Aadhaar, PAN and Bank Statements: How to Collect, Store and Share Client IDs Safely

A new client sits across the desk. You need his PAN, his Aadhaar and three months of bank statements before you can start. He pulls out his phone, opens the gallery and says, "I'll WhatsApp it to you right now."

Your firm needs the full documents, not masked ones, so the question is how to store client Aadhaar PAN securely once they arrive. The goal is simple: fewer copies, fewer people and a clear record.

Why these documents need extra care

PAN, Aadhaar and bank statements are the documents most useful to a fraudster. A PAN with a date of birth, an Aadhaar number and a recent statement is close to a complete identity.

They are also the documents most often sent casually. They travel on chat, sit in galleries and are forwarded to "someone at the bank". Because the harm from a leak falls on your client, your care for these files is a large part of the trust they place in you.

How to store client Aadhaar PAN securely from day one

Start at the point of arrival. Where a document first lands decides how many copies you will have to chase later.

Ask the client to upload through a secure link instead of sending a photo on chat. The file goes into the client's folder, and nobody saves it to a personal phone on the way. For details on how this feels for clients, see how to tell clients to stop sending documents on WhatsApp.

Ask for clear scans. A good first copy avoids the second request, and the second round of apologies. Give a short list so clients know which side of the card, which pages of the statement and which months you need.

Once the file is in, resist the urge to make more.

Do not email it to a colleague "for convenience" or save it to a desktop.

Give access by client. The person who handles Mr Shah's return opens Mr Shah's folder. Others do not, unless the owner adds them. If a manager needs to check, the manager opens the same copy.

Staff turnover makes this rule more important, not less. We cover that in what happens when an employee leaves.

A short rule helps: a client's ID has one home. Everything else is a link to that home, not a duplicate.

Know what the rules say about Aadhaar

Aadhaar is treated more strictly than most documents. The Unique Identification Authority of India publishes guidance on when a masked copy is enough and on how organisations should handle the number. Read it at the UIDAI website.

In practice, many firms need the full number for specific purposes and should collect it only for those purposes. If a masked copy would do, ask for the masked copy. Your professional adviser can tell you which case applies to which service.

Record who opened what, and share only what is needed

A secure folder is not enough on its own. You also need a record. If a client asks who has seen his Aadhaar, you should be able to answer.

The record should show the person, the file and the time. It protects the client, and it protects your staff, because it shows what they did and did not open. We explain how this works in who opened that file.

Now think about sharing. Sooner or later a bank, a lender or an authority will ask for a document. Share it carefully.

• Send only the page or document asked for.
• Use a time-limited route, not an open attachment.
• Note who received it and why.
• Ask for confirmation of receipt.

If you must email, say in the message what the document is for. A short line like "for loan application only" sets a boundary.

A quick checklist

Use this as a monthly check.

Erase when you no longer need them

The last step is the one most firms forget. Keeping every ID forever turns a small risk into a large one.

Decide how long you need each class of document. Some work needs records for several years, and some copies are needed only until a filing is done. We explain how to think about this in how long to keep client documents.

This article is general information, not legal advice. Check specific obligations with your professional adviser.

Where Reposha fits

Reposha is a secure client document service made for sensitive files like these. Clients upload IDs through a link, so nothing passes through a staff phone. Each file lives in the client's folder, and only the people assigned to that client can open it. Every open and download is recorded with the team member's name and the time. You choose how long files are kept, and expired files are erased on schedule. When a bank or lender needs a document, you share it from the folder and the record shows that you did.

Questions people ask