Periodic KYC updation, often called re-KYC, is the process through which a bank or other RBI-regulated entity keeps customer due-diligence information current. It does not automatically mean that every customer must repeat the entire account-opening KYC process each time a reminder arrives.
RBI's KYC FAQ explains that periodic updation is risk-based. The minimum frequency is at least once every two years for high-risk customers, once every eight years for medium-risk customers and once every ten years for low-risk customers. A regulated entity may apply additional measures under its internal KYC policy.
Why the bank asks again
KYC is not a one-time file created when an account is opened. Regulated entities must keep customer information relevant and up to date as part of ongoing due diligence. Changes in identity details, address, occupation, business profile, beneficial ownership or other customer information can affect the accuracy of the original record.
The periodic review also allows the regulated entity to migrate older records to the current customer-due-diligence standard and, where applicable, update information with the Central KYC Records Registry.
How often is re-KYC required?
Under paragraph 38 of RBI's KYC Master Direction, the interval runs from account opening or the last KYC update:
- High risk: at least once every 2 years.
- Medium risk: at least once every 8 years.
- Low risk: at least once every 10 years.
Customers should not assume their own risk category from account balance or occupation alone. RBI lists broad risk factors such as customer identity, social and financial status, nature and location of business, geographical risk, products and delivery channels, and transaction types. The regulated entity performs the categorisation and need not disclose the category or reasons to the customer.
What if none of your KYC information has changed?
For an individual whose KYC information has not changed, RBI permits a self-declaration through prescribed channels. Depending on the institution's facilities, this can use a registered email address or mobile number, internet or mobile banking, an ATM or a letter. A declaration does not cure expired documents or records that no longer meet current due-diligence requirements; paragraph 38(c) addresses those cases.
This is an important distinction between confirming existing KYC information and changing KYC information. A customer receiving a periodic-update reminder should first identify whether any underlying details have actually changed.
What if only the address has changed?
For an address-only change, paragraph 38(a)(ii) permits a declaration through authorised channels. The institution must positively confirm the address within two months, for example through a verification letter or contact-point check. Its approved policy may also require address evidence. There is a separate exception to positive confirmation for the Aadhaar OTP re-KYC route described in paragraph 38(a)(iv).
If documents previously supplied to the bank are updated, send the updated documents within 30 days of that change; do not wait for the next periodic cycle. See RBI KYC FAQ, question 32.
Can KYC be updated without visiting the home branch?
RBI permits multiple modes for periodic updation, subject to the applicable conditions and the regulated entity's systems. These can include digital or remote channels, Video Customer Identification Process where offered, and other authorised mechanisms. RBI's 2025 KYC Amendment Directions also expanded the use of authorised bank Business Correspondents for obtaining specified self-declarations for no-change cases or address-only changes.
If you submit through an authorised Business Correspondent, keep the BC's receipt and look for the bank's later confirmation that its records were updated. The 12 June 2025 amendment leaves responsibility with the bank; handing papers to the BC is not the final confirmation.
A customer should therefore use the official app, website, branch, authorised BC or other channel communicated by the bank rather than responding to an unsolicited link or sharing credentials with a caller claiming that KYC will expire immediately.
Low-risk individual customers: calculate both dates
The 12 June 2025 amendment, incorporated in paragraph 38 of the Master Direction, requires the institution to allow transactions and complete re-KYC by the later of one year after it falls due and 30 June 2026, with regular monitoring. 30 June 2026 is not a universal final deadline.
For illustration, if re-KYC fell due on 1 September 2025, the one-year date is 1 September 2026. That is later than 30 June 2026, so the rule points to 1 September 2026. If it fell due on 1 January 2025, the later date would instead be 30 June 2026. Both examples concern a customer categorised as a low-risk individual; they are not a waiver for every account or every reason for an account restriction.
Ask the bank to confirm the due date recorded for your account and the applicable process. Complete a genuine request promptly rather than treating this provision as a reason to postpone it.
What notices should arrive?
The same amendment requires at least three advance intimations and three reminders after the due date for customers who remain non-compliant. Each set must include a letter. The implementation deadline was 1 January 2026. Notices should explain the update process, where to seek help and any consequences.
How CKYCR can reduce repeated document collection
RBI's KYC framework requires regulated entities, where applicable, to seek or retrieve the customer's KYC Identifier and obtain KYC records online from the Central KYC Records Registry. The framework says the same KYC records or additional identification documents should not be demanded again unless specified circumstances apply, such as a change in information, incomplete or outdated records, validity issues or enhanced due-diligence needs.
This is useful for customers who assume that every new relationship necessarily requires another full paper KYC file. A CKYC record can reduce repetition, although the regulated entity remains responsible for satisfying its own legal due-diligence obligations.
When a reminder arrives but nothing has changed
Assume an individual has maintained a savings account for many years and receives a periodic KYC message. The customer's name, PAN, identity details and address are unchanged. The right first step is not to send scanned documents to the phone number in the message. The customer should open the bank's official app or website, call an independently verified bank number or visit an authorised channel and check whether a no-change self-declaration is available.
If the customer has moved to a new address, the update should instead use the bank's authorised address-change process. If identity or other material information has changed, the bank may need the relevant updated documents or verification.
Customer checklist for a KYC reminder
- Verify the reminder: use the bank's official app, website, published customer-care number or branch rather than clicking an unknown link.
- Identify what changed: separate a no-change case from an address-only change or a material change in identity or customer information.
- Use the simplest authorised route: ask whether self-declaration, digital updation, V-CIP, branch service or an authorised Business Correspondent is available for your case.
- Keep acknowledgement: preserve the confirmation or reference number until the bank confirms that its records are updated.
- Never share authentication secrets: a KYC process is not a reason to disclose OTPs, PINs, passwords or card credentials to an unsolicited caller.
- Follow up if the record remains pending: if the authorised submission is complete but the status is not updated, contact the regulated entity through its official grievance channel.
A useful follow-up to the bank is: “I submitted my no-change declaration through [authorised channel] on [date], reference [number]. Please confirm the KYC update date in your records and identify anything still required.” This makes the unresolved step clear without resending documents to an unverified contact.
