Reserve Bank of India (Small Finance Banks – Know Your Customer) Directions, 2025 (Updated as on December 29, 2025)
UR
- Applies toSmall finance banks
- StatusIn force
- ImportanceMUST READ
- IssuedNov 28, 2025
- Last amendedDec 29, 2025 · 1 incorporated
- Length76 points in 5 sections · 7 min read
The four dates on this rule
- PublishedNov 28, 2025The day RBI put this document out.
- Starts to applyNot statedNot stated separately in this document. Read the rule itself before you assume a start date.
- Time to get readyNot statedCannot be worked out until the day it starts to apply is known.
- Last date to actNot statedNo date to act by was found in this document. Other dates may sit inside single paragraphs.
Kept in your browser only. Your desk
Show me the points for
Nothing is removed from the page.
Show me the points about
75 of the 76 points name no product and bind every product. All products.
Numbers to remember
| ten per cent | For a company, holding more than ten per cent is one test of beneficial ownership. RBI Para 5(1) |
| fifteen per cent | In an unincorporated body the same test is more than fifteen per cent. RBI Para 5(1) |
| ₹50,000 | A one-off transaction of ₹50,000 or more brings the full identification duty. RBI Para 5(2) |
| one lakh rupees | In an Aadhaar one-time password account the total balance cannot cross one lakh rupees. RBI Para 26(3) |
| two lakh rupees | Credits into those accounts in a financial year cannot cross two lakh rupees. RBI Para 26(4) |
| one year | An account opened by Aadhaar one-time password cannot run past one year without full checks. RBI Para 26(6) |
| ten thousand rupees | Withdrawals and transfers together cannot cross ten thousand rupees in a month. RBI Para 29(2) |
| six months | Customer risk categories must be reviewed at least once in every six months. RBI Para 42(1) |
| two years | Papers of a high-risk customer must be refreshed at least once in two years. RBI Para 43(1) |
| eight years | For a medium-risk customer the gap may be eight years. RBI Para 43(1) |
| ten years | For a low-risk customer the gap may be ten years. RBI Para 43(1) |
| 30 days | A change in a customer's papers must reach the bank's records within 30 days. RBI Para 43(6) |
| five years | Transaction records must be kept for at least five years from the date of the transaction. RBI Para 51(1) |
| ten days | A new customer's KYC record goes to the central registry within ten days. RBI Para 66(2) |
What it says
Must know
1. Ten per cent, a company
For a company, holding more than ten per cent is one test of beneficial ownership.
2. Fifteen per cent, a body
In an unincorporated body the same test is more than fifteen per cent.
3. Fifty thousand triggers checks
A one-off transaction of ₹50,000 or more brings the full identification duty.
4. Never tip off a customer
Group information sharing must be built so that nobody is tipped off.
5. The decision stays inside
Whether KYC has been met is a decision the bank cannot outsource to anyone.
6. Director reported to FIU-IND
The name and contact details of that Director must go to FIU-IND and RBI.
7. No anonymous accounts
No account may be opened in an anonymous, fictitious or benami name.
8. No account without checks
Where customer due diligence cannot be done, the account is not opened at all.
9. Walk-in customers too
A walk-in customer paying ₹50,000 or more must be identified in the same way.
10. OTP account balance limit
In an Aadhaar one-time password account the total balance cannot cross one lakh rupees.
11. Two lakh a year
Credits into those accounts in a financial year cannot cross two lakh rupees.
12. OTP account, one year
An account opened by Aadhaar one-time password cannot run past one year without full checks.
13. Questions must change
The officer must change the questions so the video cannot be a recording.
14. Printed e-PAN not valid
A printed copy of an electronic document, such as an e-PAN, cannot be used.
15. Small account credit limit
In a small account, credits in a financial year cannot cross one lakh rupees.
16. Small account withdrawal limit
Withdrawals and transfers together cannot cross ten thousand rupees in a month.
17. Risk reviewed twice a year
Customer risk categories must be reviewed at least once in every six months.
18. High risk, two years
Papers of a high-risk customer must be refreshed at least once in two years.
BankPulse example. Suppose a high-risk customer's papers were refreshed today. They must be refreshed again within two years. For a medium-risk customer the same papers would last eight years. For low risk they would last 10 years.
19. Medium risk, eight years
For a medium-risk customer the gap may be eight years.
20. Low risk, ten years
For a low-risk customer the gap may be ten years.
21. Thirty days to update
A change in a customer's papers must reach the bank's records within 30 days.
22. No second mobile number
A second mobile number cannot be linked to such an account for one-time passwords.
23. Records kept five years
Transaction records must be kept for at least five years from the date of the transaction.
24. Identity papers after closure
Customer identity records must be kept for five years after the relationship ends.
25. Ten days to the registry
A new customer's KYC record goes to the central registry within ten days.
26. Seven days for an update
Updated customer information must reach the central registry within seven days.
27. Money mule accounts
The bank must find accounts used as money mules and report them to FIU-IND.
28. Account payee cheques
The bank cannot collect an account payee cheque for anyone except the payee.
29. No dealing with shell banks
A correspondent relationship with a shell bank cannot be opened or continued.
30. Nor through another bank
The respondent bank must not let a shell bank use its accounts either.
31. Three days for details
Details of a wire transfer must be supplied within three working days of a request.
32. Splitting transfers still checked
A person splitting transfers to stay below ₹50,000 must still be identified.
33. Transfer stopped if unclear
The bank must not send the transfer if it cannot meet these rules.
Do it
1. Designated Director named
The Board must name a Designated Director who answers for compliance under the Act.
2. Four parts to the policy
The policy must cover acceptance, risk management, identification and monitoring.
3. Live location in video
The video must carry the customer's live location, with the date and time.
4. Video data kept in India
The whole video record must sit on systems inside India.
5. Three warnings before
At least three advance intimations must go out before KYC falls due, one by letter.
6. Three reminders after
At least three reminders must follow, again including one by letter.
7. Notice before stopping account
Before it temporarily stops an account for a missing PAN, the bank must give notice.
8. First credit from own bank
The first money into such an account must come from the customer's checked account.
9. Senior approval for PEPs
If a customer becomes a politically exposed person, senior management must approve keeping the account.
10. Charities on DARPAN
A non-profit customer must be registered on the DARPAN portal of NITI Aayog.
11. Alerts for odd transactions
Software must raise an alert when a transaction does not match the customer's profile.
12. Freeze order acted on
A freeze order under section 12A must be acted on without delay.
13. Sanctions list checked daily
The UNSCR 1718 sanctions list must be checked every single day.
14. Foreign tax reporting too
The rules on foreign account tax reporting must be followed alongside these.
15. Training differs by role
Training must differ for counter staff, compliance staff and staff opening new accounts.
Background
1. The law behind it
The rules rest on the Prevention of Money-Laundering Act, 2002 and its 2005 Rules.
2. KYC rules for SFBs
This document sets the customer identification rules for small finance banks.
3. Who is covered
These Directions apply to every small finance bank.
4. Control counts as well
A person who controls the entity by other means is a beneficial owner too.
5. Then the senior official
Where no natural person can be found, the senior managing official is named.
6. Split payments still count
Several linked payments are read together, so splitting a sum does not avoid it.
7. What a remote customer is
A remote customer is one who opens an account without meeting the bank at all.
8. What a shell bank is
A shell bank has no physical presence where it is licensed and no real group behind it.
9. Video call identification
A bank officer may identify a customer over a live video call.
10. Video equals a meeting
A video call that follows the rules counts the same as meeting in person.
11. Board policy on mobile changes
A Board approved policy is needed for changing a mobile number on a remote account.
12. Board approves cross-border terms
The Board, or a committee led by the Chairman or chief executive, sets the terms.
13. Quarterly note to the committee
An audit note and compliance go to the Audit Committee every quarter.
14. Principal Officer duties
The Principal Officer watches transactions and reports what the law requires.
15. Only term loans there
In such an account only a term loan may be sanctioned, within a set ceiling.
16. Audit before account opens
An account opened by video call starts working only after an audit clears it.
17. Government money not counted
Government grants and welfare payments do not count against that balance limit.
18. Only credits on loans
When a loan account is stopped, only credits into it are allowed.
19. Watched until met in person
Such an account stays under closer watch until the customer is seen or verified by video.
20. Politically exposed persons
A relationship with a politically exposed person is allowed only on set terms.
21. Their families are covered
The same duties apply to the family members and close associates of such a person.
22. Self help groups eased
The bank need not check every member of a self help group at account opening.
23. Report does not freeze
Filing a suspicious transaction report is not by itself a reason to stop an account.
24. Duty under the UAPA
The bank carries duties under section 51A of the Unlawful Activities Prevention Act.
25. Duty under the WMD Act
Separate duties arise under the Weapons of Mass Destruction Act of 2005.
26. Records sent to CKYCR
Records of company accounts opened on or after 1 April 2021 go to CKYCR.
27. Approvals carried over
Approvals given under the cancelled rules are now treated as given under these rules.
28. Other laws still apply
These Directions add to other laws. They do not replace any of them.
How this rule has changed
The points above are the rule as it stands today, after every change listed here.
Issued on Nov 28, 2025. This is the date RBI put the rule out.
Changed on Dec 29, 2025. Takes effect Immediate effect (date of the amendment)..
- When rules start. These amendment rules apply from the date of this note.
- Last uploader duty. The last bank to upload or update KYC must check the customer's identity or address, as needed.
The same subject for other kinds of institution
The same subject for other kinds of institution.
Other RBI rules for small finance banks
RBI compliance officer and compliance function rules for small finance banks 2026
RBI credit bureau reporting rules for small finance banks 2025
RBI credit card and debit card rules for small finance banks 2025
RBI customer service and fair conduct rules for small finance banks 2025
Every rule page on BankPulse · Questions bankers ask, answered