What changed
RBI inserted an Explanation in paragraph 65 of the KYC Directions, 2025, based on a September 2025 Department of Revenue office memorandum. It specifies that the regulated entity which last uploaded or updated customer KYC records in CKYCR bears responsibility for verifying identity and address. Banks downloading and relying on such current, compliant records are exempt from re-verifying identity/address but retain full responsibility for all other customer due diligence procedures.
What it means for you
This amendment reduces duplication of KYC verification for banks that use CKYCR records, lowering operational costs and turnaround time for onboarding. However, the downloading bank must ensure the records are current and compliant with PML Act/Rules, and remains accountable for all other CDD steps. Banks should update their internal processes to clearly document reliance on CKYCR records and verify their currency and compliance status.
What you must do
- Update internal KYC policies to reflect that the last uploading RE is responsible for identity/address verification.
- Ensure your bank's systems check that downloaded CKYCR records are current and compliant before relying on them.
- Document reliance on CKYCR records in customer files to demonstrate compliance with the new Explanation.
- Train CDD staff on the revised responsibility split: no re-verification needed for identity/address, but all other CDD obligations remain.
Who it affects
All commercial banks, KYC operations teams, Compliance and AML departments, Customer onboarding teams
Does this mean we never have to verify identity again if we use CKYCR records?
No. You can skip re-verifying identity and address only if the records you download from CKYCR are current and compliant with PML Act/Rules. You remain fully responsible for all other CDD procedures under the Directions.
Who is liable if a CKYCR record turns out to be incorrect?
The RE that last uploaded or updated the customer's KYC records in CKYCR is responsible for verifying identity and address. The downloading bank is not required to re-verify those aspects but must ensure the records are current and compliant.