What changed
RBI inserted an Explanation in paragraph 65 of the Payments Banks KYC Directions, 2025. It specifies that the entity which last uploaded or updated KYC records in CKYCR bears the responsibility for verifying the customer's identity and/or address. Banks downloading and relying on such current and compliant records are exempt from re-verifying identity/address, but must still handle all other CDD procedures.
What it means for you
This amendment reduces duplication of KYC verification for payments banks when they rely on CKYCR records, lowering operational costs and onboarding time. However, the downloading bank retains full responsibility for all other CDD aspects, so due diligence on record currency and compliance is critical. It aligns with the government's September 2025 office memorandum on CKYCR responsibility.
What you must do
- Update internal KYC policies to reflect that the last updater in CKYCR is responsible for identity/address verification.
- Ensure your bank's CKYCR uploads are accurate and timely to avoid liability for downstream users.
- When downloading KYC records from CKYCR, verify that records are current and PML Act/Rules compliant before relying on them.
- Document the reliance on CKYCR records and maintain audit trails for all CDD steps except identity/address verification.
Who it affects
Payments banks, Other banks using CKYCR for customer KYC, Compliance and AML teams, CKYCR system administrators
Does this amendment apply to all banks or only payments banks?
The amendment is specifically to the Payments Banks KYC Directions, 2025, so it directly applies to payments banks. However, the principle may influence broader KYC practices for other regulated entities.
What happens if the CKYCR records are not current or compliant?
The downloading bank must not rely on such records for exemption from re-verification. It remains responsible for all CDD procedures, including identity/address verification, if records are outdated or non-compliant.
Who is liable if a customer's identity is later found to be fraudulent?
The bank that last uploaded or updated the KYC records in CKYCR is responsible for verifying identity/address. The downloading bank is not required to re-verify, but must ensure records are current and compliant.