Yes, KYC is mandatory for existing bank customers in India, not only for people opening new accounts. Banks are required to periodically update the Know Your Customer (KYC) information of existing customers as part of ongoing customer due diligence. The frequency of this updation depends on the customer’s risk category. Under the RBI’s current framework, periodic KYC updation is required at least once every two years for high-risk customers, eight years for medium-risk customers and ten years for low-risk customers, counted from account opening or the last KYC updation.
However, periodic KYC does not necessarily mean that every customer must repeatedly submit the entire set of documents. RBI has introduced simplified procedures for eligible customers, particularly where there has been no change in their KYC information.
What Is KYC in Banking?
KYC stands for Know Your Customer. It is the process through which banks verify and maintain information about a customer’s identity, address and other relevant details.
KYC requirements help banks meet obligations relating to customer identification, anti-money laundering and prevention of financial crimes. Banks are expected to keep customer information and documents updated throughout the banking relationship rather than treating KYC as a one-time exercise.
Therefore, completing KYC when opening an account does not necessarily mean that no further verification will ever be required.
Why Is KYC Required for Existing Customers?
A customer’s circumstances can change after an account is opened.
For example, a customer may:
- Change their residential address
- Change their name
- Update identity documents
- Change their occupation or business
- Become subject to a different risk classification
- Provide new information affecting the bank’s customer profile
RBI’s KYC framework requires regulated entities to adopt a risk-based approach and keep customer information collected through customer due diligence up to date and relevant.
This ongoing process helps banks understand whether transactions remain consistent with their knowledge of the customer and their risk profile.
How Often Must Existing Customers Update KYC?
The current RBI framework specifies minimum periodicity based on risk category:
| Customer risk category | Minimum KYC updation frequency |
| High risk | Every 2 years |
| Medium risk | Every 8 years |
| Low risk | Every 10 years |
The period is generally calculated from the date of opening the account or the last KYC updation. Banks may have internal policies that require additional measures where permitted by the regulatory framework.
The customer’s risk category is determined by the bank according to its applicable KYC and risk-management framework.
Is Fresh KYC Documentation Always Required?
No.
One important feature of the RBI framework is that eligible customers may be able to complete periodic KYC through simpler methods.
For an individual customer where there is no change in existing KYC information, a self-declaration may be obtained through channels such as the registered email address, registered mobile number, ATM, internet banking, mobile application or other permitted methods.
Therefore, a customer should not assume that every KYC-update request requires visiting the branch with a complete set of documents.
What If the Customer’s Address Has Changed?
A change in address should be communicated to the bank.
Where KYC information has changed, the bank may require appropriate updated information or documents according to the applicable KYC framework.
Customers should update their bank rather than continuing to use outdated information, particularly when the change affects identity or address records.
Keeping the bank’s records current can also prevent difficulties with future transactions or account-related services.
Can KYC Be Updated Through Digital Channels?
In eligible cases, yes.
RBI’s framework permits several channels for periodic KYC updation, including registered electronic communication and digital banking channels. The exact method available can depend on the bank’s systems and the customer’s circumstances.
Customers should use only the bank’s official website, mobile application, branch or verified customer-service channels. They should not share OTPs, passwords, PINs or internet-banking credentials with people claiming to help with KYC.
What Happens If KYC Is Not Updated?
Failure to comply with applicable KYC requirements can eventually affect the operation of an account.
RBI’s KYC framework provides for measures concerning KYC non-compliant accounts. Earlier RBI guidance also recognised phased restrictions, including partial freezing in specified circumstances, after repeated reminders and opportunities to comply.
The exact action depends on the customer’s circumstances, risk category, applicable rules and the bank’s procedures.
Therefore, customers should not ignore repeated KYC reminders from their bank.
Does Existing KYC Remain Valid Forever?
No.
KYC information can remain valid for a period, but banks have an ongoing obligation to periodically review and update customer information.
The purpose is not necessarily to make customers submit documents unnecessarily. Instead, the system is designed to ensure that the bank’s customer information remains accurate and sufficiently current for regulatory and risk-management purposes.
What If There Is No Change in KYC Information?
Customers should follow the bank’s permitted process for confirming that there has been no change.
For eligible individuals, a self-declaration may be sufficient for periodic updation when the existing KYC information remains unchanged.
However, if the bank specifically identifies a discrepancy or requires additional information under the applicable KYC framework, the customer may need to provide further documentation.
What Should Customers Do When They Receive a KYC Request?
Customers should first verify that the request genuinely comes from their bank.
They should then:
- Check whether their identity or address information has changed.
- Use the bank’s official KYC-update channel.
- Provide only the information requested through the authorised process.
- Keep confirmation of the completed update.
- Avoid sharing OTPs, passwords or PINs with anyone.
If a customer believes the request is suspicious, contacting the bank directly through its official customer-service number is safer than clicking an unfamiliar link.
Conclusion
KYC is mandatory for existing bank customers in India as part of ongoing customer due diligence. Banks are required to periodically update KYC information according to the customer’s risk category. The current RBI framework specifies minimum periodicity of two years for high-risk customers, eight years for medium-risk customers and ten years for low-risk customers.
However, periodic KYC does not always require a complete fresh submission of documents. Where there is no change in KYC information, eligible individual customers may be able to provide a self-declaration through permitted channels.
Customers should keep their bank’s records accurate, respond to legitimate KYC requests and use only official banking channels. Ignoring KYC requirements can eventually lead to restrictions on account operations under the applicable regulatory framework.
