Who Must Comply with RBI KYC Norms in India?
The RBI KYC Master Direction (formally Master Direction – Know Your Customer (KYC) Direction, 2016, last amended August 2025) is the authoritative KYC regulation for every entity the Reserve Bank of India oversees. It implements India's obligations under the Prevention of Money Laundering Act, 2002 (PMLA) and aligns with the Financial Action Task Force (FATF) 40 Recommendations.
Non-bank entities (fintechs, lending platforms, payment aggregators) without a direct RBI licence must comply through their banking partner's KYC programme or by becoming a KYC Registration Agency (KRA) under SEBI rules. See the full eKYC India guide for how digital verification fits into this framework.
Customer Due Diligence (CDD) Framework: SDD, CDD & EDD
The RBI KYC Master Direction establishes a risk-based approach (RBA) to customer identification. Regulated entities must classify every customer and product into a risk tier and apply the corresponding level of diligence. The August 2025 amendment expanded the definition of acceptable Officially Valid Documents (OVDs) and clarified digital CDD equivalence.
The Three CDD Tiers
Applies to: Jan Dhan accounts, small-value insurance (<₹50,000 premium), basic savings accounts, government welfare scheme accounts.
Key relaxations: No address proof required for low-balance accounts; self-declaration acceptable; reduced document requirements for rural populations.
Applies to: All retail customers, standard bank accounts, loan accounts, mutual fund investors, insurance policies above ₹50,000.
Requirements: Identity verification (Aadhaar / passport / voter ID / driving licence), address proof, PAN (mandatory for financial transactions >₹50,000), photograph. Can be done digitally via Offline Aadhaar eKYC or Video KYC (V-CIP).
Applies to: All retail customers, standard bank accounts, loan accounts, mutual fund investors, insurance policies above ₹50,000.
Requirements: Identity verification (Aadhaar / passport / voter ID / driving licence), address proof, PAN (mandatory for financial transactions >₹50,000), photograph. Can be done digitally via Offline Aadhaar eKYC or Video KYC (V-CIP).
RBI Master Direction — Para 40
Customers onboarded via OTP-based Aadhaar eKYC (online, non-face-to-face) are classified as non-face-to-face customers and subject to enhanced due diligence. Their accounts carry a ₹1 lakh/year cumulative debit cap until the customer completes face-to-face or Video KYC (V-CIP) verification.
Video KYC (V-CIP) — RBI Para 19 Requirements
Video KYC (V-CIP) was introduced by RBI in January 2020 (Para 19 of the Master Direction) and significantly expanded in the August 2025 amendment. It allows regulated entities to conduct fully compliant KYC without any physical interaction — while being treated as face-to-face equivalent, removing the ₹1 lakh transaction cap that applies to OTP eKYC.
V-CIP Mandatory Requirements (RBI Para 19)
OTP eKYC vs Video KYC: Transaction Limits
Periodic KYC: Risk-Based Review Schedule
Periodic KYC is not optional. Failure to conduct reviews on schedule can result in accounts being made inoperable. The June 2025 RBI circular significantly relaxed the process: customers can now complete KYC updation via net banking, mobile banking, or Video KYC without visiting a branch.
June 2025 RBI Amendment
RBI's June 2025 circular explicitly permits periodic KYC updation via digital channels, including net banking portals, mobile apps, and Video KYC, without requiring in-person branch visits. Regulated entities must implement this digital pathway by December 2025. eKYCNow's API supports automated periodic KYC reminders and digital re-verification flows.
AML, PEP Screening & STR Obligations
India's Anti-Money Laundering (AML) framework operates under the Prevention of Money Laundering Act, 2002 (PMLA) and the RBI KYC Master Direction. All regulated entities must screen customers against PEP lists, UNSC sanctions, and domestic watchlists, and file Suspicious Transaction Reports (STRs) with the Financial Intelligence Unit — India (FIU-IND) within prescribed timelines.
Key AML Obligations Under RBI Master Direction
eKYCNow's AML Screening India product screens against 1,200+ global watchlists, PEP databases, and sanctions lists in real-time, integrated directly into your onboarding API call.
CKYC & CERSAI: Mandatory Central KYC Registry
Aadhaar Vault & Tokenisation Requirements
Under UIDAI's Aadhaar Data Vault specification, every entity that receives an Aadhaar number, even temporarily during eKYC, must tokenise it into a Reference Key and store only the token, never the raw 12-digit number. The Aadhaar number itself must be stored in a UIDAI-compliant encrypted vault and must not appear in application databases, logs, or audit trails.
eKYCNow handles Aadhaar Vault and tokenisation automatically; your application only ever receives a Reference Key, never the raw Aadhaar number. This ensures your stack is compliant without any vault infrastructure of your own.
Penalties & Enforcement Timeline
Full RBI KYC Compliance Checklist for 2026
Use this checklist to audit your institution's compliance posture before the next RBI inspection or internal audit:
eKYCNow covers every item in the checklist above — Video KYC V-CIP, Aadhaar eKYC, AML/PEP screening, CKYC upload, and periodic KYC flows — in a single RBI & UIDAI compliant API. From ₹10/verification.
Frequently Asked Questions
What is the RBI KYC Master Direction?
The RBI KYC Master Direction is the Reserve Bank of India's consolidated regulation for Know Your Customer norms across all RBI-regulated entities — banks, NBFCs, payment banks, and fintechs. Last significantly amended in August 2025, it mandates Customer Due Diligence (CDD),
Who must comply with RBI KYC norms?
All RBI-regulated entities must comply: scheduled commercial banks, cooperative banks, NBFCs, payment banks, small finance banks, prepaid payment instrument issuers, and account aggregators. SEBI (securities), IRDAI (insurance), and PFRDA (pensions) entities follow parallel frameworks aligned with the same Master Direction principles. Unregulated fintechs must comply through their regulated banking partner's KYC programme.
Is Video KYC mandatory under RBI rules?
Video KYC (V-CIP) is not mandatory for all customers, but it is the only digital method that achieves face-to-face equivalent status under RBI Para 19 — removing the ₹1 lakh/year transaction cap and EDD classification that apply to OTP eKYC. For high-value accounts or remote customers, V-CIP is the only practical fully-compliant option. See the Video KYC India product →
What is the penalty for KYC non-compliance in India?
PMLA penalties can reach ₹1 lakh per day for continuing violations (e.g., failure to upload CKYC records, missed STR filings). RBI has additionally imposed monetary penalties of ₹1–5 crore on banks and NBFCs for systematic KYC failures — published on the RBI website, creating significant reputational risk. Severe or repeated violations can result in licence cancellation.
Is CKYC upload to CERSAI mandatory?
Yes. CKYC upload to CERSAI is mandatory for all regulated financial entities in India — banks, NBFCs, insurance companies, and securities intermediaries — within 3 working days of account opening. A customer's 14-digit CKYC number is then portable: they can onboard at any other regulated institution without repeating the full KYC process.
Can eKYCNow automate RBI KYC compliance?
Yes. eKYCNow by Message Central provides a single API covering every item in the RBI checklist: Aadhaar XML (offline eKYC), Video KYC V-CIP, PAN verification, DigiLocker document fetch, face liveness detection, AML/PEP screening, and CKYC support. Pricing from ₹10/verification 5 free checks — no credit card required →
What changed in the August 2025 RBI KYC amendment?
The August 2025 amendment made four key changes: (1) expanded the list of Officially Valid Documents (OVDs) to include new digital identity credentials; (2) clarified that Offline Aadhaar XML satisfies standard CDD; (3) strengthened deepfake-prevention requirements for V-CIP sessions; and (4) aligned India's AML/KYC framework with the FATF 2023 updated 40 Recommendations, bringing India in line with global standards.
What is the difference between eKYC and CKYC?
eKYC is the digital process of verifying a customer's identity at onboarding for a specific institution (Aadhaar-based, Video KYC, PAN-based etc.). CKYC is the portable, standardised KYC record stored in the CERSAI central registry — reusable across all regulated financial institutions nationwide. eKYC is how you collect the data; CKYC is how that data is shared and reused. See the complete eKYC India guide →