What changed
RBI observed banks overstepping by asking for non-mandatory personal details (e.g., number of dependents, spouse details, assets) during KYC. It reiterates that only risk-relevant mandatory info should be collected; optional info needs explicit consent after account opening. Confidentiality of all customer data is stressed, prohibiting use for cross-selling.
What it means for you
Banks must immediately review KYC forms to remove intrusive questions not tied to risk assessment. This reduces customer friction and privacy complaints but may limit data for profiling. Lenders must clearly distinguish mandatory vs. optional fields and obtain separate consent for optional data, impacting CRM and cross-sell strategies.
What you must do
- Audit current KYC forms and processes to remove non-mandatory personal questions (e.g., family details, assets, lifestyle).
- Separate mandatory KYC fields from optional ones; obtain explicit customer consent for optional data after account opening.
- Train frontline staff on permissible KYC data collection and confidentiality rules to avoid privacy violations.
- Update internal policies to ensure customer data is not used for cross-selling without separate consent.
Who it affects
All scheduled commercial banks (excluding RRBs), Local Area Banks, All India Financial Institutions, Compliance and KYC teams, Branch staff handling account opening
What specific information is now considered intrusive for KYC?
RBI flagged details like number of dependents, names of children, lifestyle, foreign visits in last 3 years, family members abroad, assets/liabilities, spouse name/date of birth, wedding date, and investments as non-mandatory and intrusive.
Can we still collect optional customer information for cross-selling?
Yes, but only after account opening and with explicit customer consent. The customer must know which data is mandatory for KYC and which is optional. Such data cannot be used for cross-selling without separate consent.
What should we do with existing customer data collected earlier?
Ensure all customer data is treated as confidential. For non-mandatory data collected without explicit consent, seek fresh consent or stop using it for cross-selling. Review periodic updation processes to align with this circular.