Customer Due Diligence Norms: KYC Rules for CAIIB BRBL

Customer due diligence norms are the identification, verification and ongoing monitoring steps a bank must complete before and during every customer relationship. In India they flow from the Prevention of Money Laundering Act, 2002, the PML (Maintenance of Records) Rules, 2005, and the RBI Master Direction on Know Your Customer (KYC), 2016, as amended. For CAIIB Banking Regulations and Business Laws, this is one of the highest-yield chapters: the questions are rule-based, the numbers are fixed, and the marks are easy if you memorise the framework instead of the folklore.

🔍 The Five Elements of Customer Due Diligence

The RBI Master Direction breaks the obligation into five distinct elements, and examiners love asking which one is missing from a given list.

• Identification of the customer using the prescribed identity and address proof.
• Verification of that identity from a reliable, independent source.
• Identification of the beneficial owner where the customer is not a natural person.
• Understanding the purpose and intended nature of the business relationship.
• Ongoing due diligence — monitoring transactions to confirm they match the declared profile and source of funds.

The critical exam point is that due diligence is not a one-time account-opening ritual. The first four elements are front-loaded; the fifth runs for the entire life of the relationship. A bank that opened an account perfectly in 2019 and never looked at it again has still breached the norms.

A second point candidates miss: due diligence is mandatory not only at account opening, but also for an occasional transaction above the prescribed threshold, whenever there is a doubt about the veracity of previously obtained data, and whenever the bank suspects money laundering or terrorist financing — irrespective of any threshold or exemption.

If the bank cannot complete the exercise, the prescribed response is to refuse to open the account, close an existing one, and consider filing a suspicious transaction report. It is never acceptable to open the account provisionally and collect papers later. Build your foundation with the legal framework of regulation of banks chapter before you attempt the applied questions.

💡 Exam Tip: If an option says due diligence is complete once the account is opened and documents are filed, it is wrong. Ongoing due diligence is a permanent, continuing obligation.

🪪 Officially Valid Documents and the Digital Routes

The PML Rules define a closed list of Officially Valid Documents (OVDs): passport, driving licence, proof of possession of Aadhaar number, Voter's Identity Card issued by the Election Commission, job card issued by NREGA signed by a State Government officer, and the letter issued by the National Population Register containing name and address.

Note what is not on that list. The PAN card is not an OVD — it is separately required for tax purposes, and this single fact is the most frequently tested trap in the chapter. Where an OVD does not carry an updated address, the customer may submit a deemed-OVD such as a recent utility bill, and then furnish an OVD with the current address within three months.

Verification can be completed through several routes, and each carries its own conditions:

1. Physical OVD with a certified copy and the original sighted by an authorised officer.
2. Aadhaar e-KYC authentication, available to banks notified under Section 11A of the PMLA, with the customer's explicit consent.
3. Offline Aadhaar verification using the XML file or secure QR code, where the Aadhaar number itself is redacted.
4. Digital KYC as defined in the PML Rules, using a live photograph captured in the bank's application with geo-tagging.
5. V-CIP — the video-based customer identification process, an alternate face-to-face channel permitted by RBI, requiring a live, unbroken and secure video interaction handled by a trained official.

V-CIP is treated as face-to-face onboarding, which is exactly why it does not automatically attract the extra scrutiny that other non-face-to-face channels attract. Read the RBI Master Directions page for the current text before the exam, since this Direction is amended frequently.

📊 Risk Categorisation and Periodic KYC Updation

Every customer must be assigned a risk category — low, medium or high — based on identity, social and financial status, nature of business and expected transaction pattern. The category is not decorative: it drives how often the bank must refresh KYC and how deep the scrutiny goes. The risk profile itself is confidential and must never be disclosed to the customer.

Two clarifications decide marks here. First, periodic updation does not require fresh documents when there is no change in KYC information — a self-declaration through the customer's registered email, mobile number, ATM, digital channel or a letter is sufficient. Second, the clock runs from the date of the last KYC updation, not from the date the account was opened.

Where only the address has changed, the customer may submit a self-declaration of the new address, which the bank must verify within two months. Accounts overdue for updation attract restrictions on operations, but only after prior intimation and reminders to the customer.

Commit the cycle to memory as 10-8-2: low risk ten years, medium risk eight years, high risk two years. If a question offers five years for any category, it is a distractor — five years is the record-retention period under the PMLA, not an updation cycle.

👤 Beneficial Owners, PEPs and Enhanced Due Diligence

When the customer is a company, partnership firm, trust or unincorporated association, the bank must look through the legal shell and identify the natural person who ultimately owns or controls it. The PML Rules prescribe controlling-ownership thresholds for each entity type, and those thresholds were tightened by amendment in 2023 — answer from the current Rules rather than an older textbook. Where no natural person crosses the threshold, the beneficial owner is the natural person holding the position of senior managing official.

For a trust, the bank must obtain the names of the settlor, the trustees, the protector, the beneficiaries with a specified interest, and anyone exercising ultimate effective control. For an unincorporated association, the resolution of the managing body and the power of attorney granted to the transacting person are mandatory records.

Enhanced due diligence applies to politically exposed persons, correspondent banking relationships, customers from jurisdictions flagged by the Financial Action Task Force, and any relationship the bank rates as high risk. In practice it means senior-management approval before onboarding, verification of the source of funds and source of wealth, and closer transaction monitoring.

The mirror concept is simplified due diligence, allowed only for demonstrably low-risk relationships such as a small account. A small account may hold a balance of not more than ₹50,000, receive aggregate credits of not more than ₹1,00,000 in a financial year, and permit withdrawals and transfers of not more than ₹10,000 in a month. It is valid for twelve months, extendable to twenty-four months on proof that the customer has applied for an OVD.

Entity onboarding also demands constitutional documents, which is why the control over organisation of banks chapter pairs naturally with this topic, alongside licensing of banking companies in Module A.

🏛️ Statutory Backbone, Penalties and Exam Traps

Business-law questions rarely ask what KYC is; they ask where the power comes from. RBI issues the KYC Master Direction under Section 35A of the Banking Regulation Act, 1949, read with Rule 9(14) of the PML Rules — the single most examinable sentence in the chapter.

The obligations sit in Section 12 of the PMLA: maintain records of prescribed transactions, verify client identity, identify beneficial owners, and preserve the records for five years — transaction records from the date of the transaction, identity records from the date the relationship ends. Failure attracts penalty under Section 13, imposed by the Director, FIU-IND, while non-compliance with an RBI direction separately attracts penalty under Section 47A of the Banking Regulation Act, 1949.

Banks also upload KYC records to the Central KYC Records Registry (CKYCR), run by CERSAI, so a customer verified once can be onboarded elsewhere without repeating the paperwork. Separate the three cleanly: RBI directs, FIU-IND receives reports and penalises, CERSAI runs the registry.

The lapses the regulator keeps flagging are familiar: deemed-OVDs never regularised, updation closed by a bulk system flag instead of customer contact, beneficial-owner fields left blank on corporate accounts. Note also that risk categorisation is confidential, introduction by an existing customer is no substitute for due diligence, and an account cannot be opened where the beneficial owner is withheld.

⚠️ Common Mistake: Candidates assume a PAN card alone can open an account. PAN is not an Officially Valid Document — it is a tax requirement. You still need an OVD for identity and address.

Because the enforcement chain often ends in recovery, revise this alongside asset reconstruction companies under SARFAESI and the Insolvency and Bankruptcy Code, 2016 chapter. Authorised dealer branches must satisfy both this Direction and the FEMA provisions for bankers, while treasury candidates should see how counterparty verification works for primary dealers in government securities. The bare PMLA text sits on India Code; more notes are in our Banking Regulations and Business Laws tag hub.

🧠 Practice MCQs: Customer Due Diligence Norms

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

🚀 Revise This With Timed Practice

Learn the five elements, the OVD list, the three updation cycles and the Section 35A source, and this chapter becomes a scoring one. Lock it in with the full CAIIB course material and attempt a timed chapter test the same day you revise.