KYC Norms in Banking: The Short Answer
KYC (Know Your Customer) norms are the rules a bank follows to identify and verify a customer, understand the purpose of the account and keep watching the transactions, so that the banking system is not used for money laundering or terror financing. In India, the norms are issued by the RBI under Section 35A of the Banking Regulation Act 1949, read with the Prevention of Money-Laundering Act (PMLA) 2002 and the PML (Maintenance of Records) Rules 2005. For commercial banks the current text is the RBI (Commercial Banks – Know Your Customer) Directions, 2025, dated 28 November 2025 and updated to 1 October 2026.
Key takeaway for bank exams: Learn the four key elements (Customer Acceptance Policy, Risk Management, Customer Identification Procedure, Monitoring of Transactions), the six OVDs, the re-KYC cycle of 2 / 8 / 10 years for high / medium / low risk, the small account limits (₹1 lakh credits a year, ₹10,000 withdrawals a month, ₹50,000 balance), and that CERSAI runs the CKYCR.
Every rule below is checked against the RBI KYC Directions text (updated 1 October 2026) and RBI FAQs. The November 2025 consolidation replaced the old KYC Master Direction 2016, which you will still see named in older books. For other banking laws, see important banking acts in India.
What Are KYC Norms? Meaning and Objective
KYC means the bank must know who the customer is, where they live, what they do and why they are opening the account. The objectives are:
- Prevent banks from being used, knowingly or unknowingly, for money laundering or terror financing.
- Help banks know and understand their customers and their financial dealings.
- Help banks manage risk by grading customers as low, medium or high risk.
KYC is part of the wider AML/CFT (Anti-Money Laundering / Combating the Financing of Terrorism) framework. India's financial intelligence agency that receives bank reports is FIU-IND (Financial Intelligence Unit – India).
Four Key Elements of KYC Policy (RBI)
The RBI Directions say every bank's Board-approved KYC policy must contain these four elements:
| Element | What it means |
|---|---|
| Customer Acceptance Policy (CAP) | Who the bank will or will not accept; for example, no account in an anonymous or fictitious (benami) name |
| Risk Management | Grading customers into low, medium and high risk and applying matching checks |
| Customer Identification Procedure (CIP) | Collecting and verifying identity and address documents at account opening and when needed later |
| Monitoring of Transactions | Watching account activity and reporting unusual or suspicious transactions |
Memory trick: remember A-R-I-M: Acceptance, Risk, Identification, Monitoring.
List of Officially Valid Documents (OVD) for KYC
The RBI definition names six OVDs:
| No. | Officially Valid Document |
|---|---|
| 1 | Passport |
| 2 | Driving licence |
| 3 | Proof of possession of Aadhaar number |
| 4 | Voter's Identity Card issued by the Election Commission of India |
| 5 | Job card issued by NREGA, signed by a State Government officer |
| 6 | Letter issued by the National Population Register with name and address |
PAN card is NOT an OVD. At account opening an individual gives one OVD (or Aadhaar authentication, or a KYC Identifier from CKYCR) plus PAN or Form No. 60 (Form 60 is used when the person has no PAN). This "PAN is not an OVD" point is a common exam trap.
Other accepted routes include Aadhaar e-KYC authentication (only by banks notified under Section 11A of the PMLA), offline Aadhaar verification (XML or Secure QR code not older than three working days), e-documents from DigiLocker, and downloading records from CKYCR. Banks must redact or black out the Aadhaar number on copies they keep.
Types of KYC: Physical, Digital KYC, V-CIP and e-KYC
| Method | How it works |
|---|---|
| In-person (physical) KYC | Customer visits with an original OVD; bank takes a certified copy |
| Aadhaar OTP-based e-KYC | Non-face-to-face; customer consents to OTP authentication. Accounts opened this way have extra limits until full KYC is done |
| Digital KYC | Bank officer captures a live photo of the customer and the OVD with the latitude and longitude of the place, using the bank's app; can be done through a Business Correspondent |
| V-CIP (Video based Customer Identification Process) | A live, consent-based audio-visual call in which an authorised bank official identifies the customer with facial recognition and completes due diligence |
| CKYCR download | Bank downloads the customer's existing record using the KYC Identifier |
Re-KYC (Periodic Updation of KYC): 2, 8 and 10 Year Rule
| Customer risk category | Re-KYC at least once every |
|---|---|
| High risk | 2 years |
| Medium risk | 8 years |
| Low risk | 10 years |
The period counts from the date of account opening or the last KYC update.
Recent RBI relaxations that are now part of the Directions:
- If there is no change in KYC information, or only the address has changed, the customer can give a self-declaration, including through the bank's Business Correspondent (BC).
- Re-KYC must be allowed at any branch, not only the home branch.
- During re-KYC, the customer is moved to the current due-diligence standard.
- If a customer's KYC record is already in CKYCR, the bank should fetch it with the KYC Identifier and must not ask for the same documents again.
Small Account Rules Under KYC Norms
A person without any OVD can still open a Small Account (a savings account under Rule 9(5) of the PML Rules). The bank takes a self-attested photograph, and a designated officer certifies that the person signed or put a thumb impression in their presence.
| Limit | Value |
|---|---|
| Total credits in a financial year | Not more than ₹1 lakh |
| Total withdrawals and transfers in a month | Not more than ₹10,000 |
| Balance at any time | Not more than ₹50,000 (government grants, welfare benefits and procurement payments are not counted for this limit) |
| Validity | 12 months, extendable by 12 more months if the holder shows proof of having applied for an OVD |
Beneficial Owner Thresholds in KYC (Most Asked in PO Exams)
When the customer is not an individual, the bank must identify the beneficial owner (BO), the real person behind the entity.
| Customer type | Beneficial owner is a person who holds |
|---|---|
| Company | More than 10% of shares, capital or profits, or control through other means |
| Partnership firm | More than 10% of capital or profits, or control |
| Unincorporated association / body of individuals (includes societies) | More than 15% of property, capital or profits |
| Trust | Author, trustee, beneficiaries with 10% or more interest, and anyone with ultimate control |
If no such natural person is found for a company, firm or association, the senior managing official is treated as the beneficial owner.
CKYCR and KYC Identifier: What Bank Exams Ask
- CKYCR (Central KYC Records Registry) stores customers' KYC records in digital form so that one KYC can be reused across banks, insurers, mutual funds and others.
- The Government authorised CERSAI (Central Registry of Securitisation Asset Reconstruction and Security Interest of India) to act as the CKYCR by notification dated 26 November 2015.
- A bank must upload the KYC record to CKYCR within 10 days of starting an account-based relationship.
- CKYCR gives each customer a unique KYC Identifier, which the customer can also view on the CKYCR portal (ckycindia.in).
Other KYC Rules: Records, PEPs and Reporting
| Rule | Requirement |
|---|---|
| Record of transactions | Keep for at least 5 years from the date of transaction |
| Identity and address records | Keep for at least 5 years after the relationship ends |
| Walk-in / occasional transactions | Customer due diligence for transactions of ₹50,000 or more (single or connected), and for any international money transfer |
| Politically Exposed Persons (PEPs) | Allowed as customers only with extra checks, including source of funds and senior management approval |
| Reports to FIU-IND | Cash Transaction Reports (CTR) and Suspicious Transaction Reports (STR), filed by the bank's Principal Officer |
| Compliance head | A Designated Director (MD or whole-time director) ensures overall PMLA compliance |
| Terror lists | Banks must not keep accounts of persons on UN Security Council or UAPA (Section 51A) lists, and must freeze assets when ordered |
Worked Examples on KYC Norms
Example 1 (re-KYC due date). A high-risk customer last updated KYC on 15 March 2025. High risk = every 2 years, so the next update is due by 15 March 2027. If the same customer were medium risk (8 years), it would be due by 15 March 2033.
Example 2 (small account check). A small-account holder receives ₹95,000 between April and January and then ₹8,000 in February. Total credits in the financial year = 95,000 + 8,000 = ₹1,03,000, which is above ₹1 lakh. The limit is breached, so the bank must not allow the credit that crosses ₹1 lakh until full KYC is done.
Example 3 (beneficial owner). In ABC Pvt Ltd, Ravi holds 12% of shares and Meena holds exactly 10%. Ravi is a beneficial owner (more than 10%). Meena is not a beneficial owner by shareholding, because the rule needs more than 10%, unless she controls the company in another way.
Example 4 (society). In a registered society, Arjun is entitled to 14% of its property. The threshold for an unincorporated association or body of individuals is more than 15%, so Arjun is not a beneficial owner on that basis.
KYC Norms Quick Revision Table
| Asked as | Answer |
|---|---|
| KYC norms issued by | RBI (under BR Act Section 35A, with PMLA 2002 and PML Rules 2005) |
| Current Directions | RBI (Commercial Banks – KYC) Directions, 2025, dated 28 Nov 2025 |
| Older document | KYC Master Direction 2016 |
| Four key elements | Customer Acceptance Policy, Risk Management, Customer Identification Procedure, Monitoring of Transactions |
| Number of OVDs | 6 (PAN is not one of them) |
| Re-KYC | High 2 years, Medium 8 years, Low 10 years |
| Small account | ₹1 lakh credits a year, ₹10,000 withdrawals a month, ₹50,000 balance; 12 + 12 months |
| CKYCR run by | CERSAI (notified 26 Nov 2015) |
| Upload to CKYCR | Within 10 days |
| Company BO threshold | More than 10% |
| Association BO threshold | More than 15% |
| Record keeping | 5 years |
| Reports go to | FIU-IND |
KYC Norms Questions with Answers (Practice Set)
Q1. Which of the following is NOT an Officially Valid Document under the RBI KYC Directions? (a) Passport (b) PAN card (c) Voter ID card (d) NREGA job card Answer: (b). PAN is collected separately (or Form 60), but it is not an OVD.
Q2. For a high-risk customer, periodic updation of KYC must be done at least once every: (a) 1 year (b) 2 years (c) 8 years (d) 10 years Answer: (b). 2 years; medium risk 8 years; low risk 10 years.
Q3. The maximum balance allowed in a Small Account at any time is: (a) ₹10,000 (b) ₹25,000 (c) ₹50,000 (d) ₹1 lakh Answer: (c). ₹50,000 (excluding government grants, welfare benefits and procurement payments).
Q4. Which organisation acts as the Central KYC Records Registry (CKYCR)? (a) NPCI (b) UIDAI (c) CERSAI (d) FIU-IND Answer: (c). CERSAI, authorised by the Government on 26 November 2015.
Q5. Which of these is NOT one of the four key elements of a bank's KYC policy? (a) Customer Acceptance Policy (b) Risk Management (c) Credit Appraisal Policy (d) Monitoring of Transactions Answer: (c). The fourth element is the Customer Identification Procedure.
Q6. For a company customer, a natural person is a beneficial owner if he or she holds: (a) more than 5% (b) more than 10% (c) more than 15% (d) more than 25% Answer: (b). More than 10% of shares, capital or profits (or control by other means).
Q7. Within how many days must a bank upload a new customer's KYC record to the CKYCR? (a) 3 days (b) 7 days (c) 10 days (d) 30 days Answer: (c). 10 days from the start of the account-based relationship.
Q8. In Digital KYC, along with the live photo of the customer and OVD, the bank's app also records: (a) the customer's PAN (b) the latitude and longitude of the location (c) a video recording (d) the customer's income Answer: (b). Geo-coordinates of the place where the photo is taken.
Q9. Under KYC rules, banks must keep records of transactions for at least: (a) 3 years (b) 5 years (c) 8 years (d) 10 years Answer: (b). 5 years from the date of the transaction.
Q10. A Small Account is first valid for how long? (a) 6 months (b) 12 months (c) 24 months (d) 36 months Answer: (b). 12 months, extendable by another 12 months if the holder shows proof of applying for an OVD.
KYC Norms FAQs
What are KYC norms in banking?
They are RBI rules that require banks to identify and verify customers, assess their risk and monitor their transactions, so that accounts are not used for money laundering or terror financing.
KYC norms are issued by whom?
The Reserve Bank of India issues KYC directions to banks, under Section 35A of the Banking Regulation Act and in line with the Prevention of Money-Laundering Act 2002 and its Rules.
What documents are required for KYC as per RBI?
Any one of the six OVDs (passport, driving licence, proof of possession of Aadhaar, voter ID, NREGA job card, NPR letter), or Aadhaar authentication or a CKYCR KYC Identifier, plus PAN or Form 60.
How often is re-KYC required?
At least once in 2 years for high-risk, 8 years for medium-risk and 10 years for low-risk customers, counted from account opening or the last update.
Can I do re-KYC without visiting the branch?
Yes. If nothing has changed, or only your address has changed, you can give a self-declaration through permitted channels, including the bank's Business Correspondent, and banks must allow updation at any branch.
What is V-CIP in KYC?
Video based Customer Identification Process: a live, consent-based video call in which an authorised bank official identifies the customer with facial recognition and completes due diligence without a branch visit.
What is a KYC Identifier?
A unique number given by the CKYCR (run by CERSAI) to each customer whose KYC is uploaded. Any bank can use it to download the record, so the customer need not submit the same documents again.
Practice Next
- Mock tests: IBPS and SBI Clerk Banking Awareness Mock Test 01, SBI Clerk General Awareness Mock Test 01, IBPS PO Mains Banking Awareness Mock Test 02 and Banking Acts and Financial Institutions Quiz 01.
- Related notes: RBI Ombudsman Scheme 2026, types of NBFC in India, financial inclusion schemes in India, types of cheques in banking, types of bank accounts in India and banking terms A to Z.
- Exam details: SBI Clerk 2026 notification and UCO Bank apprentice recruitment 2026.
- Browse all study notes.