RBI KYC Guidelines: A Step-by-Step Compliance Checklist for Banks and NBFCs

The RBI KYC guidelines stopped being a single document on 28 November 2025. On that date the Reserve Bank of India retired its 2016 Master Direction on KYC and issued in its place a separate Know Your Customer Direction for each of ten classes of regulated entity (Commercial Banks Direction); every one of those texts has since been amended. A compliance team still relying on the 2016 text, or on a vendor's summary of it, is citing paragraph numbers that no longer exist.

Most published commentary on the new Directions proceeds clause by clause. Read as a single customer file, from account opening through risk rating to the latest review, the obligations form a chain. The screening record sits along the way, and what, if anything, the institution reported comes last; a weakness near the start of that chain usually turns up as a finding near the end of it.

The checklist below sets out the KYC process as ten steps, in the sequence a bank or NBFC actually works through them. Each step carries its governing paragraph in the Commercial Banks Direction (CB) and in the NBFC Direction. For the Prevention of Money Laundering Act (PMLA) and other regulators, see our overview of KYC in India. This is general information, not legal advice; read the Direction that applies to your institution and take your own counsel.

Key takeaways

• On 28 November 2025 RBI replaced the single 2016 KYC Master Direction with ten entity-specific Directions. Work from the consolidated text for your own class.
• The KYC process runs in ten linked steps, from board-approved policy to PMLA record retention.
• Periodic KYC updation (re-KYC) intervals are tied to risk category: two years for high risk, eight for medium, ten for low.
• In the 2026 RBI penalty orders reviewed below, the recurring failures sit at hand-offs between stages, such as risk categories left unreviewed.

Which RBI KYC master direction applies to you

The first question in any KYC review is which text governs. On 28 November 2025 RBI published ten entity-specific KYC Directions, and it amended the set from 29 December 2025 (for commercial banks, RBI/2025-26/166 added an Explanation on CKYCR responsibility). Commercial banks cite RBI/DOR/2025-26/169, while the NBFC reference is RBI/DOR/2025-26/361. A Direction repeals the earlier KYC instructions only for its own class of entity (para 80 of the Commercial Banks Direction; para 73 of the NBFC Direction).

Scope is where mistakes usually creep in. Para 3 of the Commercial Banks Direction applies to banking companies, corresponding new banks and the State Bank of India. Small finance banks, payments banks and local area banks sit outside it, so the citations behind KYC norms for banks change with the type of bank. The NBFC Direction casts a wider net and covers every category and layer of NBFC, excluding only those with no customer interface.

RBI keeps a consolidated text of each Direction, with amendments footnoted, on its Master Directions page, and that consolidated version is the one a team should cite. "KYC master direction" is now best read as shorthand for whichever of these texts governs the institution.

The KYC process in banks and NBFCs: an RBI KYC guidelines checklist

For each step the checklist gives the obligation, the paragraph that governs it and the evidence an inspector will probably ask for. CB stands for the Commercial Banks Direction and NBFC for the NBFC Direction. An entity under a different Direction can map each step to the equivalent paragraph in its own text.

Step 1. Board-approved KYC policy and customer acceptance policy

Governing text: CB paras 6 and 16 to 18; NBFC paras 6 and 16 to 18. Outsourcing: CB para 13; NBFC para 13.

Para 6(1) requires the KYC policy to carry the approval of the board, or of a committee the board has empowered for the purpose. Para 16 then has the institution frame a customer acceptance policy that defines whom it will take on and whom it will turn away. For any outsourcing arrangement, the limit that matters is in para 13, worded identically in both Directions: the decision-making functions of determining compliance with KYC norms cannot be outsourced. A vendor may supply tools and process data. The decision, and the liability attached to it, stay with the regulated entity.

Evidence: the resolution by which the board or committee approved the current policy, and the customer acceptance policy itself. The outsourcing register should show that no third party is making the compliance decision.

Step 2. Identify the customer and verify identity

Governing text: CB and NBFC paras 21 (when identification is required), 23 (individuals), 33 to 37 (legal entities) and 38 (beneficial owners); beneficial owner thresholds in para 5(1)(iv).

Under CB para 21, identification is required when an account-based relationship begins and at other defined triggers, which for a commercial bank include occasional transactions of ₹50,000 or more. What the institution collects from an individual is set out in para 23. The customer provides one of four things: the Aadhaar number (in the cases specified), proof of possession of Aadhaar, an officially valid document or its equivalent e-document, or the KYC Identifier. That last option depends on the customer's explicit consent to download records from the Central KYC Records Registry. PAN or Form No. 60 is required in every case.

For legal persons, para 33 covers companies, para 34 partnership firms and para 35 trusts, while unincorporated associations and bodies of individuals come under para 36 and any other juridical person under para 37. Para 38 requires the institution to identify beneficial owners and to take reasonable steps to verify them. In the case of a company, para 5(1)(iv) treats an entitlement to more than 10 percent of its shares, capital or profits as a controlling ownership interest. Control also counts, including the right to appoint the majority of the directors or to control management or policy decisions. Listed entities are exempt from shareholder-level identification under para 38.

The Step 3 risk category is derived from what the institution records here about occupation, business type, geography and product, and an incomplete record at this stage weakens both the rating and the monitoring profile that rests on it.

Evidence: customer files holding the documents obtained under para 23, and beneficial ownership records that show how each owner was identified. A sample of legal entity files should contain what paras 33 to 37 require.

Step 3. Categorise risk (low, medium, high) and record the basis

Governing text: CB and NBFC para 20 (categorisation); para 41(1) (six-monthly review).

Para 20 requires every customer to be placed in a low, medium or high risk category. The text names the parameters: identity, social or financial status, nature of business activity, the customer's business and location, and the products, delivery channels and types of transactions used. Para 41(1) has the institution review the category at least once every six months.

Of all the settings in the process, the risk category carries the most consequence. The refresh interval in Step 8 comes from it. So does the depth of monitoring in Step 7, along with the question of whether enhanced due diligence applies, and failures connected with it recur among the charges in RBI's 2026 penalty orders.

Evidence: the risk categorisation methodology and the basis recorded for each customer's category, plus logs proving that the six-monthly review actually took place.

Step 4. V-CIP for customers onboarded remotely

Governing text: CB and NBFC paras 26 (when V-CIP may be used) and 27 (standards). Sub-paragraph references below are to the Commercial Banks Direction.

Para 26 permits V-CIP, the video-based customer identification process, for customer due diligence when onboarding new individual customers, the proprietor of a proprietorship firm, and the authorised signatories and beneficial owners of legal entity customers. V-CIP can also convert an existing account opened through non-face-to-face Aadhaar OTP e-KYC under para 25, and an eligible customer can complete updation or periodic updation of KYC by the same route.

Under para 27(1) the infrastructure sits within the institution's own premises, and each connection originates from its own secured network domain, encrypted end to end. The system can block IP addresses outside India, and CERT-In empanelled auditors audit the technology. Para 27(2) recognises four routes for establishing identity: Aadhaar OTP-based e-KYC, offline Aadhaar verification, a CKYCR download using the KYC Identifier, or an equivalent e-document of an officially valid document, including one obtained through DigiLocker. Where an offline Aadhaar XML file or Secure QR code is used, it can be no more than three working days old on the date of the V-CIP.

Each session is run by specially trained officials of the regulated entity, and an account opened this way does not become operational until a concurrent audit has taken place (para 27(2)(xv)). Under para 27(3), all data and recordings are stored in India. Our guide to V-CIP covers session requirements in more detail.

Evidence: session recordings carrying a geo-tag and timestamp, and an activity log naming the official who conducted each session. Every account should have its concurrent audit record; the CERT-In audit report belongs on file as well.

Step 5. Upload to CKYCR and reuse the KYC Identifier

Governing text: CB para 65; NBFC para 63.

After capturing a customer's KYC records, the institution uploads them to the Central KYC Records Registry within 10 days of commencement of an account-based relationship, under Rule 9(1A) of the PML Rules (CB para 65(2); NBFC para 63(1)). It then communicates the resulting KYC Identifier to the customer (CB para 65(7); NBFC para 63(6)). When a customer presents a KYC Identifier, the institution retrieves the record online rather than requesting the documents again (CB para 65(10); NBFC para 63(9)). That rule gives way where the customer's information has changed, the record is incomplete or outdated, documents have lapsed, or further verification or enhanced due diligence is needed.

An explanation inserted by the 29 December 2025 amendment places responsibility for verifying identity and address on whichever institution last uploaded or updated the record. An institution downloading a current, compliant record therefore does not need to re-verify those elements, although it remains responsible for the rest of customer due diligence. The operational setup is covered in our CKYC requirements guide.

Evidence: upload logs reconciled against accounts opened, and records of the KYC Identifiers communicated to customers. Any downloaded record that was re-verified should appear in an exception log.

Step 6. Sanctions and designated-list screening

Governing text: CB paras 56 to 59; NBFC paras 54 to 57.

Two UN Security Council (UNSC) lists are named in the Direction: the Security Council's list for ISIL (Da'esh) and Al-Qaida, and its Taliban list under UNSCR 1988. No account may be held for an individual or entity appearing on either. The institution also refers to the Schedules to the Prevention and Suppression of Terrorism (Implementation of Security Council Resolutions) Order, 2007. It verifies these lists every day, and each addition, deletion or change has to be applied (CB para 56(1) and (2); NBFC para 54(1) and (2)). For asset freezing under section 51A of the Unlawful Activities (Prevention) Act, the order of 2 February 2021 governs (CB para 56(4); NBFC para 54(4)).

The designated list under section 12A of the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) (WMD) Act, 2005 runs on a different cadence: the institution checks it at onboarding and periodically after that (CB para 57(3); NBFC para 55(3)). The UNSCR 1718 list on North Korea is verified daily (CB para 58; NBFC para 56).

Evidence: screening logs proving that each customer was checked before the relationship began, and evidence that list updates were loaded daily. A disposition record should exist for every potential match.

Step 7. Monitor transactions against the customer's profile

Governing text: CB and NBFC paras 39 to 41 (ongoing due diligence); CB para 55 and NBFC para 53 (alerting software).

Para 39 describes ongoing due diligence as a check on whether a customer's transactions fit what the institution knows of that customer's business, risk profile and source of funds. Para 40 lists transactions that warrant particular attention. Under para 41, how intensively an account is monitored follows from the risk category assigned in Step 3. See our guide to Transaction Monitoring in India.

Both Directions also require "robust software" that generates alerts when transactions are inconsistent with a customer's risk categorisation and updated profile (CB para 55; NBFC para 53). Those alerts can be no better than the profile assembled in Steps 2 and 3.

Evidence: monitoring scenarios and thresholds set by risk category, alongside alert volumes and disposition times. Any alert closed without escalation needs a documented rationale.

Step 8. Periodic KYC updation by risk tier

Governing text: CB and NBFC para 42.

Under para 42(1), the periodic updation clock starts at account opening or the last KYC updation, and the interval depends on the risk tier. High-risk customers fall due every two years. The interval is eight years for medium risk and ten for low risk. If an individual's KYC information has not changed, the institution obtains a self-declaration; CB para 42(3)(i) permits this through the registered email or mobile number, ATMs, digital channels or letter.

For low-risk individuals, para 42(2) has the institution allow all transactions and ensure updation within one year of the due date, or by 30 June 2026 if that is later, and keep such accounts under regular monitoring. That date has passed, so on a plain reading the one-year window is now the operative rule. The customer-facing side of the process is covered in our explainer on re-KYC.

Under para 42(7), the institution sends at least three advance notices before the due date, and after it at least three reminders go to customers who still have not complied, with at least one letter in each set. Every notice is recorded in the system against the customer as an audit trail; implementation was due by 1 January 2026. Legacy records not yet in CKYCR are uploaded at periodic updation, or earlier if updated information is obtained (CB para 65(8); NBFC para 63(7)).

Evidence: a register of updation due dates organised by risk tier, and records of the self-declarations received. Inspectors will also ask for the system record of notices and reminders under para 42(7), and they will look at how past-due accounts were treated.

Step 9. Report to FIU-IND

Governing text: CB paras 52 to 55; NBFC paras 49 to 53.

Information referred to in Rule 3 of the PML Rules goes to the Director, FIU-IND, within the time limits those Rules set (CB para 52; NBFC para 49), in FIU-IND's formats (CB para 53; NBFC para 50). Each day of delay in reporting a transaction, or in correcting a misrepresented one, is a separate violation (CB para 54; NBFC para 51). An institution may not restrict operations in an account solely because a suspicious transaction report has been filed, and the reporting itself is kept confidential (CB para 54; NBFC paras 51 and 52).

Evidence: filing records whose timestamps can be compared against the date suspicion was formed. The Principal Officer's escalation log and the acknowledgements received from FIU-IND belong alongside them.

Step 10. Record retention for the PMLA periods

Governing text: CB paras 50 and 51; NBFC paras 47 and 48. Retention periods derive from section 12 of the PMLA.

The institution keeps every transaction record, domestic or international, for no less than five years, counted from the date of each transaction (CB para 50(1); NBFC para 47(1)). Identification and address records follow their own clock, with the five-year minimum starting only once the business relationship ends (CB para 50(2); NBFC para 47(2)), and PMLA section 12 counts that period from the end of the relationship or the closure of the account, whichever is later. CB para 50(3) to (7) asks for records detailed enough to reconstruct individual transactions and quick to retrieve for a competent authority. In our reading, V-CIP recordings are identity evidence, so the second clock governs them.

Evidence: the retention schedule. An inspector may also ask for the file of a closed account, or for a transaction trail rebuilt from source records.

Changes from the 2016 Master Direction

Teams whose procedures still map the RBI guidelines for KYC onto the 2016 text have changes to act on, and most of them are structural.

• Entity-specific texts. Each of the ten classes of regulated entity RBI lists now has a Direction of its own, with independent paragraph numbering. Policies, procedures, training material and audit checklists that cite the 2016 Master Direction have to be re-mapped to the Direction governing the entity. RBI described the exercise as consolidating existing instructions on an “as-is” basis in its October 2025 consultation, so the change is mainly one of structure and numbering, not of principle.
• New paragraph numbers. V-CIP was para 18 of the 2016 Master Direction. In the Commercial Banks and NBFC Directions it now occupies paras 26 and 27, while other Directions number it differently (paras 27 and 28 for small finance banks, 25 and 26 for urban co-operative banks).
• Certified copies for foreign portfolio investors (18 September 2026). Under the Commercial Banks amendment of 18 September 2026 (RBI/2026-27/257), banks may accept from FPIs an original certified copy issued by a listed certifier, for example a notary public abroad or an Indian embassy (para 5(1)(v)). The same facility already existed for NRIs and persons of Indian origin. RBI made matching amendments that day for small finance, local area, regional rural, urban co-operative and rural co-operative banks; the NBFC Direction was not amended at that time.

Where teams fall short in RBI inspections

Four of the KYC penalty orders RBI announced in 2026 keep coming back to a short list of failures, most of them somewhere between onboarding and reporting.

RBI announced a penalty of ₹5.80 lakh on Muthoot Finance Limited in a press release dated 17 July 2026, imposed by an order dated 10 July 2026 for non-compliance with its KYC Directions. RBI sustained two charges against the company. It had no system of periodic review of the risk categorisation of accounts, and it lacked "robust software" for effective identification and reporting of suspicious transactions. The first is a Step 3 failure. The second breaks the link through which Step 7 monitoring feeds Step 9 reporting.

The same failure appears at a co-operative bank and at a second NBFC. By an order dated 11 March 2026, RBI penalised Walchandnagar Sahakari Bank Ltd., Maharashtra, ₹50,000 for failing to put in place a system of periodic review of risk categorisation at least once in six months. Muthoot Vehicle and Asset Finance Limited faced the same charge, which an order dated 13 July 2026 sustained with a penalty of ₹2.70 lakh. A separate obligation was at issue in the order of 20 March 2026, under which RBI penalised The Tanur Co-operative Urban Bank Limited, Kerala, ₹50,000 for failing to upload customers' KYC records onto CKYCR, the Step 5 obligation.

All four inspections assessed the financial position as on 31 March 2025, before the 2025 Directions were issued. The findings still apply because both obligations carried forward into the new texts. The six-monthly review now sits at CB and NBFC para 41(1) and at UCB para 40(1). For the CKYCR upload, the references are CB para 65, NBFC para 63 and UCB para 64.

Every one of these charges falls at a hand-off between stages. Three of the cases involved risk categories left unreviewed. At Tanur the records never reached the registry, while the software charge against Muthoot Finance concerns monitoring that did not reliably produce reports. Those hand-offs are where a single regulator-ready audit trail across onboarding, screening, monitoring and reporting counts for most, and that design principle sits behind KYC Hub's approach to digital KYC for India.

Measured in rupees, the penalties are modest. The larger cost is the remediation that follows a sustained charge. An institution that never ran the six-monthly review has to re-establish the risk category of every account before its Step 8 updation calendar, or its Step 7 monitoring thresholds, can be trusted again.

Want to test your own customer files against this ten-step chain? Talk to KYC Hub’s compliance team about where your onboarding, screening, monitoring and reporting hand-offs are exposed. Book a conversation today: https://www.kychub.com/book-demo