Co-operative bank KYC is governed by two RBI instruments issued on 28 November 2025: the KYC Directions, 2025 for Urban Co-operative Banks and a parallel set for Rural Co-operative Banks. Both require risk-based due diligence, timely CKYCR uploads, periodic updation, and controlled use of Aadhaar and V-CIP. Most 2026 penalties trace back to CKYCR upload failures.
When RBI repealed the 2016 KYC Master Direction in November 2025, it replaced one shared text with entity-specific Directions. For a co-operative bank, that was more than a renumbering exercise. Compliance manuals, audit checklists and vendor contracts that cited the old paragraphs now point to a document that no longer exists.
This guide is written for compliance and IT heads at urban co-operative banks (UCBs), state co-operative banks (StCBs) and district central co-operative banks (DCCBs). It covers which Directions apply, where enforcement is landing, what technology constraints matter, and a practical stack for digitising KYC.
Which KYC Directions apply to co-operative banks
| Bank type | Applicable instrument | Notes |
|---|---|---|
| Urban co-operative banks (primary co-operative banks under the Banking Regulation Act, 1949) | Reserve Bank of India (Urban Co-operative Banks – Know Your Customer) Directions, 2025, dated 28 Nov 2025 | Updated as on 18 Sep 2026, after an amendment; Directions, 2026 extended the certified copy facility to FPIs |
| State co-operative banks and district central co-operative banks | Reserve Bank of India (Rural Co-operative Banks – Know Your Customer) Directions, 2025, dated 28 Nov 2025 | Amended on 29 Dec 2025 with an explanation on CKYCR records |
Both sets follow the same architecture as the Directions for commercial banks, adapted to co-operative banks. Policies should now cite the applicable 2025 Directions, and paragraph mapping from the old Master Direction should be reviewed by legal rather than carried over by assumption.
Core co-operative bank KYC obligations under the 2025 Directions
Customer due diligence and risk categorisation
Banks must identify and verify customers using officially valid documents or permitted digital routes, identify beneficial owners for legal entities, and categorise customers by risk. The risk category drives the depth of due diligence and the frequency of review.
CKYCR upload and retrieval
The Directions define the Central KYC Records Registry as the store for customers’ digital KYC records and the KYC Identifier as the number it assigns. Banks must upload KYC records within the prescribed timeline and can retrieve records using the KYC Identifier with the customer’s explicit consent. Retrieval reduces repeat document collection, but only if the bank’s own uploads are complete.
Periodic updation
The UCB Directions set a risk-based cycle: at least once every two years for high-risk customers, eight years for medium-risk and ten years for low-risk. Where KYC information has not changed, a self-declaration is sufficient. For a change of address, the bank obtains a self-declaration and verifies the new address within two months. Banks must send at least three advance intimations, one by letter, and three reminders after the due date.
V-CIP
Video-based Customer Identification Process (V-CIP) is permitted for new individual and legal entity customers, for converting Aadhaar OTP-based accounts, and for periodic updation. Requirements include infrastructure on the bank’s premises or secured network, blocking of non-Indian and spoofed IP addresses, geo-tagged and time-stamped recordings, liveness and face matching, data stored in India, and concurrent audit before accounts become operational.
Aadhaar OTP-based e-KYC limits
Accounts opened in non-face-to-face mode using Aadhaar OTP e-KYC carry limits under the UCB Directions: deposit balances up to Rs 1 lakh, aggregate annual credits up to Rs 2 lakh and term loans up to Rs 50,000 in a year, with full due diligence to be completed within one year. These limits do not apply when OTP e-KYC is used for periodic updation, provided the mobile number matches the bank’s records.
What RBI penalties in 2026 tell us
Recent co-operative bank KYC enforcement has a clear pattern: CKYCR uploads.
| Bank | Type | Date | Penalty | KYC deficiency cited |
|---|---|---|---|---|
| The Tanur Co-operative Urban Bank Ltd, Kerala | UCB | Press release 23 Mar 2026 (order 20 Mar 2026) | Rs 50,000 | Failed to upload customers’ KYC records to CKYCR |
| Dharmavir Sambhaji Urban Co-operative Bank Ltd, Pune | UCB | Press release 29 Jun 2026 | Rs 10,000 | Did not upload KYC records to CKYCR within prescribed timelines |
| The Monghyr-Jamui Central Co-operative Bank Ltd, Bihar | DCCB | Order 25 Sep 2026 | Rs 5 lakh | Did not upload KYC records to CKYCR within prescribed timeline |
The amounts are modest, but each order is published, named and visible to members, depositors and auditors. The Pune case arose from a statutory inspection with reference to the bank’s position as on 31 March 2025, which means lapses surface a year or more later.
Three practical lessons follow:
- CKYCR upload is treated as a measurable obligation; backlogs show up in inspections.
- The issue is rarely policy; it is process and system. Records stuck in paper files, incomplete fields, or failed batch uploads all count.
- Rural banks are not exempt. A DCCB received the largest of the three penalties.
Aadhaar authentication for co-operative banks
On 21 August 2025, UIDAI launched an Aadhaar authentication framework for co-operative banks, developed with the Ministry of Cooperation, NABARD, NPCI and co-operative banks. Under it, the 34 state co-operative banks register with UIDAI as Authentication User Agencies (AUA) and e-KYC User Agencies (KUA). The 352 district central co-operative banks use their parent StCB’s Aadhaar application and IT infrastructure, so they do not need separate systems. Services covered include biometric e-KYC, face authentication, AePS, and the Aadhaar Payment Bridge.
For UCBs, the route to Aadhaar authentication depends on the bank’s own UIDAI approval or arrangement, and compliance teams should confirm their status with UIDAI before designing journeys around it. Where Aadhaar authentication is not available, the Directions still allow officially valid documents, DigiLocker-issued documents and V-CIP.
Two cautions apply regardless of route. Aadhaar is not mandatory for KYC unless the customer seeks a government benefit or subsidy, and where authentication is not performed, the Aadhaar number must be redacted.
Technology constraints in co-operative bank KYC
Most co-operative banks run on core banking systems supplied by a vendor or shared through a sponsor bank or federation. That creates constraints that private banks do not face:
- Limited change capacity: New fields, APIs or workflows depend on vendor release cycles.
- Shared infrastructure: DCCBs depending on StCB systems inherit their timelines.
- Data quality debt: Legacy customer records often lack PAN, mobile numbers, or complete addresses, which causes CKYCR upload rejections.
- Small compliance teams: One or two officers may own KYC, AML, CKYCR and reporting.
- Branch-heavy operations: Documents are captured on paper at branches and keyed in later, creating errors and delays.
Governance links to regulatory categorisation as well. Our note explains how RBI differentiates co-operative banks on financial and governance strength.
A practical digital KYC stack for co-operative banks
A workable stack does not require replacing core banking. It adds verification at capture and automates the handoff to CKYCR.
- Capture once, digitally. Use tablet- or web-based capture at branches so documents and data enter the system at source.
- Verify identifiers at capture. Check PAN status and name against the source, and fetch documents through DigiLocker where the customer consents.
- Confirm the person. Run face match between the live photo and the ID photo, with liveness detection to block photos of photos and screen replays.
- Validate the account and name. Verify linked bank accounts for loan disbursal or standing instructions, and use name matching to reconcile spelling variants across documents.
- Assign a risk category. Apply your board-approved risk rules at onboarding, not months later.
- Queue the CKYCR upload automatically. Generate the upload file from verified fields and track rejections daily.
- Schedule periodic updates. Drive intimations and reminders from the risk category and due date.
- Report the backlog. Give the board a monthly view of pending uploads, rejections, and overdue updates.
| Layer | What it does | Typical owner |
|---|---|---|
| Capture | Digital forms, document images | Branch operations |
| Verification | PAN, DigiLocker, face match, liveness, name match, bank account checks | Verification API provider |
| Core record | Customer master, risk category | Core banking system |
| Registry | CKYCR upload and retrieval | Bank or CKYCR service provider |
| Assurance | Audit trail, MIS, concurrent audit | Compliance |
Where BeFiSc fits: IDProof provides the verification layer of this stack: PAN verification, Aadhaar routes, DigiLocker, face match, liveness, name match, and bank account verification, through APIs that sit alongside your core banking system. It improves the accuracy of what goes into the KYC record. IDProof is not a CKYCR uploader, a core banking system, or a V-CIP platform, and it does not decide a customer’s risk category.
Key Takeaways
- Co-operative bank KYC is now governed by separate 2025 KYC Directions for UCBs and for rural co-operative banks, both dated 28 November 2025.
- Periodic updation runs on a two-, eight-, and ten-year cycle by risk category under the UCB Directions.
- Every 2026 co-operative bank KYC penalty reviewed here cited CKYCR upload failures.
- UIDAI’s August 2025 framework lets StCBs act as AUA/KUA, with DCCBs using StCB infrastructure.
- A verification layer at capture plus automated CKYCR queuing addresses most recurring gaps without replacing core banking.
Frequently Asked Questions
Can co-operative banks use Aadhaar authentication?
UIDAI’s August 2025 framework allows state co-operative banks to register as AUA and KUA, with DCCBs using their StCB’s setup. UCBs should confirm their own approval route with UIDAI. Aadhaar remains voluntary for KYC except for government benefits.
Why are co-operative banks being penalised for KYC?
In the 2026 cases reviewed here, RBI cited failure to upload customers’ KYC records to the Central KYC Records Registry within the prescribed timeline. Penalties ranged from Rs 10,000 to Rs 5 lakh.
Which KYC Directions apply to StCBs and DCCBs?
State and district central co-operative banks follow the Reserve Bank of India (Rural Co-operative Banks – Know Your Customer) Directions, 2025, also dated 28 November 2025 and amended on 29 December 2025.
Which RBI KYC Directions apply to urban co-operative banks?
The Reserve Bank of India (Urban Co-operative Banks – Know Your Customer) Directions, 2025, issued on 28 November 2025 and updated as on 18 September 2026. They replaced the earlier KYC Master Direction for UCBs.
Conclusion
Co-operative bank KYC in 2026 is less about interpreting new policy and more about proving execution. The 2025 Directions keep the core obligations familiar, but RBI’s recent orders show that inspections are measuring whether records reach CKYCR on time.
Banks that add verification at the point of capture, automate the registry handoff, and report backlogs to the board will spend less time on remediation and less time in penalty press releases.
Talk to BeFiSc about an IDProof demo
