Periodic KYC updation, often called re-KYC, is the process through which a bank or other RBI-regulated entity keeps customer due-diligence information current. It does not automatically mean that every customer must repeat the entire account-opening KYC process each time a reminder arrives.
RBI's KYC FAQ explains that periodic updation is risk-based. The minimum frequency is at least once every two years for high-risk customers, once every eight years for medium-risk customers and once every ten years for low-risk customers. A regulated entity may apply additional measures under its internal KYC policy.
Why does periodic KYC exist?
KYC is not a one-time file created when an account is opened. Regulated entities must keep customer information relevant and up to date as part of ongoing due diligence. Changes in identity details, address, occupation, business profile, beneficial ownership or other customer information can affect the accuracy of the original record.
The periodic review also allows the regulated entity to migrate older records to the current customer-due-diligence standard and, where applicable, update information with the Central KYC Records Registry.
How often is re-KYC required?
RBI's current FAQ sets the minimum periodicity by the customer's risk category: two years for high risk, eight years for medium risk and ten years for low risk. The period runs from account opening or the last KYC verification or updation, as applicable.
Customers should not assume their own risk category from account balance or occupation alone. RBI lists broad risk factors such as customer identity, social and financial status, nature and location of business, geographical risk, products and delivery channels, and transaction types. The regulated entity performs the categorisation and need not disclose the category or reasons to the customer.
What if none of your KYC information has changed?
For an individual whose KYC information has not changed, RBI permits a self-declaration to that effect through prescribed channels rather than requiring a fresh set of identity and address documents in every case. The exact channel offered can depend on the regulated entity.
This is an important distinction between confirming existing KYC information and changing KYC information. A customer receiving a periodic-update reminder should first identify whether any underlying details have actually changed.
What if only the address has changed?
RBI's KYC framework also provides simplified treatment where only address details change. The regulated entity can obtain the customer's declaration of the new address through permitted channels and must verify the declared address within the prescribed framework. Customers should use the bank's authorised process and retain the acknowledgement.
Can KYC be updated without visiting the home branch?
RBI permits multiple modes for periodic updation, subject to the applicable conditions and the regulated entity's systems. These can include digital or remote channels, Video Customer Identification Process where offered, and other authorised mechanisms. RBI's 2025 KYC Amendment Directions also expanded the use of authorised bank Business Correspondents for obtaining specified self-declarations for no-change cases or address-only changes.
A customer should therefore use the official app, website, branch, authorised BC or other channel communicated by the bank rather than responding to an unsolicited link or sharing credentials with a caller claiming that KYC will expire immediately.
Special relief for low-risk individual customers
The 2025 amendment introduced a specific protection for an individual customer categorised as low risk. It requires the regulated entity to allow transactions and ensure KYC updation within one year after KYC falls due or up to 30 June 2026, whichever is later, while subjecting the account to regular monitoring. The June 2026 calendar date was a transitional outer date; for future cases, the operative one-year-from-due-date element should be read with the current RBI directions.
This should not be interpreted as permission to ignore a genuine KYC reminder. It is a consumer-protection measure within the regulated framework, not a permanent waiver of periodic KYC.
How CKYCR can reduce repeated document collection
RBI's KYC framework requires regulated entities, where applicable, to seek or retrieve the customer's KYC Identifier and obtain KYC records online from the Central KYC Records Registry. The framework says the same KYC records or additional identification documents should not be demanded again unless specified circumstances apply, such as a change in information, incomplete or outdated records, validity issues or enhanced due-diligence needs.
This is useful for customers who assume that every new relationship necessarily requires another full paper KYC file. A CKYC record can reduce repetition, although the regulated entity remains responsible for satisfying its own legal due-diligence obligations.
Practical example
Assume an individual has maintained a savings account for many years and receives a periodic KYC message. The customer's name, PAN, identity details and address are unchanged. The right first step is not to send scanned documents to the phone number in the message. The customer should open the bank's official app or website, call an independently verified bank number or visit an authorised channel and check whether a no-change self-declaration is available.
If the customer has moved to a new address, the update should instead use the bank's authorised address-change process. If identity or other material information has changed, the bank may need the relevant updated documents or verification.
Customer checklist for a KYC reminder
- Verify the reminder: use the bank's official app, website, published customer-care number or branch rather than clicking an unknown link.
- Identify what changed: separate a no-change case from an address-only change or a material change in identity or customer information.
- Use the simplest authorised route: ask whether self-declaration, digital updation, V-CIP, branch service or an authorised Business Correspondent is available for your case.
- Keep acknowledgement: preserve the confirmation or reference number until the bank confirms that its records are updated.
- Never share authentication secrets: a KYC process is not a reason to disclose OTPs, PINs, passwords or card credentials to an unsolicited caller.
- Follow up if the record remains pending: if the authorised submission is complete but the status is not updated, contact the regulated entity through its official grievance channel.
Common mistakes to avoid
- Assuming every periodic KYC request requires fresh copies of all documents.
- Assuming every customer follows the same two-year, eight-year or ten-year cycle without regard to risk classification.
- Sending KYC documents or credentials through an unverified link received by SMS or messaging apps.
- Ignoring a genuine reminder because account details have not changed; a no-change declaration may still be required.
- Confusing CKYCR availability with a complete exemption from a regulated entity's due-diligence checks.
Practical takeaway
RBI periodic KYC is a risk-based record-updation process, not automatically a demand to redo full KYC. Start by checking whether your information has changed, use only the regulated entity's authorised channel, and use the simplified self-declaration route where it applies. The minimum RBI periodicity is two years for high-risk, eight years for medium-risk and ten years for low-risk customers, but the institution can apply additional controls under its KYC policy.
