Commercial-bank KYC: documents, account limits, updates and customer safeguards
The Commercial Banks – Know Your Customer Directions, 2025, updated on 1 October 2026, govern customer identification, beneficial ownership, ongoing checks and reporting. Different rules apply to full KYC, OTP-only onboarding, small bank accounts and periodic updates.
Finin2min · Updated 26 October 2026
Rules, scope and practical implications
Start with the bank category and the current version
These Directions apply to commercial banks as defined in paragraph 3; their bank definition excludes Small Finance Banks, Payments Banks and Local Area Banks. The broader definition of regulated entities elsewhere in the document does not expand this particular Direction’s scope. NBFCs have a separate KYC Direction. Overseas branches and majority-owned subsidiaries follow these requirements to the extent compatible with host-country law; stricter applicable standards and reporting of unresolved conflicts also matter.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 1–5
KYC is an ongoing process with customer protections
The bank must identify customers and beneficial owners, understand the intended relationship, assess money-laundering and terrorist-financing risk and monitor transactions. It must not open anonymous or fictitious-name accounts. Its acceptance policy must not arbitrarily exclude financially or socially disadvantaged people or persons with disabilities. An onboarding or update rejection needs a considered decision and recorded reasons. A third party may assist under the specified conditions, but the bank retains responsibility and cannot outsource the decision that KYC requirements are met.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 8–22
Distinguish an identity document from PAN
The officially valid documents are a passport, driving licence, proof of possession of Aadhaar number, voter identity card, a duly signed NREGA job card, or the National Population Register’s name-and-address letter. PAN is obtained separately, or Form 60 where applicable; PAN is not itself one of these six OVDs. Certain recent utility bills, municipal/property-tax receipts, pension orders and specified employer-accommodation documents may temporarily establish a current address when the OVD lacks it. They do not replace the requirement to submit a current-address OVD within three months.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 5(1)(xiv)
Aadhaar is not compulsory in every bank relationship
Aadhaar submission is required for the specified benefit or subsidy under a scheme notified under section 7 of the Aadhaar Act. Other individuals may use Aadhaar voluntarily or another permitted identification route. Authentication, offline verification, equivalent electronic documents and Digital KYC have different requirements. Where Aadhaar authentication is not required, the customer should redact or black out the Aadhaar number as instructed. An existing fully identified customer opening another product under the same UCIC does not need to undergo identity CDD afresh, although product-specific checks still apply.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 17
OTP-only onboarding has its own caps and one-year deadline
For accounts newly opened through Aadhaar OTP e-KYC without a face-to-face process, aggregate deposit balances across all such accounts must not exceed ₹1 lakh, and aggregate credits must not exceed ₹2 lakh in a financial year. Only term loans may be sanctioned, with aggregate sanction not exceeding ₹60,000 in a year. Complete the prescribed full identification within one year; otherwise the deposit account must be closed and no further debit is permitted in a borrowing account. The customer declares that no other OTP-based account has been or will be opened with another regulated entity. These limits do not apply merely because OTP is used for an eligible periodic update of an existing account.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 25
Video KYC is a live, auditable identification process
A compliant Video-based Customer Identification Process is treated on a par with face-to-face identification. It involves live consent, a trained bank official, an auditable recording, location and time checks, secure technology and India-based storage. Specified identity data or the Aadhaar XML/QR must satisfy the three-working-day freshness requirement. A concurrent audit is required before accounts become operational. A dropped call requires a fresh session; the detailed rule distinguishes a temporary pause from disconnection. Blinking, smiling or another particular facial gesture is not compulsory, so accessibility must not be defeated by insisting on it. A business correspondent may assist at the customer end; this does not transfer the bank official’s identification role.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 26–27
Small bank accounts are different from small wallets
A small bank account under paragraph 28 permits aggregate credits up to ₹1 lakh in a financial year, a balance up to ₹50,000 and aggregate withdrawals and transfers up to ₹10,000 in a month. The specified government grant, welfare-benefit and procurement-payment exception applies to the balance test. The account initially operates for twelve months, with a further twelve months when the customer produces evidence of applying for an OVD during the first period; the overall relaxation is reviewed after twenty-four months. Foreign remittances cannot be credited until full identity verification is completed. These are bank-account rules, not the ₹10,000 balance and conversion rules for small PPIs.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 28
Business accounts need the business and its people identified
A sole proprietor undergoes individual CDD and normally provides two listed proofs of business/activity. Accepting one is a bank discretion requiring the prescribed verification, not an automatic customer entitlement. Companies, partnerships, trusts and other legal persons need their applicable constitution/registration records, authority to operate, address and required PAN or Form 60, together with CDD of relevant signatories and beneficial owners. The document lists differ by entity; a trust’s checklist cannot be substituted for a company’s.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 30–38
Apply beneficial-owner thresholds precisely
For a company or partnership the controlling-ownership test is more than 10%; control through other means must also be considered. For an unincorporated association or body of individuals it is more than 15%. Trust identification includes the author, trustee, beneficiaries with 10% or more interest and any other natural person exercising ultimate effective control. A person at exactly 10% is not automatically exempt from a control-based company test. The specified senior-managing-official fallback and listed-entity exceptions apply only on their stated conditions.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 5(1)(iv)
Keep risk review and periodic KYC updates separate
Customer risk categorisation is reviewed at least once every six months. Periodic KYC updates are due at least every two years for high-risk customers, eight for medium-risk and ten for low-risk, measured from account opening or the last update. Monitoring remains ongoing between those dates. A no-change individual update can use a self-declaration through the permitted channels; an address-only self-declaration requires positive confirmation within two months, subject to the specified Aadhaar-OTP alternative. Documents, an inoperative account or another fact requiring fresh CDD must be handled under the relevant rule rather than assuming a declaration always suffices.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 20
Calculate low-risk update relief from the actual due date
For a low-risk individual, the bank must allow transactions and complete the KYC update within one year after its due date or by 30 June 2026, whichever is later, with regular monitoring. Thus an update due on 1 August 2026 has a 1 August 2027 outer date under this provision; it is incorrect to say all relief ended in June 2026. The bank must use the required advance notices and post-due-date reminders, including a letter in each group of at least three. The specified notice system had to be implemented by 1 January 2026.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025
Do not turn a PAN request into an invented freeze deadline
For existing customers, paragraph 43 links submission of PAN or Form 60 to a date notified by the Central Government. Temporary cessation is subject to the prescribed accessible notice, reasonable opportunity to be heard and safeguards, including illness, injury or old age. A customer who states in writing that they will not provide the documents is dealt with under the closure provision after identity and settlement safeguards. A website should not invent a universal freeze date from the mere existence of this clause.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 43
Non-face-to-face EDD is not a label for every digital account
Paragraph 44 addresses non-face-to-face onboarding outside the OTP-only paragraph 25 route and without physical meeting or V-CIP. It calls for additional safeguards, including PAN, positive address confirmation before operation, a first credit from the customer’s KYC-compliant bank account and high-risk treatment until face-to-face or V-CIP identification. If the bank offers V-CIP it should provide that as the first option for remote onboarding. A compliant V-CIP account should not be called high-risk merely because video technology was used.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 44
Read the PEP definition before applying enhanced checks
The defined politically exposed person category concerns individuals entrusted with prominent public functions by a foreign country. Such relationships require the stated source-of-funds/wealth checks, senior-management approval and enhanced ongoing monitoring; family members and close associates are also covered. Continuing an existing customer relationship after the customer or beneficial owner becomes a PEP requires senior-management approval. This definition should not be rewritten as a statement that every domestic political officeholder automatically falls within this particular defined category.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 45
Special customers have specific identification concessions
For a self-help group savings account, CDD of office bearers is sufficient; CDD of all members may be undertaken at credit linking. For a foreign student’s NRO account, passport, visa, admission evidence, photograph and overseas address are the initial documents, with local-address declaration and verification within thirty days. Pending verification, inward remittance is capped at USD1,000 and aggregate withdrawals at ₹50,000 during that thirty-day period. Students from Pakistan need prior RBI approval. These are specific concessions, not general exemptions from identification.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 47–48
Do not use the old three-category FPI table as today’s SEBI classification
The RBI Direction’s FPI documentary table still uses an older three-category structure. SEBI’s current consolidated FPI Regulations, last amended on 7 July 2026, name Category I and Category II in regulation 5. Category II includes investors not eligible for Category I, subject to the stated criteria; the regulation also permits SEBI to specify another category. For a current FPI relationship, use the applicable SEBI category and current documentary requirements rather than reclassifying an investor into a supposed current Category III solely from the older table.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 49; SEBI FPI Regulations 2019 consolidated last amended 7 July 2026; official linked PDF
Record retention and suspicious reporting have different purposes
Transaction records are retained for at least five years from the transaction. Customer-identification records are retained for at least five years after the relationship ends. Non-profit-organisation DARPAN registration records have their own five-year period after the relationship ends or the account closes, whichever is later. Suspicious transactions are reported to FIU-IND under the applicable reporting rules, with confidentiality and no tipping-off. Filing an STR alone must not restrict operation of the account; a separate lawful freeze or other restriction has its own basis.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 50–55
Sanctions matching needs the prescribed legal process
The bank checks the specified UN and government sanctions lists, including the required daily updates, and follows the UAPA section 51A and WMD Act section 12A implementation procedures. For a WMD match it must not transact and must inform the designated Central Nodal Officer with the required copies. A freezing order must be followed without delay. An unfreezing request must be forwarded with asset details within two working days. This process is different from automatically freezing an account merely because an STR was filed.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 56–62
Use CKYCR records instead of repeatedly demanding the same documents
New account-based KYC records are uploaded within ten days. Additional or updated information is furnished within seven days or another period notified by the Central Government. For opening, verifying or updating a relationship, the bank seeks or retrieves the KYC Identifier and obtains the current record online. It should not demand the same documents again unless a specified exception applies, such as changed, incomplete, expired or non-compliant information or a justified further identification or risk requirement. The last uploading/updating entity has the stated identity/address-verification responsibility; the downloading bank retains the remaining CDD responsibilities.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 65
Wire transfers require traceable originator and beneficiary information
All cross-border wires need the prescribed complete originator and beneficiary information. Domestic wires by an account-holding originator also require it. For a non-account-holder’s domestic wire, ₹50,000 is the threshold for the full accompanying information; below that amount, the specified traceable-reference alternative and information-access conditions apply. Deliberately splitting transfers does not avoid identification. A card/PPI purchase of goods or services with the required reference is excepted, but a person-to-person transfer using it is not automatically excepted. Ordering, intermediary and beneficiary banks each have distinct duties.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 74
Cash, third-party products and cheque validity are separate controls
Remittances and specified instruments of ₹50,000 or more must be funded by account debit or cheque, not cash, under paragraph 75. The third-party-product rules separately distinguish identity verification for a walk-in transaction above ₹50,000 from payment-method and PAN requirements for transactions of ₹50,000 or more. Cheques, drafts, pay orders and banker’s cheques presented beyond three months are not payable. These thresholds do not mean a new account below ₹50,000 is exempt from KYC.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 21
Governance, confidentiality and reporting remain bank obligations
The KYC policy is approved by the Board or a committee with delegated powers under the current provision. The bank designates responsible senior officers, performs the prescribed risk assessments and compliance reviews, trains staff and maintains an independent audit arrangement. Customer information is confidential and cannot be reused for cross-selling without express permission. Lawful disclosure exceptions and FATCA/CRS reporting requirements remain applicable. Consolidation into the 2025 Direction preserves earlier liabilities and actions; it does not erase them.
Sources: RBI Commercial Banks - Know Your Customer Directions, 2025 — paragraphs 6–15
Practical illustration and assumptions
Consider two different customers. An individual with a full-KYC bank account and a low-risk update due on 1 August 2026 is covered by paragraph 42’s later-date relief, with completion by 1 August 2027 and continued monitoring. Another individual opening a new Aadhaar OTP-only account on 1 August 2026 is subject to paragraph 25’s account caps and one-year full-identification condition. The two one-year periods come from different rules; neither turns the account into a small PPI. In a company account, a 10% shareholder may still be a beneficial owner through another means of control even though the ownership-percentage limb says more than 10%.
Questions answered
Is Aadhaar always required to open a bank account?
No. The specified benefit/subsidy case differs from voluntary use. Other permitted OVD and identification routes remain available subject to the Direction’s requirements.
Can the bank restrict an account only because it filed an STR?
No. Paragraph 54 prohibits a restriction merely on that basis. A separate valid freeze, identification failure or other lawful restriction must be assessed under its own applicable procedure.
Did all low-risk KYC update relief end on 30 June 2026?
No. The deadline is the later of one year after the particular due date and 30 June 2026. It must be calculated for the customer’s actual due date.
Official sources and editions
- RBI Commercial Banks - Know Your Customer Directions, 2025
- SEBI FPI Regulations 2019 consolidated last amended 7 July 2026; official linked PDF
Illustrations are hypothetical and depend on the stated assumptions. Official blank formats and guidance are identified separately from completed reports.