KYC compliance under the RBI KYC directions: what they require

KYC compliance for RBI-regulated entities means running a board-approved KYC policy with four elements: a customer acceptance policy, risk management, customer identification procedures and monitoring of transactions. For years the governing text was the Master Direction – Know Your Customer (KYC) Direction, 2016. On 28 November 2025 RBI replaced it with entity-wise KYC Directions, 2025, which carry the same requirements forward.

This explainer sets out the current position and the main requirements, using the commercial banks direction as the reference text.

Which KYC direction applies now

The 2016 Master Direction applied to all regulated entities and was amended many times. As part of RBI's consolidation of its regulations, it was repealed on 28 November 2025 and its content was re-issued in separate directions for each type of regulated entity. Two examples:

• Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025
• Reserve Bank of India (Non-Banking Financial Companies – Know Your Customer) Directions, 2025

Small finance banks, payments banks, local area banks, regional rural banks and cooperative banks have their own texts. The NBFC direction applies to all categories of NBFCs except those with no customer interface.

The directions have already been amended. An amendment of 29 December 2025 clarified responsibility for records taken from the Central KYC Records Registry. An amendment of 18 September 2026 extended the facility of overseas certification of documents, earlier available to non-resident Indians and persons of Indian origin, to foreign portfolio investors. The commercial banks direction on RBI's website is shown as updated on 1 October 2026.

For regulatory compliance in banking, the practical step is simple: policies, procedures and audit checklists that still cite the 2016 Master Direction should cite the 2025 direction for your entity type. Paragraph numbers have changed even where the wording has not. Always check the current text on rbi.org.in.

KYC policy and customer acceptance policy

Every regulated entity must have a KYC policy approved by its board or a committee of the board to which the power is delegated. The policy has four key elements:

1. Customer Acceptance Policy
2. Risk Management
3. Customer Identification Procedures
4. Monitoring of Transactions

The customer acceptance policy sets the ground rules for opening accounts. In substance, no account is opened in an anonymous or fictitious name, no account is opened where the entity cannot apply appropriate customer due diligence, and no transaction or account-based relationship is undertaken without following the due diligence procedure. The policy must not result in denial of banking services to the general public, especially to people who are financially or socially disadvantaged.

Governance sits alongside the policy. The entity appoints a designated director to ensure overall compliance with the PMLA and the Rules, and a principal officer responsible for reporting to FIU-IND. The two cannot be the same person. The entity also carries out a money laundering and terrorist financing risk assessment periodically, and reviews it at least annually.

Risk categorisation of customers

Customers are categorised as low, medium or high risk, based on the entity's assessment and risk perception. Factors include the customer's identity, social and financial status, the nature of the business activity, and information about the customer's business and location.

The risk category drives the rest of the framework: the depth of due diligence, the intensity of transaction monitoring and the frequency of periodic updation. The directions require a review of the risk categorisation of accounts at least once in six months. The category and the reasons for it are confidential and are not to be revealed to the customer, so that the customer is not tipped off.

Customer due diligence and beneficial owner

Customer due diligence (CDD) means identifying the customer and verifying that identity using reliable and independent sources, and doing the same for the beneficial owner. It is carried out when an account-based relationship begins, and for occasional transactions of ₹50,000 or more and international money transfers by non-account holders.

For individuals, CDD relies on the Permanent Account Number or Form 60 and an officially valid document (OVD) or Aadhaar-based verification. The OVDs are the passport, the driving licence, proof of possession of Aadhaar number, the Voter's Identity Card issued by the Election Commission of India, the job card issued by NREGA duly signed by an officer of the State Government, and the letter issued by the National Population Register containing details of name and address.

For legal persons, the entity must identify the beneficial owner, the natural person who ultimately owns or controls the customer:

Enhanced due diligence applies to higher-risk situations. Accounts opened without meeting the customer face to face are treated as high risk until identity is verified in person or through V-CIP. Accounts of politically exposed persons, their family members and close associates need senior management approval, reasonable steps to establish the source of funds, and enhanced ongoing monitoring.

V-CIP and CKYCR

Video-based Customer Identification Process (V-CIP) is a method of customer identification with facial recognition and due diligence by an authorised official of the entity, through a live, secure, consent-based audio-visual interaction with the customer. It is treated on par with face-to-face identification. The direction sets conditions, including:

• only specially trained officials conduct V-CIP, with liveness checks;
• the customer's consent is recorded in an auditable and alteration-proof manner;
• the video carries geo-tagging and a date and time stamp, and connections from IP addresses outside India or spoofed addresses are blocked;
• PAN is verified from the database of the issuing authority;
• the technology sits in the entity's own premises or secured network, and the data is stored in systems located in India;
• an account opened through V-CIP becomes operational only after a concurrent audit.

Central KYC Records Registry (CKYCR). The entity uploads the customer's KYC records to the CKYCR within 10 days of commencing an account-based relationship, and communicates the KYC Identifier generated by the registry to the customer. When it obtains additional or updated information from a customer, it furnishes the update to the CKYCR within seven days. A customer who gives a KYC Identifier need not submit the same documents again unless one of the listed exceptions applies. Under the December 2025 amendment, the entity that last uploaded or updated the record is responsible for verifying the identity and address, and the entity relying on the record remains responsible for the other aspects of CDD.

Periodic updation (re-KYC) frequency by risk

Periodic updation follows a risk-based approach, counted from the date of opening the account or the last KYC updation:

The process is meant to be light where nothing has changed:

• No change in KYC information: a self-declaration from the customer through the registered email, registered mobile number, ATM, digital channels or a letter is enough.
• Change only in address: a self-declaration of the new address, which the entity verifies through positive confirmation within two months.
• Low-risk individual customers: the bank allows transactions to continue and completes the updation within one year of its falling due. The direction also carried a transitional date of 30 June 2026, which has passed.
• Notice to customers: at least three advance intimations before the due date, including one by letter, and at least three reminders after the due date, including one by letter.

Banks may also use V-CIP for periodic updation, and business correspondents may collect self-declarations, with the bank remaining responsible.

Record retention and banking internal controls

The directions require the entity to:

• maintain all necessary records of transactions, domestic and international, for at least five years from the date of the transaction;
• preserve records of customer identification and address obtained at account opening and during the relationship for at least five years after the business relationship has ended;
• keep records in a way that allows individual transactions to be reconstructed and data to be retrieved quickly for competent authorities.

KYC is also part of banking internal controls. The directions expect independent evaluation of compliance, internal audit staffed by people trained in KYC and AML, employee screening at recruitment and ongoing training for frontline and compliance staff.

How RegIntel Nexus helps

RegIntel Nexus does not perform KYC, screen customers or monitor transactions. It helps you keep up with the rules. It monitors RBI and FIU-IND publications, classifies them and tracks amendments, so changes such as the 2025 re-issue and later amendments are picked up. It turns each clause into an obligation with an owner, due date, status and escalation, and maps it to the processes and applications it touches. The research assistant answers with document, clause and page cited, and source references, document versions and approvals are kept as audit evidence.

This article is general information for compliance and risk professionals. It is not legal advice. Regulations are amended often; check the current text published by the regulator before acting.