What changed
RBI inserted an Explanation in paragraph 66 of the Small Finance Banks KYC Directions, 2025. It specifies that the bank which last uploaded or updated customer KYC records to CKYCR bears responsibility for verifying identity/address. Banks downloading such records are exempt from re-verifying identity/address if records are current and compliant, but retain responsibility for all other CDD procedures.
What it means for you
This amendment reduces duplication of KYC verification for SFBs when they rely on CKYCR records uploaded by another bank. It clarifies liability: the uploading bank owns the verification, while the downloading bank must still ensure overall CDD compliance. This should streamline customer onboarding and reduce operational burden for SFBs using CKYCR.
What you must do
- Review your SFB's KYC processes to identify which entity last uploaded customer records to CKYCR.
- Ensure your SFB's uploads to CKYCR are accurate and compliant, as you bear verification responsibility.
- Update internal policies to reflect that downloading banks need not re-verify identity/address if records are current.
- Train staff on the new liability split: uploading bank verifies identity/address; downloading bank handles other CDD aspects.
Who it affects
Small Finance Banks, Compliance teams at SFBs, KYC operations teams, CKYCR system administrators
Does this amendment apply to all banks or only Small Finance Banks?
The amendment specifically modifies the Reserve Bank of India (Small Finance Banks – Know Your Customer) Directions, 2025, so it applies only to Small Finance Banks.
What happens if the CKYCR records are not current or compliant?
If the records downloaded from CKYCR are not current or compliant with the PML Act/Rules, the downloading bank cannot rely on the exemption and must verify identity/address as per standard CDD procedures.
Who is responsible if a downloading bank uses CKYCR records but fails in other CDD aspects?
The downloading bank remains fully responsible for all aspects of CDD procedure and provisions of the Directions, except verification of identity and/or address. So any other CDD failures are its liability.