Customer Due Diligence(CDD) : Individuals
This post is based on RBI Master Circular dated Feb 25, 2016 updated on Jan 04, 2024
Part
I - Customer Due Diligence (CDD) Procedure in case of Individuals
For undertaking CDD, REs shall obtain the following from an individual while establishing an account-based relationship or while dealing with the individual who is a beneficial owner, authorised signatory or the power of attorney holder related to any legal entity:
(a)
the
Aadhaar number where,
(i) He is desirous of receiving any benefit or
subsidy under any scheme notified under section 7 of the Aadhaar (Targeted
Delivery of Financial and Other subsidies, Benefits and Services) Act, 2016 (18
of 2016); or
(ii)
He decides to submit his Aadhaar number voluntarily to a bank or any RE
notified under first proviso to sub-section (1) of section 11A of the PML Act;
or
(aa)
the proof of possession of Aadhaar number where offline verification can be
carried out; or
(ab)
the proof of possession of Aadhaar number where offline verification cannot be
carried out or any OVD or the equivalent e-document thereof containing the
details of his identity and address; or
(ac)
the KYC Identifier with an explicit consent to download records from CKYCR; and
(b)
the
Permanent Account Number or the equivalent e-document thereof or Form No. 60 as
defined in Income-tax Rules, 1962; and
(c)
such
other documents including in respect of the nature of business and financial
status of the customer, or the equivalent e-documents thereof as may be
required by the RE: Provided that where the customer has submitted,
i) Aadhaar number under clause (a) above to a
bank or to a RE notified under first proviso to sub-section (1) of section 11A
of the PML Act, such bank or RE shall carry out authentication of the
customer’s Aadhaar number using e-KYC authentication facility provided by the
Unique Identification Authority of India. Further, in such a case, if customer
wants to provide a current address, different from the address as per the
identity information available in the Central Identities Data Repository, he
may give a self-declaration to that effect to the RE.
ii)
proof of possession of Aadhaar under clause (aa) above where offline
verification can be carried out, the RE shall carry out offline verification.
iii)
an equivalent e-document of any OVD, the RE shall verify the digital signature
as per the provisions of the Information Technology Act, 2000 (21 of 2000) and
any rules issues thereunder and take a live photo as specified under Annex I.
iv)
any OVD or proof of possession of Aadhaar number under clause (ab) above where offline
verification cannot be carried out, the RE shall carry out verification through
digital KYC as specified under Annex I.
v)
KYC Identifier under clause (ac) above, the RE shall retrieve the KYC records
online from the CKYCR in accordance with Section 56.
Provided
that for a period not beyond such date as may be notified by the Government for
a class of REs, instead of carrying out digital KYC, the RE pertaining to such
class may obtain a certified copy of the proof of possession of Aadhaar number
or the OVD and a recent photograph where an equivalent e-document is not
submitted.
Provided
further that in case e-KYC authentication cannot be performed for an individual
desirous of receiving any benefit or subsidy under any scheme notified under
section 7 of the Aadhaar (Targeted Delivery of Financial and Other subsidies,
Benefits and Services) Act, 2016 owing to injury, illness or infirmity on
account of old age or otherwise, and similar causes, REs shall, apart from
obtaining the Aadhaar number, perform identification preferably by carrying out
offline verification or alternatively by obtaining the certified copy of any
other OVD or the equivalent e-document thereof from the customer. CDD done in
this manner shall invariably be carried out by an official of the RE and such
exception handling shall also be a part of the concurrent audit as mandated in
Section 8. REs shall ensure to duly record the cases of exception handling in a
centralised exception database. The database shall contain the details of grounds
of granting exception, customer details, name of the designated official
authorising the exception and additional details, if any. The database shall be
subjected to periodic internal audit/inspection by the RE and shall be
available for supervisory review.
Explanation 1: RE shall, where its
customer submits a proof of possession of Aadhaar Number containing Aadhaar
Number, ensure that such customer redacts or blacks out his Aadhaar number
through appropriate means where the authentication of Aadhaar number is not
required as per proviso (i) above.
Explanation 2: Biometric based e-KYC
authentication can be done by bank official/business correspondents/business
facilitators.
Explanation 3: The use of Aadhaar, proof
of possession of Aadhaar etc., shall be in accordance with the Aadhaar
(Targeted Delivery of Financial and Other Subsidies Benefits and Services) Act,
2016 and the regulations made thereunder.
Accounts opened using Aadhaar OTP based
e-KYC, in non-face-to-face mode, are subject to the following conditions:
i.
There
must be a specific consent from the customer for authentication through OTP.
ii.
As
a risk-mitigating measure for such accounts, REs shall ensure that transaction
alerts, OTP, etc., are sent only to the mobile number of the customer
registered with Aadhaar. REs shall have a board approved policy delineating a
robust process of due diligence for dealing with requests for change of mobile
number in such accounts.
iii.
The
aggregate balance of all the deposit accounts of the customer shall not exceed
rupees one lakh. In case, the balance exceeds the threshold, theaccount shall
cease to be operational, till CDD as mentioned at (vi) below is complete.
iv.
The
aggregate of all credits in a financial year, in all the deposit accounts taken
together, shall not exceed rupees two lakh.
v.
As
regards borrowal accounts, only term loans shall be sanctioned. The aggregate
amount of term loans sanctioned shall not exceed rupees sixty thousand in a
year.
vi.
Accounts,
both deposit and borrowal, opened using OTP based e-KYC shall not be allowed
for more than one year unless identification as per Section 16 or as per Section
18 (V-CIP) is carried out. If Aadhaar details are used under Section 18, the
process shall be followed in its entirety including fresh Aadhaar OTP
authentication.
vii.
If
the CDD procedure as mentioned above is not completed within a year, in respect
of deposit accounts, the same shall be closed immediately. In respect of
borrowal accounts no further debits shall be allowed.
viii.
A
declaration shall be obtained from the customer to the effect that no other
account has been opened nor will be opened using OTP based KYC in
nonface-to-face mode with any other RE. Further, while uploading KYC
information to CKYCR, REs shall clearly indicate that such accounts are opened
using OTP based e-KYC and other REs shall not open accounts based on the KYC
information of accounts opened with OTP based e-KYC procedure in
non-faceto-face mode.
ix.
REs
shall have strict monitoring procedures including systems to generate alerts in
case of any non-compliance/violation, to ensure compliance with the above
mentioned conditions.
REs may undertake V-CIP to carry out:
i) CDD in case of new customer on-boarding
for individual customers, proprietor in case of proprietorship firm, authorised
signatories and Beneficial Owners (BOs) in case of Legal Entity (LE) customers.
Provided that in case of CDD of a
proprietorship firm, REs shall also obtain the equivalent e-document of the
activity proofs with respect to the proprietorship firm, as mentioned in
Section 28 and Section 29, apart from undertaking CDD of the proprietor.
ii)
Conversion of existing accounts opened in non-face to face mode using Aadhaar
OTP based e-KYC authentication as per Section 17.
iii)
Updation/Periodic updation of KYC for eligible customers. REs opting to
undertake V-CIP, shall adhere to the following minimum standards:
(a)
V-CIP Infrastructure
i) The RE should
have complied with the RBI guidelines on minimum baseline cyber security and
resilience framework for banks, as updated from time to time as well as other
general guidelines on IT risks. The technology infrastructure should be housed
in own premises of the RE and the V-CIP connection and interaction shall
necessarily originate from its own secured network domain. Any technology
related outsourcing for the process should be compliant with relevant RBI guidelines.
59Where cloud deployment model is used, it shall be ensured that the ownership
of data in such model rests with the RE only and all the data including video
recording is transferred to the RE’s exclusively owned / leased server(s)
including cloud server, if any, immediately after the V-CIP process is
completed and no data shall be retained by the cloud service provider or
third-party technology provider assisting the V-CIP of the RE.
ii) The RE shall
ensure end-to-end encryption of data between customer device and the hosting
point of the V-CIP application, as per appropriate encryption standards. The
customer consent should be recorded in an auditable and alteration proof
manner.
iii) The V-CIP
infrastructure / application should be capable of preventing connection from IP
addresses outside India or from spoofed IP addresses. iv) The video recordings
should contain the live GPS co-ordinates (geo-tagging) of the customer
undertaking the V-CIP and date-time stamp. The quality of the live video in the
V-CIP shall be adequate to allow identification of the customer beyond doubt.
v) The application shall have components with face liveness / spoof detection
as well as face matching technology with high degree of accuracy, even though
the ultimate responsibility of any customer identification rests with the RE.
Appropriate artificial intelligence (AI) technology can be used to ensure that
the V-CIP is robust.
vi) Based on
experience of detected / attempted / ‘near-miss’ cases of forged identity, the
technology infrastructure including application software as well as work flows
shall be regularly upgraded. Any detected case of forged identity through V-CIP
shall be reported as a cyber event under extant regulatory guidelines.
vii) 60The V-CIP
infrastructure shall undergo necessary tests such as Vulnerability Assessment,
Penetration testing and a Security Audit to ensure its robustness and
end-to-end encryption capabilities. Any critical gap reported under this
process shall be mitigated before rolling out its implementation. Such tests
should be conducted by the empanelled auditors of Indian Computer Emergency
Response Team (CERT-In). Such tests should also be carried out periodically in
conformance to internal / regulatory guidelines.
viii) The V-CIP
application software and relevant APIs / webservices shall also undergo
appropriate testing of functional, performance, maintenance strength before
being used in live environment. Only after closure of any critical gap found
during such tests, the application should be rolled out. Such tests shall also
be carried out periodically in conformity with internal/ regulatory guidelines.
(b)
V-CIP Procedure
i) Each RE shall
formulate a clear work flow and standard operating procedure for V-CIP and
ensure adherence to it. The V-CIP process shall be operated only by officials
of the RE specially trained for this purpose. The official should be capable to
carry out liveness check and detect any other fraudulent manipulation or
suspicious conduct of the customer and act upon it.
ii) Disruption
of any sort including pausing of video, reconnecting calls, etc., should not
result in creation of multiple video files. If pause or disruption is not
leading to the creation of multiple files, then there is no need to initiate a
fresh session by the RE. However, in case of call drop / disconnection, fresh
session shall be initiated.
iii) The sequence
and/or type of questions, including those indicating the liveness of the
interaction, during video interactions shall be varied in order to establish
that the interactions are real-time and not pre-recorded.
iv) Any prompting
observed at end of customer shall lead to rejection of the account opening
process.
v) The fact of the
V-CIP customer being an existing or new customer, or if it relates to a case
rejected earlier or if the name appearing in some negative list should be
factored in at appropriate stage of work-flow.
vi) The authorised
official of the RE performing the V-CIP shall record audio-video as well as
capture photograph of the customer present for identification and obtain the
identification information using any one of the following:
a) OTP based Aadhaar e-KYC authentication
b) Offline Verification of Aadhaar for identification
c) KYC records downloaded from CKYCR, in accordance with Section 56, using the KYC identifier provided by the customer
d) Equivalent e-document of Officially Valid Documents (OVDs) including documents issued through DigiLocker RE shall ensure to redact or blackout the Aadhaar number in terms of Section 16.
In case of
offline verification of Aadhaar using XML file or Aadhaar Secure QR Code, it
shall be ensured that the XML file or QR code generation date is not older than
three working days from the date of carrying out V-CIP.
Further, in line
with the prescribed period of three working days for usage of Aadhaar XML file
/ Aadhaar QR code, REs shall ensure that the video process of the V-CIP is
undertaken within three working days of downloading / obtaining the
identification information through CKYCR / Aadhaar authentication / equivalent
e-document, if in the rare cases, the entire process cannot be completed at one
go or seamlessly. However, REs shall ensure that no incremental risk is added
due to thisvii) If the address of the customer is different from that indicated
in the OVD, suitable records of the current address shall be captured, as per
the existing requirement. It shall be ensured that the economic and financial
profile/information submitted by the customer is also confirmed from the
customer undertaking the V-CIP in a suitable manner. viii) RE shall capture a
clear image of PAN card to be displayed by the customer during the process,
except in cases where e-PAN is provided by the customer. The PAN details shall
be verified from the database of the issuing authority including through
DigiLocker.
ix) Use of printed
copy of equivalent e-document including e-PAN is not valid for the V-CIP.
x) The authorised
official of the RE shall ensure that photograph of the customer in the
Aadhaar/OVD and PAN/e-PAN matches with the customer undertaking the V-CIP and
the identification details in Aadhaar/OVD and PAN/e-PAN shall match with the
details provided by the customer.
xi) Assisted V-CIP
shall be permissible when banks take help of Business Correspondents (BCs)
facilitating the process only at the customer end. Banks shall maintain the
details of the BC assisting the customer, where services of BCs are utilized.
The ultimate responsibility for customer due diligence will be with the bank.
xii) All accounts opened through V-CIP shall be made operational only after
being subject to concurrent audit, to ensure the integrity of process and its
acceptability of the outcome. xiii) All matters not specified under the
paragraph but required under other statutes such as the Information Technology
(IT) Act shall be appropriately complied with by the RE.
(c)
V-CIP Records and Data Management
i)
The
entire data and recordings of V-CIP shall be stored in a system / systems
located in India. REs shall ensure that the video recording is stored in a safe
and secure manner and bears the date and time stamp that affords easy
historical data search. The extant instructions on record management, as
stipulated in this MD, shall also be applicable for V-CIP.
ii) The activity log along with the
credentials of the official performing the V-CIP shall be preserved.
Financial Inclusion
CDD of Small account holders
Notwithstanding
anything contained in Section 16 and as an alternative thereto, in case an
individual who desires to open a bank account, banks shall open a ‘Small
Account’, which entails the following limitations:
i. the aggregate of all credits in a financial
year does not exceed rupees one lakh;
ii. the aggregate
of all withdrawals and transfers in a month does not exceed rupees ten
thousand; and
iii. the balance
at any point of time does not exceed rupees fifty thousand. 68Provided, that
this limit on balance shall not be considered while making deposits through
Government grants, welfare benefits and payment against procurements.
Further,
small accounts are subject to the following conditions:
(a)
The bank shall obtain a self-attested photograph from the customer.
(b)
The designated officer of the bank certifies under his signature that the
person opening the account has affixed his signature or thumb impression in his
presence.
Provided
that where the individual is a prisoner in a jail, the signature or thumb print
shall be affixed in presence of the officer in-charge of the jail and the said
officer shall certify the same under his signature and the account shall remain
operational on annual submission of certificate of proof of address issued by
the officer in-charge of the jail.
(c)
Such accounts are opened only at Core Banking Solution (CBS) linked branches or
in a branch where it is possible to manually monitor and ensure that foreign
remittances are not credited to the account.
(d)
Banks shall ensure that the stipulated monthly and annual limits on aggregate
of transactions and balance requirements in such accounts are not breached, before
a transaction is allowed to take place.
(e)
The account shall remain operational initially for a period of twelve months
which can be extended for a further period of twelve months, provided the
account holder applies and furnishes evidence of having applied for any of the
OVDs during the first twelve months of the opening of the said account.
(f)
The entire relaxation provisions shall be reviewed after twenty-four months.
(g)
Notwithstanding anything contained in clauses (e) and (f) above, the small account
shall remain operational between April 1, 2020 and June 30, 2020 and such other
periods as may be notified by the Central Government
(h)
The account shall be monitored and when there is suspicion of money laundering
or financing of terrorism activities or other high-risk scenarios, the identity
of the customer shall be established as per Section 16 or Section 18.
(i)
Foreign remittance shall not be allowed to be credited into the account unless
the identity of the customer is fully established as per Section 16 or Section
18.
Simplified
procedure for opening accounts by Non-Banking Finance Companies (NBFCs): In
case a person who desires to open an account is not able to produce documents,
as specified in Section 16, NBFCs may at their discretion open accounts subject
to the following conditions:
(a)
The NBFC shall obtain a self-attested photograph from the customer.
(b)
The designated officer of the NBFC certifies under his signature that the
person opening the account has affixed his signature or thumb impression in his
presence.
(c)
The account shall remain operational initially for a period of twelve months,
within which CDD as per Section 16 or Section 18 shall be carried out.
(d)
Balances in all their accounts taken together shall not exceed rupees fifty
thousand at any point of time.
(e)
The total credit in all the accounts taken together shall not exceed rupees one
lakh in a year.
(f)
The customer shall be made aware that no further transactions will be permitted
until the full KYC procedure is completed in case Directions (d) and (e) above
are breached by him.
(g)
The customer shall be notified when the balance reaches rupees forty thousand
or the total credit in a year reaches rupees eighty thousand that appropriate
documents for conducting the KYC must be submitted otherwise the operations in
the account shall be stopped when the total balance in all the accounts taken
together exceeds the limits prescribed in direction (d) and (e) above.
(h)
The account shall be monitored and when there is suspicion of ML/TF activities
or other high-risk scenarios, the identity of the customer shall be established
as per Section 16 or Section 18.
KYC
verification once done by one branch/office of the RE shall be valid for
transfer of the account to any other branch/office of the same RE, provided
full
KYC
verification has already been done for the concerned account and the same is
not due for periodic updation.
Part
II - CDD Measures for Sole Proprietary firms
For
opening an account in the name of a sole proprietary firm, CDD of the
individual (proprietor) shall be carried out.
In
addition to the above, any two of the following documents or the equivalent e-documents
there of as a proof of business/ activity in the name of the proprietary firm
shall also be obtained:
(a) Registration
certificate including Udyam Registration Certificate (URC) issued by the
Government
(b)
Certificate/licence issued by the municipal authorities under Shop and
Establishment Act
(c)
Sales and income tax returns
(d) CST/VAT/ GST certificate
(e)
Certificate/registration document issued by Sales Tax/Service Tax/Professional
Tax authorities
(f)
IEC (Importer Exporter Code) issued to the proprietary concern by the office of
DGFT or Licence/certificate of practice issued in the name of the proprietary
concern by any professional body incorporated under a statute
(g)
Complete Income Tax Return (not just the acknowledgement) in the name of the
sole proprietor where the firm's income is reflected, duly
authenticated/acknowledged by the Income Tax authorities
(h)
Utility bills such as electricity, water, landline telephone bills, etc. In
cases where the REs are satisfied that it is not possible to furnish two such
documents, REs may, at their discretion, accept only one of those documents as
proof of business/activity. Provided REs undertake contact point verification
and collect such other information and clarification as would be required to
establish the existence of such firm, and shall confirm and satisfy itself that
the business activity has been verified from the address of the proprietary
concern
THANK YOU FOR YOUR VALUABLE UPDATES
ReplyDelete