A KYC restriction is usually a compliance-control issue, not proof that the customer committed fraud.
RBI’s KYC Direction requires regulated entities to conduct periodic KYC updates on a risk-based cycle.
Customers should notify the regulated entity of changes in KYC documents within the prescribed period.
Where the existing information remains unchanged, the bank may permit self-declaration or other permitted update methods under the current framework.
Restrictions should be addressed only through the bank’s official branch, app, website or approved video/customer-service channel.
What the customer or business should understand
- RBI’s KYC Direction requires regulated entities to conduct periodic KYC updates on a risk-based cycle.
- Customers should notify the regulated entity of changes in KYC documents within the prescribed period.
- Where the existing information remains unchanged, the bank may permit self-declaration or other permitted update methods under the current framework.
- Restrictions should be addressed only through the bank’s official branch, app, website or approved video/customer-service channel.
- No genuine KYC update requires sharing an OTP, UPI PIN or remote-control access with an unsolicited caller.
The five-point review
| Check | What to examine |
|---|---|
| Reason | Periodic update, document expiry, address, PAN or risk review. |
| Scope | Debit, credit, channel or complete account restriction. |
| Requirement | Specific document or declaration requested. |
| Channel | Branch, app, video KYC or other bank-approved route. |
| Closure | Update acknowledgement and restoration timeline. |
Practical example
A low-risk customer’s address and identity documents are unchanged, but the account is restricted for periodic KYC. The user should ask whether the bank’s permitted self-declaration route is available rather than sending documents to a number received by SMS.
How to apply the framework
Separate KYC restriction from law-enforcement freeze. The branch should identify which issue applies.
Keep proof of submission and follow up if the restriction continues after the bank confirms completion.
Dispute workflow
Classify the problem before choosing the remedy
Identify the regulated entity, transaction or loan account, date, amount, contractual document and exact failure. Review reason, scope and requirement together. A failed transaction, authorised mistake, unauthorised fraud, merchant dispute, credit-report error and lawful account freeze require different remedies.
Create one written chronology
Record the event, alert, discovery, first report, complaint number, response and financial impact in date order. Attach only the documents that prove each step. Phone calls can stop urgent harm, but a written acknowledgement creates the escalation record.
Escalate to the correct authority
Start with the bank, card issuer, lender, credit institution, app or other regulated entity responsible for the service. Use cybercrime or law-enforcement channels for suspected fraud. Use RBI CMS only after the regulated entity process satisfies the Scheme’s timing or rejection condition and the issue is within Ombudsman scope.
Implementation checkpoint
Before treating the case as closed, verify the actual bank statement, loan ledger, credit report, account status or merchant refund rather than relying only on a ticket message. Record who confirmed the financial outcome, the date, remaining open amount and the next escalation deadline. This final check prevents a complaint from being marked resolved while the money, lien, overdue status or credit record remains unchanged.
Action checklist
- Read the bank’s official notice.
- Call the official bank number.
- Ask for the exact KYC deficiency.
- Use an approved update channel.
- Obtain acknowledgement.
- Escalate unexplained delay through bank grievance and RBI CMS if eligible.
Evidence to keep
- Bank KYC notice
- Documents/declaration submitted
- Submission acknowledgement
- Account restriction screenshot
- Grievance and restoration record
Warning signs
- Link received from unknown number
- Request for OTP or remote app
- Bank cannot state reason
- Repeated full-document demand despite unchanged record
- Restriction described as police freeze without reference
Finin2min takeaway
Banking disputes are resolved through classification, speed, written evidence and the correct escalation route. No legitimate bank, regulator or recovery process requires disclosure of an OTP, UPI PIN or remote-control access.
Frequently asked questions
How often is periodic KYC required?
It is risk-based under the current RBI framework.
Must unchanged customers always visit a branch?
No; permitted self-declaration or remote routes may be available.
Can KYC be done through a random agent?
Use only official bank channels.
Can Ombudsman be approached?
After the bank grievance process for eligible service deficiency.