DoT Notifies Biometric User Identification for Wireless Access and Mobile Internet Telephony Services

The Department of Telecommunications (DoT) has brought two specific categories of telecom services within the biometric user-identification requirement under the Telecommunications Act, 2023.

Through notification S.O. 4623(e), dated 21 August 2026, the central government has notified wireless access services and internet telephony services through mobile user terminals. Authorized entities providing these services are required to ensure verifiable biometric-based identification of their users in accordance with the Telecommunications (User Identification) Rules, 2026.

The notification is only two pages long, but its wording has direct compliance consequences for the entities within its scope. At the same time, it should not be read more broadly than it is written. It does not say that every telecom service, every internet calling platform, or every user in India automatically falls under this particular notification.

For telecom operators, the first job is therefore not to rush into a new verification process. It is to establish whether the service being offered is one of the services actually notified.

Notification at a Glance

The notification is precise about three things: the services covered, who carries the responsibility and the requirement that identification must follow the Telecommunications (User Identification) Rules, 2026.

It is much less detailed on implementation. There is no separate table of procedures, technology specifications, fees or transition dates in S.O. 4623(E) itself.

The Regulatory Framework

The August 2026 notification does not create an isolated biometric-KYC system. It sits within the broader structure of the Telecommunications Act, 2023 and the Telecommunications (User Identification) Rules, 2026.

Section 3(7) of the Telecommunications Act, 2023

Section 3 of the Telecommunications Act deals with authorization. Sub-section (7) states that an authorized entity providing a telecommunication service notified by the Central Government must identify the person receiving that service through a verifiable biometric-based identification method as prescribed.

This explains why S.O. 4623(E) matters.

The Act creates the legal mechanism. The government then issues a notification identifying the telecom services to which that mechanism applies. S.O. 4623(E) names two such categories.

This distinction also prevents an unnecessarily broad interpretation. The legal requirement under Section 3(7) is tied to services notified by the Central Government, rather than being worded in the notification as a blanket requirement for every telecom service.

Telecommunications (User Identification) Rules, 2026

The second part of the framework is the Telecommunications (User Identification) Rules, 2026.

DoT's Telecom e-services Portal confirms that these Rules have been made live on the portal.

S.O. 4623(E) expressly states that the biometric identification of users has to be ensured in accordance with these Rules.

That is why the notification and Rules have to be read together.

A simple way to understand the structure is:

For a telecom business, reading only the Gazette notification is therefore not enough to design an operational KYC process.

What Has Changed?

The immediate change is that two categories of telecom services have now been expressly notified for Section 3(7).

They are:

• wireless access services, and
• Internet telephony services through mobile user terminals.

The responsibility rests with authorized entities providing those services. They are required to ensure verifiable biometric-based identification of the users to whom the services are provided.

The practical position can be read as follows:

What should not be said is that telecom KYC itself started on 21 August 2026. The notification is narrower than that. Its job is to identify particular services for the biometric requirement under Section 3(7).

Scope and Applicability of S.O. 4623(E)

The most important compliance question is simple: does the service being provided fall within one of the two categories named in the notification?

That question should be answered before technology, paperwork or internal processes are changed.

Wireless Access Services

Wireless access services are expressly mentioned in clause (a) of the notification.

An authorized entity providing a service that falls within this category must therefore consider the biometric user-identification requirement and the corresponding 2026 Rules.

The commercial name used for a service should not be the sole basis for determining applicability. The provider's regulatory authorization and the legal classification of the service should also be checked.

Internet Telephony through Mobile User Terminals

The wording of the second category deserves close attention.

The Gazette does not simply say "internet telephony services." It says:

• "Internet telephony service through mobile user terminals."
• That qualification matters.

A business should not assume that every VoIP product, internet calling platform, software application or online communication service automatically falls within this notification merely because voice communication takes place over the internet.

The nature of the service, the way it is delivered, and the regulatory authorization under which it operates have to be looked at together.

Applicability Matrix

This is one area where a telecom compliance consultant or internal regulatory team can add value. Applicability should be determined by the legal and operational facts rather than by assumptions about the technology being used.

Who Is Responsible for the Biometric Identification Requirement?

S.O. 4623(E) places the responsibility on the authorized entity providing the notified service.

The relevant wording says that authorized entities shall ensure verifiable biometric-based identification of the users receiving those services.

That may sound like a small drafting point, but it matters in practice.

The user may have to participate in the verification process. The compliance responsibility under this notification, however, sits with the authorized service provider.

For an operator, that turns biometric identification into more than a customer-KYC task. Legal, compliance, operations and technology teams may all have a role.

The operator needs to know:

• Whether the service is covered,
• Which verification method is permitted under the Rules?
• Where verification takes place in the customer journey,
• Which team owns the process?
• How failures or exceptions are dealt with, and
• What evidence must be kept where the applicable Rules require it?

Not every item in this list is separately written into S.O. 4623(E). They are practical questions that arise when an authorized entity converts the legal requirement into an operating process.

What Does “Verifiable Biometric-Based Identification” Mean Here?

The notification uses the expression “verifiable biometric-based identification”, but it does not provide its own detailed technical procedure.

This is exactly where businesses need to avoid reading too much into a short Gazette notice.

S.O. 4623(E) does not itself say that the only acceptable method is:

• Fingerprint verification,
• Facial authentication,
• Iris scanning,
• Aadhaar-based authentication, or
• Any particular biometric device or software.

Those conclusions should not be added unless they are supported by the Telecommunications (User Identification) Rules, 2026 or another applicable DoT instruction.

The safer compliance approach is first to identify the method permitted or prescribed by the official framework and then check whether the company's existing technology can support it.

Buying a biometric solution and using a biometric solution that meets the applicable regulatory requirements are two different things.

How S.O. 4623(E) and the User Identification Rules Work Together

The notification answers “which notified services?”

The Rules answer the wider question of “how user identification must be handled?”

This division is important for management teams because otherwise businesses may treat the Gazette notice as if it were a complete implementation manual.

It is not.

The Department of Telecommunications also lists separate instructions on its e-services portal in connection with the Telecommunications (User Identification) Rules, 2026. The portal shows an item titled “Instructions to be specified on the portal in accordance with the Telecommunications (User Identification) Rules, 2026,” published on 9 August 2026.

That tells affected entities something practical: the compliance framework extends beyond this single notification. The Rules and official instructions need to form part of the review.

What Does This Mean for Wireless Access Service Providers?

For a wireless access provider within the notified category, the issue moves from general awareness to operational readiness.

The provider should first check how users are currently identified and whether that process fits the framework required under the 2026 Rules.

Areas likely to require review include:

• Existing customer on boarding controls,
• Subscriber identity-verification procedures,
• Internal KYC responsibilities,
• Technology used for verification,
• Integration between customer and verification systems,
• Regulatory records maintained by the entity, and
• Internal escalation where verification cannot be completed.

Some operators may already have mature digital on boarding systems. Others may rely on several systems or external service providers.

The amount of work required will therefore differ from one authorized entity to another. S.o. 4623(e) does not prescribe a single implementation cost or a standard internal setup for every provider.

What Does This Mean for Internet Telephony Providers?

Internet telephony providers have an additional issue to settle before looking at compliance mechanics: service classification.

The notification's reference is to internet telephony through mobile user terminals.

A provider should therefore examine what service is actually being supplied, how the customer accesses it and under which telecom authorization the service is offered.

This matters because internet-based communications can take many forms. A business may describe a product commercially as “calling,” “voice,” “communication”, or “VoIP,” but a marketing description by itself does not settle the regulatory position.

If there is uncertainty, an applicability review should come before changes are made to KYC or biometric systems.

How Could the Requirement Affect Telecom User On boarding?

For affected providers, on boarding is likely to be one of the first business processes that needs examination.

Biometric identification has to fit somewhere into the journey between a customer requesting a telecom service and that service being provided.

The compliance team therefore needs to look beyond the verification screen itself.

Questions worth checking include:

• At what point does the prescribed identification take place?
• Does the present KYC process use a method allowed under the Rules?
• Is verification connected correctly with service activation?
• How does the system deal with an unsuccessful verification?
• Who can approve an exception if the legal framework permits one?
• Are responsibilities clear between the KYC, technology and operations teams?
• Is the evidence required under the applicable Rules being captured correctly?

These are practical review points. They should not be presented as separate duties created by S.O. 4623(E) unless the Rules expressly say so.

Responsibilities across Telecom Teams

A biometric user-identification requirement cannot normally be managed by one department working alone.

Legal and Compliance Team

The first responsibility is interpretation.

This team should determine whether the service is covered, identify the relevant authorization and map the notification against the User Identification Rules and DoT instructions.

A good compliance review should separate what is legally compulsory from what the company chooses to introduce as an internal control.

KYC and Customer-On boarding Team

The KYC team is responsible for turning regulatory requirements into a customer-facing process.

If an existing process was designed under earlier instructions, it should be checked against the current framework rather than being carried forward automatically.

Technology Team

Technology teams need a clear legal requirement before they start changing systems.

That reduces the risk of building a verification process around a technology that is not required or overlooking a condition that the applicable Rules actually prescribe.

Operations Team

Operations teams usually deal with what happens after a process goes live.

They may need clear internal instructions covering staff responsibilities, unsuccessful verification, customer communication, and escalation.

Information Security and Data Governance

Biometric information requires careful handling.

Any duty concerning storage, retention, access, sharing, or security should be derived from the applicable legal framework. S.O. 4623(E) itself does not prescribe a retention period or a detailed data-storage process.

What the Notification Does Not Expressly Specify

This section is just as important as explaining what the Gazette does say.

S.O. 4623(E) does not expressly provide:

• A separate compliance deadline,
• A separate transition period,
• A standalone application form,
• A filing process for complying with this notification,
• A separate compliance fee,
• A new renewal procedure,
• A particular biometric device,
• A named biometric technology,
• A record-retention period,
• A product-testing requirement, or
• A separate penalty table.

That does not mean these subjects can never arise under another provision.

It means they should not be attributed to this notification without checking the Telecommunications Act, the 2026 Rules, relevant authorization conditions and other official DoT instructions.

This approach matters because compliance content can easily become inaccurate when missing information is filled with assumptions.

Is biometric identification required for every telecom service?

No. S.O. 4623(E) by itself does not establish a biometric requirement for every telecom service in India.

It expressly identifies two categories:

• Wireless access services, and
• Internet telephony service through mobile user terminals.

A provider operating another telecommunications service should check its own legal position separately.

The reverse is also true. A service not named in S.O. 4623(E) should not automatically be treated as free from every user-identification requirement. Other Rules, notifications, authorization terms or DoT instructions may still be relevant.

The correct approach is service-by-service regulatory assessment.

Compliance Requirements

The clearest way to understand the legal position is to separate the requirements stated in S.O. 4623(E) from the wider implementation framework.

What S.O. 4623(E) Expressly Requires

For the services notified:

• An authorized entity is providing the relevant service,
• The service falls within one of the two specified categories,
• The authorized entity must ensure verifiable biometric-based identification of the user, and
• The identification has to be carried out in accordance with the Telecommunications (User Identification) Rules, 2026.

What Must Be Checked Separately

The following should be verified from the Rules and applicable DoT instructions rather than assumed from the Gazette notification:

• Permitted biometric identification method,
• User on boarding procedure,
• Any alternative identification route,
• Treatment of different categories of users,
• Re-verification requirements,
• Documents or records to be maintained,
• System or portal requirements,
• Timelines under particular circumstances, and
• Operational instructions issued by DoT.

This separation helps keep the compliance position accurate.

Compliance Readiness for Authorized Telecom Entities

A practical review does not need to start with a large technology project. It can start with a few basic questions.

1. Confirm Whether the Service Is Covered

Map the actual service against the two categories notified in S.O. 4623(E).

If classification is unclear, settle that issue first.

2. Check the Authorization Position

Identify the authorization or legacy licensing framework under which the service is being provided.

The status of the entity and the nature of the authorized service can affect the compliance analysis.

3. Read the User Identification Rules alongside the Notification

Do not treat S.O. 4623(E) as the complete procedure.

The Rules should be mapped to the business model and customer on boarding process.

4. Review the Existing KYC Process

Document how the entity currently identifies users.

The objective is to determine whether the current process already meets the applicable requirements or needs changes.

5. Carry out a Compliance Gap Assessment

A compliance gap assessment can examine the difference between the current process and the verified DoT requirements.

The review may cover legal interpretation, on boarding procedures, technology controls, record management and internal ownership.

6. Check Technology Readiness

Any biometric or digital verification system should be tested against the regulatory requirements before major changes are made.

A provider should not assume that commercially available biometric technology is automatically acceptable under the telecom framework.

7. Give Each Team Clear Ownership

Legal, KYC, technology, information-security and operations teams should know which parts of the process they are responsible for.

8. Keep Monitoring DoT Instructions

The DoT portal continues to publish material linked to user identification. Regulatory teams should monitor official updates rather than relying only on the original Gazette notification.

Impact on Businesses

The effect will not be identical for every company.

The notification may appear to deal only with user verification, but its operational effect can extend across several parts of a telecom business.

That is why telecom regulatory compliance services can be useful when service classification, existing KYC systems, and regulatory requirements need to be examined together rather than separately.

Benefits for Businesses and the Telecom Ecosystem

A stronger identification process can have practical value when it is implemented correctly.

For authorized entities, clearer user-identification controls can improve the reliability of subscriber records and reduce uncertainty about how a connection was issued.

Other possible benefits include:

• Better consistency in user-verification procedures,
• Clearer responsibility for customer identification,
• Stronger internal KYC controls,
• Improved traceability of the verification process,
• Better alignment between compliance and on boarding systems, and
• A more structured basis for internal audits and reviews.

These should be treated as potential regulatory and operational benefits, not guaranteed outcomes.

S.O. 4623(E) does not promise that biometric verification will eliminate fraud, reduce operating costs or make on boarding faster.

Challenges and Cost Implications

The harder part for many operators may be implementation rather than understanding the two-page notification.

Existing Systems May Need Review

A company may already have digital KYC tools in place. That does not automatically mean those systems satisfy the current Rules.

The existing setup has to be checked against the actual legal requirement.

Different Teams Need to Work Together

If the legal team interprets the requirement one way while the technology team builds something different, the company may end up with a process that is expensive but still incomplete.

Clear internal ownership reduces that risk.

Smaller Operators May Have Fewer Resources

Entities with limited in-house regulatory or technology teams may depend more heavily on external vendors.

This can make it even more important to define the legal requirements before purchasing or modifying technology.

Compliance Costs Will Differ

S.O. 4623(E) does not prescribe a standard implementation fee or cost.

Actual expenses, where they arise, may depend on existing systems, integration requirements, staffing, vendor arrangements and internal compliance work.

No fixed figure should therefore be presented as a government-prescribed cost for complying with this notification.

Is the Biometric Identification Requirement a Right Decision or an Additional Burden?

The answer depends on which part of the change is being considered.

Where the Requirement Can Help

From a regulatory-control perspective, stronger identity verification can make subscriber records more dependable.

It can also make responsibility clearer. The authorized entity knows that identification cannot simply be treated as an informal customer on boarding step where the notified service is concerned.

A defined biometric framework may also improve consistency in how users are verified across regulated services.

Where Businesses May Feel the Burden

Implementation can require time and resources.

Some operators may need changes to their technology. Others may need to revisit procedures, vendor contracts, training or internal controls.

The burden may be greater when an entity starts with an older or fragmented KYC system.

There is another risk as well: over-compliance.

A business that assumes the notification requires more than it actually does could spend money on technology or procedures that are not legally necessary.

A Balanced View

S.o. 4623(e) is useful because it clearly identifies the services brought within the Section 3(7) mechanism.

The practical difficulty lies in translating that requirement into the correct operating process.

For most authorized entities, the sensible approach is not to treat biometric identification as either purely beneficial or purely burdensome. The better question is whether the company can implement the verified requirement accurately without building unnecessary layers around it.

Regulatory and Implementation Risks to Avoid

Several risks can be reduced simply by reading the wording carefully.

Businesses should avoid:

• Treating the notification as applicable to every telecom service,
• Assuming every form of internet calling falls within the notified category,
• Ignoring the words “through mobile user terminals”,
• Assuming biometric verification automatically means Aadhaar-only verification,
• Selecting fingerprint, facial or iris technology without checking the Rules,
• Treating 21 August 2026 as a separate compliance deadline when S.O. 4623(E) does not state one,
• Assuming every existing customer needs immediate re-verification without verifying the applicable Rules,
• Treating internal best practices as legal obligations,
• Relying on the notification without reading the User Identification Rules, and
• Making technology decisions before settling service applicability.

Avoiding these mistakes can save both compliance effort and unnecessary implementation cost.

What Businesses Should Do Next

These actions are a practical readiness plan. They should not all be described as separate legal duties written into S.O. 4623(E).

The starting point is always the same: find out exactly what service is being provided and which part of the regulatory framework applies to it.

How Can Corpseed Help?

For a telecom provider, the difficult question is often not whether biometric identification exists as a regulatory requirement. The harder part is deciding whether the requirement applies to the service, what the applicable Rules require and what needs to change inside the business.

Corpseed supports businesses through relevant telecom regulatory compliance services, including:

• Applicability assessment: reviewing the service model and regulatory position to determine whether the notified categories are relevant.
• Telecommunications Act and User Identification Rules review: mapping the notification to the wider statutory and rule-based framework.
• Telecom authorization compliance support: reviewing the entity's authorization or regulatory status in relation to the service being provided.
• Compliance gap assessment: comparing the present KYC, on boarding and internal-control framework with verified DoT requirements.
• User-identification process review: examining how customer verification currently works and where regulatory alignment may be required.
• Regulatory documentation review: helping organize policies, records and internal responsibilities connected with telecom compliance.
• Implementation-readiness support: coordinating legal, compliance, operations and technology considerations before process changes are made.
• Ongoing telecom regulatory consulting: tracking relevant DoT notifications, instructions and changes that may affect the user-identification framework.

Professional support should help a business understand and apply the rules correctly. It cannot guarantee a regulatory outcome or replace the authority of the Department of Telecommunications.

For authorized entities that are unsure whether their service falls within S.O. 4623(E), working with a telecom compliance consultant can help settle the applicability question before money is spent on new systems or process changes.

Businesses looking for telecom regulatory compliance services can also use professional support to review their current user-identification framework, identify gaps and organize implementation around the requirements that actually apply.

Key Takeaways

The DoT biometric user identification notification 2026 is focused rather than general. It brings two identified service categories within the biometric user-identification requirement under Section 3(7) of the Telecommunications Act, 2023.

• DoT issued S.O. 4623(E) on 21 August 2026.
• It has been issued under Section 3(7) of the Telecommunications Act, 2023.
• It covers wireless access services and internet telephony services through mobile user terminals.
• The responsibility lies with authorized entities providing those services.
• Users must be identified through a verifiable biometric-based process in accordance with the Telecommunications (User Identification) Rules, 2026.
• The notification does not itself specify a separate deadline, transition period, fee, biometric device or detailed operating procedure.
• Other telecom services should not automatically be treated as covered by this particular notification.

Affected providers should first confirm applicability and then review their KYC, technology and operational processes against the applicable Rules.