ML/TF risk assessment and customer categories

The institution-wide risk assessment, customer categorisation and transaction monitoring use different reviews.

Published by Finin2min · Updated 24 October 2026

How this provision works

Document the bank’s ML/TF assessment across customers, countries/geography, products, services, transactions and delivery channels. It must be proportionate to the institution and reviewed at least annually; present the outcome to the Board or delegated committee.
Classify customers as low, medium or high risk based on actual factors such as identity, financial/business profile, location, product, delivery channel and transaction types. A single generic occupation score is not a substitute for these factors.
Keep the customer’s risk category and specific reasons confidential to avoid tipping off. This does not remove the obligation to provide appropriate customer-facing service and complaint communications.
Review account risk categorisation at least once every six months and align monitoring intensity with it. The 2/8/10-year periodic-document update minima are a separate requirement.

Practical illustration

A low-risk customer begins complex high-turnover activity inconsistent with the known profile. Ongoing monitoring and category reassessment cannot wait until the ten-year document-update anniversary.

The example is illustrative; it is not a reported company or court case.

Questions answered

Is the annual institution risk assessment the same as six-monthly customer-risk review?

No. They are different duties under paragraphs 10 and 41.

May the bank publish a customer’s exact internal risk reasons?

Paragraph 20 requires that category and its reasons to remain confidential to avoid tipping off.

Primary source and edition

Commercial Banks KYC Directions 2025, updated 1 October 2026; current tax-form transition cross-checked against the official e-filing department. Commercial Banks KYC Directions paragraphs 10–11,20,41.

Open the official instrument at this provision

Legal effect follows the instrument’s commencement and amendment provisions; a website upload date does not by itself change the law.

Related primary authorities

Scope and source editions

This explanation uses the Commercial Banks KYC Directions 2025, updated 1 October 2026, retrieved 24 October 2026. Its commercial-bank definition excludes Small Finance Banks, Payments Banks and Local Area Banks; those have separate directions. NBFCs also have a separate KYC direction and some paragraph numbers/procedures differ. Tax-form transitions are corroborated by current official e-filing guidance rather than copied from older tax-form references in the RBI consolidation.