RBI Master Direction on KYC: Periodic Updation Requirements for Bank Accounts

Why banks are required to periodically re-verify KYC

KYC (Know Your Customer) isn't a one-time exercise completed at account opening — RBI's Master Direction on KYC requires banks to periodically update customer KYC records, on the reasoning that a customer's risk profile, address, occupation, and financial behaviour can change meaningfully over time, and static, never-refreshed KYC records become a growing compliance and money-laundering risk the longer they go unreviewed.

The risk-based cycle

Banks are required to categorise customers into risk categories (typically high, medium, and low risk) based on factors including the nature of the customer's business/occupation, source of funds, location, and transaction patterns — and the frequency of periodic KYC updation is tied to this risk categorisation:

• High-risk customers: re-KYC required more frequently — commonly every 2 years.
• Medium-risk customers: a longer cycle — commonly every 8 years.
• Low-risk customers: the longest cycle — commonly every 10 years.

What "updation" actually requires

Depending on the customer's risk category and whether there have been material changes, periodic updation can range from a simplified self-declaration (for low-risk customers with no change in KYC-relevant details) to fresh documentary verification (updated address proof, identity proof) where the bank's records are outdated or the customer's risk profile has changed — banks are not required to demand the same intensity of re-verification from every customer regardless of risk category.

Video-KYC as a re-verification channel

RBI has permitted Video-based Customer Identification Process (V-CIP) as an accepted method for both initial account opening and periodic re-KYC in specified circumstances — allowing a customer to complete re-verification remotely through a live video interaction with a bank representative, rather than requiring an in-person branch visit, which has meaningfully reduced the friction of periodic KYC compliance for customers.

What happens if a customer doesn't complete periodic re-KYC

Banks are generally required to follow up with customers whose periodic KYC updation is due, and non-compliance can eventually lead to restrictions on account operations (in more persistent non-compliance cases) — though banks typically provide multiple reminders and a reasonable compliance window before imposing operational restrictions, rather than freezing an account immediately upon the updation date passing.

Why this matters beyond simple compliance

Periodic KYC updation is one of the structural mechanisms India's banking system uses to support anti-money-laundering (AML) and counter-terrorist-financing (CFT) obligations under the Prevention of Money Laundering Act framework — it isn't purely an administrative bank requirement, but part of the broader regulatory architecture banks operate within to detect and prevent the banking system being used for illicit financial flows.