Title, applicability and definitions
Freeze the regulated-entity class and defined terms before applying any onboarding control.
KYC and Customer Due Diligence
Identify the regulated entity and customer type, select the permitted identification route, then maintain ownership, monitoring and reporting records.
16 unitsBR Act/RBI Act with PMLA and PML RulesCurrent-source controlled
KYC and customer due diligence: the actual decision path
Identify the regulated entity and customer type, select the permitted identification route, then maintain ownership, monitoring and reporting records.
- The bank direction has its own commercial-bank definition. Small Finance Banks, Payments Banks and Local Area Banks have separate directions; the NBFC direction is also separate. Paragraph numbers below refer to the commercial-bank text, not a universal all-entity checklist.
- A Board or Board-delegated committee approves the bank’s KYC policy. It covers customer acceptance, risk management, identification and transaction monitoring. KYC compliance decisions cannot be outsourced.
- Aadhaar is not universally mandatory. Use the actual paragraph 23 route and applicable PAN/declaration requirements. A limited OTP e-KYC account, Digital KYC and V-CIP are different processes with different conditions.
- Beneficial ownership depends on entity type and control, not a universal 25-percent threshold. Periodic KYC uses 2/8/10-year high/medium/low-risk minima, with a specific low-risk-individual grace rule, while risk-category review is at least six-monthly.
- Maintain transaction records and relationship-identification records under their distinct five-year clocks, preserve FIU confidentiality and apply sanctions procedures. A filed STR alone does not authorise a blanket account freeze.
Practical illustration
A customer with current compliant CKYCR records opens another product at the same bank. Determine the existing-customer and CKYCR branches before asking for duplicate documents; still assess product risk, actual changes and required monitoring.
This illustration is not a reported company or court case.
Questions answered
Does one KYC checklist apply identically to every RBI-regulated entity?
No. The entity-specific direction and customer/product branches control; some NBFC procedures and paragraph numbers differ.
Does a longer page establish a better legal guide?
No. The useful comparison is whether it states the actual applicable conditions, exceptions, source edition and working document links.
Primary source and edition
Commercial Banks KYC Directions 2025, updated 1 October 2026; current tax-form transition cross-checked against the official e-filing department. Commercial Banks KYC Directions 2025, updated 1 October 2026: paragraphs 3,6,17,22–28,38,42,50–66,73–74
Read the actual official provision
Scope and source editions
This explanation uses the Commercial Banks KYC Directions 2025, updated 1 October 2026, retrieved 24 October 2026. Its commercial-bank definition excludes Small Finance Banks, Payments Banks and Local Area Banks; those have separate directions. NBFCs also have a separate KYC direction and some paragraph numbers/procedures differ. Tax-form transitions are corroborated by current official e-filing guidance rather than copied from older tax-form references in the RBI consolidation.
Module register
Board-approved KYC policy and designated responsibility
The Board framework must cover customer acceptance, risk management, CIP, monitoring and reporting.
Customer Acceptance Policy
Prohibit anonymous or fictitious accounts, apply risk parameters and avoid exclusion through mechanical documentation.
Risk management and ML/TF risk assessment
Risk category must be reasoned, reviewable and linked to monitoring intensity.
Customer Identification Procedure and third-party reliance
Trigger CIP at account commencement, qualifying occasional transactions, suspicion and structuring; ultimate responsibility remains with the RE.
CDD for individuals
Obtain and verify permitted identity/address records, PAN/Form 60 and business/financial information as applicable.
Digital records and V-CIP
Preserve consent, live interaction, geotag/audit trail, official verification and authorised-official evidence.
Sole proprietorships and legal entities
Verify entity existence, authorised persons and ownership/control structure.
Beneficial owner and special entity types
Apply legal-person-specific ownership/control tests and document the reasoning.
Ongoing due diligence and periodic updation
Monitor transactions against customer profile; review risk at least every six months and update KYC by risk cycle.
Enhanced due diligence for non-face-to-face onboarding
Prefer V-CIP, verify address/PAN, restrict mobile changes and monitor as high risk until stronger verification.
Politically Exposed Persons
Identify PEPs, establish source of funds/wealth, obtain senior approval and intensify monitoring.
Professional intermediaries and simplified cases
CDD reliance does not transfer ultimate responsibility; simplified routes require exact eligibility.
Record management and FIU reporting
Preserve retrievable CDD and transaction records and file complete CTR/STR and other reports within applicable timelines.
Sanctions, UAPA and international obligations
Screen customers and beneficial owners against current lists and retain escalation evidence.
FATCA/CRS, correspondent banking and wire transfers
Apply tax-information, respondent-bank, shell-bank and originator/beneficiary data controls.
Related provisions and official resources
- RBI Commercial Banks KYC Directions, 2025 (updated 1 October 2026)
- RBI KYC, customer due diligence and periodic update | Finin2min
- PPI-03: KYC and customer onboarding | Finin2min
- Current commercial-bank KYC consolidation, updated 1 October 2026
- Separate NBFC KYC Directions
- Income Tax Department: 2026 form mapping, including Form 97 (former 60) and Form 166 (former 61B)