RBI Guidelines Under Anti-Money Laundering (Part 2): KYC, CAP & CIP Explained

Money laundering quietly moves an estimated 2-5% of global GDP through the financial system every year. Banks sit on the front line of that fight. This is why the RBI guidelines under anti-money laundering exist. And why every banker preparing for the IIBF AML-KYC 2026 certification must know them cold.

This is Part 2 of our easy AML-KYC notes. In Part 1 we covered the purpose. Applicability and aim of the KYC, AML and CFT framework. Here we go deeper into the heart of the KYC Policy - the Customer Acceptance Policy. Risk profiling, and the Customer Identification Procedure.

Read this once. Revise it daily. And the toughest exam questions on this topic will feel routine. Let us begin.

What the RBI Guidelines Under Anti-Money Laundering Cover

Anti-Money Laundering guidelines are the rules. Regulations. Obligations framed to detect and prevent money laundering and other financial crimes. The Reserve Bank of India issues these directions to keep the banking system clean.

Under the AML Compliance Program for Banks. The RBI prescribes a layered system. Each layer plugs a different gap that criminals try to exploit.

• KYC in Banking - knowing who your customer truly is.
• CDD in Banking - Customer Due Diligence on the relationship. Its risk.
• Screening of transactions - watching money movement for red flags.
• AML audits - independent checks that the system actually works.

This Part 2 zooms into the KYC Policy. Its two most exam-relevant building blocks: the Customer Acceptance Policy. The Customer Identification Procedure.

Why These Guidelines Matter for Bankers

A weak onboarding process is how dirty money slips in. The RBI guidelines under anti-money laundering push the burden of vigilance onto the bank. Not the regulator.

For an aspirant, this topic is high-yield. Questions on risk categorization. CAP and CIP appear in almost every AML-KYC paper. For a working banker. Getting this wrong can mean penalties and reputational damage.

So mastering this is not just exam strategy. It is professional survival in modern banking.

Customer Acceptance Policy (CAP)

The Customer Acceptance Policy is the rulebook for who a bank will. Will not onboard. It is the first filter against money launderers. Everything starts with building a profile.

Risk Profile: Building a File on Every New Client

Banks must prepare a profile for every new client based on risk categorization. A customer profile may contain details on the customer's identity. Social or financial status, the nature of business, location and activity.

There is an important limit here. While preparing the profile. Banks must seek only information relevant to the risk category.

Never anything intrusive. The customer profile is a confidential document. Its details must not be used for cross-selling or any other purpose.

Purpose of the Risk Profile: Low, Medium and High Risk

The whole point of the profile is to sort customers by the risk they carry. Different risk levels trigger different levels of scrutiny.

For risk categorization. Individuals (other than High Net-Worth individuals). Entities whose identity and sources of wealth can be easily identified. And whose transactions fit a known profile. May be categorized as low risk.

Examples of low-risk customers:

• Salaried employees whose wage structure is well defined.
• People from the lower economic strata with small balances and low turnover.
• Government departments and government-owned companies.
• Regulatory and statutory bodies.

For these customers. The policy may require only basic identity and location verification. The risk is low, so the friction is low.

Customers likely to pose a higher than average risk should be categorized as medium or high risk. This depends on the client's background. Nature and place of business. Country of origin. Sources of funds and the profile of their own clients.

For these customers. Banks must apply Enhanced Due Diligence (EDD) based on risk assessment. EDD means intensive due diligence on higher-risk clients. Especially those with unclear sources of funds.

Examples of higher-risk customers:

• Non-resident customers.
• High Net-Worth Individuals (HNIs).
• Trusts, NGOs, charities and organizations receiving donations.
• Companies with close family shareholding or beneficial ownership.
• Firms with "sleeping partners".
• Politically Exposed Persons (PEPs) of foreign origin.
• Persons with a dubious reputation as per available public information.

Risk Categories at a Glance

This comparison table is a perfect last-minute revision tool. Memorize the pattern, not the words.

Risk Category	Typical Customers	Level of Due Diligence
Low Risk	Salaried staff, govt. bodies, low-turnover accounts	Basic identity and address verification
Medium Risk	Customers with moderate but unclear risk factors	Standard to enhanced due diligence
High Risk	NRIs, HNIs, PEPs, trusts, NGOs, sleeping-partner firms	Enhanced Due Diligence (EDD)

The Policy Must Not Be Too Restrictive

Here is a point examiners love. The Customer Acceptance Policy and its implementation should not be too restrictive. It must never lead to the denial of banking services. Especially to those who are financially or socially disadvantaged.

In short, balance is everything. Vigilance must not become exclusion.

Customer Identification Procedure (CIP)

Once a customer is accepted, the bank must verify who they are. This is the job of the Customer Identification Procedure. The Banking Board must approve a clear policy on it.

When Must Identification Happen?

Customer identification means identifying the customer and verifying their identity using reliable. Independent source documents, data or information. The CIP must be carried out at specific stages.

• When establishing a banking relationship or executing a financial transaction.
• When the bank doubts the authenticity or adequacy of previously obtained identification data.

Banks must obtain enough information to satisfy themselves about the identity of each new client. Regular or occasional, and the purpose of the relationship.

What "To Be Satisfied" Really Means

To be satisfied means the bank can prove to the relevant authorities that due diligence was done per the applicable guidelines. Based on the client's risk profile.

This is a risk-based approach. It is deliberately designed to avoid disproportionate costs for banks. A burdensome experience for genuine customers.

The information. Documents required also depend on the type of customer - individual. Business and so on.

Identification for Natural Persons

For individuals (natural persons), banks should obtain sufficient identification data to verify:

• The identity of the client.
• Their address or location.
• A current photograph.

Identification for Legal Persons or Entities

For companies. Firms and other legal entities, the bank must do more digging. The goal is to see the real people behind the entity.

• Verify the legal status of the entity through proper and relevant documents.
• Verify that any person acting on behalf of the entity is authorized to do so. And identify that person.
• Understand the ownership. Control structure and determine who ultimately controls the entity.

Note: Banks may develop their own internal guidelines based on experience. Banker's prudence and legal requirements. If a bank accepts such an account under its CAP. It must take reasonable steps to identify. Verify the beneficial owner(s).

Special Case: Opening Accounts for Relatives

This is a practical, frequently-tested scenario. Some close relatives - wife. Son, daughter, parents - live with the head of the household. They often face difficulty opening an account. Utility bills are not in their name.

The RBI has clarified the solution. In such cases, banks may obtain:

1. The identity document. Utility bill of the relative the customer lives with.
2. A declaration by that relative confirming the person is a relative living with them.

Banks can also use additional proof. Such as a letter delivered by post, for further address verification. This keeps banking accessible without breaking the rules.

Periodic Updation of KYC Records

KYC is not a one-time event at account opening. Banks must run a system of periodic updation of a client's identification data. Including photographs, after the account is opened.

The frequency of this updation depends on the customer's risk category. Learn these intervals - they are classic exam material.

Customer Risk Category	Minimum Updation Frequency
Low Risk	At least once every 5 years
Medium & High Risk	At least once every 2 years

Note: Updation timelines have evolved over the years. Always confirm the exact periodic updation interval on the latest official IIBF notification. Current RBI Master Direction before your exam.

Documents and the Idea of "Correct Permanent Address"

The RBI provides an indicative list of documents. Information for customer identification. For clarity. The correct permanent address means the address where the person usually stays. It may be the address in the utility bill or any other document the bank accepts for address verification.

Two crucial points about this list:

• The indicative list is not exhaustive.
• It must not be used to deny banking services to any section of the public.

Banks are always advised to review their existing internal guidelines accordingly. The spirit is inclusion with vigilance.

How to Study This Topic for the IIBF AML-KYC Exam

Theory alone will not get you through. Use a smart. Repeatable method to lock in the RBI guidelines under anti-money laundering.

1. Learn the structure first. CAP decides "who to accept". CIP decides "how to verify". Periodic updation decides "how to stay current".
2. Master the examples. Know at least three low-risk and three high-risk customer types by heart.
3. Memorize the numbers. The 5-year and 2-year updation cycles are easy marks.
4. Revise daily, not in one sitting. A little every day beats cramming the whole syllabus in one go.
5. Test yourself. Attempt our mock tests to convert reading into recall under exam pressure.

For deeper concept clarity on related chapters, browse our free guides on AML, KYC and CFT.

Common Mistakes Students Make

Avoid these traps and you will already be ahead of most candidates.

• Confusing CAP with CIP. Acceptance is about the decision to onboard. Identification is about verifying the person.
• Forgetting the "not too restrictive" rule. Many candidates miss that AML must not deny services to the disadvantaged.
• Mixing up updation frequencies. Remember: higher risk means more frequent updation (2 years), not less.
• Ignoring beneficial ownership. For legal entities, the real controller must always be identified.
• Treating the document list as final. The indicative list is never exhaustive.
• Relying on old figures. Regulatory timelines change - always confirm on the latest official IIBF notification.

Frequently Asked Questions (FAQ)

What is the Customer Acceptance Policy in AML?

The Customer Acceptance Policy is the bank's framework for deciding. Customers to onboard. It requires building a risk-based profile and categorizing each customer as low. Medium or high risk before opening an account.

What is the difference between CAP and CIP?

CAP (Customer Acceptance Policy) governs the decision to accept a customer. CIP (Customer Identification Procedure) governs how the bank verifies that customer's identity using reliable. Independent documents. CAP comes first, CIP enforces it.

How often must banks update KYC records?

Periodic updation is generally required at least once every 2 years for high. Medium risk customers and once every 5 years for low risk customers. Always confirm the current interval on the latest official IIBF notification. RBI Master Direction.

Who are considered high-risk customers under RBI AML guidelines?

High-risk customers include non-residents. High Net-Worth Individuals. Trusts.

NGOs. Charities. Firms with sleeping partners.

Foreign Politically Exposed Persons (PEPs) and persons with a dubious public reputation. They require Enhanced Due Diligence.

Can a person open an account if utility bills are not in their name?

Yes. If a relative lives with family. The bank may accept the identity document.

Utility bill of the relative they live with. Plus a declaration confirming the relationship. Additional proof like a posted letter may be used for address verification.

Final Words: Turn These Notes Into Marks

The RBI guidelines under anti-money laundering are not just compliance jargon. They are the backbone of a clean banking system. And a guaranteed scoring area in your IIBF AML-KYC 2026 exam.

Understand the logic. Memorize the examples and numbers, and revise a little every day. Do that. And you will walk into the exam hall calm and confident.

In the next part of this series. We move into the Monitoring of Transactions and Risk Management guidelines. Keep going - you are closer to clearing this exam than you think.

Related Guides