Quiz on KYC: Understand RBI guidelines on KYC

CDD helps a regulated entity identify and verify the customer and, where applicable, the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing due diligence. It supports prevention of money laundering and terrorist financing.

The RBI KYC framework recognises specified documents as OVDs, including a passport, driving licence, proof of possession of Aadhaar number, voter identity card, NREGA job card duly signed by an officer of the State Government, and a letter issued by the National Population Register containing details of name and address, subject to applicable rules.

CKYCR receives, stores, safeguards and retrieves KYC records in digital form. A KYC Identifier can help regulated entities retrieve existing KYC records, subject to customer consent and the applicable requirements.

The regulated entity should use the KYC Identifier as the first reference point and retrieve the records online with the customer‘s consent. It should generally not ask the customer to submit the same records again unless the prescribed conditions apply, such as a change in the records available with CKYCR.

Under the general risk-based periodic updation schedule in the RBI KYC Directions, KYC is updated at least once every two years for high-risk customers, once every eight years for medium-risk customers, and once every ten years for low-risk customers. Any applicable later instruction or special measure must also be followed.

The general risk-based schedule requires periodic KYC updation at least once every eight years for medium-risk customers. The corresponding intervals are two years for high-risk and ten years for low-risk customers, subject to applicable instructions.

The general risk-based schedule provides for periodic KYC updation at least once every ten years for low-risk customers. Banks must also follow applicable special instructions, including any temporary relief or revised process that applies to the customer.

Where there is no change in KYC information, the bank may obtain a self-declaration from the customer through permitted channels under the RBI framework. The bank should follow the prescribed process and update its records accordingly.

The 2025 revised instructions permit a bank to obtain a customer‘s self-declaration through an authorised BC when there is no change in KYC information or only a change in address details, subject to the prescribed process.

V-CIP is a consent-based, live audio-visual customer identification process permitted under RBI KYC requirements when the prescribed conditions are met. It is an authorised alternative mode for customer identification, not a general exemption from KYC.

The Customer Acceptance Policy must not permit anonymous or fictitious/benami accounts. The regulated entity must identify and verify customers as required and must not establish a relationship where required CDD cannot be completed, subject to the applicable directions.

Risk categorisation helps the regulated entity apply appropriate risk-based controls and ongoing due diligence. The level and frequency of monitoring and periodic KYC updation should reflect the assessed risk and applicable regulatory instructions.

Identifying the beneficial owner helps establish the natural person(s) who ultimately own or control a customer, or on whose behalf a transaction is conducted, as defined by the applicable rules. This prevents misuse of legal entities to conceal ownership or control.

For a company, the general threshold used to identify an individual as a beneficial owner is more than 10% of shares, capital or profits, as applicable, or control through other means. The full definition and any applicable rule must be checked for the case at hand.

The general threshold for an individual beneficial owner of an unincorporated association or body of individuals is more than 15% of the property, capital or profits, as applicable, under the relevant definition.

Transaction records are generally required to be maintained for five years from the date of the transaction. Customer identification and account files, including business correspondence, are generally preserved for five years after the business relationship ends or the account is closed, whichever is later.

Customer identification records and account files, including business correspondence, are generally retained for at least five years after the business relationship ends or the account is closed, whichever is later.

Where required CDD cannot be completed, the regulated entity must not establish or continue the relationship, or carry out the relevant transaction, as prescribed by the RBI KYC Directions and applicable law. The entity should consider the required reporting and internal procedures where relevant.

Ongoing due diligence requires monitoring transactions to ensure they are consistent with the regulated entity‘s knowledge of the customer, the customer‘s business and risk profile, and, where necessary, the source of funds. It is not limited to the account-opening stage.

A KYC Identifier is a unique identifier assigned by CKYCR to a customer‘s KYC record. It enables a regulated entity to retrieve the customer‘s central KYC record with consent, subject to applicable rules and exceptions.