Knowledge base · Anti-money laundering
What is Know Your Customer (KYC)?
Short answer
Know Your Customer (KYC) is the set of procedures a regulated entity uses to identify and verify its customers and their beneficial owners, understand the purpose of the relationship, assess risk and monitor transactions. In India, KYC rests on s. 12 of the PMLA 2002 and, for commercial banks, the RBI (Commercial Banks – Know Your Customer) Directions 2025.
Definition of Know Your Customer (KYC) (also: KYC, customer due diligence, CDD, KYC norms, know your client)
Know Your Customer (KYC) is the process by which banks and other regulated entities establish who their customers are and whether doing business with them poses a risk of money laundering, terrorist financing or fraud. It is the frontline preventive control in India's anti-money laundering framework.
KYC is not a single document check at account opening. It covers identification and verification, understanding the nature and purpose of the relationship, risk categorisation, ongoing monitoring and periodic updating.
What is the legal basis for KYC in India?
Section 12 of the Prevention of Money-laundering Act 2002 requires reporting entities to verify the identity of their clients and beneficial owners, maintain records and report to FIU-IND. Detailed requirements are set by the PML (Maintenance of Records) Rules 2005 and by each sector regulator.
For commercial banks, the current instrument is the RBI (Commercial Banks – Know Your Customer) Directions, 2025, dated 28 November 2025 and updated as on 1 October 2026. It repealed the Master Direction – Know Your Customer (KYC) Direction 2016 for commercial banks. Parallel 2025 KYC Directions apply to other categories of regulated entities. SEBI, IRDAI and other regulators have their own KYC rules for their sectors.
What are the main elements of KYC?
Customer due diligence (CDD). The Directions define CDD as identifying and verifying the customer and the beneficial owner using reliable and independent sources of identification. For legal entities, this includes identifying the natural persons who own or control them.
Risk categorisation. Banks must classify customers as low, medium or high risk based on their own assessment, considering factors such as the customer's profile, geography, products and channels.
Enhanced due diligence. Higher-risk relationships, including non-face-to-face onboarding and politically exposed persons, require additional measures such as establishing source of funds and senior management approval.
Sanctions screening. Banks must ensure that customers do not match individuals or entities on designated sanctions lists, including UN Security Council lists, before onboarding and on an ongoing basis.
Ongoing monitoring and reporting. Transactions are monitored against the customer's profile using alert systems, and suspicious transactions are reported to FIU-IND. The Directions state that a bank must not restrict account operations merely because a suspicious transaction report has been filed.
Periodic updation. KYC records must be refreshed at least every two years for high-risk, eight years for medium-risk and ten years for low-risk customers.
How has KYC changed with digital onboarding?
Video-based Customer Identification Process (V-CIP) lets an authorised bank official identify a customer by live video, treated on par with face-to-face identification, subject to minimum standards including liveness checks, spoof detection and data storage in India. The Central KYC Records Registry (CKYCR) lets entities rely on an existing verified record instead of re-collecting documents, while keeping their other due diligence duties.
Where does KYC fail?
KYC breaks down when documents are genuine but the person behind the account is not the true user, as with mule accounts rented out to fraudsters. It also fails when beneficial ownership is concealed through layers, when risk ratings are not revisited as behaviour changes, and when transaction monitoring alerts are closed without real review. Many bank and cyber-fraud investigations trace back to accounts that passed KYC on paper.
How does KYC differ from related terms?
Customer due diligence is the core component of KYC; KYC is the wider programme. Due diligence on business partners applies similar thinking to suppliers, distributors and acquisition targets, usually without a statutory mandate. Background verification focuses on individuals such as employees and directors. Our guide to business partner due diligence in India explains how companies outside the financial sector adapt KYC-style checks.
Spectra Forensics' integrity due diligence service covers identity, ownership and reputation checks on counterparties.
Frequently asked questions
How often must a bank update a customer's KYC?
Under the RBI (Commercial Banks – Know Your Customer) Directions 2025, banks must carry out periodic updation at least once every two years for high-risk customers, every eight years for medium-risk customers and every ten years for low-risk customers. The period runs from account opening or the last KYC update. Banks may update sooner if risk or customer information changes.
Does KYC apply to companies outside the financial sector?
The statutory KYC obligation applies to reporting entities under the PMLA, such as banks, NBFCs, intermediaries and certain professionals for specified activities. Other companies have no general legal duty to perform KYC on customers, but many apply similar checks to suppliers, distributors and partners as part of due diligence and anti-bribery programmes, because the same risks of concealed ownership and illicit funds apply to them.