KYC paperwork: what banks ask for, and why they ask again

Know Your Customer is usually experienced as a document request and is more usefully understood as a question the bank is legally obliged to be able to answer: who is this customer, and does what they do with this account match what they said they would do with it.

That framing explains features of the process that otherwise look arbitrary. It explains why identity documents alone are not enough and the bank also asks what your business does and roughly what volumes to expect — because without that, the second half of the question has no baseline to be measured against. It explains why a bank that has known you for a decade still needs current documents, since the answer it gave the regulator was true as at a date. And it explains why the requirement does not soften for small accounts.

The obligation sits on the bank, not on you, which is the source of most of the frustration: the customer experiences an administrative demand while the bank is discharging a statutory duty. The framework comes from the Prevention of Money-Laundering Act and its rules, operationalised for banks through the Reserve Bank of India's Master Direction on Know Your Customer, which is the document that actually specifies what banks must collect and how often they must refresh it.

The Master Direction works with a defined category called an officially valid document, and a great deal of counter-level confusion comes from people not knowing that the category is closed rather than illustrative.

A document either falls within the prescribed list or it does not, and helpfulness is not a criterion. This is why a document that obviously proves who you are can still be declined for the purpose it is being offered for, and why staff who cannot explain the refusal in principle can only repeat that it is not accepted. It is also why one document can be acceptable as proof of identity and not as proof of current address — the two are separate requirements that some documents satisfy jointly and others do not.

The address problem is the recurring one. An officially valid document that carries an address which is no longer current does not establish where you live now, and the Direction provides for a deemed-OVD route where a document with an outdated address can be accompanied by prescribed proof of the current one. For a business, the parallel problem is premises held in someone else's name, which is why a lease with a no-objection letter and a utility bill is the familiar combination.

Because the list and the permitted substitutions are amended from time to time, the current Master Direction is the authority rather than a remembered list.

This is the part that feels like administrative failure and is not. The Master Direction requires banks to carry out periodic updation of records for existing customers — re-KYC — on a cycle keyed to the risk category the bank has assigned to the customer.

Two features of that design account for the experience. The first is that the cycle is risk-based rather than uniform: customers classified as higher risk are refreshed more frequently, and lower-risk customers much less often. The periodicities are specified in the Master Direction, commonly cited as two years for high risk, eight for medium and ten for low. The second feature is that the bank generally does not tell you which category you are in, and is not obliged to, so from the customer's side an event driven by an internal classification arrives without an explanation of its timing.

A further reason for apparent duplication is that KYC is held per relationship and per institution. Being fully verified at one bank does not verify you at another, and the Central KYC Records Registry exists to reduce that duplication rather than eliminate it.

The periodicities and the permitted procedures have been revised more than once, including changes to simplify updation where nothing has changed, so the current Master Direction is worth checking rather than assuming the cycle you were told about previously still applies.

The most useful thing to know about re-KYC is that it is not automatically a fresh document exercise.

Where there is no change in the information already held, the framework provides for the customer to confirm that by declaration rather than by resubmitting everything, and banks are permitted to accept that confirmation through channels that do not require a branch visit — registered email, registered mobile, ATMs, online banking and mobile banking among them, subject to the conditions the Direction sets. Where only the address has changed, there is provision for a declaration of the new address with subsequent verification by the bank rather than a full re-verification from scratch.

Video-based Customer Identification Process is the other route worth knowing exists: a live video interaction with an official of the bank, conducted to prescribed standards, which can serve for onboarding and for updation. It removes the branch visit rather than the process.

What this means in practice is that a re-KYC notice asking a long-standing customer with unchanged details to attend a branch with a full document set is often asking for more than the framework requires, and it is reasonable to ask the bank which route applies. What it does not mean is that the request can be ignored. The specific channels a bank offers are its own implementation choice within the Direction, so the bank is the one to ask.

The consequence of not completing periodic updation is not usually closure, and describing it as closure both overstates and understates what happens.

What typically follows is a progressive restriction of the account rather than its termination. Banks generally send reminders, then restrict operations — commonly allowing credits while blocking debits, or freezing operations altogether while the account continues to exist. The balance remains yours throughout; what is suspended is the ability to operate. That distinction matters because the fear of losing money drives people into exactly the panic the fraud in the next section exploits.

For a business the operational impact is disproportionate, because a partially frozen current account stops outward payments while continuing to receive them. Salary transfers, supplier payments and standing instructions fail, and each failure has its own downstream cost and, frequently, its own charge.

Restoring operations is a matter of completing the updation, after which the restriction is lifted. The specific sequence of reminders, the point at which restrictions begin, and how quickly they are removed are matters of the individual bank's board-approved policy within the regulatory framework, so the timeline is bank-specific. The general shape — reminders, then restriction, then restoration on compliance — is common, and it is worth acting on a notice while it is still a notice.

Because re-KYC is genuine, unpredictable from the customer's side, and carries a real consequence for inaction, it is close to ideal material for fraud — and the Reserve Bank has itself issued public cautions about it.

The pattern is consistent. A message or call claims that KYC is due and that the account will be blocked or closed imminently. The urgency is the mechanism: it exists to move the recipient past the step where they would have checked. The message then supplies the convenience that a real bank would not — a link to a form, an application to install, or a request to share a one-time password, card details, PIN or account credentials.

The reliable discriminator is not the wording, which can be perfect, but the request. Genuine updation never requires you to disclose a one-time password, a PIN or full card details to anyone, and no legitimate process requires installing a remote-access or screen-sharing application. The consequence of a real lapse is also not instantaneous closure, which is why extreme time pressure is itself evidence.

The safe response is to disregard the channel that contacted you and use one you already had — the number on your card or passbook, the bank's own app, or the branch — to ask whether an updation is actually due. A real requirement will still be there when you call.