Overview
- A cross‑border release of EU inspection reports and member‑state questionnaires in late May 2026 found biometric and personal data at VFS India stored on unencrypted media and sometimes transmitted insecurely, in breach of Schengen rules that require rapid deletion after transmission.
- Inspectors and a 20‑member EU delegation documented recurring operational lapses across Indian centres, including wrong data entry, missing biometrics, scanning and IT problems, and passports left on site from 2020, with New Delhi repeatedly identified as the worst performing location.
- Reports flagged commercial and fraud risks such as fake appointment bookings, slot‑selling by intermediaries or staff, widespread ‘visa shopping’ by agents, and aggressive promotion of optional value‑added services that can sharply raise applicants’ costs.
- VFS Global rejects the allegations, saying its operations face continuous government audits and that optional services are transparently presented, while some embassies have demanded fixes and at least one member state has sought an alternative provider.
- The revelations put pressure on EU policy: the Commission’s new Visa Policy Strategy calls for stronger quality control and monitoring of external service providers, but many embassies say they currently lack realistic alternatives to VFS for high‑volume markets like India.