Whenever the end user changes, the business must inform the telecom operator and ensure biometric verification of the new end user
| Photo Credit:
SIVA SARAVANAN S
Small businesses will face operational hurdles with the biometric verification mandate for SIM issuance and related services, similar to SIM-binding challenges, as per experts.
Beyond privacy concerns, digital rights experts warned that biometric validation puts a lot of onus on small businesses that report a short staff turnover. Comparing the mandate to the earlier SIM-linking of devices, CUTS International flagged how medium-sized enterprises could face higher absolute costs due to scale and automation intensity, while micro enterprises experience higher relative strain due to limited financial buffers. E-commerce and digital services could experience layered financial exposure. It also argued that even among aware businesses, expected negative financial impact remained high.
While acknowleding this added friction for smaller firms and sectors with frequent staff turnover, Sumeysh Srivastava, Partner at The Quantum Hub pointed out the government can exempt particular end users or classes of end users, which gives it some room to calibrate implementation. However, here too CUTS pointed out a hurdle.
Multi-SIM Workflows
“The regulations say exemptions can be made for small businesses depending on the discretion of telecom service providers. But then the responsibility falls on the TSPs, who will err on side of caution,” said Amol Kulkarni, Director (Research) at CUTS International. He also cited an earlier report by CUTS that said multi-SIM workflows are essential for communication, education, financial transactions, and continuity of work.
Looking at the definitions in the new regulation, Apar Gupta, Founder of the Internet Freedom Foundation (IFF) said the burden on small businesses may be considerable. The newly notified rules define a “business user” broadly to include companies, partnerships, LLPs, trusts, societies, cooperative societies and persons holding a trade or business licence or permit. So, biometric identification is needed not only of the authorised representative of the business but ordinarily of each end user of a business connection.
Staff Changes
Whenever the end user changes, the business must inform the telecom operator and ensure biometric verification of the new end user within the period specified on the portal. If this is not completed, the business connection can be suspended until verification takes place.
A cybersecurity measure may create a recurring biometric compliance obligation every time staff change. Small enterprises will bear this administrative cost, said Gupta. Further, employees will bear the privacy cost of repeatedly linking their identities to employer-controlled telecom connections.
“This may be manageable for a large company with HR and compliance departments. It is much harder for a small logistics company, shop, contractor or sales business where phones and SIMs may move between employees and field workers,” said Gupta.
Published on August 25, 2026
