Reserve Bank of India (Payments Banks – Know Your Customer) Directions, 2025 (Updated as on December 29, 2025)

1. The law behind it

The rules rest on the Prevention of Money-Laundering Act, 2002 and its 2005 Rules.

1. Ten per cent, a company

For a company, holding more than ten per cent is one test of beneficial ownership.

2. Fifteen per cent, a body

In an unincorporated body the same test is more than fifteen per cent.

3. Fifty thousand triggers checks

A one-off transaction of ₹50,000 or more brings the full identification duty.

4. Designated Director named

The Board must name a Designated Director who answers for compliance under the Act.

5. KYC for payments banks

This document sets the customer identification rules for payments banks.

6. Who is covered

These Directions apply to every payments bank.

7. Control counts as well

A person who controls the entity by other means is a beneficial owner too.

8. Then the senior official

Where no natural person can be found, the senior managing official is named.

9. Split payments still count

Several linked payments are read together, so splitting a sum does not avoid it.

10. What a remote customer is

A remote customer is one who opens an account without meeting the bank at all.

11. What a shell bank is

A shell bank has no physical presence where it is licensed and no real group behind it.

12. Video call identification

A bank officer may identify a customer over a live video call.

13. Video equals a meeting

A video call that follows the rules counts the same as meeting in person.

1. Never tip off a customer

Group information sharing must be built so that nobody is tipped off.

2. The decision stays inside

Whether KYC has been met is a decision the bank cannot outsource to anyone.

3. Director reported to FIU-IND

The name and contact details of that Director must go to FIU-IND and RBI.

4. Board approves KYC policy

The Board must approve the bank's customer identification policy.

5. Four parts to the policy

The policy must cover acceptance, risk management, identification and monitoring.

6. Board policy on mobile changes

A Board approved policy is needed for changing a mobile number on a remote account.

7. Board approves cross-border terms

The Board, or a committee led by the Chairman or chief executive, sets the terms.

8. Quarterly note to the committee

An audit note and compliance go to the Audit Committee every quarter.

9. Principal Officer duties

The Principal Officer watches transactions and reports what the law requires.

1. No anonymous accounts

No account may be opened in an anonymous, fictitious or benami name.

2. No account without checks

Where customer due diligence cannot be done, the account is not opened at all.

1. Walk-in customers too

A walk-in customer paying ₹50,000 or more must be identified in the same way.

1. OTP account balance limit

In an Aadhaar one-time password account the total balance cannot cross one lakh rupees.

2. Two lakh a year

Credits into those accounts in a financial year cannot cross two lakh rupees.

3. OTP account, one year

An account opened by Aadhaar one-time password cannot run past one year without full checks.

4. Questions must change

The officer must change the questions so the video cannot be a recording.

5. Printed e-PAN not valid

A printed copy of an electronic document, such as an e-PAN, cannot be used.

6. Small account credit limit

In a small account, credits in a financial year cannot cross one lakh rupees.

7. Small account withdrawal limit

Withdrawals and transfers together cannot cross ten thousand rupees in a month.

8. Risk reviewed twice a year

Customer risk categories must be reviewed at least once in every six months.

9. High risk, two years

Papers of a high-risk customer must be refreshed at least once in two years.

BankPulse example. Suppose a high-risk customer's papers were refreshed today. They must be refreshed again within two years. For a medium-risk customer the same papers would last eight years. For low risk they would last 10 years.

10. Medium risk, eight years

For a medium-risk customer the gap may be eight years.

11. Low risk, ten years

For a low-risk customer the gap may be ten years.

12. Thirty days to update

A change in a customer's papers must reach the bank's records within 30 days.

13. No second mobile number

A second mobile number cannot be linked to such an account for one-time passwords.

14. Live location in video

The video must carry the customer's live location, with the date and time.

15. Video data kept in India

The whole video record must sit on systems inside India.

16. Three warnings before

At least three advance intimations must go out before KYC falls due, one by letter.

17. Three reminders after

At least three reminders must follow, again including one by letter.

18. Notice before stopping account

Before it temporarily stops an account for a missing PAN, the bank must give notice.

19. First credit from own bank

The first money into such an account must come from the customer's checked account.

20. Find the source of funds

For a politically exposed person the source of funds and wealth must be established.

21. Senior approval for PEPs

If a customer becomes a politically exposed person, senior management must approve keeping the account.

22. Audit before account opens

An account opened by video call starts working only after an audit clears it.

23. Government money not counted

Government grants and welfare payments do not count against that balance limit.

24. Watched until met in person

Such an account stays under closer watch until the customer is seen or verified by video.

25. Politically exposed persons

A relationship with a politically exposed person is allowed only on set terms.

26. Senior approval for a PEP

Opening an account for such a person needs senior management approval.

27. Their families are covered

The same duties apply to the family members and close associates of such a person.

28. Self help groups eased

The bank need not check every member of a self help group at account opening.

1. Records kept five years

Transaction records must be kept for at least five years from the date of the transaction.

2. Identity papers after closure

Customer identity records must be kept for five years after the relationship ends.

3. Charities on DARPAN

A non-profit customer must be registered on the DARPAN portal of NITI Aayog.

1. Alerts for odd transactions

Software must raise an alert when a transaction does not match the customer's profile.

2. Report does not freeze

Filing a suspicious transaction report is not by itself a reason to stop an account.

1. Freeze order acted on

A freeze order under section 12A must be acted on without delay.

2. Sanctions list checked daily

The UNSCR 1718 sanctions list must be checked every single day.

3. Duty under the UAPA

The bank carries duties under section 51A of the Unlawful Activities Prevention Act.

4. Duty under the WMD Act

Separate duties arise under the Weapons of Mass Destruction Act of 2005.

1. Ten days to the registry

A new customer's KYC record goes to the central registry within ten days.

2. Seven days for an update

Updated customer information must reach the central registry within seven days.

3. Money mule accounts

The bank must find accounts used as money mules and report them to FIU-IND.

4. Account payee cheques

The bank cannot collect an account payee cheque for anyone except the payee.

5. No dealing with shell banks

A correspondent relationship with a shell bank cannot be opened or continued.

6. Nor through another bank

The respondent bank must not let a shell bank use its accounts either.

7. Three days for details

Details of a wire transfer must be supplied within three working days of a request.

8. Splitting transfers still checked

A person splitting transfers to stay below ₹50,000 must still be identified.

9. Transfer stopped if unclear

The bank must not send the transfer if it cannot meet these rules.

10. Foreign tax reporting too

The rules on foreign account tax reporting must be followed alongside these.

11. Training differs by role

Training must differ for counter staff, compliance staff and staff opening new accounts.

12. Records sent to CKYCR

Records of company accounts opened on or after 1 April 2021 go to CKYCR.

1. Old actions preserved

Anything already done under the old rules stays governed by those old rules.

2. Approvals carried over

Approvals given under the cancelled rules are now treated as given under these rules.

3. Other laws still apply

These Directions add to other laws. They do not replace any of them.