KYC / AML Touchpoints
KYC is not a signup step. You must understand your customer on an ongoing basis. You must also notice when their activity stops looking like their activity.
Which KYC rule applies to you depends on what kind of firm you are.
Until November 2025 there was one KYC Master Direction covering everyone. On 28 November 2025 the RBI repealed it and issued ten separate ones instead — one each for commercial banks, NBFCs, small finance banks, payments banks, local area banks, regional rural banks, urban co-operative banks, rural co-operative banks, all-India financial institutions, and asset reconstruction companies.
The core requirements are broadly the same across all ten. What differs is the law each one is made under, and some operational detail. If you are an NBFC, the payments-bank rules are not yours.
We have not yet identified which of the ten applies to every situation this page describes, so treat the specifics below as the shared baseline rather than your exact obligation.
If you run a regulated firm, Know Your Customer (KYC — the identity checks you must run on customers) is not a one-time signup form. The RBI framework treats it as an ongoing duty. You must understand who your customer is and what normal activity looks like for them. You must also notice when their pattern of use starts to look like money laundering.
The framework ties three things together:
- Onboarding checks when a customer first joins
- Periodic re-verification as their circumstances change
- Ongoing transaction monitoring against their expected pattern of behaviour
These are not separate compliance projects. They are three views of one continuous obligation.
Am I a Data Fiduciary?
KYC obligations under RBI's Master Direction run alongside your DPDP duties on the same data. Run the self-check to confirm where you sit under DPDP first.
Run it nowThat framing matters for product decisions. Your KYC team, fraud team, and compliance team look at the same customer. They should read from the same story about that customer. They should not run three independent stories that only meet in an incident review after something has gone wrong.
This page summarises finance and fintech expectations for orientation. For binding rulings on your product, consult qualified counsel and the primary source below.
Master Direction DBR.AML.BC.No.81/14.01.001/2015-16, 25 February 2016, updated as on 14 August 2025. Repealed on 28 November 2025 and replaced by ten entity-specific KYC Master Directions. The link is kept so you can read the old instrument. We have not yet confirmed which of the ten applies here.
Repealed — no status check recorded