By S&S Co. Advocates & Solicitors · Published 14 August 2026 · Informational content, not legal advice: see our disclaimer
The KYC Framework's Purpose
Know Your Customer (KYC) norms, set out in the Reserve Bank of India's Master Direction on KYC, require banks and other regulated entities to verify the identity and address of every customer before establishing an account relationship, and periodically thereafter, in order to prevent the banking system from being used, wittingly or unwittingly, for money laundering, terror financing, or other illicit financial activity, in line with obligations under the Prevention of Money Laundering Act, 2002 (PMLA).
Risk Categorisation and Customer Due Diligence
Banks are required to categorise customers into risk categories, typically low, medium and high risk: based on factors such as the customer's occupation, source of funds, the nature of the business relationship, and geographic considerations, and to apply correspondingly more rigorous due diligence for higher-risk customers, including enhanced ongoing monitoring of transactions and periodic re-verification of KYC documents at intervals shorter than those applicable to low-risk customers.
Periodic Updation and Video-Based KYC
RBI's framework requires periodic re-KYC even for existing customers, typically every two years for high-risk customers, eight years for medium-risk, and ten years for low-risk customers, though these periods are revised from time to time. RBI has also permitted Video-based Customer Identification Process (V-CIP) as an alternative to in-person verification for a range of KYC and re-KYC purposes, subject to specified technical and procedural safeguards to ensure the process is not misused.
Reporting Obligations Under PMLA
In addition to onboarding due diligence, banks must maintain records of specified transactions and file periodic reports, including Cash Transaction Reports and Suspicious Transaction Reports: with the Financial Intelligence Unit-India under the Prevention of Money Laundering Act, and must have internal systems capable of flagging transaction patterns inconsistent with a customer's declared profile for closer examination before any report is filed.
Frequently Asked Questions
How often must a bank update a customer's KYC details?
Periodic re-KYC intervals depend on the customer's risk category under RBI's framework: high-risk customers require more frequent re-verification (typically every two years) than medium- or low-risk customers, though banks should always check the current intervals prescribed in RBI's Master Direction as these are periodically revised.
Can KYC verification be completed entirely online?
Yes, for many purposes. RBI permits Video-based Customer Identification Process (V-CIP) as an alternative to in-person verification, subject to specific technical safeguards, alongside other digital KYC modes such as Aadhaar e-KYC where permitted.
What is a Suspicious Transaction Report?
A Suspicious Transaction Report (STR) is a report a bank is required to file with the Financial Intelligence Unit-India under the PMLA framework when it identifies a transaction, or pattern of transactions, that appears inconsistent with a customer's known, legitimate business or is otherwise suggestive of money laundering or connected illicit activity.
References & Further Reading
This article references the following statutory provisions and regulatory materials. Readers should always verify current rules, circulars and timelines against the applicable statute, regulation or RBI direction as amended, since these are revised from time to time.
- Reserve Bank of India, Master Direction: Know Your Customer (KYC) Direction, 2016 (as amended).
- Prevention of Money Laundering Act, 2002.