Know Your Customer (KYC) Framework

Know Your Customer refers to the statutory and regulatory procedures under which a bank or other regulated financial entity establishes and verifies a customer's identity before or during a financial relationship. In India, the obligation flows from the Prevention of Money Laundering Act, 2002 and the Prevention of Money-laundering (Maintenance of Records) Rules, 2005, both operative from 1 July 2005, with the Reserve Bank of India's Master Direction on Know Your Customer, dated 25 February 2016, translating the statutory obligation into operational rules for banks and other regulated entities. The framework is explicitly risk-based in design. Customer Due Diligence (CDD) is the baseline verification process; Enhanced Due Diligence (EDD) applies to higher-risk relationships such as politically exposed persons and complex ownership structures requiring identification of the ultimate 'beneficial owner' under Rule 9 of the 2005 Rules; and 'small accounts', with capped balances and transaction limits, offer simplified due diligence for customers lacking officially valid documents. Periodic re-verification (updation) is similarly staggered by assessed risk, at least once every two years for high-risk customers, eight years for medium-risk, and ten years for low-risk. Technology has progressively lowered the practical cost of compliance without lowering the standard. Video-based Customer Identification Process (V-CIP) allows remote verification without a branch visit, with business correspondents permitted to assist from 12 June 2025. The Central KYC Records Registry (CKYCR), operated by CERSAI, allows a single verified KYC record to be reused across institutions with customer consent rather than recreated at each new relationship; its 'CKYCR 2.0' upgrade, moving to consent-based real-time interfaces with Aadhaar masking, began rolling out from August 2026. Aadhaar-based e-KYC operates only through the voluntary, notified route under Section 11A of the PMLA (inserted in 2019), after the Supreme Court in Justice K.S. Puttaswamy v. Union of India (26 September 2018) struck down Section 57 of the Aadhaar Act, which had permitted private entities to compel Aadhaar authentication.

• 1 Statutory basis: PMLA, 2002 and PML (Maintenance of Records) Rules, 2005, in force from 1 July 2005; operationalised by the RBI Master Direction on KYC, 25 February 2016.
• 2 Risk-based design: Customer Due Diligence (CDD) baseline, Enhanced Due Diligence (EDD) for higher-risk relationships, simplified 'small accounts' for the undocumented.
• 3 Periodic updation intervals: 2 years (high risk), 8 years (medium risk), 10 years (low risk).
• 4 Beneficial owner identification under Rule 9 pierces shell/complex ownership structures.
• 5 V-CIP enables remote identity verification; business correspondents permitted to assist from 12 June 2025.
• 6 CKYCR (run by CERSAI) allows a single verified KYC record to be reused across institutions with consent; 'CKYCR 2.0' rollout began August 2026.
• 7 Aadhaar e-KYC for private entities is voluntary and notified only, under Section 11A PMLA (2019), after Puttaswamy (2018) struck down Section 57 of the Aadhaar Act.
• 8 India's Mutual Evaluation Report (FATF, June 2024 Singapore plenary) placed India in the 'regular follow-up' category, compliant/largely compliant on 37 of 40 Recommendations.

A migrant worker without a permanent address can open a 'small account' under simplified KYC, but faces the same periodic re-verification burden as a wealthy urban customer once the account matures, illustrating the proportionality tension the framework has yet to fully resolve.