency may not hold production credentials in its own name | Access belongs to the bank or insurer, which remains the data fiduciary |
| Compliance with the Digital Personal Data Protection Act, 2023 and CERT-In directions; a CERT-In-empanelled audit before launch and every year; incidents reported to NeGD and CERT-In | Breaches reach two authorities, not only the client |
| All development, test and support infrastructure hosted in India | Localisation reaches vendors’ tooling, not just production systems |
| Handover, up to 90 days’ transition help, certified data destruction; “no vendor lock-in of any nature” | Requesters keep DigiLocker access if the agency leaves |
What Changes for Citizens and Firms
For citizens, the mechanics stay familiar: a requester asks, DigiLocker shows a consent screen, the document flows. What changes is volume: a fee model that pays only for successful pulls rewards agencies for putting more consent prompts in front of more people. The draft leaves the requester to confine use to the approved service. In this desk’s reading, the real limit on what a bank does with a pulled document is therefore NeGD’s case-by-case approval plus the DPDP Act, not the empanelment terms.
For firms, the offer is a vetted integrator and faster access to verified documents, at the price of recurring security audits.
An Assistant That Fetches and Shares Documents
Separately, NeGD has been buying a reusable assistant platform. NewsBytes reported on 23 September that, per an NeGD evaluation notice, CoRover and Kyndryl Solutions had cleared technical evaluation for a “Conversational and Agentic AI Bot Framework”, with DigiLocker as the first use: fetching and sharing documents, consent-based access, consent and audit logging, a four-month build and 12 months of operations.
On 7 October the trade site Adgully carried an unbylined item, written like a company announcement, saying that CoRover, a Bengaluru start-up, had won. That is CoRover’s account: this desk found no award notice on NeGD’s tender pages, so the value and scores remain unconfirmed.
Where the Risks Sit
An assistant that can share identity documents on request widens the attack surface: a manipulated prompt or a misheard instruction could send a PAN card to the wrong party. An earlier NeGD tender, MediaNama reported in August, required human checkpoints for sensitive agent actions and audit trails. Whether an assistant that initiates a share honours the draft’s rule that consent is never “replicated or bypassed” is the question NeGD has yet to answer publicly.
A wallet that holds 9bn documents is now buying software that can move them.
The assistant arrives as India prepares a broader AI regulation consultation and as its sovereign-AI plans meet the hardware costs examined here last week. Other governments are writing rules for reporting AI agent incidents.
What to Watch
Watch the final RFE, and whether feedback loosens the no-profiling clause; a published award and specification for the assistant, showing how it records consent before sharing; and whether NeGD reports assistant-initiated shares separately. Banks weighing empanelled partners should ask now who holds the audit logs.
Sources
- Public Notice and Draft Request for Empanelment (RFE) for Specialized Ecosystem Enablement Partners for DigiLocker — National e-Governance Division, MeitY — 21 September 2026; (PDF; a copy of the NeGD document hosted by MediaNama; NeGD’s own file at negd-media.digitalindiacorporation.in would not open on 11 October)
- MeitY plans to expand DigiLocker into private sectors like finance, education & health — MediaNama — 25 September 2026
- These companies might make Modi government’s agentic AI platform — NewsBytes — 23 September 2026
- CoRover wins MeitY contract to build sovereign agentic AI platform starting with DigiLocker — Adgully — 7 October 2026; unbylined item reading as company-supplied material, cited only as CoRover’s account of the award
- MeitY tender for AI agents across DigiLocker, UMANG — MediaNama — 27 August 2026
- DigiLocker — National e-Governance Division — page last updated 5 October 2026; accessed 11 October 2026
Discussion
No comments yet. Start the conversation.
