Central KYC Records Registry (CKYCR): IIBF KYC-AML Guide (2026)

The Central KYC Records Registry is one of the most exam-favourite yet under-prepared topics in the IIBF KYC, AML and CFT certificate. Every reporting entity that opens an account today must file the customer's verified records with the Central KYC Records Registry, so a single question on its 14-digit identifier, upload timelines or account types can decide your marks. This guide breaks down what CKYCR is, who runs it, the four record types, and the compliance duties a banker must remember, all mapped to the PML Rules and the RBI Master Direction on KYC as they stand in 2026.

🏛️ What Is the Central KYC Records Registry?

The Central KYC Records Registry (CKYCR) is a centralised repository that stores the KYC records of customers in a single, standardised electronic format so they can be reused across the financial system. It was created under Rule 9(1A) of the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, which empowers the Central Government to authorise an agency to receive, store, safeguard and retrieve KYC records. That agency is CERSAI — the Central Registry of Securitisation Asset Reconstruction and Security Interest of India — the same government-owned body that runs the central registry of security interests.

The core idea is "KYC once, use many times". When a customer completes KYC with one bank, the record is uploaded to CKYCR and made available to every other regulated entity under the RBI, SEBI, IRDAI and PFRDA. This removes duplicate document collection, speeds up onboarding, and gives investigators a single searchable trail — a genuine anti-money-laundering control, not just a convenience. Banks perform the underlying verification during their customer identification procedure and risk management process before any record is pushed to the registry. CKYCR became operational for banks from 15 July 2016 and now covers individuals as well as legal entities.

💡 Exam Tip: Remember the ownership split — the registry is CKYCR, the operator/manager is CERSAI, and the enabling law is Rule 9(1A) of the PML (Maintenance of Records) Rules, 2005. Examiners love swapping these three.

🔢 How the CKYC Identifier (KIN) Works

Once a customer's record is successfully uploaded for the first time, CERSAI generates a unique 14-digit KYC Identifier, also called the KIN (KYC Identification Number). This number is random and non-repeating, and CERSAI sends an SMS or email to the customer's registered mobile or email once it is created or updated. The KIN is the key that unlocks the entire "reuse" benefit: under Rule 9(1C) of the PML Rules, when a customer quotes their KYC Identifier, the bank must retrieve the record online from CKYCR and cannot insist on fresh documents — unless there is a change in information, the record needs updating, or the validity of the earlier document has lapsed.

This is where the registry connects directly to your bank's KYC policy and customer acceptance policy. A well-drafted policy will tell staff exactly when a KIN can be relied upon and when enhanced checks still apply. The 14-digit structure also encodes the customer category — individual, legal entity or minor — which is why different institutions may see slightly different record formats. For the exam, focus on three numbers: the identifier is 14 digits, it is generated by CERSAI, and it is communicated to the customer's registered contact details.

⚠️ Common Mistake: Candidates confuse the KIN with the Aadhaar or PAN. The KIN is a fresh 14-digit number generated only by CERSAI after upload — it is neither derived from Aadhaar nor from PAN.

📇 Types of CKYC Accounts

CKYCR classifies records into four account types depending on the level of due diligence and the documents collected. Knowing which type maps to which customer is a very common two-mark question, so learn the table below cold. The distinction mirrors the risk-based approach that underpins the whole KYC framework, and it links to how banks handle the three stages of money laundering at the placement stage where accounts are first opened.

The Small and OTP-based categories carry regulatory ceilings — for example, OTP-based e-KYC accounts are subject to aggregate limits and must be converted to full KYC within the prescribed period. Small accounts remain valid only while balance and turnover stay within the caps. Understanding these tiers helps you answer questions on both the registry and on customer risk categorisation in one shot.

⏱️ Upload Timelines and Compliance Duties

The RBI Master Direction on KYC obliges every regulated entity to capture the customer's KYC information in the CKYCR template and upload it within the prescribed window. For individual accounts the record must be filed with CKYCR within 10 days of the commencement of the account-based relationship, and legal-entity records were brought into the same regime subsequently. Failure to upload — or uploading incomplete or inaccurate records — is a compliance breach that can attract supervisory action, so the duty sits squarely with the bank's principal officer and the branch.

Reporting entities must also keep the registry current: whenever a customer's KYC is updated at the bank, the revised record must be pushed to CKYCR so the shared copy never goes stale. This ties into the broader compliance architecture your bank builds under its organisational set-up for KYC/AML. Strong CKYCR discipline also strengthens fraud defences: clean, current central records make money mule account detection far easier because mismatches surface quickly when the same person appears across institutions.

📌 Remember: Individual KYC records go to CKYCR within 10 days of opening the relationship. The record must be refreshed on the registry every time the bank updates the customer's KYC — the two obligations are separate.

🔄 CKYCR in Periodic Updation and Re-KYC

The registry is not a one-time upload. Under the risk-based periodic updation regime, high-risk customers are re-verified every two years, medium-risk every eight years and low-risk every ten years, and each refreshed record must flow back to CKYCR. Bankers preparing for the certificate should read the full periodic KYC updation rules alongside CKYCR, because the exam frequently pairs the registry with re-KYC timelines in a single case study. When a customer already has a KIN, periodic updation is lighter — the bank retrieves the central record, confirms nothing has changed, and simply revalidates.

The registry also supports the wider AML ecosystem beyond deposit accounts. Because credit relationships equally require KYC, the same records support lending compliance, including flows such as priority sector lending where borrower identity must be robustly established before disbursal. For a full topic map across this paper, browse the KYC, AML and CFT article hub, and when you are ready to test recall, attempt a timed set on iibf.store practice tests or revise the fundamentals through the CAIIB course track if you are combining certifications.

🧠 Practice MCQs: Central KYC Records Registry

Want chapter-wise mock tests with 100+ MCQs? Start practising free

❓ Frequently Asked Questions

Authoritative reference: see the latest guidelines on the Reserve Bank of India website and the IIBF syllabus portal.

Master the Central KYC Records Registry and you lock in easy marks that many candidates lose. Reinforce it with timed revision — jump into a full mock on iibf.store practice tests and turn this topic into guaranteed score.