KYC and Customer Due Diligence

1. Why banks must know their customers#

Suppose someone asks to open an account, receives unexplained money from unrelated persons, and rapidly transfers it onward. A bank must be able to answer: Who is the customer? What is the intended purpose of the relationship? Who ultimately controls the funds? Do the transactions fit the customer's known profile? These questions are central to customer due diligence.

A bank faces risks if it cannot recognise who it serves: illicit finance, identity misuse, fraud, sanctions breaches, regulatory penalties and reputational damage. KYC helps manage these risks while enabling legitimate customers to access banking.

2. KYC vs CIP vs CDD#

• KYC — Know Your Customer: broad policy and process of understanding the customer and managing customer-related risks.
• CIP — Customer Identification Procedure: establish and verify identity using permitted data and procedures.
• CDD — Customer Due Diligence: customer identification plus understanding the relationship, beneficial ownership where applicable, purpose and ongoing monitoring.

Memory formula: CIP verifies who; CDD understands who, why and how the relationship behaves; KYC is the surrounding compliance programme.

A bank can complete document collection but still fail at CDD if it never considers who controls an entity or why its transactions are unusual.

3. The four pillars of a sound KYC policy#

RBI's framework is commonly taught through:

1. Customer Acceptance Policy — conditions for entering customer relationships without unreasonable exclusion.
2. Risk Management — risk-based identification and treatment.
3. Customer Identification Procedure — verify identities at the appropriate stage.
4. Monitoring of Transactions — detect activity inconsistent with expected behaviour.

KYC should support inclusion: inability to present one preferred document must not automatically mean a legitimate person is excluded when lawful alternatives exist.

4. A risk-based approach#

Not all customers and transactions carry the same risk. A student with a simple savings account and predictable activity may be lower risk than a complex company with opaque ownership and cross-border transactions.

Banks classify customers into appropriate low, medium and high risk categories using parameters such as:

• identity, occupation and business activity;
• source of funds, geography and transaction pattern;
• type of products and delivery channels;
• ownership/control complexity;
• publicly exposed position, adverse indicators or sanctions exposure;
• other factors allowed by the current KYC framework.

Risk classification must not be based on arbitrary stereotypes, and controls should be proportionate. Higher risk means more scrutiny, not proof of wrongdoing.

5. CDD when opening an individual account#

A bank normally obtains and verifies information needed to establish:

• customer's legal name and identity;
• address under the applicable identification framework;
• PAN or Form 60 as required;
• other mandatory particulars;
• intended nature of the relationship;
• any relevant risk information.

A practical example is opening a savings account: the bank checks identity, applies the permitted verification route, records contact/address information and creates an account against its customer identifier.

6. Officially Valid Documents — OVD#

The KYC framework identifies Officially Valid Documents, including documents such as:

• passport;
• driving licence;
• proof of possession of Aadhaar number, in the manner permitted by law;
• voter identity card issued by the Election Commission;
• NREGA job card duly signed by an authorised State Government officer;
• letter issued by the National Population Register containing name and address.

Exam trap: PAN is important under tax/KYC requirements but is not interchangeable with an OVD for every RBI identity/address step. Similarly, Aadhaar authentication is not a universally mandatory mode for every customer and situation. Applicable law, consent and alternatives matter.

7. PAN and Form 60#

PAN is a tax identifier. When a customer does not possess PAN, Form 60 may be the alternative declaration in situations permitted by tax/KYC law. A bank does not treat Form 60 as a universal substitute for every other CDD obligation.

Example: A customer may provide an appropriate OVD to verify identity/address and separately furnish PAN/Form 60 as required. These serve related but distinct legal purposes.

8. Aadhaar: identification, authentication and choice#

These terms must not be collapsed into one:

• Aadhaar number: unique identity number.
• Aadhaar authentication: a verification process involving UIDAI under applicable rules.
• Offline Aadhaar verification: permitted verification methods without online Aadhaar authentication.
• Aadhaar seeding/mapping: bank/payment association used for eligible benefit-routing workflows.

Aadhaar is not a bank account, and providing it does not automatically authorise every future debit or data-sharing purpose. See Module 09 for DBT/AePS distinctions and Module 11 for payment flows.

9. Digital KYC and V-CIP#

V-CIP stands for Video-based Customer Identification Process. Under RBI's prescribed framework, an authorised official can conduct live audio-video interaction and complete identification in a controlled process.

It is not simply a customer uploading a selfie or sending a prerecorded video. Banks must follow identity, liveness, recording, security, location and other applicable controls.

Digital KYC is a broader expression for permitted technology-assisted capture/verification; each mode has different regulatory requirements.

10. CKYCR and the KYC Identifier#

CKYCR means Central KYC Records Registry. It supports central storage and retrieval of prescribed KYC records by regulated institutions.

Typical flow:

1. A regulated entity completes CDD.
2. The prescribed customer KYC record is uploaded to CKYCR.
3. The registry assigns/uses a KYC Identifier.
4. Another eligible regulated entity may retrieve the record following applicable rules.
5. Additional due diligence remains necessary where facts, risk or current instructions require it.

CKYCR is not a bank, credit bureau or transaction switch. It reduces duplication of records, not the bank's accountability.

11. Customer vs beneficial owner#

For a normal individual savings account, the customer and beneficial owner may be the same person. For a company, partnership, trust or complex arrangement, the named account holder may not be the person who ultimately owns or controls it.

A beneficial owner (BO) is the natural person who ultimately owns/controls the customer or on whose behalf transactions are undertaken, according to legal tests.

Example: A company named ABC Pvt. Ltd. opens an account. KYC of ABC alone does not answer whether a natural person ultimately controls it through shareholdings or other arrangements.

12. Legal-entity due diligence#

For companies and other legal entities, a bank may need:

• constitution/incorporation documents;
• authorised signatories and mandate;
• business address and purpose;
• beneficial owners and control structure;
• directors/partners/trustees as applicable;
• appropriate tax/registration details;
• ongoing business and transaction review.

A bank's exact verification obligations depend on the customer type and current RBI/PML Rules. Memorising one universal shareholding percentage for all entities is unsafe.

13. Enhanced Due Diligence — EDD#

CDD becomes more intensive when risks are elevated. EDD can involve deeper checks on:

• source of funds and source of wealth;
• ownership and unusual business relationships;
• higher-risk geographies/transactions;
• politically exposed persons (PEPs), subject to the precise definition;
• complex or unusual activity with no clear economic purpose.

EDD ≠ automatic rejection. It is additional verification and monitoring proportionate to risk.

14. PEPs and sanctions screening#

A Politically Exposed Person is a person entrusted with prominent public functions under the applicable definitions. Such relationships may require enhanced controls because influence can increase corruption-related risks; PEP status itself is not guilt.

Sanctions screening checks relevant individuals/entities against applicable prohibitions and lists. The bank must act according to law when a true match is found. A name match alone requires careful resolution—mistaken identity can harm an innocent customer.

15. Ongoing transaction monitoring#

CDD does not end when an account opens. The bank compares actual activity with the expected profile.

Example: An account belonging to a small local business suddenly begins receiving many unrelated international remittances. This may justify review and enquiries, not a presumption of criminality.

Monitoring may include transaction patterns, cash intensity, counterparts, expected turnover, unusual geography and alert resolution.

16. Periodic updation: re-KYC#

Periodic updation keeps information current. RBI uses risk-differentiated intervals and simplified procedures for eligible no-change/address-change cases.

A customer can be asked to update KYC without being accused of suspicious activity. Risk-based periodic updation and event-driven review are complementary: a significant change can trigger checks before the next routine interval.

The RBI KYC amendments of 2025 also improved access to certain re-KYC facilities through authorised BCs and customer communication. Specific extensions and dates belong in the current snapshot.

17. UCIC and avoiding needless repetition#

UCIC is the Unique Customer Identification Code at a regulated entity. It links accounts belonging to the same customer.

If an existing customer's CDD is already properly completed at the UCIC level, RBI's framework generally aims to avoid needless repetition just because the customer opens another account with the same institution, while allowing fresh checks where warranted.

18. Small accounts and financial inclusion#

RBI allows prescribed simplified/small-account arrangements subject to safeguards and limitations. Their purpose is to let eligible persons enter formal finance without bypassing legal monitoring.

19. KYC privacy and data minimisation#

Banks handle sensitive identity and financial data. Good practice includes collecting only required information, restricting access, preserving records securely and processing data lawfully.

India's DPDP legislation and rules use phased commencement. Therefore a study resource should distinguish established privacy principles from the exact provisions currently in force.

20. A practical KYC case#

Case: A new sole proprietor seeks a current account for a grocery shop. The bank verifies the proprietor, collects relevant business evidence, understands approximate turnover and checks risk. Later, turnover rises because the shop expands.

Correct approach: the bank updates its understanding and monitors reasonably. Rising activity alone does not prove criminality.

BA-12-01 — Quick check#

1. Why is KYC more than gathering documents?
2. What distinguishes CIP from CDD?
3. Is PAN the same as every OVD?
4. Does CKYCR take over the bank's CDD responsibility?
5. What is a beneficial owner?
6. Can low-risk customers still require re-KYC?

Answers: (1) Ongoing understanding and risk monitoring. (2) Identification/verification versus wider due diligence. (3) No. (4) No. (5) The natural person ultimately owning/controlling a customer or transaction under legal tests. (6) Yes.