Banking, RBI & Payments

KYC Risk Categorisation: Why Some Bank Accounts Get Flagged as High Risk

CA Nikhil Gupta·July 2026· PMLA Rules & RBI KYC Master Direction PMLA / AML

Reviewed by CA Nikhil Gupta · Last reviewed 17 July 2026

Two customers with identical account balances can sit in completely different KYC risk categories — the classification has almost nothing to do with how much money is in the account, and almost everything to do with a specific set of risk indicators banks are required to assess.

What actually drives risk categorisation

Banks are required to categorise customers into risk tiers (commonly low, medium, and high) based on an assessment of factors including:

Customer's business or occupation — certain professions and business types are treated as inherently higher-risk from a money-laundering perspective (cash-intensive businesses, dealers in high-value goods, money service businesses, among others).
Politically Exposed Person (PEP) status — individuals holding (or having held) prominent public functions, and their close family members/associates, are treated as higher-risk given the elevated corruption/bribery risk associated with public office.
Geography — customers or transactions connected to jurisdictions identified as higher-risk (including countries flagged by FATF for AML/CFT deficiencies) attract closer scrutiny.
Nature and pattern of transactions — unusual volume, frequency, or structuring relative to the customer's stated profile.
Source of funds — where the origin of funds is unclear or inconsistent with the customer's known profile.
Delivery channel — non-face-to-face account relationships have historically been treated as carrying somewhat elevated risk compared to in-person, branch-verified relationships, though digital verification methods (like video-KYC) have evolved to manage this risk differently.

What "Politically Exposed Person" actually covers

⚠ PEP status isn't limited to the person themselves: PEP-related enhanced scrutiny typically extends to close family members and known close associates of a politically exposed person, not just the PEP's own accounts — this reflects the recognised risk that illicit funds connected to a PEP's public position could be channelled through family members' or associates' accounts rather than the PEP's own.

What changes for a high-risk-categorised customer

Enhanced Due Diligence (EDD) — more intensive documentation and verification at onboarding, potentially including source-of-wealth and source-of-funds documentation beyond standard identity/address proof.
More frequent periodic KYC updation — high-risk customers face materially shorter re-KYC cycles than low or medium-risk customers (see our related article on periodic updation timelines).
Closer, ongoing transaction monitoring — high-risk accounts are typically subject to more sensitive automated monitoring thresholds for flagging potentially suspicious activity.
In some cases, senior management approval is required before establishing or continuing a relationship with a high-risk customer, rather than standard branch-level account opening.

Simplified due diligence for genuinely low-risk customers

At the other end, customers assessed as genuinely low-risk (based on stable, transparent profiles — salaried individuals with regular, traceable income, for example) can be subject to simplified due diligence, with less onerous ongoing verification requirements — the risk-based approach is designed to concentrate compliance intensity where it is actually warranted, rather than applying maximum scrutiny uniformly to every customer regardless of actual risk profile.

Why this affects the customer experience directly

A customer categorised as high-risk may notice more frequent requests for document updation, occasional requests for source-of-funds clarification for larger transactions, and sometimes longer processing times for certain banking requests — this is generally a direct, visible consequence of the underlying risk categorisation and the enhanced due diligence framework attached to it, not arbitrary friction from the bank.

Frequently Asked Questions

Can a customer find out their own KYC risk category from their bank? ▼

Banks are not typically required to proactively disclose a customer's specific internal risk categorisation, since this is an internal compliance assessment — a customer noticing more frequent KYC updation requests or additional document requests can reasonably infer they may be in a higher-risk category, but banks generally do not publish or confirm the specific classification on request.

Does being a business owner automatically put someone in a higher KYC risk category than a salaried employee? ▼

Not automatically — but certain business types (particularly cash-intensive businesses, or those in sectors with historically higher money-laundering risk profiles) are more likely to be categorised as higher-risk than a standard salaried employment relationship with clear, regular, traceable income, given the differing inherent risk profiles the regulatory framework is designed to assess.

How long does a person remain classified as a PEP after leaving public office? ▼

PEP-related enhanced scrutiny has generally been understood to continue for some period after a person leaves the relevant public position, rather than ending immediately upon departure from office, reflecting the ongoing (if somewhat diminishing) risk profile — the exact duration/criteria for this continuing classification should be checked against the specific applicable guidance.

Source and review trail

Use the current official instrument, portal or regulator publication before acting. This panel separates the category authority from page-specific references.

Primary category: Banking, RBI & Payments
Official starting point: www.rbi.org.in

Page source links

The prior page did not embed a page-specific external source. The category authority above is the minimum verification starting point; a specific instrument should be added when available.