{"id":953,"date":"2026-06-04T12:07:18","date_gmt":"2026-06-04T11:07:18","guid":{"rendered":"https:\/\/www.befisc.com\/fintechsherlock\/?p=953"},"modified":"2026-06-04T12:10:10","modified_gmt":"2026-06-04T11:10:10","slug":"rbi-kyc-master-directions-guide","status":"publish","type":"post","link":"https:\/\/www.befisc.com\/fintechsherlock\/rbi-kyc-master-directions-guide\/","title":{"rendered":"RBI KYC Master Directions 2025: What Every Fintech and NBFC Needs to Know About Video KYC and CKYC"},"content":{"rendered":"\n

India’s KYC framework is not a single regulation \u2014 it is a layered architecture built on the Prevention of Money Laundering Act, the RBI KYC Master Directions, UIDAI’s Aadhaar authentication guidelines, and the CKYC Registry operated by CERSAI. For any regulated entity \u2014 bank, NBFC, payment aggregator, or licensed fintech \u2014 navigating this architecture correctly determines both compliance standing and onboarding performance. The RBI’s KYC Master Directions have been amended multiple times since their original 2016 notification, with significant updates in 2023 and 2025 addressing Video KYC (V-CIP), digital onboarding<\/a>, and CKYC obligations. This guide deconstructs what the Directions actually require, where organisations commonly fail, and how the CKYC system changes the verification workflow.<\/p>\n\n\n\n

What the RBI KYC Master Directions Actually Cover<\/strong><\/h2>\n\n\n\n

The RBI KYC Master Directions (updated through 2025) govern how Regulated Entities (REs) \u2014 a category that includes commercial banks, cooperative banks, NBFCs, payment system providers, and account aggregators \u2014 must identify and verify their customers. The Directions cover four core areas: Customer Due Diligence (CDD)<\/a>, record-keeping, reporting obligations, and cross-border correspondent banking.<\/p>\n\n\n\n

What the Directions do not cover: they do not prescribe specific technology vendors or API providers. They specify outcomes \u2014 the standard of verification, the documents acceptable, the data that must be captured \u2014 and leave implementation choices to the RE. This is important context for product teams building onboarding flows: compliance is about meeting defined verification standards, not about using any particular method.<\/p>\n\n\n\n

The Directions apply at the point of account opening, at trigger events during the relationship (such as a transaction that breaches a risk threshold), and at periodic re-KYC intervals defined by the customer’s risk classification. A one-time onboarding check is not sufficient \u2014 the Directions require ongoing due diligence.<\/a><\/p>\n\n\n\n

Customer Due Diligence: The Four-Level Risk Framework<\/strong><\/h2>\n\n\n\n

The RBI’s CDD framework operates on risk-based principles aligned with FATF recommendations. Customers are classified into three risk categories \u2014 low, medium, and high \u2014 with Simplified Due Diligence (SDD) available for a specific subset of low-risk accounts (such as Basic Savings Bank Deposit Accounts with defined transaction limits), and Enhanced Due Diligence <\/a>(EDD) mandated for high-risk categories.<\/p>\n\n\n\n

High-risk designations apply automatically to Politically Exposed Persons (PEPs), their close associates, customers from jurisdictions on FATF<\/a> grey or blacklists, non-resident customers, and legal entities with complex or opaque ownership structures. For these customers, EDD requires not just identity verification but also source of funds verification, beneficial ownership identification<\/a> (particularly for entities where ultimate ownership chains are long), and more frequent periodic review.<\/p>\n\n\n\n

For product teams, the implication is architectural: the onboarding system must not just collect KYC data but also apply a risk score and route customers into the appropriate CDD tier. A single onboarding flow that treats all customers identically does not satisfy the RBI’s risk-based approach requirement.<\/p>\n\n\n\n

Video KYC (V-CIP): RBI Guidelines and Technical Requirements<\/strong><\/h2>\n\n\n\n

What V-CIP Allows and Requires<\/strong><\/h3>\n\n\n\n

Video-based Customer Identification<\/a> Process (V-CIP) was introduced by the RBI as a face-to-face equivalent for digital onboarding. Under V-CIP, a trained official of the RE conducts a live, audio-visual interaction with the customer, captures their Aadhaar or PAN details, geolocates the session, and records the interaction for audit purposes.<\/p>\n\n\n\n

The 2025 guidelines reinforced several technical requirements. The video interaction must be live \u2014 pre-recorded responses are not permitted, and the system must include liveness detection<\/a> to prevent replay attacks. Deepfake-resistance has been explicitly flagged as a requirement, meaning passive or active liveness checks must be capable of detecting AI-generated synthetic faces<\/a>. The interaction must be geolocated to confirm the customer is within India (for resident customers). The recording must be stored for at least five years.<\/p>\n\n\n\n

Who Can Conduct V-CIP and Who Cannot<\/strong><\/h3>\n\n\n\n

V-CIP must be conducted by officials of the RE itself. A Lending Service Provider (LSP) or Digital Lending App (DLA) can assist in collecting KYC data, but the V-CIP interaction and the identity verification decision cannot be fully outsourced. This creates an important operational boundary: technology vendors can provide the platform and biometric verification tools, but a trained RE official must be present in or monitoring the interaction.<\/p>\n\n\n\n

NBFCs and smaller fintechs that rely entirely on LSPs for onboarding need to review their V-CIP workflow against this requirement. The RBI has issued guidance that the RE cannot entirely outsource the verification decision, even when the technology is provided by a third party.<\/p>\n\n\n\n

What is CKYC? How the Central KYC Registry Works<\/strong><\/h2>\n\n\n\n

CKYC (Central KYC) is a centralised repository of KYC records maintained by CERSAI (Central Registry of Securitisation Asset Reconstruction and Security Interest of India) under a mandate from the Ministry of Finance. When a customer completes KYC with one Regulated Entity, their record is uploaded to the CKYC <\/a>Registry and assigned a 14-digit KYC Identification Number (KIN).<\/p>\n\n\n\n

When the same customer approaches a second RE, the second entity can retrieve the existing CKYC record using the customer’s PAN or Aadhaar \u2014 eliminating the need for the customer to submit documents again, provided the record is current, and the risk classification is appropriate. This is the CKYC system’s primary value: reducing redundant verification for customers and reducing document handling costs for REs.<\/p>\n\n\n\n

However, CKYC records have a shelf life tied to periodic re-KYC requirements. A record that is more than eight years old (for low-risk customers), two years old (for medium-risk), or one year old (for high-risk) must be refreshed. REs cannot simply rely on a CKYC record without checking its age and validity against the applicable re-KYC schedule.<\/p>\n\n\n\n

For fintechs building onboarding flows, CKYC integration via the CKYC search API <\/a>allows the system to query for an existing record before initiating a full KYC collection. This reduces friction for returning customers and accelerates onboarding<\/a> without compromising compliance.<\/p>\n\n\n\n

Aadhaar-Based eKYC: Scope and Limitations<\/strong><\/h2>\n\n\n\n

Aadhaar-based eKYC<\/a> allows an RE to retrieve a customer’s demographic data (name, date of birth, address, photograph) from the UIDAI database using an OTP or biometric authentication. This is the fastest KYC pathway available in India \u2014 it can complete identity verification in seconds with a very high accuracy rate.<\/p>\n\n\n\n

However, Aadhaar eKYC is not universally available. Only entities with a valid Aadhaar User Agency (AUA) or KYC User Agency (KUA) licence from UIDAI can access the authentication API <\/a>directly. Many fintechs and NBFCs access this capability through licensed intermediaries. The DPDP Act 2023 and DPDP Rules 2025 have added consent and data governance obligations on top of UIDAI’s existing rules \u2014 Aadhaar data retrieved via eKYC can only be used for the purpose stated at the time of consent and cannot be stored beyond the retention period permitted under both the UIDAI framework and DPDP Rules.<\/p>\n\n\n\n

For high-risk customers, Aadhaar eKYC alone is not sufficient \u2014 EDD requires additional verification steps beyond what Aadhaar provides. For BNPL and digital lending, where PAN is mandatory for all loans, PAN verification must accompany any Aadhaar-based flow.<\/p>\n\n\n\n

Common Compliance Failures and How to Avoid Them<\/strong><\/h2>\n\n\n\n

The most frequent KYC compliance failures identified in RBI inspections and enforcement actions cluster around four areas. First, incomplete periodic re-KYC: REs often complete onboarding KYC correctly but fail to implement systematic re-KYC triggers for medium and high-risk customers within the required intervals. Second, beneficial ownership gaps<\/a>: for corporate accounts, the Directions require identification of beneficial owners \u2014 individuals holding more than 10 percent of shares or voting rights \u2014 but this verification is often superficial or based on self-declaration without independent verification against MCA21<\/a> or company registry data. Third, incomplete PEP screening: PEP status must be checked at onboarding and re-screened when lists are updated. Many systems screen once and do not re-screen on list changes. Fourth, inadequate documentation of enhanced due diligence: EDD procedures must be documented in the customer file, with a record of the additional steps taken and the rationale for the risk rating.<\/p>\n\n\n\n

Digital Lending and the KYC Stack: What Lenders Must Get Right<\/strong><\/h2>\n\n\n\n

The RBI’s Digital Lending Guidelines<\/a>, updated through 2024, have tightened the KYC requirements that apply specifically in the digital lending context \u2014 overlaying the general KYC Master Directions with additional obligations around borrower identification<\/a>, data handling, and LSP oversight.<\/p>\n\n\n\n

For digital lenders and their LSP partners, three requirements deserve particular operational attention. First, the verification standard: the Guidelines require that identity verification be conducted to the standard specified in the KYC Master Directions \u2014 Aadhaar-based eKYC, Video KYC (V-CIP), or equivalent OVD-based verification. A lender that relies on an LSP-conducted KYC but does not have a process for ensuring that the LSP’s verification meets this standard faces compliance exposure, because the regulatory liability remains with the RE, not the LSP.<\/p>\n\n\n\n

Second, the data minimisation requirement: the Guidelines explicitly state that only the minimum data necessary for credit assessment should be collected. An onboarding flow that requests access to a borrower’s contacts, call logs, or location history \u2014 beyond what is genuinely required for credit assessment \u2014 violates both the Digital Lending Guidelines and the DPDP Act.<\/p>\n\n\n\n

Third, the cooling-off period and loan contract: the Digital Lending Guidelines require that borrowers receive a Key Fact Statement (KFS) before accepting a loan, with a cooling-off period during which they can withdraw without penalty. The KYC verification event and the KFS delivery are sequential \u2014 a lender cannot proceed to disbursement without completing both.<\/p>\n\n\n\n

Key Takeaways<\/strong><\/h2>\n\n\n\n