KYC · onboarding checks
Knowing who you're dealing with, layer by layer
KYC is less a single check than a set of layers, each answering one question about a new customer. This guide explains who has to do regulated KYC, what each layer checks, and how to build a flow that keeps genuine customers moving and stops the rest.
- 1IdentifyWho is this person, according to a document?
- 2VerifyIs the document genuine, and are they its holder?
- 3Keep up to dateIs what we know still true, and how risky is the relationship?
One week of onboarding, layer by layer
Illustrative1. Identity documentWhich document, and is it genuine?
2. Identity checkDoes it match an official record?
31 review39 stop
3. Person presentIs the applicant the document holder?
22 review28 stop
4. Bank accountIs the account theirs?
18 review11 stop
5. Risk reviewAnything that needs a closer look?
21 review
Two things called “KYC”
The same three letters describe two different obligations, and mixing them up causes most of the confusion about KYC.
Regulated KYC
Required by law for regulated entities. RBI's KYC Master Direction applies to every entity regulated by RBI, such as banks and NBFCs. It sets out what must be collected, how it's verified, how customers are risk-categorised and how often records are updated. Other regulators set equivalent rules for their sectors.
Verification for your own risk
Many businesses that aren't regulated entities still verify customers: marketplaces checking sellers, platforms checking gig workers, apps checking who they pay. The checks can look similar, but the rules are your own policy, contracts and general law, including data protection.
Which applies to your business is a legal question. Peneu provides verification checks; it doesn't take on a regulated entity's KYC obligations.
The layers, and the question each one answers
| Layer | Question | Typical checks | Read more |
|---|---|---|---|
| Identity | Who does this person say they are? | An officially valid document; PAN | PAN verification |
| Authenticity | Is the document real and does it match official records? | Record lookup, digital signature checks, offline Aadhaar verification | Aadhaar verification |
| Presence | Is the applicant the person in the document? | In-person check, video-based identification, live photo | — |
| Address | Where do they live? | Address on the document, or a permitted proof of address | — |
| Bank account | Is the account they gave us theirs? | Penny drop, penny-less check | Bank verification |
| Risk | How closely should we watch this relationship? | Risk category, screening, purpose of the relationship | — |
For business customers, the same idea applies to the business and the people behind it: see KYB.
Officially valid documents
For RBI-regulated entities, the KYC Master Direction defines which documents count as “officially valid documents” (OVDs) for identity and address. Where the address on an OVD isn't current, the Direction allows certain other documents, such as recent utility bills, as proof of address for that limited purpose.
Businesses outside RBI's regulation often use the same list as a sensible baseline, even when they aren't bound by it.
- Passport
- Driving licence
- Proof of possession of Aadhaar number
- Voter's identity card issued by the Election Commission of India
- NREGA job card signed by an officer of the State Government
- National Population Register letter containing name and address
- As listed in RBI's Master Direction – KYC, 2016 (updated 14 Aug 2025).
Ways to verify, and what each is good for
| Method | How it works | Good for | Watch for |
|---|---|---|---|
| In person | An official sees the original document and the customer | Branch and agent onboarding | Cost and reach |
| Video-based (V-CIP) | A regulated entity's authorised official identifies the customer in a live, consent-based video interaction | Remote onboarding by regulated entities | Strict standards on infrastructure and process |
| Offline Aadhaar verification | The customer shares digitally signed Aadhaar data, which is verified without contacting UIDAI's central repository | Consent-based identity checks | Who may use it, and what may be stored |
| Document upload with checks | Photos of documents, checked against records or for tampering | Lower-risk onboarding | Image quality, forged documents |
| Record lookup | An identifier such as PAN checked against official records | Confirming identifiers exist and match a name | Confirms the record, not the person |
V-CIP as defined in RBI's KYC Master Direction. Offline Aadhaar verification as described by UIDAI.
Risk decides how often you look again
KYC doesn't end at onboarding. RBI's Master Direction asks regulated entities to categorise customers by risk, using parameters such as the customer's identity, their social and financial status, the nature of their business, location, the products they use, the channel and the kinds of transactions involved.
That category then sets how often the KYC record must be updated.
| Risk category | Update KYC at least every |
|---|---|
| High | 2 years |
| Medium | 8 years |
| Low | 10 years |
From RBI's KYC Master Direction, counted from account opening or the last update. Applies to RBI-regulated entities.
Designing a flow people finish
Every layer loses some genuine applicants: a failed photo, a document at home, a bank that didn't respond. The order of the layers, and how each failure is handled, decides how many of them you get back.
Ask for the cheapest, most familiar things first and the most effortful last, so people have invested some time before the hard step. Explain why you need each item. And make every failure recoverable in the same session where possible.
- 1Say what's comingList what they'll need before they start: which document, a few minutes, a working camera.
- 2Easy firstName, phone, PAN: quick to enter, and they catch obvious mismatches early.
- 3Document and presenceThe effortful steps, once they're committed.
- 4Bank account lastChecked right away, while they're still on the screen.
- 5Tell them the outcomeApproved, under review with a time frame, or what to do next.
Reviews: where most of the judgement happens
Automated checks give clear answers most of the time. The rest go to a person, and how that queue is run decides both your risk and your customers' experience.
| Case | Often means | Reviewer asks for |
|---|---|---|
| Name differs between documents | Initials, marriage, spelling, transliteration | An explanation, or a document that links the two |
| Photo or document unclear | Poor lighting or camera | A new photo, with guidance |
| Address doesn't match | They moved | A permitted proof of current address |
| Bank account in another name | A family member's account, or something worse | An account in their own name |
| Record lookup didn't respond | A temporary outage | Nothing: retry later |
Write down how each case is decided, so two reviewers reach the same answer, and record who decided and why.
Running periodic updates without losing customers
Onboarding gets all the design attention; re-KYC gets an email with a deadline. Yet an update is often harder for the customer than signing up was: they didn't ask for it, they may not remember what they submitted, and the message asking for it looks exactly like a phishing attempt.
Treat it as a small product of its own. Tell customers well before the due date, explain what's needed and why, make it possible to confirm “nothing has changed” where your rules allow that, and ask for new documents only where something has.
- 1Know who's dueFrom each customer's risk category and last update date.
- 2Tell them early, in your own channelsIn the app or logged-in account, not only by SMS or email with a link.
- 3Ask for the minimumA confirmation if nothing changed; documents only for what did, where permitted.
- 4Follow up, then actReminders first; what happens after the deadline is set by your rules, and should be stated up front.
Screening: checking names against lists
Alongside identity, many businesses check new customers against lists: sanctions lists, lists of people who hold prominent public positions, and internal lists of customers they've previously stopped. For RBI-regulated entities, the KYC Master Direction includes obligations that stem from international agreements and communications from international agencies.
Screening produces false positives by design, because common names match many people. What matters is a documented way to clear them: compare dates of birth, nationality and other details, record the decision and move on. Which lists you must screen against, and how often, depends on your obligations; confirm them with your compliance adviser.
Different customers, different routes
| Customer | Usual route | Watch for |
|---|---|---|
| Resident individual, digital onboarding | Document plus a digital identity check, and presence where required | Drop-off at the document and presence steps |
| Resident individual, in person | Original documents seen by your staff or agent | Consistent recording of what was seen |
| Non-resident Indian | Documents that may need to be certified; special provisions exist for regulated entities | Longer timelines; foreign addresses |
| Sole proprietor | The owner's KYC plus proof the business exists | Business and personal names differing |
| Company, LLP or partnership | KYB: the entity, its signatory and beneficial owners | Layered ownership |
General guide. Regulated entities follow their regulator's rules for each type. Businesses in depth: KYB.
Collect less, protect more
KYC gathers some of the most sensitive data you'll hold: identity numbers, photos, addresses. Collect only what your obligations or your policy need, tell people why, keep it secured and only as long as you must. India's Digital Personal Data Protection Act, 2023 and your sector's rules shape what that means for you.
Aadhaar deserves special care: the law limits who may use it and how. Read the Aadhaar verification guide before building it into any flow.
Purpose. Ask for each item because a rule or a real risk needs it.
Access. Only the people who review applications can open documents.
Display. Identity numbers shown masked everywhere else.
Retention. Kept as long as the law or your policy requires, then deleted.
Records: proving the check happened
A KYC decision you can't evidence is, for an auditor, a decision that wasn't made. For each customer, keep what was checked, how, what came back, who decided and when. For regulated entities, record management is its own chapter of the KYC Master Direction, and how long records must be kept is set by law.
Keep the evidence and the decision together, and make it retrievable by customer. When a customer's details change, record the new check alongside the old one rather than overwriting it.
- What was checked
- Document type and number (masked), method used
- What came back
- Result of each check, as received
- Decision
- Approved, rejected or referred, and by whom
- Risk category
- And the date the next update is due
- Consent
- What the customer agreed to, and when
KYC in different businesses
Lenders
Regulated KYC before disbursal, with bank account checks for the loan account.
Insurers
Identity of the policyholder, and of the nominee or claimant at payout.
Marketplaces
Sellers verified as businesses before they're paid; buyers usually not.
Gig platforms
Workers verified before their first payout.
Building KYC as cases, not screens
Onboarding screens are the visible part. Behind them, every applicant should be a case: a record that collects each check's result, each reviewer's note and the final decision, in order. A case survives staff changes, audits and the customer calling six months later.
Design the case first and the screens second. It forces the questions that matter: what does each check return, who can see documents, what makes a case go to review, and when does it close?
Documents stored apart
Encrypted, with access limited to reviewers and every view logged.
Results as they came
Each check's raw response kept with the time and method, not just a pass or fail.
Review queue with reasons
Each case says why it's waiting, so reviewers start from the problem.
Due dates
Next periodic update computed from the risk category and stored on the case.
KYC questions
How long should KYC take for a customer?
For a digital flow with clear documents, a few minutes of the customer's time; reviews add hours or days. Measure time to approval and the share of applications that need a person, and work on whichever is worse.
Is a selfie check the same as video KYC?
No. A selfie or liveness check is a technique to confirm a real person is present. Video-based Customer Identification Process (V-CIP) is RBI's defined method, in which an authorised official of a regulated entity identifies the customer in a live interaction under specific standards.
Can we rely on KYC done by another company?
Sometimes, within limits. Regulated entities have specific rules on when they may rely on another entity's customer due diligence; outside regulation, relying on someone else's checks is a risk decision. Either way, you remain accountable for knowing your customer.
What if a customer's documents show different names?
It's common: initials, marriage, transliteration, spelling. Ask for an explanation or a document that links the names, have a reviewer decide, and record why. Don't reject automatically.
What is the difference between KYC and eKYC?
KYC is the whole process of identifying and verifying a customer. eKYC usually means doing parts of it electronically, for example sharing digitally signed identity data instead of a paper copy. The electronic route still has to meet the same rules for whoever is doing the KYC.
Can a customer be onboarded before KYC is complete?
For regulated entities, the rules decide what's allowed before verification is complete, and the answer differs by product. For other businesses it's a risk decision, often handled with limits: for example, no payouts until the checks are done.
What is KYC?
KYC (Know Your Customer) is the process of identifying a customer and verifying that identity before, and while, doing business with them. For banks, NBFCs and other entities regulated by RBI it's a legal requirement set out in RBI's KYC Master Direction; other businesses use similar checks to manage fraud and risk.
Does my business have to do KYC?
It depends on what you are. RBI's KYC Master Direction applies to every entity regulated by RBI. Other sectors have their own regulators and rules, and many unregulated businesses verify customers for their own risk reasons. Whether, and how, KYC applies to you is a legal question; check with your adviser.
What documents are accepted for KYC?
For entities regulated by RBI, the KYC Master Direction lists the officially valid documents: passport, driving licence, proof of possession of Aadhaar number, voter's identity card, NREGA job card signed by a State Government officer, and a National Population Register letter with name and address. Other checks, such as PAN, are used alongside them.
What is video KYC?
Video-based Customer Identification Process (V-CIP) is RBI's method in which an authorised official of a regulated entity identifies the customer through a live, consent-based audio-visual interaction. Under the KYC Master Direction, a compliant V-CIP is treated on par with face-to-face identification.
How often does KYC need to be updated?
For RBI-regulated entities, the KYC Master Direction requires periodic updation at least once every two years for high-risk customers, every eight years for medium-risk and every ten years for low-risk customers, counted from account opening or the last update.
Is bank account verification part of KYC?
It's often part of onboarding, but it answers a narrower question: whether an account exists and whose it is. It doesn't identify the person. KYC identifies the person; account verification checks where money will go.
What happens to applicants who fail an automated check?
Most shouldn't simply be rejected. A blurry photo, a name spelled differently on two documents or a bank that didn't respond are reasons for review or a second attempt, not proof of fraud. Decide in advance which failures go to a person and which end the application.
Which KYC checks does Peneu provide?
Which checks are available through Peneu, and in what form, is confirmed during onboarding. Peneu doesn't take on your regulatory obligations; if you're a regulated entity, your KYC policy and its compliance remain yours.
Build onboarding checks that fit your obligations
Tell us who you onboard and what you're required to check. We'll walk through the layers that fit.
Official sources
- RBI — Master Direction – Know Your Customer (KYC) Direction, 2016 (updated 14 Aug 2025)Applicability to RBI-regulated entities, officially valid documents, V-CIP, risk categorisation, periodic updation.
- UIDAI — Aadhaar offline verification handbookOffline verification without contacting UIDAI's central repository; consent before sharing.
Last reviewed . Examples, amounts and screens marked illustrative are not Peneu figures.