Know Your Customer, usually shortened to KYC, is a continuing process of understanding and verifying a customer relationship. It includes identity, relevant ownership or control, the purpose of the relationship and the information needed to assess risk. Collecting documents at onboarding is an important step, but it is not the whole process.
Central KYC records can support the efficient exchange of customer information where the applicable framework permits or requires it. They do not remove the institution's responsibility to understand its customer or to address conflicting and outdated information. A retrieved record and a completed due-diligence decision are different things.
For banks and NBFCs, an effective process combines customer convenience with reliable evidence. The goal is to ask for the right information, verify it appropriately, keep it current and use it in ongoing risk decisions without collecting unnecessary personal data.
Separate identity verification from customer understanding
Identity verification establishes that the institution has appropriately identified the person or entity. Customer understanding explains why the relationship exists and what activity is reasonably expected. A valid identity document alone cannot explain an unusual source of funds or a complex corporate structure.
RBI's commercial-bank KYC directions cover customer identification, due diligence, beneficial ownership, ongoing review and related requirements. [1] NBFCs have a separate institution-specific direction that must be checked for applicability. [4] The operational process should map to the relevant provisions rather than assume that all customer types require the same evidence.
Record information in a usable form. A folder of documents may contain the facts, but analysts need reliable structured fields for customer type, relevant ownership, business activity and risk assessment. Keep the documents linked to the fields they support.
Design onboarding around the customer category
An individual, sole proprietor, company, partnership and trust present different due-diligence questions. Define the required information and verification approach for each category under the applicable rules. Avoid a universal checklist that either misses important facts or requests irrelevant documents.
For legal entities, establish existence, authority to act and the relevant ownership or control structure. Confirm who can instruct the institution and how that authority was granted. A person signing an application is not necessarily the beneficial owner.
Make exceptions explicit. If information is missing, inconsistent or difficult to verify, route the case for an authorised decision. Do not allow a sales deadline to turn an incomplete file into an apparently completed one. Equally, avoid treating an administrative discrepancy as proof of misconduct without investigation.
Understand beneficial ownership and control
Beneficial-ownership analysis seeks to identify the relevant natural persons behind a legal structure, using the definitions applicable to the customer. Ownership percentages may be relevant, but control can also arise through other arrangements. A chart that stops at another company may leave the analysis incomplete.
FATF's beneficial-ownership materials provide international background on transparency of legal persons and arrangements. [2] For an Indian institution's actual customer decision, use the applicable domestic definitions, thresholds and verification requirements. Do not substitute a generic global threshold.
Retain the reasoning connecting the customer to the identified persons. Record the source of ownership information, inconsistencies found and how they were resolved. Where the structure changes, the previous analysis should remain available so the institution can explain what it knew at an earlier date.
Use CKYC records as part of a controlled workflow
The Central KYC Records Registry, or CKYCR, is a mechanism for receiving, storing and retrieving KYC records under the relevant framework. RBI's KYC directions address related obligations. [1] [4] Operational teams should understand the applicable upload, retrieval, update and customer-information requirements for their institution.
Match records carefully. Similar names and inconsistent dates can cause incorrect association. Use the prescribed identifiers and verification process rather than treating a search result as conclusive. Record the retrieval or submission outcome and resolve rejected or incomplete records.
A central record may need to be supplemented or updated for legitimate reasons under the applicable rules. Explain those reasons to the customer and avoid unnecessary repeat requests. Efficient reuse and responsible verification should work together, with clear handling of contradictions between a retrieved record and current information.
Make risk assessment explainable
Customer risk assessment should consider the factors relevant to the institution's framework, such as customer characteristics, products, delivery channels and geographical exposure. The assessment should lead to proportionate due diligence and monitoring, rather than becoming a label that nobody uses.
Document important reasons for the rating. A reviewer should be able to understand why a customer was assigned a particular category and what that decision changes operationally. Avoid unexplained scores whose inputs are unavailable or whose interpretation differs between teams.
Review overrides. An authorised adjustment can be appropriate when the standard assessment misses relevant facts, but it needs a recorded basis and review point. Repeated overrides in one segment may reveal a weakness in the underlying methodology.
A worked example: a company changes ownership
Suppose a hypothetical corporate borrower was onboarded with a verified ownership structure. During a later review, the relationship team learns that one holding company has changed and a new person can appoint a majority of the customer's directors. The customer name and registration number remain unchanged.
The institution should assess the new information under its applicable beneficial-ownership and customer-risk requirements. The task is not completed by replacing one company name in the chart. The team needs to understand the revised chain, verify relevant persons and reconsider any effect on risk or expected activity.
The file should preserve the earlier structure, the evidence of change, the updated assessment and the approval. This allows later reviewers to distinguish a newly identified development from information that should have been addressed earlier.
Keep periodic reviews connected to events
A periodic review provides a scheduled opportunity to update customer information. Event-driven review responds to relevant changes before that scheduled date. Examples can include ownership changes, a material change in business activity or information that conflicts with the existing profile.
Determine review timing from the applicable rules and approved risk framework. Avoid presenting one review interval as suitable for every customer and institution. The operational system should retain the basis for the next review date and the information used to calculate it.
Track the review population and unresolved cases. A completion percentage can conceal high-risk cases that remain incomplete. Report ageing, reasons for delay and the actions taken, while ensuring that any restrictions or customer treatment follow the applicable requirements.
Assess digital verification on its own merits
Digital onboarding can improve speed and accessibility, but the assurance depends on the method and its controls. Consider identity proofing, authentication, document integrity, fraud resistance and the handling of exceptions. A polished digital journey does not establish that these elements are reliable.
FATF's digital-identity guidance discusses how digital identity can support due diligence when its reliability and assurance are appropriately understood. [3] Institutions must still follow the domestic methods and conditions applicable to their process.
Test failure paths as well as successful onboarding. Consider interrupted sessions, inconsistent images, duplicate records and accessibility barriers. Provide an appropriate route for genuine customers who cannot complete the standard process, while preserving the required verification standard.
Protect customer information and decision records
KYC files contain sensitive personal and financial information. Limit access to legitimate responsibilities, control exports and record significant access or changes. Store only information that has a justified purpose and apply the relevant retention and deletion requirements.
Keep original evidence distinguishable from later corrections. If a customer updates an address, the system should show the current information without destroying the history needed to explain previous decisions. At the same time, avoid unnecessary duplication across uncontrolled email folders and local devices.
Management reporting usually needs aggregated trends rather than full identity documents. Design dashboards and committee packs accordingly. An effective control environment makes the right information accessible to authorised users without distributing sensitive records more widely than necessary.
Make review communications useful to customers
Tell customers what information is needed and why, using an approved explanation appropriate to the request. Avoid repeatedly asking for documents already verified unless the applicable process provides a reason.
Track communication failures separately from refusal to cooperate. An outdated address or inaccessible digital channel may explain non-response. Establishing the facts helps the institution apply the correct process and reduces unnecessary friction for genuine customers.
Test outcomes across the customer lifecycle
Quality assurance should sample onboarding, central-record handling, periodic reviews and event-driven updates. Examine whether the evidence supports the recorded decision, not merely whether every field is populated. Include cases with corrections, exceptions and changes in risk category.
Use findings to improve instructions and source quality. Repeatedly missing ownership links may require better guidance or specialist support. Frequent central-record rejections may indicate inconsistent data capture. Treat these as process issues rather than asking staff to work around them indefinitely.
KYC works best when it remains connected to the institution's understanding of the customer. Verified identity, reliable ownership information, current risk assessment and controlled review together create a record that can support responsible decisions throughout the relationship.
PRIMARY REFERENCES
Sources & further reading
Primary-source references checked on 12 October 2026. Follow the relevant authority’s current text for applicability, amendments and commencement dates. International standards provide context and are not automatically identical to domestic requirements.