Brolly Academy | AML
KYC and AML
Full Forms, Key Differences and the RBI KYC Process Step by Step (2026)
KYC and AML explained in plain English for India in 2026: what each term means, how KYC sits inside the wider AML programme, a side-by-side differences table, the full KYC process in Indian banks under the RBI's 2025 KYC Directions, what happens after onboarding, and how KYC analyst and AML analyst jobs differ.
KYC and AML explained: full forms, how KYC fits inside AML, key differences, the RBI 2025 KYC process step by step, AML after onboarding and career roles.
By Brolly Academy Team · Brolly Academy · Updated 24 October 2026
Table of Contents
2. What is KYC? Full form and meaning
3. What is AML? Full form and meaning
5. Difference between KYC and AML
6. KYC process in banking in India, step by step
7. The AML process after onboarding
8. Worked example: one customer from KYC to AML
10. Common KYC and AML mistakes
Quick answer
KYC (Know Your Customer) is the process a bank uses to identify and verify who you are, while AML (Anti Money Laundering) is the full set of laws, controls and checks that stop criminals from using the bank to clean dirty money, so KYC is one part of AML, not a separate thing. KYC happens mostly when you open an account and again when your details are refreshed. AML runs for as long as you are a customer: it watches your transactions, screens your name against sanctions lists and reports suspicious activity to FIU-IND, India's financial intelligence unit. In India, banks follow the Prevention of Money-laundering Act, 2002 (PMLA) and the RBI's KYC Directions.
- KYC full form: Know Your Customer
- AML full form: Anti Money Laundering
- Relationship: KYC is the first line of defence inside the AML programme
- KYC answers: who is this customer, and how risky are they?
- AML answers: is this customer's money behaving normally, or does it look like laundering?
Key takeaways
- KYC is a subset of AML. Without good KYC, the AML system has no baseline to compare a customer's transactions against.
- For commercial banks, the current rule book is the "Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025", dated 28 November 2025 and updated as on 1 October 2026 (RBI, October 2026). It replaced the 2016 KYC Master Direction for these banks.
- The RBI lists four key elements of a KYC policy: Customer Acceptance Policy, Risk Management, Customer Identification Procedures and Monitoring of Transactions.
- KYC must be refreshed at least every 2 years for high-risk customers, every 8 years for medium-risk and every 10 years for low-risk customers (RBI, October 2026).
- After onboarding, AML work takes over: transaction monitoring, sanctions screening, suspicious transaction reports (STRs) within 7 working days, and monthly cash transaction reports (FIU-IND, October 2026).
1. KYC and AML at a glance
Short answer: KYC checks the person; AML checks the person and their money for the whole life of the relationship, and reports anything suspicious to the government.
Here is the whole topic in one table before we go deeper.
If you want the bigger picture of money laundering, the three stages and India's legal set-up first, read our pillar guide to anti money laundering.
2. What is KYC? Full form and meaning
Short answer: KYC stands for Know Your Customer: the steps a regulated firm takes to confirm a customer's identity and address, understand who really owns or controls the account, and rate how risky the customer is.
You meet KYC every time you open a bank account, buy a mutual fund or take a loan. The bank asks for an identity document and your PAN. Behind the counter, it also decides your risk level and saves your details to a central registry.
The RBI's 2025 KYC Directions say every bank's KYC policy must have four key elements (RBI, October 2026):
- Customer Acceptance Policy: the rules for who the bank will and will not take on. For example, no anonymous, fictitious or benami accounts, and no account if customer due diligence cannot be applied.
- Risk Management: rating each customer as low, medium or high risk, and applying more checks to higher-risk customers.
- Customer Identification Procedures (CIP): collecting and verifying identity documents at onboarding and at other trigger points.
- Monitoring of Transactions: watching account activity to make sure it fits what the bank knows about the customer.
Notice that the fourth element, monitoring, is already AML work. This is why the two terms are so tightly linked.
A few terms you will see throughout this guide:
- CDD (Customer Due Diligence): identifying and verifying the customer and the beneficial owner using reliable and independent sources (RBI, October 2026).
- EDD (Enhanced Due Diligence): extra checks for higher-risk customers, such as politically exposed persons or customers onboarded without meeting the bank in person.
- SDD (Simplified Due Diligence): lighter checks allowed for clearly low-risk cases.
- Beneficial owner: the real person who owns or controls a company or other entity account.
- PEP (Politically Exposed Person): someone who holds or has held a prominent public function, such as a senior politician, plus their family and close associates.
For the full CDD vs SDD vs EDD comparison and beneficial ownership thresholds, read our guide to customer due diligence.
3. What is AML? Full form and meaning
Short answer: AML stands for Anti Money Laundering: the laws, policies, systems and people that detect, prevent and report attempts to make crime money look legal.
Money laundering is the process of hiding where criminal money came from. UNODC describes it in three stages: placement (moving the cash away from the crime), layering (hiding the trail through many transactions) and integration (bringing the money back as if it were legitimate), and notes that real cases can skip, combine or repeat stages (UNODC, October 2026).
An AML programme in an Indian bank usually includes:
- KYC and CDD at onboarding and refresh
- Sanctions screening: checking customers and payments against official lists of banned people and entities
- Transaction monitoring: software that raises alerts when activity matches a risk rule
- Investigations: analysts decide if alerts are real concerns or false positives (alerts that turn out to be innocent)
- Regulatory reporting: filing STRs, CTRs and other reports with FIU-IND (Financial Intelligence Unit – India)
- Record keeping: at least 5 years, as PMLA section 12 and the PML Rules require (FIU-IND, October 2026)
- Governance: a Designated Director, a Principal Officer, policies, audits and training
The legal base in India is the PMLA and the PML (Maintenance of Records) Rules, 2005; our PMLA Act guide explains the key sections. Global standards come from FATF (the Financial Action Task Force), an inter-governmental body set up in 1989. India became an FATF member in 2010 (FIU-IND Annual Report 2024-25).
4. How KYC sits inside AML
Short answer: KYC is the front door of the AML programme: it creates the verified customer profile and risk rating that every later AML control, from screening to monitoring to STR decisions, depends on.
Here is the flow from the day a customer walks in to the day a report reaches FIU-IND.
- Customer applies → the bank collects identity documents, PAN or Form 60, a photo and the purpose of the account (KYC: Customer Identification Procedure)
- Verification → documents are checked, often against Aadhaar-based e-KYC, DigiLocker, V-CIP or CKYCR records (KYC)
- Screening at onboarding → the name is checked against sanctions lists and PEP databases (KYC and AML)
- Risk rating → the customer is rated low, medium or high risk; high-risk customers go through EDD (KYC: Risk Management)
- Account opened and record uploaded → KYC records go to CKYCR within 10 days (KYC)
- Ongoing monitoring → software compares each transaction with the customer's profile and raises alerts (AML: Monitoring of Transactions)
- Alert review → an L1 analyst closes false positives or escalates; an L2 analyst investigates deeper (AML)
- Reporting → if the activity is suspicious, the Principal Officer's team files an STR with FIU-IND within 7 working days of deciding it is suspicious (AML)
- Periodic updation → the customer's KYC is refreshed every 2, 8 or 10 years based on risk, or earlier if something changes, and the loop starts again (KYC)
L1, L2 and L3 here are review levels. L1 is the first, fast review of an alert. L2 is a deeper investigation. L3 is senior review and the final reporting decision.
Steps 1 to 5 and step 9 are KYC. Steps 6 to 8 are the rest of AML. If the risk rating at step 4 is wrong, monitoring at step 6 compares transactions against the wrong profile, and real red flags can slip past.
5. Difference between KYC and AML
Short answer: KYC is a process focused on the customer's identity and risk at specific points in time, while AML is a broader, continuous programme focused on the customer's money, which includes KYC plus monitoring, screening, investigation and reporting.
KYC and AML are not rivals. One sits inside the other.
An easy way to remember it: KYC is a snapshot, AML is a video. KYC captures who you are at a moment. AML keeps watching for patterns such as structuring, which means splitting cash into smaller amounts to stay under reporting thresholds.
You may also see KYB (Know Your Business) for KYC on company customers, and CFT (Combating the Financing of Terrorism), which usually travels with AML as "AML/CFT".
6. KYC process in banking in India, step by step
Short answer: Under the RBI's 2025 KYC Directions, a bank collects an Officially Valid Document and PAN (or Form 60), verifies them through physical checks, Aadhaar-based e-KYC, V-CIP or CKYCR, screens and risk-rates the customer, uploads the record to CKYCR within 10 days, and refreshes KYC every 2, 8 or 10 years based on risk.
Everything in this section comes from the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, which we read on 24 October 2026 (page updated as on 1 October 2026). These Directions consolidated and replaced the 2016 KYC Master Direction for commercial banks. NBFCs, co-operative banks and other regulated entities have their own RBI KYC Directions, so details can differ slightly. This is a plain-English guide, not legal advice; check the current RBI Directions or a lawyer for your specific case.
Step 1: Collect the documents
For an individual, the bank asks for:
- Proof of identity and address: the Aadhaar number (only in specific benefit or subsidy cases, or if you give it voluntarily), proof of possession of Aadhaar, or another Officially Valid Document. A KYC Identifier with your consent to download records from CKYCR also works.
- PAN or its e-document equivalent, or Form No. 60 if you do not have a PAN.
- Other documents the bank needs, such as a photograph and details of your occupation and income, based on its own policy.
The Directions make clear that Aadhaar is not mandatory for KYC in general. You can use another OVD.
Step 2: Know the Officially Valid Documents (OVDs)
An OVD is a document the RBI accepts as proof of identity and address. Here is the list from the 2025 Directions.
If your OVD does not show your current address, the bank can accept certain documents as address proof only: a utility bill not more than two months old, a property or municipal tax receipt, a pension payment order, or an accommodation allotment letter from your employer. You must then submit an OVD with your current address within three months (RBI, October 2026).
Step 3: Verify the customer
Banks can verify you in several ways:
- In person at the branch: staff check original documents and your face.
- Aadhaar-based e-KYC: identity details come electronically from Aadhaar with your consent.
- V-CIP (Video based Customer Identification Process): a live, consent-based video call in which an authorised bank official identifies you and does CDD.
- CKYCR download: the bank fetches your existing record using your KYC Identifier.
- Digital channels such as DigiLocker: customers onboarded without meeting the bank are treated as higher risk until verified face-to-face or by V-CIP.
Step 4: Understand the OTP e-KYC limits
If you open an account remotely using only Aadhaar OTP-based e-KYC (no branch visit and no video call), the RBI puts strict limits on the account until full CDD is done (RBI, October 2026).
If full CDD is not completed within that year, deposit accounts are closed immediately and loan accounts get no further debits. Alerts for such accounts go only to the mobile number registered with Aadhaar.
Step 5: V-CIP rules in practice
The 2025 Directions put strict safeguards on V-CIP (RBI, October 2026):
- The set-up must sit in the bank's own secure network, with data stored in India.
- Connections from IP addresses outside India, or spoofed ones, must be blocked.
- The video must carry a geo-tag and time stamp.
- The official checks that your face is live and matches your documents, and varies the questions; if someone prompts you, the call is rejected.
- Aadhaar offline XML or QR data must not be more than three working days old.
Step 6: Screen and risk-rate the customer
Before opening the account, the bank screens your name against sanctions lists. Under section 51A of the Unlawful Activities (Prevention) Act, no account may exist for anyone on the UN Security Council's ISIL (Da'esh) and Al-Qaida list or the Taliban list, and the 2025 Directions ask banks to check these lists daily (RBI, October 2026).
Then the bank rates you low, medium or high risk, based on factors such as your identity, financial status, business, location, products and channel. PEPs get EDD: the bank must establish the source of funds and wealth, and senior management must approve the account.
For an occasional transaction of ₹50,000 or more, whether single or connected, CDD applies even if the person has no account, for example a walk-in customer (RBI, October 2026).
Step 7: Upload to CKYCR
CKYCR (Central KYC Records Registry) is the central database that receives, stores and retrieves KYC records in digital form. When it registers you, it gives you a KYC Identifier, a unique number the bank shares with you.
Banks must upload your KYC record to CKYCR within 10 days of starting an account-based relationship, and upload any updated information within 7 days of getting it (RBI, October 2026). Since a PML Rules amendment notified on 19 July 2024 (G.S.R. 419(E)), reporting entities are expected to fetch your record from CKYCR using the KYC Identifier rather than ask you to submit documents again, with some exceptions (FIU-IND Annual Report 2024-25).
For customers, one KYC can serve many institutions. For KYC analysts, much of the work is checking and updating CKYCR data, not just collecting paper.
Step 8: Periodic updation (re-KYC)
KYC is not one-time. The bank must refresh it on a fixed cycle based on risk, counted from the date of account opening or the last update (RBI, October 2026).
If nothing has changed, you can simply give a self-declaration through your registered email or mobile number, an ATM, digital banking channels or a letter. If only your address has changed, you can self-declare the new address, and the bank must verify it within two months. The Directions also let low-risk individuals keep transacting while their update is pending, with the update due within one year of falling due or by 30 June 2026, whichever is later.
Small accounts: KYC for people without documents
For people without an OVD, the Directions allow small accounts with tight limits: credits up to ₹1 lakh a financial year, withdrawals up to ₹10,000 a month and a balance up to ₹50,000. They run for 12 months, extendable by 12 more if the holder has applied for an OVD (RBI, October 2026).
7. The AML process after onboarding
Short answer: Once the account is open, AML controls take over: daily sanctions screening, transaction monitoring against the KYC profile, alert reviews, investigations, STR and CTR filing with FIU-IND, and record keeping for at least 5 years.
Here is what happens to your account every day after KYC is done.
- Transaction monitoring. The RBI calls this on-going due diligence: checking that transactions match what the bank knows about you, your business, risk profile and source of funds. The 2025 Directions ask banks to use robust software that raises alerts for transactions that do not fit a customer's risk category and profile.
- Screening. Customers and payments are screened against sanctions lists on a continuing basis.
- Alert review. An L1 analyst checks each alert against the KYC profile, then closes it with a reason or escalates it.
- Investigation. An L2 analyst reviews months of transactions, linked accounts and open-source information, then writes a case narrative.
- STR decision. If there are reasonable grounds to suspect the activity involves proceeds of crime, has no clear economic purpose, is unusually complex or may involve terrorist financing, the Principal Officer files an STR. It must reach FIU-IND not later than seven working days after the Principal Officer is satisfied the transaction is suspicious (FIU-IND FAQs, October 2026).
- Threshold reports. Cash transactions above ₹10 lakh (and connected cash transactions that add up to more than ₹10 lakh in a month) go into monthly CTRs, filed by the 15th of the following month (FIU-IND, October 2026). A CTR is a cash transaction report; it is filed on the amount, not on suspicion.
- Record keeping. Transaction records are kept for at least 5 years from the transaction date, and identity records for at least 5 years after the relationship ends (RBI, October 2026).
- Confidentiality. Filing an STR is confidential. The RBI Directions also say a bank must not restrict operations in an account merely because an STR was filed.
For scale: in FY 2024-25, FIU-IND received 4,34,668 STRs and 1,73,13,368 CTRs from reporting entities (FIU-IND Annual Report 2024-25). Failing these duties is costly. Under PMLA section 13, the Director of FIU-IND can fine a reporting entity, its designated director or employees ₹10,000 to ₹1 lakh for each failure (FIU-IND, October 2026).
The detail of monitoring rules, alert types and tuning lives in our guide to transaction monitoring.
8. Worked example: one customer from KYC to AML
Short answer: Follow one fictional customer through onboarding, risk rating, monitoring and an alert, and you see exactly where KYC ends and AML begins.
This case is fictional and simplified, for learning only.
Onboarding (KYC). Ravi, 29, opens a savings account at a bank in Hyderabad through V-CIP. He shows his PAN and Aadhaar offline XML, and says he is a salaried software tester earning about ₹70,000 a month. Screening finds no sanctions or PEP match. The bank rates him low risk and uploads his record to CKYCR.
Normal months (AML monitoring). For eight months, the account shows a salary credit, rent, card bills and SIP debits. Nothing is unusual, because the activity fits his profile.
The alert (AML). In month nine, the account receives 46 small UPI credits from different people in five days, about ₹6 lakh in total. Almost all of it leaves the same day for three other accounts. A velocity rule fires an alert.
L1 and L2 review. The L1 analyst sees that a salaried tester has no reason to receive dozens of credits from strangers and pass them on at once, so she escalates. The L2 analyst finds the pattern matches what the RBI's 2016 KYC Master Direction described as a money mule: an account used to move fraud proceeds, often from phishing or identity theft.
STR and KYC refresh. The Principal Officer's team files an STR with FIU-IND within the 7-working-day window. The bank re-rates Ravi as high risk, which moves his KYC to a 2-year updation cycle.
Notice the loop: KYC set the baseline, AML spotted the break from it, and the result fed back into KYC as a new risk rating.
9. KYC analyst vs AML analyst
Short answer: A KYC analyst verifies customers and builds their profiles at onboarding and refresh, while an AML analyst reviews alerts and investigates suspicious activity after onboarding; KYC is the common entry point, and AML investigation is the usual next step.
Job listings read on 24 October 2026 show the split. A Wipro "Analyst (KYC/AML)" listing in Gurugram described client onboarding, KYC/CDD reviews and document verification. A Wise "FinCrime Operations Analyst - AML Investigations" listing in Hyderabad, marked entry level on LinkedIn, described reviewing sanctions-screening matches and AML alerts, then escalating or discounting them with a documented reason. A State Street listing in Hyderabad asked for KYC reviews using World-Check, with a quality target of at least 99%.
Many people start in KYC and then move into monitoring and investigations. For the investigation side in full, read our guide to the AML analyst role.
10. Common KYC and AML mistakes
Short answer: Most failures come from treating KYC as paperwork, not updating risk ratings, closing alerts without checking the KYC profile, and writing weak case notes.
- Thinking KYC and AML are the same thing. A bank with perfect onboarding but no monitoring still fails its AML duties.
- Treating KYC as a one-time task. Periodic updation every 2, 8 or 10 years is part of the rule.
- Collecting documents without understanding the customer. No clear occupation, income or account purpose means the monitoring team has nothing to compare against.
- Ignoring beneficial ownership. Missing the real owner behind layers of companies is a classic gap.
- Wrong risk rating. A cash-heavy business rated low risk is compared with the wrong baseline.
- Closing alerts on autopilot. Every closure needs a reason that refers back to the KYC profile.
- Missing the STR timeline. The clock is 7 working days from the suspicion decision.
- Tipping off the customer. STRs are confidential. Never tell a customer a report has been filed.
- Late CKYCR uploads. The windows are 10 days for new records and 7 days for updates.
- Weak case writing. A narrative a reviewer cannot follow is almost as bad as none.
11. Career angle: KYC and AML jobs in India
Short answer: KYC and AML roles are a common entry into banking compliance for graduates of any stream, with KYC analyst pay of about ₹4.5–5 lakh a year and AML analyst pay of about ₹5.8–6.4 lakh a year for early-to-mid career roles, per AmbitionBox in October 2026.
On 24 October 2026, Naukri showed about 14,972 results for "kyc aml" and about 9,311 for "aml analyst" across India. These are keyword-match counts, not open AML jobs; they change daily and include duplicates and loosely related roles.
Pay data from AmbitionBox, read 24 October 2026, gives typical ranges, not guarantees:
At the 1–3 year band, AmbitionBox showed about ₹3.8–4.2 lakh for KYC analysts and ₹4.5–4.9 lakh for AML analysts, one reason many KYC analysts later move into AML work.
What employers asked for in the listings we read: mostly any graduate, Excel skills, knowledge of KYC/CDD/EDD and red flags, and clear writing. Certifications such as ACAMS's CAMS or IIBF's AML and KYC certificate were listed as "good to have", not mandatory. Some roles asked for night or rotational shifts.
12. How Brolly Academy helps
Short answer: Brolly Academy's 45-day AML course teaches KYC, CDD, EDD, the regulatory framework and transaction monitoring in one track, with case-study practice and placement assistance.
If you want to work in KYC or AML, the Brolly Academy AML Course in India covers both halves of this topic. The course page (checked 24 October 2026) lists:
- Duration and modes: 45 days, live online or classroom in Hyderabad, plus a self-paced video plan; next batch listed for Monday, 2 November 2026
- Syllabus: 7 modules, including money laundering basics, typologies, the regulatory framework (FATF, RBI, SEBI, reporting), CDD and KYC with EDD, AML compliance programmes and AML technology
- Tools introduced: NICE Actimize, SAS AML, Oracle Financial Services (OFSAA), World-Check, Excel and SQL, among others
- Practice: six capstone projects, including a KYC verification case study, transaction monitoring and an end-to-end AML case
- Career support: resume and interview support, mock interviews and placement assistance
- Fees: Video Recording ₹6,999, Online Course ₹14,999, Classroom Training ₹19,999
- Eligibility: any stream, age 18+, no finance or coding background needed
Brolly gives a course completion certificate. Third-party certifications such as IIBF's AML and KYC certificate or ACAMS's CAMS are examined by those bodies, with separate fees. You can attend a free demo class before you enrol.
Learn KYC and AML the way banks actually use them
Reading about OVDs, CKYCR and STR timelines is a start. Working through a real KYC file and a real alert is what gets you hired. Brolly Academy's 45-day AML course takes you from KYC and CDD basics to transaction monitoring and an end-to-end AML case study, online across India or in a Hyderabad classroom. Book a free demo class and see if it fits your goals.
Frequently asked questions
What is KYC and AML?
KYC, or Know Your Customer, is the process of identifying and verifying a customer and rating their risk. AML, or Anti Money Laundering, is the full set of laws, controls and checks that stop criminals from using a financial firm to make crime money look legal. KYC is one part of AML. Banks do KYC at onboarding and refresh, and run AML controls such as monitoring and reporting throughout the relationship.
What is the full form of KYC?
KYC stands for Know Your Customer. It is the process banks and other regulated firms use to confirm who a customer is, check their address, understand who really owns or controls an account, and place the customer in a low, medium or high risk category. In India, the RBI's KYC Directions set out how banks must do it.
What is the full form of AML?
AML stands for Anti Money Laundering. It covers the laws, policies, systems and people that detect, prevent and report attempts to hide the criminal origin of money. In India, the main law is the Prevention of Money-laundering Act, 2002, supported by the PML Rules 2005, the RBI's KYC Directions and FIU-IND's reporting rules.
What is the difference between KYC and AML?
KYC focuses on the customer's identity and risk at specific points, such as onboarding and periodic updation. AML is the wider, continuous programme that includes KYC plus sanctions screening, transaction monitoring, investigations, suspicious transaction reports and record keeping. A simple way to remember it is that KYC is a snapshot of the person, while AML is a running video of their money.
Is KYC part of AML?
Yes, KYC is part of AML. It is the first line of defence inside the AML programme. KYC builds the verified customer profile and risk rating, and the AML monitoring system then compares every transaction with that profile. The RBI even lists monitoring of transactions as one of the four key elements of a bank's KYC policy, which shows how closely the two are linked.
Are KYC and AML the same?
No, KYC and AML are not the same, but they work together. KYC verifies who the customer is and how risky they are. AML covers everything a firm does to prevent and report money laundering, including KYC, sanctions screening, transaction monitoring, investigations and filing reports with FIU-IND. A bank with good onboarding but no monitoring would still fail its AML duties.
What are the four key elements of KYC?
The RBI's 2025 KYC Directions list four key elements of a bank's KYC policy. They are the Customer Acceptance Policy, Risk Management, Customer Identification Procedures, and Monitoring of Transactions. Together they decide who the bank accepts, how it rates risk, how it verifies identity, and how it watches account activity after onboarding.
Which RBI rule governs KYC for banks in 2026?
For commercial banks, the current rule is the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, dated 28 November 2025 and updated as on 1 October 2026. It replaced the 2016 KYC Master Direction for these banks. NBFCs, co-operative banks and other regulated entities have their own RBI KYC Directions, so check the one that applies.
What is the KYC process in banking in India?
The bank collects an Officially Valid Document and PAN or Form 60, verifies them in person or through Aadhaar-based e-KYC, V-CIP or a CKYCR download, screens the customer against sanctions lists, and rates them low, medium or high risk. It then uploads the record to CKYCR within 10 days and refreshes KYC every 2, 8 or 10 years based on risk.
What documents are accepted for KYC in India?
The RBI's Officially Valid Documents are the passport, driving licence, proof of possession of Aadhaar, Voter ID card, NREGA job card signed by a State Government officer, and the NPR letter showing name and address. You also need PAN or Form 60. A recent utility bill or similar document can serve as temporary address proof if you submit an updated OVD within three months.
Is Aadhaar mandatory for KYC?
No, Aadhaar is not mandatory for KYC in general under the RBI's 2025 KYC Directions. You can use another Officially Valid Document, such as a passport, driving licence or Voter ID. The Aadhaar number itself is asked only in specific benefit or subsidy cases or if you give it voluntarily, though proof of possession of Aadhaar is one accepted OVD.
What are the limits on an account opened with OTP-based e-KYC?
An account opened remotely with only Aadhaar OTP-based e-KYC can hold a total balance of up to ₹1 lakh and receive total credits of up to ₹2 lakh in a financial year. Loans are limited to term loans up to ₹60,000 a year. Full CDD or V-CIP must be done within one year, or the deposit account is closed.
What is V-CIP in KYC?
V-CIP means Video based Customer Identification Process. It is a live, consent-based video call in which an authorised bank official identifies you, checks that your face is live and matches your documents, and completes customer due diligence. The RBI requires the set-up to run on the bank's own secure network, block connections from outside India, and carry geo-tags and time stamps.
What is CKYC or CKYCR?
CKYCR is the Central KYC Records Registry, a central database that stores KYC records in digital form. When your record is registered, you get a unique KYC Identifier. Banks must upload new records within 10 days and updates within 7 days. Other institutions can then fetch your record with the identifier instead of asking you for fresh documents.
How often should KYC be updated?
Under the RBI's 2025 KYC Directions, banks must update KYC at least once every 2 years for high-risk customers, once every 8 years for medium-risk customers, and once every 10 years for low-risk customers. The period is counted from account opening or the last KYC update. Banks may also ask earlier if your details or risk change.
How can I do re-KYC if nothing has changed?
If your details have not changed, you can give a self-declaration through your registered email or mobile number, an ATM, the bank's digital banking channels, or a letter. If only your address has changed, you can self-declare the new address, and the bank must verify it within two months. Low-risk individuals can usually keep transacting while their update is pending.
What happens after KYC in the AML process?
After onboarding, the bank screens you against sanctions lists, monitors your transactions against your KYC profile, and raises alerts for unusual activity. Analysts review and investigate these alerts. If activity looks suspicious, the Principal Officer files a suspicious transaction report with FIU-IND. The bank also files monthly cash reports and keeps records for at least 5 years.
What is an STR and when must it be filed?
An STR is a suspicious transaction report. A bank files it with FIU-IND when a transaction, even an attempted one, gives reasonable grounds to suspect proceeds of crime, has no clear economic purpose, is unusually complex, or may involve terrorist financing. It must be filed not later than seven working days after the Principal Officer is satisfied that the transaction is suspicious.
What is the difference between a CTR and an STR?
A CTR, or cash transaction report, is filed based on the amount: cash transactions above ₹10 lakh, or connected cash transactions adding up to more than ₹10 lakh in a month, reported monthly by the 15th. An STR is filed based on suspicion, regardless of the amount, within seven working days of the suspicion decision. Both go to FIU-IND.
What is the difference between KYC and CDD?
KYC is the overall process and policy for knowing your customer, including acceptance rules, risk management, identification and monitoring. CDD, or customer due diligence, is the core verification step inside KYC: identifying and verifying the customer and the beneficial owner from reliable, independent sources. Simplified and enhanced due diligence are lighter and stronger versions of CDD based on risk.
Why are KYC and AML important in banking?
KYC and AML stop criminals from opening fake or mule accounts and from moving crime money through the banking system. They also protect banks from heavy penalties. In FY 2024-25, FIU-IND received 4,34,668 suspicious transaction reports from reporting entities, and each one depended on KYC profiles and AML monitoring working together.
What does a KYC analyst do?
A KYC analyst verifies customers at onboarding and during periodic refresh. The work includes checking identity documents, completing CDD and EDD reviews, identifying beneficial owners of company accounts, screening names against sanctions and PEP lists, and keeping customer profiles complete and correctly risk-rated. Much of the work is also checking and updating CKYCR data.
What is the difference between a KYC analyst and an AML analyst?
A KYC analyst builds and refreshes customer profiles, while an AML analyst reviews alerts and investigates suspicious activity after onboarding. AmbitionBox in October 2026 showed about ₹4.5–5 lakh a year for KYC analysts with 1–6 years' experience and about ₹5.8–6.4 lakh for AML analysts with 1–7 years. Many people start in KYC and later move into AML investigations.
Is KYC and AML a good career?
KYC and AML can be a good entry into banking compliance, especially for graduates of any stream. Most listings we read asked for a degree, Excel and basic KYC and AML knowledge, with certifications as a plus. Naukri showed about 14,972 results for "kyc aml" on 24 October 2026, though these are keyword matches, not confirmed openings.
How can I learn KYC and AML?
Start with the basics: the three stages of money laundering, the PMLA, the RBI's KYC Directions and FIU-IND's reporting rules. Then practise KYC files and alert reviews through case studies. Brolly Academy's 45-day AML course covers KYC, CDD, EDD, the regulatory framework and transaction monitoring, online or in Hyderabad, with six capstone projects and placement assistance.
Learn with Brolly Academy
Review the syllabus, practical projects and batch timings, and book a free demo before you enrol.
Related Articles
Continue Your Learning
AML Course in India
45-day programme in KYC, customer due diligence, transaction monitoring, AML regulations and compliance, with case studies, capstone projects and placement assistance.
View CourseBusiness Analyst Course in Hyderabad
Learn requirements, process mapping, documentation and stakeholder skills used by analysts in banks and financial services teams.
View CourseData Analytics Course in Hyderabad
Build Excel, SQL and dashboard skills that help in alert analysis, reporting and data-driven compliance roles.
View Course