§ The concepts

Know Your Customer (KYC) is the process of identifying and verifying a customer, understanding the relationship, and keeping that knowledge current.

Client Due Diligence (CDD), defined in the Rules, is due diligence carried out on a client using reliable and independent sources of identification, including identifying the beneficial owner and understanding the purpose and intended nature of the relationship.

Ongoing due diligence means scrutinising transactions throughout the relationship to ensure they are consistent with the entity's knowledge of the client, its business and risk profile, and the source of funds.

Aadhaar authentication

Permitted for banking companies; for other reporting entities only if notified by the Central Government after being satisfied as to privacy and security standards

Offline Aadhaar verification

Verification using the Aadhaar XML or QR code, without authentication through the central database

Passport

Issued under the Passports Act, 1967

Other officially valid documents

Such as the driving licence, voter identity card, job card under the rural employment scheme, and letter from the National Population Register, as defined in the Rules

Clients who choose other modes

A client cannot be denied service for not using Aadhaar authentication where other modes are available

📖 Justice K. S. Puttaswamy v. Union of India (Aadhaar), (2019) 1 SCC 1

The Constitution Bench struck down the 2017 amendment to the Rules that had made linking of bank accounts with Aadhaar mandatory, holding it disproportionate. Section 11A, inserted in 2019, now permits Aadhaar authentication by banking companies while preserving other modes of verification.

§ Looking through to the natural person

• The ultimate beneficial owner (UBO) is the natural person who ultimately owns or controls a client, or on whose behalf a transaction is conducted, including a person exercising ultimate effective control over a juridical person: Section 2(1)(fa).

• Companies. A natural person with a controlling ownership interest of more than ten per cent of shares, capital or profits, or who exercises control through other means.

• Partnership firms. More than ten per cent of capital or profits, or control.

• Unincorporated associations and bodies of individuals. More than fifteen per cent of property, capital or profits.

• Trusts. The author or settlor, the trustee, beneficiaries with ten per cent or more interest, and any natural person exercising ultimate effective control.

• Where no one meets the test, the relevant natural person holding the position of senior managing official is identified.

• The 2023 change. The thresholds for companies and partnerships were lowered to ten per cent from twenty-five and fifteen per cent; always check the current Rules.

Risk-based approach

Diligence proportionate to risk: simplified for low risk, standard for most, enhanced for high risk; drawn from FATF Recommendation 1

Customer risk categorisation

Low, medium or high, based on the customer's identity and status, business, geography, products used, delivery channel and transaction pattern

Periodic updation

Under RBI's KYC Master Direction, at least every two years for high risk, eight years for medium risk and ten years for low risk customers

Non-face-to-face customers

Additional verification; video-based customer identification under RBI directions

§ Section 12AA, in substance

Before each specified transaction, the reporting entity must: (a) verify the identity of the client by Aadhaar authentication, or such other mode as prescribed; (b) take additional steps to examine the ownership and financial position, including sources of funds; and (c) take additional steps to record the purpose of the transaction and the intended nature of the relationship.

Refusal. Where the client fails to fulfil these conditions, the entity shall not allow the specified transaction: s. 12AA(2).

Monitoring. If a specified transaction appears suspicious, the entity increases the future monitoring of the relationship: s. 12AA(3).

Specified transactions include cash withdrawals or deposits above a prescribed amount, foreign exchange transactions above a prescribed amount, high-value imports or remittances, and others notified.

§ High-risk customers and PEPs

• Politically exposed persons. The Rules, amended in 2023, define PEPs as individuals entrusted with prominent public functions by a foreign country, including heads of state or government, senior politicians, senior government, judicial or military officers, senior executives of state-owned corporations and important political party officials. Enhanced diligence applies to them and to their family members and close associates.

• Source of funds is where the money in a particular transaction came from; source of wealth is how the customer came to have their overall wealth. Both are examined for high-risk customers.

• Other high-risk customers include those with complex or opaque structures, businesses dealing mainly in cash, and customers linked to high-risk jurisdictions.

Central KYC Records Registry (CKYCR)

Operated by CERSAI; reporting entities upload the KYC records of new clients within the prescribed time after the relationship begins, and other entities may rely on the CKYC identifier

Identity records

Kept for five years after the business relationship ends or the account is closed, whichever is later: s. 12(4)

Transaction records

Kept for five years from the date of the transaction: s. 12(3)