Re-KYC is the periodic updating of a customer’s KYC records that banks and other regulated entities must carry out under RBI’s KYC Directions: at least every two years for high-risk customers, every eight years for medium-risk customers, and every 10 years for low-risk customers. If nothing has changed, a self-declaration through a registered channel is usually enough.
Few compliance tasks touch as many customers as re-KYC. A large retail bank has accounts falling due every month, and each one needs intimations, a customer response, verification, and a record update.
For customers, it shows up as an SMS or letter that is easy to ignore and easy for fraudsters to imitate. For banks and NBFCs, it is a recurring obligation that RBI has pushed hard on since 2025. This guide covers both sides: what the rules say, what customers should do, and how regulated entities can run re-KYC at scale.
What Re-KYC Is and How It Differs From Remediation
Re-KYC, formally “periodic updation of KYC”, is the scheduled refresh of a customer’s identity, address, and risk profile, at intervals set by the customer’s risk category.
It is often confused with KYC remediation. The difference matters for planning:
| Re-KYC (periodic update) | KYC remediation | |
|---|---|---|
| Trigger | Calendar, based on risk category | Backlog, audit finding or regulatory observation |
| Nature | Recurring, permanent duty | One-time clean-up project |
| Population | Accounts falling due in a period | Accounts with gaps or defects |
| Goal | Keep records current | Fix records that were never compliant |
What RBI Requires: Re-KYC Frequency and Routes
The current text is the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, dated 28 November 2025 and updated on 18 September 2026. Other regulated entities, including NBFCs, follow parallel KYC Directions.
Updation frequency
Paragraph 42(1) requires periodic updation “at least once in every two years for high-risk customers, once in every eight years for medium-risk customers and once in every 10 years for low-risk customers”, counted from account opening or the last KYC updation. The frequency follows the risk rating, so it drives the update calendar.
Route 1: No change in information
The bank may accept a self-declaration through the customer’s registered email, registered mobile number, ATMs, digital channels such as internet or mobile banking, or a letter. Since RBI’s 12 June 2025 circular, banks may also take this declaration through an authorised business correspondent (BC) after biometric e-KYC authentication, with an acknowledgment to the customer.
Route 2: Change of address only
The customer self-declares the new address through the same channels. The bank must verify it through positive confirmation within two months, using methods such as an address verification letter, contact point verification, or deliverables.
Route 3: Other changes or fresh KYC
Where identity details change, or the bank’s policy calls for it, the bank runs a fuller KYC process. The Directions permit Aadhaar OTP-based e-KYC in non-face-to-face mode and V-CIP for updation of eligible customers.
Bank-side duties at every updation
- Verify PAN against the issuing authority’s database.
- Give the customer an acknowledgment with the date of receipt, and intimate the date of updation.
- Update the customer’s record in the Central KYC Records Registry (CKYCR) when updated information is obtained.
What Banks May and May Not Do
RBI’s 2025 instructions changed the tone of periodic updation from enforcement to facilitation. The June 2025 circular asked banks to hold camps and intensive campaigns, especially in rural and semi-urban branches, and flagged large pendency in DBT, EBT and PMJDY accounts.
The campaign that followed ran from 1 July to 30 September 2025 at gram panchayat level. RBI’s 11 August 2025 press release reported more than 1.41 lakh camps held and re-KYC completed in over 35 lakh accounts by that date.
Banks must
- Give at least three advance intimations before the due date, including at least one by letter.
- Send at least three reminders after the due date to customers who have not complied, including at least one by letter.
- Explain in these communications how to comply and what happens on non-compliance, and keep an audit trail.
Banks should not
- Restrict low-risk individual accounts prematurely. Paragraph 42(2) requires the bank to allow all transactions and complete updation within one year of the due date or by 30 June 2026, whichever is later.
- Insist on branch visits or fresh documents where a valid self-declaration route exists.
Where the Directions require operations to cease, as paragraph 43 does for missing PAN or Form 60, they require notice and an opportunity to be heard first, and allow only credits in loan accounts. Any further restriction for non-compliance should be grounded in board-approved policy and applied consistently.
Where BeFiSc fits: IDProof brings PAN verification, Aadhaar routes, DigiLocker, face match, liveness, and name match into one API layer, so an update journey on your app or website can verify a customer’s update in minutes. Book a re-KYC workflow demo to map it to your due-date queue.
For Customers: How to Update KYC Online Safely
Why did my bank ask for re-KYC?
Because your account reached its periodic update date under RBI rules, based on your risk category. It does not mean anything is wrong with your account.
How to complete it
- Check the message that came through your bank’s official channels, and open the bank’s own app or website directly rather than a link.
- If nothing has changed, submit the self-declaration through net banking, the mobile app, registered email, or an ATM, as your bank allows.
- If only your address changed, declare the new address; the bank will confirm it within two months.
- If other details changed, complete Aadhaar OTP e-KYC, video KYC or a branch visit as the bank directs.
- Keep the acknowledgment the bank gives you.
The scam warning
RBI’s press release of 2 February 2024 warned that fraudsters send unsolicited calls, SMS, and emails about KYC updation, create urgency by threatening to freeze or close accounts, and push links to unauthorised apps. RBI’s advice: never share login credentials, card details, PINs, passwords, or OTPs; do not share KYC documents with unknown parties; and report cyber fraud at cybercrime.gov.in or helpline 1930.
How Regulated Entities Automate Re-KYC at Scale
Running periodic updates through branch queues does not scale. The entities that handle it well treat it as a data pipeline.
- Risk-based scheduling. Compute due dates from risk category and last updation date, and refresh them when a customer’s risk rating changes.
- Intimation engine. Trigger the three advance intimations and three reminders automatically across SMS, email, app notifications, and letters, with every send logged.
- CKYC first. With explicit consent, retrieve records using the customer’s KYC Identifier, so customers are not asked for documents the registry already holds.
- Digital declaration capture. Offer one-tap “no change” declarations in app and net banking, with consent and timestamps.
- Verified updates. Route changes through Aadhaar OTP e-KYC, DigiLocker documents, face match and PAN verification, and send higher-risk cases to journeys.
- Assisted channels. Equip BCs for biometric e-KYC declarations in rural and semi-urban areas.
- Close the loop. Update the core system and CKYCR, send the acknowledgment and date of updation, and record the audit evidence.
Consider a lender with a large low-risk retail book. If due dates cluster after a past onboarding drive, a digital-first flow with CKYCR retrieval and self-declaration can absorb most of the volume, leaving branch and BC capacity for customers who genuinely need help.
Key Takeaways
- Re-KYC is periodic updating of KYC: at least every 2 years for high-risk, 8 for medium-risk, and 10 for low-risk customers.
- A self-declaration through registered channels or a BC is enough when nothing has changed; a changed address needs positive confirmation within two months.
- Banks must send three advance intimations and three reminders, each set including a letter, and allow low-risk individuals a defined grace window.
- Customers should update KYC only through official bank channels; RBI has warned repeatedly about KYC-updation fraud.
- At scale, periodic updation works as an automated pipeline: risk-based scheduling, CKYCR retrieval, digital declarations, verified updates, and audit logs.
Frequently Asked Questions
Is a KYC update request by SMS or call genuine?
Treat it with caution. RBI has warned that fraudsters send KYC-update messages with links and threats of account freezing. Never share OTPs, PINs, or passwords, and update KYC only through your bank’s official app, website, or branch.
What happens if I do not complete re-KYC?
Your bank must first send advance intimations and reminders. For low-risk individuals, RBI requires banks to allow all transactions for a grace period of one year from the due date. After that, the bank may restrict the account under its policy, so it is best to update promptly.
Can I do re-KYC online without visiting the branch?
Usually, yes. If your details have not changed, banks can accept a self-declaration through registered email, registered mobile, ATMs, internet, or mobile banking. Address changes can also be self-declared. Other changes may need Aadhaar OTP e-KYC or video KYC.
How often is re-KYC required in India?
Under RBI’s KYC Directions, banks must update KYC at least once every two years for high-risk customers, every eight years for medium-risk customers, and every 10 years for low-risk customers, from account opening or the last update. Banks may ask sooner if your information changes
Conclusion
Re-KYC has moved from a compliance afterthought to a supervisory focus, with RBI widening the channels, adding BCs and running nationwide camps. The obligation is permanent, and the due-date queue refills every year.
The banks and NBFCs that manage it best will be those that treat re-KYC as an engineered, consent-based process: risk-driven schedules, registry-first data, digital declarations, and verified updates. That reduces cost per update and keeps customers away from fraudsters posing as their bank.
