KYC, AML, Cybersecurity & Customer Protection: Revision and Practice

How the Five Lessons Connect#

Customer onboarding and identity verification (KYC/CDD)
↓
Understanding and monitoring transactions (AML/CFT)
↓
Securing payment systems and preventing deception (Cybersecurity)
↓
Determining fair treatment and payment liability (Customer Protection)
↓
Resolving deficiencies in service (Bank grievance / RBI Ombudsman)

The unifying principle is trust with accountability: a bank must make legitimate services accessible while controlling illegal activity, protecting information and providing effective remedies.

Common Confusions and Exam Traps#

Important Exam Facts to Revise#

1. KYC stands for Know Your Customer.
2. CDD stands for Customer Due Diligence; CIP is Customer Identification Procedure.
3. KYC policy includes customer acceptance, risk management, identification and transaction monitoring.
4. KYC is ongoing, not just an account-opening formality.
5. Customer risk classifications commonly include low, medium and high risk.
6. Periodic re-KYC requirements are risk-based and can be supplemented by event-driven review.
7. PAN/Form 60 and an OVD serve different roles; one does not automatically replace the other.
8. V-CIP stands for Video-based Customer Identification Process.
9. CKYCR stands for Central KYC Records Registry.
10. A beneficial owner is a natural person ultimately owning/controlling a customer under applicable tests.
11. PEP means Politically Exposed Person; enhanced monitoring is not a finding of crime.
12. AML is Anti-Money Laundering and CFT is Countering the Financing of Terrorism.
13. PMLA was enacted in 2002; reporting rules were issued in 2005.
14. FIU-IND is Financial Intelligence Unit–India.
15. FATF stands for Financial Action Task Force.
16. The classic money-laundering stages are placement, layering and integration.
17. CTR means Cash Transaction Report.
18. STR means Suspicious Transaction Report and is not limited to cash transactions.
19. A legitimate transaction can meet a CTR reporting threshold without being criminal.
20. STR filing is not a criminal conviction; suspicious activity is subject to assessment/investigation.
21. Revealing a confidential STR can amount to prohibited tipping off.
22. Banks use ongoing monitoring, sanctions checks and record retention under the AML framework.
23. CIA in cybersecurity is Confidentiality, Integrity and Availability.
24. Authentication verifies identity; authorisation controls permitted actions.
25. Phishing, vishing and smishing use different deception channels.
26. OTPs, passwords and UPI PINs are sensitive credentials and should not be shared with callers.
27. A QR code does not establish that the payee is genuine.
28. Entering a UPI PIN normally authorises an outgoing payment—not receipt of funds.
29. Money-mule accounts are a key risk in financial cybercrime.
30. RBI issued revised bank Fraud Risk Management Directions in 2024.
31. Red flags/EWS warrant review; they are not automatic findings of fraud.
32. The national cyber-financial-fraud helpline is 1930.
33. The official National Cyber Crime Reporting Portal is cybercrime.gov.in.
34. A cyber fraud victim should report immediately to the bank/payment provider as well as the cybercrime channel.
35. RBI's Charter of Customer Rights was released in 2014.
36. The five rights are fair treatment; transparency; suitability; privacy; grievance redress/compensation.
37. KFS means Key Facts Statement; APR means Annual Percentage Rate.
38. Fair recovery does not permit harassment even when debt is owed.
39. For covered third-party unauthorised electronic transactions, reporting within three working days can mean zero liability.
40. The liability rule depends on bank fault, customer negligence, third-party breach and timing.
41. A shadow reversal is a temporary credit, not necessarily a permanent adjudicated refund.
42. The RBI Internal Ombudsman mechanism is distinct from the external RBI Ombudsman.
43. RBI's 2023 Internal Ombudsman Directions cover specified regulated entities.
44. RB-IOS, 2026 replaced RB-IOS, 2021 for new complaints effective 1 July 2026.
45. Under the 2026 Scheme, complain to the regulated entity first and then follow the scheme's waiting/response conditions.
46. The new scheme ordinarily provides a 90-day post-trigger filing window subject to the exact conditions.
47. The 2026 compensation ceilings are ₹30 lakh consequential loss and ₹3 lakh additional eligible inconvenience/harassment.
48. The amount of the disputed transaction is not itself capped by those compensation ceilings.
49. The 2026 appeal route is focused on qualifying Awards, ordinarily within 30 days.
50. RB-IOS is free, and the RBI complaint portal is cms.rbi.org.in.

Module Recap#

KYC answers: Who is the customer and what is the relationship?
AML/CFT asks: Can the financial system be misused to conceal illicit funds or finance prohibited activity?
Cybersecurity asks: Are systems, customers and data protected against compromise and manipulation?
Customer protection asks: Did the bank communicate fairly, secure the relationship and apply liability properly?
Ombudsman redress asks: If the regulated entity failed in service, does an eligible remedy exist?

There is no shortcut in this chain. Collecting KYC papers does not replace monitoring. A cyber fraud report does not replace notifying the bank. An Ombudsman complaint does not determine whether an accused person is guilty of a criminal offence. And a bank's power to recover contractual debt does not authorise unfair or unlawful conduct.

Glossary#

AML — Anti-Money Laundering.
APB / AePS — Aadhaar payment routing and Aadhaar-enabled transaction channels, respectively (Modules 09/11).
APR — Annual Percentage Rate, an annualised total-credit-cost measure under the applicable framework.
Authentication — Verification of identity or claimed credential.
Authorisation — Grant of permission for a particular action or transaction.
Beneficial Owner — Natural person ultimately owning/controlling a customer or on whose behalf a transaction occurs, per legal tests.
BC — Business Correspondent.
CDD — Customer Due Diligence.
CFT — Countering the Financing of Terrorism.
CIC — Credit Information Company.
CIP — Customer Identification Procedure.
CKYCR — Central KYC Records Registry.
CMS — RBI's Complaint Management System.
CTR — Cash Transaction Report.
CRPC — Centralised Receipt and Processing Centre (RBI).
Customer negligence — Failure to exercise reasonable protection of credentials/actions, as relevant to liability rules.
Cybercrime — Crime involving digital networks/devices or technology-enabled activity.
Data minimisation — Limiting collection/processing of data to what is justified by lawful requirements and purpose.
DBT — Direct Benefit Transfer.
DPDP — Digital Personal Data Protection.
EDD — Enhanced Due Diligence.
ED — Enforcement Directorate.
EWS — Early Warning Signals.
FATF — Financial Action Task Force.
FIU-IND — Financial Intelligence Unit–India.
Form 60 — Prescribed declaration when PAN is not available in situations where law permits.
Fraud risk management — Governance, prevention, detection, reporting and response concerning institutional fraud risk.
Hashing — Cryptographic transformation used, among other things, for integrity and protected credential handling.
Internal Ombudsman — Independent reviewer within a covered regulated entity's grievance structure.
KFS — Key Facts Statement for covered lending products.
KYC — Know Your Customer.
Money mule — Person/account used to move funds on behalf of others, potentially involving illicit proceeds.
NPA — Non-Performing Asset, a repayment/asset-quality classification, distinct from fraud.
OVD — Officially Valid Document under the KYC framework.
PAN — Permanent Account Number.
PEP — Politically Exposed Person.
Phishing — Deceptive messages or sites intended to obtain sensitive information or actions.
PMLA — Prevention of Money-laundering Act, 2002.
PRB — Payments Regulatory Board (context from Module 11).
RBI Ombudsman — RBI-appointed officer considering eligible deficiency-in-service complaints.
RB-IOS — Reserve Bank–Integrated Ombudsman Scheme.
RFA — Red Flagged Account under applicable fraud-risk controls.
Re-KYC — Updating existing customer information as required by risk/event-driven policy.
Shadow reversal — Provisional credit related to disputed unauthorised electronic banking transactions under the applicable direction.
SIM swap — Unauthorised transfer of control of a mobile number.
Smishing — SMS-based phishing.
STR — Suspicious Transaction Report.
Tokenisation — Replacement of sensitive data with a surrogate token under an approved framework.
Tipping off — Unlawful disclosure of protected suspicious reporting/investigation information.
UCIC — Unique Customer Identification Code.
UPI PIN — Credential used to authorise relevant UPI transactions, especially debits.
V-CIP — Video-based Customer Identification Process.
Vishing — Voice/telephone-based phishing.

Practice MCQs — Module 12#

Instructions: Choose the single best answer. The questions test concepts, practical distinctions and update-sensitive RBI rules that should be verified against the latest official sources.

1. Which statement best describes KYC?#

A. Only checking a signature
B. Identifying and understanding customers and monitoring associated risk
C. Only collecting a PAN copy
D. Only checking a credit score

2. CDD most directly means:#

A. Customer Due Diligence
B. Central Deposit Database
C. Cash Deposit Direction
D. Credit Disbursement Document

3. Which is NOT automatically an OVD solely by virtue of being a tax identifier?#

A. Passport
B. Voter identity card
C. PAN
D. Driving licence

4. A regulated bank should view KYC as:#

A. A one-time process with no future monitoring
B. A continuous obligation
C. Only an AML report
D. A replacement for underwriting

5. V-CIP refers to:#

A. Virtual Cash Insurance Plan
B. Video-based Customer Identification Process
C. Verified Credit Investment Product
D. Vendor Client Identification Policy

6. CKYCR stands for:#

A. Central KYC Records Registry
B. Central Know Your Credit Rating
C. Customer Key Yield Record
D. Credit KYC Review

7. A beneficial owner is generally:#

A. Always the person carrying a company stamp
B. A natural person ultimately owning or controlling an entity under legal tests
C. Only the branch manager
D. Always the first director listed

8. EDD should generally be understood as:#

A. Automatic refusal to a customer
B. Higher scrutiny for higher-risk relationships
C. Elimination of all documentation
D. Giving every customer the same risk grade

9. Which is the strongest reason for a periodic re-KYC review?#

A. KYC documents can never be reused
B. Customer details and risk profiles can change
C. Interest rates require daily KYC
D. RBI forbids any digital verification

10. The purpose of UCIC is to:#

A. Combine all banks into one bank
B. Identify the same customer across accounts at a regulated entity
C. Set the repo rate
D. Set ATM cash withdrawal limits

11. AML stands for:#

A. Anti-Money Laundering
B. Annual Money Limit
C. Asset Margin Liability
D. Authorised Money Lending

12. Which correctly names the conventional three-stage teaching model of money laundering?#

A. Deposit, loan, cheque
B. Placement, layering, integration
C. KYC, PAN, IFSC
D. Sanction, disbursement, repayment

13. CFT is principally concerned with:#

A. Credit fund transfers
B. Financing of terrorism
C. Changing foreign tariffs
D. Capital fund taxation

14. FIU-IND is primarily:#

A. A commercial bank
B. A financial-intelligence receiving and analysis agency
C. The issuer of RuPay cards
D. A bank customer grievance cell

15. Which body is the international AML/CFT standard setter?#

A. NPCI
B. FATF
C. DICGC
D. NHB

16. A CTR is primarily triggered by:#

A. Only a proven fraud
B. Prescribed cash transaction / connected-series reporting criteria
C. Any telephone enquiry
D. A low credit score

17. A suspicious transaction report (STR):#

A. Requires a fixed minimum cash transaction amount
B. May cover suspicious non-cash activity regardless of amount
C. Is proof of conviction
D. Is filed by customers to RBI CMS

18. The core statute in India for money-laundering offences is:#

A. PMLA, 2002
B. Regional Rural Banks Act, 1976
C. Companies Act alone
D. Payment and Settlement Systems Act alone

19. Tipping off refers to:#

A. Explaining an FD interest rate
B. Prohibited disclosure of protected suspicious reporting/investigation information
C. Giving a customer a deposit receipt
D. Issuing an ATM card

20. Which is true of an STR?#

A. Every STR means the customer is guilty
B. It triggers intelligence/compliance handling, not automatic criminal guilt
C. Every STR is a cash report
D. It replaces CDD entirely

21. The CIA triad stands for:#

A. Capital, Income, Assets
B. Confidentiality, Integrity, Availability
C. Cash, Insurance, Advances
D. Credit, Investment, Audit

22. Authentication and authorisation differ because:#

A. Both mean interest payment
B. Authentication verifies identity; authorisation controls permitted action
C. Only customers need authorisation
D. Authorisation always comes before identity checks

23. A fraudulent phone call pretending to be a bank official is:#

A. Vishing
B. RTGS
C. Tokenisation
D. Hashing

24. SMS-based phishing is commonly called:#

A. Smishing
B. Pharming only
C. Netting
D. Settlement

25. A person receiving an ordinary UPI transfer should generally:#

A. Enter UPI PIN to receive the payment
B. Not need to enter UPI PIN solely to receive funds
C. Share OTP with payer
D. Install remote-control software

26. Which practice is most unsafe?#

A. Checking the payee in the trusted app
B. Using official support channels
C. Sharing OTP with an unknown caller
D. Enabling transaction alerts

27. Encryption differs from hashing because:#

A. Encryption is designed for authorised reversible protection; hashing produces a digest
B. Both are simple synonyms
C. Hashing always stores plain passwords
D. Neither is used in finance

28. Ransomware most commonly threatens:#

A. Only fixed deposit interest
B. Availability and integrity of systems/data
C. Only agricultural collateral
D. Only customer nomination

29. Under RBI fraud risk management, an Early Warning Signal is:#

A. A criminal conviction
B. A sign needing assessment/investigation
C. Always an NPA
D. A deposit product

30. After suspected financial cyber fraud, the safest immediate response is:#

A. Wait for the Ombudsman before contacting the bank
B. Inform bank/payment provider immediately and report via 1930/official portal
C. Pay a recovery agent first
D. Delete all evidence

31. Which right was included in RBI’s Charter of Customer Rights?#

A. Right to automatic loan approval
B. Right to Fair Treatment
C. Right to interest-free advances
D. Right to bypass KYC

32. Right to Suitability most closely concerns:#

A. Appropriate products for customer needs
B. A guarantee every investment performs
C. A guarantee of loan sanction
D. ATM note denominations

33. A Key Facts Statement (KFS) primarily helps borrowers:#

A. Understand key terms and charges of covered loans
B. Avoid repayment entirely
C. Get a guaranteed credit score
D. Escape all contractual obligations

34. RBI’s penal-charges approach aims to:#

A. Hide loan penalties
B. Improve fair, transparent charging for non-compliance
C. Make every default a crime
D. Waive every loan

35. In a covered third-party unauthorised banking transaction, reporting within three working days can mean:#

A. Zero customer liability
B. Automatic customer liability for every rupee
C. Criminal conviction of bank staff
D. Guaranteed cybercrime recovery

36. In a third-party unauthorised transaction notified 4–7 working days after bank communication, the broad rule provides:#

A. Always 100% customer liability
B. Limited customer liability under applicable caps
C. No bank investigation
D. Automatic chargeback in cash

37. When a customer negligently shares payment credentials, the 2017 liability framework generally:#

A. Gives automatic zero liability for all earlier losses
B. May place pre-notification loss on the customer, with post-notification loss on bank
C. Treats the customer as RBI Ombudsman
D. Makes the bank exempt from all fraud reporting

38. A shadow reversal is best described as:#

A. Temporary credit under the relevant unauthorised transaction rule
B. Interest on a housing loan
C. A criminal sentence
D. A guarantee of final compensation

39. A fraudster deceives a customer into voluntarily authorising a UPI transfer. Which statement is safest?#

A. The transaction automatically qualifies for the three-working-day zero-liability rule
B. It requires fact-specific assessment; report promptly but do not assume automatic protection under unauthorised-transaction rules
C. The payment can never be reported
D. No bank is permitted to investigate

40. Which is NOT among RBI’s five broad customer-rights principles?#

A. Right to Privacy
B. Right to Grievance Redress and Compensation
C. Right to Suitability
D. Right to guaranteed profit from investments

41. Which RBI Integrated Ombudsman scheme currently applies to newly governed eligible complaints?#

A. RB-IOS, 2021
B. RB-IOS, 2026
C. The Banking Ombudsman Scheme, 2006 alone
D. Only the 2019 Digital Transactions Scheme

42. The first formal complaint under the RBI Ombudsman framework normally goes to:#

A. FIU-IND
B. The concerned regulated entity
C. FATF
D. The Supreme Court

43. An Internal Ombudsman is:#

A. The same external officer as RBI Ombudsman
B. An independent apex-level internal grievance reviewer at covered entities
C. A police officer issuing FIRs
D. A bank examiner writing RBI policy rates

44. Under RB-IOS, 2026, the general RBI Ombudsman filing window is:#

A. A fixed 10-year period after account opening
B. Generally 90 days after the prescribed triggering time/last RE communication, subject to conditions
C. Always one year after the reply as the sole current rule
D. There is no time limit

45. Under RB-IOS, 2026, maximum compensation for consequential loss is:#

A. ₹1 lakh
B. ₹10 lakh
C. ₹30 lakh
D. There is no compensation possible

46. Under RB-IOS, 2026, the additional upper limit for eligible time/expense/harassment compensation is:#

A. ₹3 lakh
B. ₹20 lakh
C. ₹50 lakh
D. There is no such category

47. The disputed amount itself under RB-IOS 2026:#

A. Is always capped at ₹30 lakh
B. Has no universal monetary ceiling for bringing an eligible grievance
C. Must be less than ₹10,000
D. Is automatically refunded in every case

48. In the current 2026 scheme, the ordinary appeal route is principally against:#

A. An Award
B. Every telephone exchange with the bank
C. Every closed complaint without conditions
D. A KYC document

49. The RBI Complaint Management System is:#

A. cms.rbi.org.in
B. fiuindia.gov.in
C. cybercrime.gov.in
D. a private payment app

50. Which statement best integrates this module?#

A. KYC can replace cyber controls and redress
B. Banks need KYC, AML/CFT, cybersecurity, fair customer treatment and functioning grievance systems together
C. Reporting to 1930 means a bank need not be notified
D. A suspicious transaction is a criminal conviction

Answers and Explanations#

1. B — Identifying and understanding customers and monitoring associated risk.
KYC combines customer acceptance, identity checks, risk management and ongoing monitoring.

2. A — Customer Due Diligence.
CDD goes beyond identification to understand the relationship, beneficial ownership and risk.

3. C — PAN.
PAN has a distinct tax/KYC role; an OVD is defined by RBI KYC directions.

4. B — A continuous obligation.
Ongoing due diligence and risk-based updates matter throughout the relationship.

5. B — Video-based Customer Identification Process.
V-CIP is an authorised live audio-video identification procedure subject to RBI controls.

6. A — Central KYC Records Registry.
CKYCR is a central repository for prescribed KYC records, not a payment switch.

7. B — A natural person ultimately owning or controlling an entity under legal tests.
Legal ownership/control tests determine the beneficial owner; a signatory can be a different person.

8. B — Higher scrutiny for higher-risk relationships.
Enhanced due diligence imposes additional checks, not a presumption of criminal conduct.

9. B — Customer details and risk profiles can change.
Re-KYC keeps information and monitoring aligned with changing circumstances.

10. B — Identify the same customer across accounts at a regulated entity.
UCIC supports customer-level records and reduces needless repeat checks within the same institution.

11. A — Anti-Money Laundering.
AML consists of controls to prevent, detect and report misuse involving illicit proceeds.

12. B — Placement, layering, integration.
The three stages are a conceptual model; actual cases need not follow this sequence neatly.

13. B — Financing of terrorism.
CFT addresses terrorist financing, which may involve legitimate or illicit origin of funds.

14. B — A financial-intelligence receiving and analysis agency.
FIU-IND receives, analyses and disseminates mandated financial intelligence.

15. B — FATF.
FATF sets international standards and evaluates jurisdictions; it is not an Indian police station.

16. B — Prescribed cash transaction / connected-series reporting criteria.
A CTR is rule/threshold driven; lawful cash transactions may still meet reporting criteria.

17. B — May cover suspicious non-cash activity regardless of amount.
STRs are driven by assessed suspicion, not exclusively by cash amount.

18. A — PMLA, 2002.
PMLA 2002 is the principal legislation; detailed reporting duties are set by rules/directions.

19. B — Prohibited disclosure of protected suspicious reporting/investigation information.
Confidential AML reporting must not be improperly disclosed.

20. B — It triggers intelligence/compliance handling, not automatic criminal guilt.
Suspicion must be assessed; criminal guilt is determined through law and evidence.

21. B — Confidentiality, Integrity, Availability.
The information-security triad protects secrecy, correctness and service accessibility.

22. B — Authentication verifies identity; authorisation controls permitted action.
A verified identity still requires appropriate permissions for each action.

23. A — Vishing.
Vishing is voice-based social engineering.

24. A — Smishing.
Smishing is fraudulent SMS messaging intended to deceive recipients.

25. B — Not need to enter UPI PIN solely to receive funds.
UPI PIN authorises relevant outgoing actions; receipt alone does not require PIN.

26. C — Sharing OTP with an unknown caller.
OTPs and PINs are confidential; banks do not require disclosure to strangers to process refunds.

27. A — Encryption is designed for authorised reversible protection; hashing produces a digest.
Encrypted data can be decrypted by authorised keys; cryptographic hashing is used for different purposes.

28. B — Availability and integrity of systems/data.
Ransomware may lock or encrypt systems and data, disrupting operations.

29. B — A sign needing assessment/investigation.
EWS/RFA concepts initiate control and investigation processes, not automatic guilt.

30. B — Inform bank/payment provider immediately and report via 1930/official portal.
Rapid direct bank notification and cybercrime reporting are complementary and time-sensitive.

31. B — Right to Fair Treatment.
RBI’s charter includes fair treatment, transparency, suitability, privacy and grievance redress.

32. A — Appropriate products for customer needs.
Banks should avoid inappropriate or misleading sale of products to customers.

33. A — Understand key terms and charges of covered loans.
KFS is a standardised disclosure summary and does not replace the loan contract.

34. B — Improve fair, transparent charging for non-compliance.
Covered penalties should be treated as disclosed penal charges rather than compounded penal interest.

35. A — Zero customer liability.
The conditional RBI timing rule applies when neither bank nor customer is at fault and other conditions are met.

36. B — Limited customer liability under applicable caps.
Under the 2017 framework, limited liability is calculated against specified cap and transaction value.

37. B — May place pre-notification loss on the customer, with post-notification loss on bank.
Customer-negligence treatment differs from bank fault and no-fault third-party breach.

38. A — Temporary credit under the relevant unauthorised transaction rule.
A shadow reversal protects the disputed balance provisionally; final liability is determined separately.

39. B — It requires fact-specific assessment; report promptly but do not assume automatic protection under unauthorised-transaction rules.
Authorised-but-fraudulently-induced payments are not automatically the same as an unauthorised debit.

40. D — Right to guaranteed profit from investments.
A bank cannot guarantee investment profit just because a consumer-rights charter exists.

41. B — RB-IOS, 2026.
RB-IOS 2026 came into force on 1 July 2026 and replaced 2021 for newly covered complaints.

42. B — The concerned regulated entity.
A prior complaint to the regulated entity is generally a maintainability prerequisite.

43. B — An independent apex-level internal grievance reviewer at covered entities.
The internal and external ombudsman mechanisms have different positions and duties.

44. B — Generally 90 days after the prescribed triggering time/last RE communication, subject to conditions.
The 2026 scheme uses a post-trigger 90-day rule and other maintainability conditions.

45. C — ₹30 lakh.
The consequential-loss ceiling under the 2026 scheme is ₹30 lakh, subject to proof and award conditions.

46. A — ₹3 lakh.
The separate ceiling is ₹3 lakh, not the former 2021 ₹1 lakh.

47. B — Has no universal monetary ceiling for bringing an eligible grievance.
The compensation caps are separate from the amount involved in the dispute.

48. A — An Award.
RB-IOS 2026 narrows its appeal structure; it is not the older 2021 appealability table.

49. A — cms.rbi.org.in.
RBI CMS is the official online Ombudsman complaint portal; cybercrime.gov.in serves another purpose.

50. B — Banks need KYC, AML/CFT, cybersecurity, fair customer treatment and functioning grievance systems together.
The five functions support each other but do not replace one another.

Official Sources and Further Reading#

Research emphasis: RBI and other primary Indian authorities for compliance, customer protection and cybercrime reporting. The links below are official sources or original legal texts. Some RBI pages occasionally present access restrictions; in that case, follow the official Master Directions/FAQs index rather than relying on an unofficial copy. Statements in the website's Current Snapshot should be checked against the most recent amendments before publishing.

[S1] RBI — Master Direction: Know Your Customer (KYC) Direction, 2016 (as amended)#

• Official Master Directions access: https://old.rbi.org.in/commonman/English/Scripts/MasterDirection.aspx
• RBI direction detail (earlier consolidated rendition; cross-check subsequent amendments): https://systemhealth.rbi.org.in/Scripts/BS_ViewMasDirections.aspx_id%3D11566%282%29.html

Used for: customer acceptance, risk assessment, CIP/CDD, OVD, PAN/Form 60, beneficial ownership, CKYCR, V-CIP, ongoing monitoring and periodic updation. Do not confuse the original 2016 issue year with the latest amendment date.

[S2] RBI — KYC Amendment Directions, 2025#

https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12866

Used for: low-risk re-KYC relaxation and customer-friendly BC-mediated/no-change updation. The 2025 transition date is historical once it passes; never keep showing it as an upcoming compliance deadline.

[S3] FIU-IND — Official AML and PMLA FAQs#

https://fiuindia.gov.in/files/FAQs/faqs.html

Used for: CTR, STR, connected cash-transaction series, other reporting categories and distinction between record keeping and suspicion. Check current rule amendments before reusing threshold figures.

[S4] Prevention of Money-laundering Act, 2002 — India Code#

https://upload.indiacode.nic.in/showfile?actid=AC_CEN_2_2_00035_200315_1517807326550&filename=a2003-15.pdf&type=actfile

Used for: basic legislative framework, proceeds of crime, reporting-entity duties and enforcement context. Also consult the Prevention of Money-laundering (Maintenance of Records) Rules, 2005, as amended.

[S5] RBI — Fraud Risk Management Directions, 2024#

https://systemhealth.rbi.org.in/Scripts/BS_ViewMasDirections.aspx_id%3D12702%281%29.html

Used for: governance of fraud controls, Early Warning Signals, Red Flagged Accounts, reporting and fair procedural safeguards. Issued for commercial banks/RRBs and AIFIs, with distinct 2024 directions for co-operative banks and NBFCs.

[S6] RBI — Digital Payment Security Controls Directions, 2021#

https://systemhealth.rbi.org.in/Scripts/BS_ViewMasDirections.aspx_id%3D12032%283%29.html

Used for: security governance, mobile/internet/card payments, fraud controls, secure authentication and customer awareness. Scope is entity-specific.

[S7] RBI — Charter of Customer Rights (2014)#

https://www.rbi.org.in/Commonperson/english/Scripts/PressReleases.aspx?Id=1507

Used for: five overarching customer-rights principles.

[S8] RBI — Customer Protection: Limiting Liability for Unauthorised Electronic Banking Transactions (2017)#

https://www.rbi.org.in/commonman/English/scripts/Notification.aspx?Id=2623

Used for: bank deficiency versus third-party breach versus customer negligence, reporting bands, customer liability and shadow reversal. This source does not automatically cover all voluntary payments induced by a scam; interpret the event facts first.

[S9] RBI — Internal Ombudsman for Regulated Entities Directions, 2023#

https://systemhealth.rbi.org.in/Scripts/BS_ViewMasDirections.aspx_id%3D12586.html

Used for: internal independent complaint review at covered entities; not the same as the external RB-IOS.

[S10] RBI — Reserve Bank–Integrated Ombudsman Scheme, 2026#

• Official scheme: https://rbidocs.rbi.org.in/rdocs/content/pdfs/SCHEME16012026_A.pdf
• Official 2026 FAQ: https://old.rbi.org.in/commonman/english/scripts/faqs.aspx?id=3407
• Official complaint portal: https://cms.rbi.org.in/

Used for: 1 July 2026 effective date, supersession of RB-IOS 2021 for new matters, first complaint to RE, current filing rule, admissibility, compensation, settlement/Awards and appeals. Do not cite the archived 2021 FAQ as the source of current time limits or award powers.

[S11] Ministry of Home Affairs / I4C — National Cyber Crime Reporting Portal#

https://cybercrime.gov.in/

Used for: 1930 financial-cybercrime helpline and police/cybercrime-reporting channel. Reporting a crime does not by itself constitute formal notice to a bank under its separate liability framework.

[S12] MeitY — Digital Personal Data Protection Rules, 2025#

https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf

Used for: data-protection framework and phased rule commencement. Privacy safeguards and AML retention duties may operate in parallel.

Source-accuracy rules#

1. Official RBI directions/schemes outrank coaching summaries.
2. Classify whether each rule is about banks, co-operative banks, NBFCs, PPI issuers or other REs.
3. Differentiate law enacted, direction issued, direction amended, and effective/commencement date.
4. RBI Ombudsman 2026, not 2021, is the current external framework for newly governed complaints.
5. PMLA criminal offences, regulatory fraud classification, unauthorised debit and a customer scam complaint have separate legal meanings.
6. Treat numerical liability caps, reporting limits, compensation and deadlines as current-data entries even if they have been stable for years.
7. Do not claim KYC/AML reports are proof of criminal guilt or guarantee of recovery.