RBI Master Direction on Know Your Customer (KYC) 2016 is the Reserve Bank of India's comprehensive guideline for all regulated entities (REs) on Know Your Customer (KYC), Anti-Money Laundering (AML), and Countering Financing of Terrorism (CFT). It consolidates and updates all previous circulars and directions on these topics. Key points of RBI Master Direction on KYC Purpose and Applicability Aims to prevent banks and financial institutions from being used for money laundering (ML) and terrorist financing (TF). Applies to all entities regulated by the RBI, including banks, NBFCs, payment system providers, and their branches/subsidiaries in India and abroad (unless local laws conflict). KYC Policy Requirements Every RE must have a Board-approved KYC policy covering: Customer Acceptance Policy Risk Management Customer Identification Procedures (CIP) Monitoring of Transactions Customer Acceptance and Identification No accounts to be opened in anonymous or fictitious names. CDD (Customer Due Diligence) is mandatory for all account openings and certain transactions (e.g., above INR 50,000, international transfers). CDD includes verifying identity, beneficial ownership, and understanding the nature of the business relationship. Reliance on third-party CDD is allowed under strict conditions. Risk Management Customers must be categorized as low, medium, or high risk based on various parameters (identity, business, geography, transaction type, etc.). Enhanced due diligence (EDD) is required for high-risk customers, non-face-to-face onboarding, and politically exposed persons (PEPs). Ongoing due diligence and periodic review of risk categorization are mandatory. Customer Due Diligence (CDD) Procedures Specific CDD requirements for individuals, sole proprietorships, legal entities, trusts, and unincorporated associations. Use of Aadhaar, PAN, and other Officially Valid Documents (OVDs) for identification. Digital KYC and Video-based Customer Identification Process (V-CIP) are permitted with strict controls. Small accounts and simplified procedures are allowed for certain disadvantaged groups, with transaction and balance limits. Record Management Transaction records must be kept for at least 5 years from the date of transaction. Customer identification records must be preserved for at least 5 years after the end of the business relationship. Records must be made available swiftly to competent authorities upon request. Reporting Requirements REs must report suspicious transactions (STRs), cash transactions (CTRs), and other prescribed information to the Financial Intelligence Unit-India (FIU-IND). Delays in reporting are treated as separate violations. Confidentiality of reporting and record-keeping is emphasized. International Obligations and Sanctions Compliance REs must comply with UN Security Council sanctions lists and Indian government notifications under The Unlawful Activities (Prevention) Act (UAPA) and Weapons of Mass Destruction and Their Delivery System (WMD) Acts. Daily screening of customer lists against designated persons/entities is required. Procedures for freezing/unfreezing assets and reporting matches are detailed. Use of Technology and Innovation Encourages use of AI/ML for transaction monitoring and name screening. Mandates robust IT and cybersecurity for digital KYC and V-CIP. Employee Training and Internal Controls REs must have ongoing employee training on KYC/AML/CFT. Adequate screening of employees and independent audit of compliance functions are required. Other Notable Provisions Prohibits opening/continuing relationships with shell banks. Special procedures for correspondent banking, wire transfers, and third-party product sales. Unique Customer Identification Code (UCIC) to be allotted to all customers. KYC information to be uploaded to the Central KYC Records Registry (CKYCR). Provisions for compliance with FATCA/CRS and Foreign Contribution Regulation Act (FCRA). Example Implementation: A bank must verify a new customer's identity using Aadhaar (with consent), PAN, or other OVDs, conduct risk assessment, and monitor transactions for suspicious activity. If the customer is a PEP, enhanced due diligence and senior management approval are required. All records must be preserved for at least 5 years, and any suspicious activity must be reported to FIU-IND. Source : RBI