Know Your Customer (KYC)
This domain tests customer due diligence: who the customer is, who really owns or controls the relationship, and whether the risk rating remains valid over time.
Core rules
- The KYC Master Direction (2016, as amended) requires a Customer Acceptance Policy, Customer Due Diligence (CDD) and risk-based monitoring; it is not a one-time account-opening form.
- Risk categorisation drives periodic updation: high risk at least every two years, medium every eight, low every ten.
- For legal entities, identify the beneficial owner; screen politically exposed persons (PEPs) and apply enhanced due diligence where risk is higher.
- Permitted digital routes include Aadhaar e-KYC, V-CIP and CKYC; a CKYC number must be verified against records, not merely quoted.
- Ongoing monitoring must test transactions against the customer profile; suspicion goes to FIU-IND as an STR.
Worked example
A customer declared a modest income and was rated low risk. Within six months, cash deposits of ₹18 lakh are made across three branches. The branch should treat this as a trigger event: reassess risk, obtain source-of-funds evidence, update CDD, and file an STR if the explanation is inconsistent. It should not close the account silently, because that can tip off the customer and defeat monitoring.
Traps
Treating KYC as one-time; accepting a beneficial-owner declaration without checking thresholds; screening PEPs only at onboarding; ignoring trigger events; assuming CKYC replaces CDD.