Last Updated on: 30th October 2026 | Last Reviewed on: 30th October 2026
Key Takeaways
- Identification and verification are two different obligations. Identification collects the customer’s claim; identity verification tests that claim against a source the customer does not control. The Reserve Bank of India defines customer due diligence as “identifying and verifying the customer and the beneficial owner using reliable and independent sources of identification.”
- Verification is one link in a chain, not the whole of due diligence. The chain runs: identify, verify, understand the purpose and intended nature of the relationship, understand ownership and control, identify and verify the beneficial owner, screen, risk rate and monitor.
- Indian law recognises several identification and verification methods. CKYCR retrieval allows KYC records to be reused subject to the conditions in Rule 9(1C), but it does not mean that the new reporting entity has no customer due diligence responsibility.
- Beneficial ownership thresholds are now uniform across the RBI and SEBI: more than 10 per cent for companies and partnerships, more than 15 per cent for unincorporated associations and bodies of individuals, and 10 per cent or more interest for trust beneficiaries, with the senior managing official as the fallback.
- You can outsource the workflow but never the judgement. Paragraph 13 of the RBI’s 2025 KYC Directions states plainly that a bank “shall ensure that it does not outsource the decision making functions of determining compliance with KYC norms.”
Quick Answer: What Identity Verification Means
Identity verification is the step in customer due diligence where a regulated business tests a customer’s claimed identity against reliable and independent evidence, using documents, authenticated data or biometrics. In India, it is not optional. The Prevention of Money-Laundering Act, 2002 and the PML (Maintenance of Records) Rules, 2005 require it, and your sector regulator sets the method.
Identity Verification Meaning: Identification vs Verification
Most published writing on this subject treats identification and verification as one activity with two names. They are not. Indian regulation separates them, imposes a different standard on each, and the gap between the two is where most onboarding failures happen.
Identification: Collecting the Claim
Identification is the act of finding out who the customer says they are. It produces a set of assertions: a name, a date of birth, an address, a document number, and for a legal entity a registration number and a list of the people behind it.
Identification involves obtaining the information required to establish the identity of the customer. Verification is the separate process of verifying that identity using reliable and independent sources of identification. The RBI’s own drafting reflects this: paragraph 21 of the Reserve Bank of India (Commercial Banks — Know Your Customer) Directions, 2025 is headed with the obligation to “undertake identification of customers” in listed situations, and the separate work of proving the claim appears elsewhere.
Verification: Testing the Claim Against Independent Evidence
Verification requires the use of reliable and independent sources of identification. The source need not be described as evidence that the customer does not control. Paragraph 5(2)(v) of the 2025 Directions defines customer due diligence as “identifying and verifying the customer and the beneficial owner using reliable and independent sources of identification.”
Two adjectives carry the whole weight of the obligation. The source must be reliable, meaning it is accurate and resistant to manipulation, and it must be independent, meaning it does not originate with the person being checked. The applicable rules prescribe the documents and verification procedures that may be used. Whether a particular document or verification method is acceptable depends on the requirements applicable to the customer and the reporting entity.
The same paragraph goes further than a bare identity check. Customer due diligence, at the commencement of an account based relationship or on an occasional transaction of Rs 50,000 or more, must include obtaining information on the purpose and intended nature of the business relationship, taking reasonable steps to understand the nature of the customer’s business and its ownership and control, and determining whether the customer is acting on behalf of a beneficial owner. Identity verification is the foundation of that work. It is not the sum of it.
Authentication: Confirming a Returning Customer
There is a third concept that vendor content routinely folds into the first two, and keeping it separate is worth the effort.
Authentication has a specific statutory meaning in the AML framework where it is used in connection with Aadhaar. The PML Rules define authentication by reference to the Aadhaar Act. Other controls such as passwords, transaction OTPs and device authentication should not be presented as the statutory AML definition of authentication. It answers “is this the same customer?” and it does not answer “was this customer ever who they said they were?”
The distinction has an operational consequence. A strong authentication layer sitting on top of a weak original verification does not produce a verified customer; it produces reliable access to an unverified identity. Money mule networks exploit precisely this. The RBI treats the point seriously enough that paragraph 68 provides that where an account is established to be a money mule and the bank filed no suspicious transaction report, “it shall then be deemed that the bank has not complied with these directions.”
Note that “authentication” also has a narrower statutory meaning in the Aadhaar context, which paragraph 5(1)(iii) of the 2025 Directions imports from the Aadhaar Act. When this article uses the word in that sense, it says so.
Not Sure Where Your Biggest Risks Are?
Knowing your risks helps you decide how much checking each customer needs. We assess your business risks and give you a clear, practical action plan.
Where Identity Verification Sits Inside Customer Due Diligence
Identity verification is a stage in a sequence. Treating it as a standalone gate — verified, therefore onboard — is the most common structural error in a compliance programme, because it detaches the identity check from the risk decisions that are supposed to depend on it.
The Full CDD Chain, Stage by Stage
The chain below is assembled from paragraph 5(2)(v) of the 2025 Directions and the CDD chapters that follow it. Each stage feeds the next.
# | Stage | What it requires | Where it comes from |
1 | Identify | Collect the customer’s claimed identity and the documents or identifiers listed for that customer type | Paras 21, 23, 33–37 |
2 | Verify | Test that claim against reliable and independent sources of identification | Para 5(2)(v); paras 23, 24, 26–27 |
3 | Understand purpose | Obtain information on the purpose and intended nature of the business relationship | Para 5(2)(v), Expl. (a) |
4 | Understand ownership and control | Take reasonable steps to understand the nature of the customer’s business and its ownership and control | Para 5(2)(v), Expl. (b) |
5 | Identify and verify the beneficial owner | Determine whether the customer acts for a beneficial owner; identify and take all reasonable steps to verify that person | Para 5(2)(v), Expl. (c); para 38; Rule 9(3) |
6 | Screen | Check the verified identity against sanctions lists, PEP data and adverse media (not expressly prescribed under RBI Directions) | Paras 45, 56–59 |
7 | Risk rate | Assign a risk category that determines the depth of everything downstream | Paras 20, 41 |
8 | Monitor | Assign a risk category that informs the extent of CDD, EDD, ongoing monitoring and periodic updation | Paras 39–41, 55 |
Stage 6 is the one most often mis-sequenced. Screening is a separate AML control from customer identification and verification. The RBI Directions prescribe specific sanctions screening and PEP requirements, including daily checks of specified sanctions lists. The Directions do not establish a universal rule that every form of screening must occur only after identity verification.
What Triggers a Customer Identification Procedure
Paragraph 21 of the 2025 Directions lists the situations in which a bank must undertake identification of customers. The list is longer and more specific than most summaries suggest, and three of its limbs are routinely missed:
- Commencement of an account based relationship with the customer.
- Carrying out any international money transfer operations for a person who is not an account holder of the bank.
- When there is a doubt about the authenticity or adequacy of the customer identification data already obtained.
- Selling third party products as agents, selling its own products, payment of dues of credit cards, sale and reloading of prepaid or travel cards, and any other product, for more than Rs 50,000.
- Carrying out transactions for a non account based, walk in customer where the amount is equal to or exceeds Rs 50,000, whether as a single transaction or several transactions that appear to be connected.
- Where the bank has reason to believe that a customer, account based or walk in, is intentionally structuring a transaction into a series of transactions below the Rs 50,000 threshold.
The same paragraph adds a seventh instruction that is a prohibition rather than a trigger: the bank “shall ensure it does not seek introductions while opening accounts.”
Limb 6 deserves particular attention because it is the only trigger driven purely by inference. It requires identification not because a threshold was crossed but because the institution formed a belief that someone was arranging their affairs to avoid crossing it. A rules based monitoring system that only fires at Rs 50,000 will never surface it.
Separately, paragraph 19 addresses the case where the institution already suspects money laundering or terrorist financing. Where it “reasonably believes that performing the CDD process will tip off the customer, it shall not pursue the CDD process, and instead file an STR with FIU IND.” This is the one situation in which the correct response to a suspicion is to stop verifying rather than to verify harder.
Verification, Third Party Reliance and Who Carries the Risk
Paragraph 22 permits a bank, at its option, to rely on customer due diligence performed by a third party when verifying identity at the commencement of a relationship, on an occasional transaction of Rs 50,000 or more, or on international money transfer operations. Five conditions attach, and they are cumulative:
- The bank obtains the CDD records or information from the third party or from the Central KYC Records Registry immediately.
- The bank satisfies itself that the third party will make copies of identification data and other relevant documentation available on request, without delay.
- The third party is regulated, supervised or monitored, and has measures in place for CDD and record keeping in line with the PML Act.
- The third party is not based in a country or jurisdiction assessed as high risk.
- The bank retains ultimate responsibility for customer due diligence and for enhanced due diligence measures.
The last condition is the one that matters commercially. Reliance transfers the work. It does not transfer the liability.
The Function You Cannot Outsource
Paragraph 13 is one sentence long and it constrains every vendor decision a compliance team will make: the bank “shall ensure that it does not outsource the decision making functions of determining compliance with KYC norms.”
Read carefully, this permits a great deal. A vendor may capture the document, run the optical character recognition, perform the face match, score the liveness check, query the database and present a recommendation. A bank may use third party technology and services for activities supporting KYC, subject to the applicable outsourcing and KYC requirements. The bank must retain responsibility for compliance with KYC requirements and must not outsource the decision making functions of determining compliance with KYC norms.
In practice, this is a test of workflow design. Where automated or vendor based systems are used, the bank should ensure that the arrangement does not result in the decision making functions of determining compliance with KYC norms being outsourced.
Methods of Identity Verification
Indian law does not present a single approved method. It recognises several, attaches different conditions to each, and leaves the choice to a risk based judgement made by the entity.
Document Based Verification
The traditional route is to obtain an Officially Valid Document, defined in rule 2(1)(d) of the PML Rules, 2005 and in paragraph 5(1)(xiv) of the 2025 Directions. There are six:
- The passport.
- The driving licence.
- Proof of possession of Aadhaar number.
- The Voter’s Identity Card issued by the Election Commission of India.
- The job card issued by NREGA and duly signed by an officer of the State Government.
- The letter issued by the National Population Register containing details of name and address.
What “officially valid” adds over “any government ID” is a closed list. A PAN card, an employer identity card, a ration card or a student card is not an OVD, however official it looks. PAN sits alongside the OVD rather than inside the list: paragraph 23(5) requires PAN or its equivalent e-document, or Form No. 60, in addition to the identity document.
Where a customer furnishes an OVD without a current address, the Directions deem certain documents to be OVDs for proof of address: a utility bill not more than two months old from a utility provider; a property or municipal tax receipt; pension or family pension orders; and letters of allotment from specified employers with leave and licence agreements. The concession is temporary; under paragraph 5(1)(xiv) proviso (c), the customer must submit an OVD with current address within three months of submitting a deemed OVD.
Aadhaar Authentication and Offline Verification
Section 11A of the PMLA provides specified modes through which a reporting entity may verify the identity of clients and beneficial owners, subject to the conditions in the Act and applicable rules and regulatory directions. The availability and conditions of a particular mode should therefore be stated together with the applicable regulatory requirements.
Section 11A(2) requires that where a reporting entity performs Aadhaar authentication, “it shall make the other modes of identification under clauses (b), (c) and (d) of sub section (1) also available to such client or the beneficial owner.” Offering Aadhaar authentication as the only path does not comply.
The RBI Directions state that Aadhaar number is not mandatory for KYC, subject to the statutory exception applicable to a person seeking a benefit under a scheme notified under section 7 of the Aadhaar Act.
Biometric Verification
Biometric verification tests a physical characteristic — fingerprint, iris or face — against a stored reference. Biometric based authentication can provide an additional means of establishing that the biometric presented corresponds with the reference held by the relevant authentication system. Its legal use remains subject to the applicable Aadhaar and regulatory requirements.
Explanation 2 to paragraph 23 provides that “a bank official, business correspondent, or business facilitator can perform biometric based e-KYC authentication, including Aadhaar Face Authentication.” Biometric authentication also supports periodic updation: under paragraph 42(3)(iv), a self declaration through a business correspondent is obtained in electronic mode “after successful biometric based e-KYC authentication.”
Liveness Detection and Why It Matters More Every Year
A face match answers whether two images show the same face. It does not answer whether the thing in front of the camera is a living person. That second question belongs to liveness detection, and it is now the load bearing control in remote onboarding.
The threat has three broad shapes: a presentation attack holds something to the camera (a printed photograph, screen, or mask), an injection attack feeds synthetic frames directly into the video stream, and synthetic media created by machine learning can produce a convincing face from a single image.
Indian regulation requires control without prescribing the technology. Paragraph 27(1)(v) provides that the V-CIP application “shall have components with face liveness/spoof detection as well as face matching technology with high degree of accuracy, even though the ultimate responsibility of any customer identification rests with the bank.” The Explanation to that clause adds a practical instruction: making specific facial gestures such as blinking, smiling or frowning is not mandatory for a liveness check, and the bank must take due cognisance of any special needs of the customer during the check.
Paragraph 27(1)(vii) closes the loop by requiring the bank to update its technology infrastructure and workflows based on experience with detected cases of forged identity, and to report detected fraud through V-CIP as a cyber event under regulatory guidelines.
Video Based Verification
The Video based Customer Identification Process is defined at paragraph 5(2)(xvi) as an alternative method of customer identification with facial recognition and customer due diligence, conducted by an authorised official through a seamless, secure, live, informed consent based audio visual interaction.
Paragraph 26 sets out what V-CIP may be used for: customer due diligence when onboarding new individual customers, the proprietor of a proprietorship firm, and the authorised signatories and beneficial owners of legal entity customers; conversion of existing accounts opened in non face to face mode using Aadhaar OTP based e-KYC; and updation or periodic updation of KYC for eligible customers.
Paragraph 27 then imposes minimum standards, substantially infrastructural. The technology must be housed in the bank’s own premises on its secured network. Data must be end to end encrypted. The application must prevent connections from IP addresses outside India. Video recordings must carry GPS co ordinates and timestamp at quality adequate to identify the customer. Where cloud deployment is used, all data must transfer to the bank’s own servers immediately after the process completes, and the cloud provider must retain no data.
That last requirement quietly rules out a range of otherwise attractive vendor architectures. It is worth checking against your provider’s actual data retention behaviour rather than its contractual promise.
The Digital KYC Process
Digital KYC is a defined term and is not remote. Paragraph 5(1)(viii) defines it as capture by an authorised officer of a live photo of the customer and of an OVD or proof of possession of Aadhaar, together with location co ordinates.
Paragraph 24 prescribes the procedure. The customer must visit the authorised official with the original OVD in hand. The application captures a live photograph against a white background, watermarked with the form number, GPS co ordinates, official name, employee code, and timestamp. The officer separately photographs the original document vertically from above. An OTP sent to the customer’s mobile validates their signature on the form, and a separate OTP to the officer’s registered number validates the officer’s declaration.
The reason this matters for an identity verification article is that Digital KYC is frequently marketed as a remote alternative to meeting the customer. It is not. It is a paperless method of conducting a meeting.
Retrieving a Verified Record from CKYCR
The fourth route is to retrieve a verification someone else performed. Paragraph 23(4) allows a customer to supply a KYC Identifier with explicit consent to download records from the Central KYC Records Registry, and proviso (v) requires the bank to retrieve those records online in accordance with paragraph 65.
The current Rule 9 framework expressly allocates responsibility for verifying the authenticity of the identity or address to the reporting entity that performed the last KYC verification or sent updated information, while prescribing conditions for entities that retrieve and rely on CKYCR records. Paragraph 65(1) records that the Government of India authorised the Central Registry of Securitisation Asset Reconstruction and Security Interest of India to act as, and perform the functions of, the CKYCR by Gazette Notification No. S.O. 3183(E) dated November 26, 2015. Paragraph 65(5) records that the live run of the CKYCR started from July 15, 2016, in a phased manner, beginning with new individual accounts, with scheduled commercial banks required to upload data for all new individual accounts opened on or after January 1, 2017, and other reporting entities from April 1, 2017. Paragraph 65(6) extends the obligation to legal entity accounts opened on or after April 1, 2021, using the LE Template released by CERSAI.
Comparing Methods by Assurance Level and Legal Recognition in India
Method | What it proves | Presence required | Legal recognition |
Certified copy of an OVD | The document exists and matches the original presented | Yes | Para 5(1)(v), para 23 |
Equivalent e document | The issuer digitally signed the document | No | Para 5(1)(x); digital signature verified under the IT Act, 2000, plus a live photo under para 24 |
Aadhaar authentication | The issuing authority confirms the identity assertion | No | PMLA s.11A(1)(a); para 23(1) |
Offline Aadhaar verification | The signed data object is authentic and unaltered | No | PMLA s.11A(1)(b); para 23(2) |
Biometric e-KYC | A physical characteristic matches the stored reference | Yes, at capture | Explanation 2 to para 23 |
Digital KYC Process | A live person, a live document and a location, captured by an officer | Yes | Paras 5(1)(viii), 24 |
V-CIP | A live, consented, geo-tagged audio visual interaction with liveness and face match | No, but live | Paras 5(2)(xvi), 26, 27 |
CKYCR retrieval | Another regulated entity verified this customer and filed the record | No | Para 23(4); para 65; Rule 9 |
Choosing the Right Verification Tools?
With so many options available, picking the right software can be confusing. We help you compare tools and select the one that suits your business and budget.
Verifying Non Individual Customers
Verifying a company is a different exercise from verifying a person. A company cannot present itself. Everything about it arrives through documents and through the natural people who act for it, and each of those people is a separate verification problem.
Companies, Partnerships, Trusts and Unincorporated Bodies
Paragraphs 33 to 37 set out what must be obtained for each entity type, as certified copies or equivalent e-documents. In every case, the entity must also produce the paragraph 23 documents for its beneficial owners and for the managers, officers or employees holding an attorney. Entity documents establish that the entity exists; paragraph 23 documents verify the humans.
- Company (para 33): certificate of incorporation; memorandum and articles of association; PAN; a board resolution and power of attorney for those transacting on its behalf; paragraph 23 documents for the beneficial owner and attorney holders; the names of relevant persons holding a senior management position; and the registered office and principal place of business if different.
- Partnership firm (para 34): registration certificate; partnership deed; PAN; paragraph 23 documents for the beneficial owner and attorney holders; the names of all partners; and the registered office and principal place of business if different.
- Trust (para 35): registration certificate; trust deed; PAN or Form No. 60; paragraph 23 documents for the beneficial owner and attorney holders; the names of the beneficiaries, trustees, settlor, protector if any, and authors of the trust; the registered office address; and a list of trustees with paragraph 23 documents for those authorised to transact.
- Unincorporated association or body of individuals (para 36): a resolution of the managing body; PAN or Form No. 60; power of attorney; paragraph 23 documents for the beneficial owner and attorney holders; and such information as is required to collectively establish legal existence. Two Explanations expand the category: unregistered trusts and partnership firms are included under “unincorporated association”, and “body of individuals” includes societies.
- Other juridical persons (para 37): for societies, universities and local bodies such as village panchayats, a document showing the name of the person authorised to act, paragraph 23 documents for the attorney holder, and documents establishing legal existence. Where the customer is a trust, the proviso requires trustees to disclose their status at the commencement of the relationship or when carrying out transactions under paragraph 21(2), (5) and (6).
Identifying the Beneficial Owner
Paragraph 38 requires a bank opening an account for a legal person that is not a natural person to identify the beneficial owners and to “undertake all reasonable steps in terms of sub-rule (3) of Rule 9 of the Rules to verify their identity.”
The thresholds are set out in the definition at paragraph 5(1)(iv), and they mirror Rule 9(3) of the PML Rules.
Customer type | Who is the beneficial owner | Threshold |
Company | Natural person(s) with a controlling ownership interest, or who exercise control through other means | More than 10% of shares, capital or profits |
Partnership firm | Natural person(s) with ownership of or entitlement to capital or profits, or who exercise control through other means | More than 10% of capital or profits |
Unincorporated association or body of individuals (includes societies) | Natural person(s) with ownership of or entitlement to property, capital or profits | More than 15% |
Trust | Author of the trust, the trustee, beneficiaries with interest in the trust, and any other natural person exercising ultimate effective control through a chain of control or ownership | 10% or more interest, for beneficiaries |
Where no natural person is identified under the company, partnership or unincorporated association limbs | The relevant natural person holding the position of senior managing official | Not applicable |
Two points about this table are worth stating plainly. First, the senior managing official is a fallback, not a shortcut. It applies where no natural person has been identified after the threshold test has genuinely been applied, and defaulting to it because the ownership chain was difficult to unravel is a failure of the reasonable steps obligation, not a satisfaction of it.
Second, these thresholds are no longer a banking peculiarity. SEBI’s Master Circular SEBI/HO/MIRSD/MIRSDSECFATF/P/CIR/2024/78 dated June 06, 2024, carries the same figures for securities market intermediaries: more than ten per cent for companies and partnerships, more than fifteen per cent for unincorporated associations and bodies of individuals, ten per cent or more interest for trust beneficiaries, and the senior managing official as the fallback. Any older SEBI beneficial ownership guidance should be checked against the current SEBI KYC and AML and CFT framework before being relied upon. The article should not describe an older instrument as current merely because its thresholds continue to appear in secondary content.
When You Do Not Have to Look Through to Beneficial Owners
Paragraph 38(1) creates a carve out that saves work and is narrower than often assumed. Where the customer or owner of controlling interest is an entity listed on a stock exchange in India, or resident in a notified jurisdiction and listed on that stock exchange, or a subsidiary of such an entity, it is not necessary to identify and verify shareholders or beneficial owners.
Read the middle limb carefully. The exemption applies to an entity resident in a jurisdiction notified by the Central Government and listed on a stock exchange in such notified jurisdiction, subject to the conditions prescribed in the applicable rules and directions. Applying the carve out to any overseas listing is a frequent and material error.
Paragraph 38(2) then adds the opposite instruction for trust, nominee and fiduciary accounts. The bank must determine whether the customer is acting on behalf of another person as trustee, nominee or other intermediary, and where it is, must obtain satisfactory evidence of the identity of the intermediaries and of the persons on whose behalf they act, together with details of the nature of the trust or other arrangement.
What "Control" Means Beyond Shareholding
Ownership percentages are the easy half of the test. The definition at paragraph 5(1)(iv)(a) reaches a natural person who “exercises control through other means”, and the Explanation defines control to include “the right to appoint the majority of the directors or to control the management or policy decisions including by virtue of their shareholding or management rights or shareholders agreements or voting agreements.”
Four instruments are named there, and only one of them is a shareholding. A person holding two per cent of the equity who controls the board through a shareholders agreement is a beneficial owner. A person with no shares at all who holds the right to appoint a majority of the directors is a beneficial owner. Any control test that runs only against a shareholding register will miss both.
For partnerships, paragraph 5(1)(iv)(b) narrows the Explanation to “the right to control the management or policy decision”, without the director appointment limb, which reflects the different constitutional structure of a firm.
Screening: The Step After Verification
Once you know who the customer is, you have to find out whether that person is someone you are prohibited from dealing with, or someone who requires additional scrutiny. This is a separate control from verification, and it fails in different ways.
Sanctions List Screening
Paragraph 56 requires a bank to comply with the requirements under section 51A of the Unlawful Activities (Prevention) Act, 1967 and the applicable lists and orders specified in the RBI Directions, that it holds no account in the name of individuals or entities appearing on the lists approved and periodically circulated by the United Nations Security Council. Two lists are named: the ISIL (Da’esh) and Al Qaida Sanctions List established and maintained pursuant to Security Council resolutions 1267, 1989 and 2253, and the Taliban Sanctions List established and maintained pursuant to Security Council resolution 1988 (2011).
Paragraph 56(2) adds the lists in the Schedules to the Prevention and Suppression of Terrorism (Implementation of Security Council Resolutions) Order, 2007, as amended, and sets the frequency: the bank “shall verify the aforementioned lists… daily “, taking into account any additions, deletions or other changes for meticulous compliance.
Paragraph 58 imposes a separate daily obligation in respect of the UNSCR 1718 Sanctions List of Designated Individuals and Entities, published on the Ministry of External Affairs website, together with compliance with the Implementation of Security Council Resolution on Democratic People’s Republic of Korea Order, 2017 as amended.
Paragraph 59 then requires the bank to consider other UNSCRs and the lists in the first and fourth schedules of the UAPA, 1967, and amendments to them.
The RBI Directions prescribe daily verification for the specified sanctions lists covered by the relevant provisions. The article should identify the list and paragraph when stating a daily screening requirement rather than generalising the frequency to every possible screening source.
Proliferation Financing: The Second Screening Obligation
Sanctions screening in India is not one obligation but two, and the second is regularly left out of both compliance programmes and published content.
Paragraph 57 requires meticulous compliance with the Procedure for Implementation of Section 12A of the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005, issued by the Ministry of Finance on September 1, 2023. Under it, the bank must not carry out transactions where the particulars of an individual or entity match the designated list and must run a check on the given parameters both when establishing a relationship and periodically thereafter, to verify whether designated individuals and entities hold any funds or financial assets with it.
On a match, the bank must immediately inform the transaction details with full particulars to the Central Nodal Officer, copied to the State Nodal Officer where the account or transaction is held and to the RBI. Paragraph 57(5) records that the Director, FIU-India has been designated as the Central Nodal Officer. Where there are reasons to believe beyond doubt that funds or assets fall within section 12A(2)(a) or (b), the bank must prevent the individual or entity from conducting financial transactions, under intimation to the CNO by email, fax and post, without delay. An unfreezing application must be forwarded to the CNO by email, fax and post within two working days.
A bank’s sanctions control framework must address the applicable UAPA, WMD Act and UNSCR requirements prescribed by the RBI Directions and the relevant legal instruments.
PEP Screening
Paragraph 45 governs accounts of Politically Exposed Persons, and its definition is jurisdictionally specific in a way that surprises people. The Explanation defines PEPs as “individuals who are or have been entrusted with prominent public functions by a foreign country, including the Heads of States / Governments, senior politicians, senior government or judicial or military officers, senior executives of state owned corporations and important political party officials.”
By a foreign country. The PEP definition in the RBI Directions refers to individuals who are or have been entrusted with prominent public functions by a foreign country. Banks may apply broader internal risk based controls under their approved policies, but those internal controls should be distinguished from the regulatory definition of PEP. That does not make a domestic official low risk — the risk based approach in paragraphs 20 and 41 applies to everyone, and many institutions treat domestic PEPs as high risk by policy — but it does mean an institution should be clear about whether it is applying the regulatory definition or a wider internal one, and should say so in its board approved policy.
Where a customer or beneficial owner is a PEP, the bank may establish or continue the relationship subject to the enhanced due diligence and senior management approval requirements prescribed by the RBI Directions, including measures to establish source of wealth and source of funds and enhanced ongoing monitoring.
Adverse Media Screening
Adverse media screening may be used as an additional risk based control. Investigations, charges, regulatory action, and credible reporting of involvement in predicate offences. It catches risk that no official list carries, because a person is usually written about long before they are designated.
What To Do When You Get a Match
A match is a beginning, not a conclusion. The Directions prescribe the steps.
Under paragraph 56(3), the bank must report the details of accounts resembling any of the listed individuals or entities to FIU-IND, and in addition advise the Ministry of Home Affairs, as required under the UAPA notification dated February 2, 2021, which is reproduced at Annex I to the Directions. Note the word “resembling”. The reporting trigger is a resemblance, not a confirmed identity, and an institution that waits for certainty before reporting has misread the standard.
Under paragraph 56(4), freezing of assets under section 51A of the UAPA must follow the procedure laid down in that Order strictly, with meticulous compliance. Freezing is not a decision the institution takes on its own initiative and outside the prescribed route.
For a WMD Act match, the parallel route runs through the Central Nodal Officer as described above.
Managing False Positives Without Weakening the Control Delivery Channels
Every screening programme generates far more matches than it does true hits, and the pressure to reduce that volume is where controls quietly degrade. Raising a fuzzy matching threshold reduces alerts and reduces detection at the same time, and the second effect is invisible until it matters.
The regulation offers a hook for doing this properly. Paragraph 62 provides that “the bank is encouraged to leverage latest technological innovations and tools for effective implementation of name screening to meet the sanctions requirements.” The operative word is effective. That is an efficiency instruction anchored to an effectiveness objective, not a licence to tune for a quieter queue.
The defensible ways to reduce false positives without reducing sensitivity are structural: improve data quality (a screen fed a full name, date of birth and nationality discriminates better than a name alone); use secondary identifiers to auto discount rather than raising thresholds; handle transliteration explicitly for names from multiple scripts; and measure false negative rates by deliberately seeding known designated identities into the pipeline.
Whatever tooling is adopted, paragraph 13 still applies. The determination remains inside the entity.
Risk Based Verification: Doing More Where the Risk Is Higher
The depth of verification is not fixed. It is a function of assessed risk, and the assessment is itself a regulated activity.
How Risk Categorisation Changes the Verification Standard
Paragraph 20 requires a risk based approach for risk management, and paragraph 41 requires the bank to “align the extent of monitoring with the risk category of the customer.” Paragraph 41(1) adds a governance obligation that is often missed: the bank must put in place a system of periodic review of risk categorisation of accounts, at least once every six months, and must establish the need for applying enhanced due diligence measures.
A risk rating assigned at onboarding and never revisited fails that requirement on its own terms, regardless of how carefully it was originally set.
Enhanced Due Diligence Triggers
Three EDD triggers are relevant to identity verification.
Paragraph 44 covers non face to face onboarding other than onboarding under paragraph 25, which is to say onboarding through digital channels such as CKYCR, DigiLocker or equivalent e-documents, and non digital modes such as an OVD copy certified by the additional certifying authorities permitted for NRIs and PIOs. Six measures follow: where the bank has introduced V-CIP it must offer it as the first option for remote onboarding, and V-CIP complying with the prescribed standards is treated on par with face to face customer identification; alternate mobile numbers must not be linked post CDD for transaction OTPs or updates, transactions must be permitted only from the mobile number used at account opening, and changes of registered mobile number must run through a board approved due diligence process; the current address must be verified through positive confirmation before operations are allowed; PAN must be obtained and verified from the issuing authority’s verification facility; the first transaction must be a credit from an existing KYC compliant bank account of the customer; and the customer must be categorised as high risk and subjected to enhanced monitoring until identity is verified face to face or through V-CIP.
Paragraph 45 covers PEPs, as set out above.
Paragraph 61 covers jurisdictions that do not, or insufficiently, apply the FATF Recommendations. The bank must identify such countries using FATF Statements circulated by the RBI and apply enhanced due diligence measures effective and proportionate to risks. It must examine the background and purpose of transactions with persons from those countries, retain written findings with all documents, and make them available to the RBI or relevant authorities on request. An Explanation preserves the right to legitimate trade, so this is heightened scrutiny and not prohibition.
Simplified Due Diligence and Where It Is Permitted
The Directions prescribe specific simplified or modified KYC measures for customer categories and circumstances. These include the provisions relating to Self Help Groups, certain foreign students, eligible Foreign Portfolio Investors and small accounts.
Paragraph 47 provides that a bank shall not require customer due diligence of all the members of a Self Help Group while opening the SHG’s savings bank account; CDD of all the office bearers suffices.
Paragraph 48 sets out the procedure for accounts of foreign students. Paragraph 48 permits a Non Resident Ordinary account for a foreign student subject to the specified passport, visa, identity and address documents, photograph and admission letter requirements, together with verification of the local address within the prescribed period. A declaration of the local address must be obtained within 30 days of opening and verified. Pending that verification, the account operates with foreign remittances not exceeding USD 1,000 or equivalent and a cap of Rs 50,000 on aggregate withdrawals during the 30 days. Students of Pakistani nationality require prior RBI approval.
Paragraph 49 provides simplified KYC measures for eligible Foreign Portfolio Investors subject to the conditions and documentation requirements specified in the RBI Directions and the applicable SEBI and tax requirements. Simplified is not absent. Each of these still requires verified identity documents; what changes is scope and sequence.
Need Help Verifying Your Customers the Right Way?
Every business needs a verification process that is simple for customers and reliable for compliance. We help you build one that fits the way you work.
Ongoing Verification and Monitoring
Verification is a point in time assertion about a customer who will keep changing. Everything after onboarding exists to stop that assertion going stale.
Ongoing Due Diligence
Paragraph 39 requires the bank to undertake ongoing due diligence so that customer transactions are consistent with its knowledge of the customer, the customer’s business and risk profile, and the source of funds and wealth.
Paragraph 40 names four transaction types that must be monitored: large and complex transactions including RTGS, with unusual patterns inconsistent with normal activity that have no apparent economic rationale or legitimate purpose; transactions exceeding prescribed thresholds; high account turnover inconsistent with balance size; and third party cheques or drafts in new accounts followed by large cash withdrawals. The paragraph also records that banks may adopt innovations including artificial intelligence and machine learning to support effective monitoring.
Paragraph 41(2) singles out accounts of marketing firms, especially multi level marketing companies, for close monitoring, and an Explanation requires immediate reporting to the RBI and other appropriate authorities such as FIU-IND where a company seeks a large number of cheque books, or there are multiple small cash deposits across the country into one account, or a large number of cheques bearing similar amounts or dates are issued.
Periodic Updation
Paragraph 42(1) sets the periodicity. The bank must adopt a risk based approach and carry out periodic updation at least once every two years for high risk customers, once every eight years for medium risk customers and once every ten years for low risk customers, measured from the date of opening the account or the last KYC updation, under a policy documented in the bank’s internal KYC policy and approved by the Board or a committee to which the power has been delegated.
Paragraph 42(2) carries a transitional concession that is live at the time of writing and worth flagging to any team planning its remediation calendar. For an individual customer categorised as low risk, the bank must allow all transactions and ensure updation of KYC within one year of its falling due, or up to June 30, 2026, whichever is later, with such accounts subject to regular monitoring. It applies equally to low risk individual customers whose periodic updation had already fallen due.
Where there is no change in KYC information, paragraph 42(3)(i) permits a self declaration through the customer’s registered email, registered mobile number, ATMs, digital channels such as online or mobile banking, or letter. Where only the address has changed, paragraph 42(3)(ii) permits a self declaration of the new address through the same channels, but requires the declared address to be verified through positive confirmation within two months, by means such as an address verification letter, contact point verification or deliverables.
Two further limbs deal with identity specifically. Under paragraph 42(3)(v), where an account was opened when the customer was a minor, the bank must obtain fresh photographs on the customer becoming a major and ensure that CDD documents meeting current standards are available, carrying out fresh KYC where required. Under paragraph 42(5)(i), where the validity of the CDD documents held has expired at the time of periodic updation, the bank must undertake a KYC process equivalent to onboarding a new customer — an expired document is not refreshed by a self declaration.
Paragraph 42(7) adds a communication discipline that is easy to under build: before the due date the bank must give at least three advance intimations, including at least one by letter, and after the due date at least three reminders, including at least one by letter, with issue of each recorded in the bank’s system for audit trail.
Alerts When Activity Diverges From the Profile
Paragraph 55 is a single sentence with a large systems implication: to identify and report suspicious transactions effectively, the bank “shall implement robust software that generates alerts when transactions are inconsistent with a customer’s risk categorisation and updated profile.”
The phrase “and updated profile” ties monitoring back to verification. Alerting logic calibrated against a profile captured at onboarding, and never refreshed by periodic updation, is not monitoring against the updated profile the paragraph requires.
What Happens When Identity Verification Fails
Failure is a normal operating condition, not an exception. A proportion of customers will not complete verification, and the rules governing what happens next are more constrained than most teams assume.
Refusing or Exiting the Relationship
The instinct to refuse anything doubtful is itself regulated. Paragraph 18 provides that the Customer Acceptance Policy “shall not result in denial of a banking / financial facility to members of the general public, especially those who are financially or socially disadvantaged, including the Persons with Disabilities (PwDs).”
It goes further. The bank “shall not reject an application for onboarding or periodic updation of KYC without application of mind”, and “the officer concerned shall duly record the reason(s) for rejection.” A rejection that is automated, unreasoned or undocumented breaches the paragraph even where the underlying decision was defensible. Over refusal is a compliance failure in India, not a conservative safe harbour.
Paragraph 17 requires the bank to open no account in an anonymous or fictitious or benami name, to open no account where it is unable to apply appropriate CDD measures, and not to undertake a transaction or commence an account based relationship without following CDD. The two rules – paragraph 17 and paragraph 18 – must be read together: the first governs the outcome, the second governs how that outcome is reached.
There is a line between paragraphs 17 and 18, and it is worth naming precisely because so many policies blur it. Paragraph 17 bars you from proceeding where verification cannot be completed. Paragraph 18 bars casual, bulk refusals without recorded reason. The first governs the outcome; the second governs how it is reached. A well drafted policy does not ask “may we refuse?” but “have we actually tried the alternatives and recorded why they did not work?”
Paragraph 23 reinforces this for customers who cannot complete e-KYC authentication owing to injury, illness or infirmity on account of old age or similar causes where the customer seeks a benefit under a section 7 notified scheme. In those cases the bank must perform identification preferably by offline verification or alternatively by obtaining a certified copy of another OVD, with an official of the bank invariably carrying out CDD done in that manner, the case recorded in a centralised exception database, that database subjected to periodic internal audit and made available for supervisory review.
Filing a Suspicious Transaction Report
Where a failed verification produces a suspicion rather than an administrative dead end, the obligation changes. Where the Principal Officer is satisfied that a transaction is suspicious, the reporting entity must furnish the prescribed information to the Director in accordance with Rule 8 of the PML Rules and the applicable FIU IND reporting framework.”
Three consequences follow that are widely misunderstood.
First, filing an STR does not freeze the customer. Paragraph 54 states that the bank “shall not put any restriction on operations in the accounts merely based on the STR filed.” Restricting an account because an STR was filed is itself a departure from the Directions.
Second, delay is counted per day. The same paragraph provides that a delay of each day in not reporting a transaction, or in rectifying a misrepresented transaction, beyond the time limit specified in the Rules, “shall constitute a separate violation.”
Third, where the institution reasonably believes that performing CDD will tip off the customer, paragraph 19 requires it to stop the CDD process and file an STR instead.
Confidentiality attaches. Paragraph 54 requires the bank, its directors, officers and employees to keep the fact of maintaining records under Rule 3 and of furnishing information to the Director confidential, subject to the internal sharing permitted under paragraph 8.
Regulatory Consequences
Section 13(2) of the PMLA sets out what happens when a reporting entity, its designated director or its employees fail to comply with the Chapter IV obligations. The Director may issue a warning in writing; direct the entity, designated director or employees to comply with specific instructions; direct them to send reports at prescribed intervals on the measures being taken; or, by order, impose a monetary penalty “which shall not be less than ten thousand rupees but may extend to one lakh rupees for each failure.”
Section 13 permits the Director to impose a monetary penalty of not less than ten thousand rupees but which may extend to one lakh rupees for each failure, subject to the statutory framework. Section 13(1A) separately allows the Director, having regard to the nature and complexity of a case, to direct the entity to have specified records audited by an accountant from a Central Government panel.
There is also the money mule deeming provision at paragraph 68. Where an account opened and operated is established to be a money mule and no STR was filed by the bank, “it shall then be deemed that the bank has not complied with these directions.” No separate finding of inadequate verification is needed; the deeming does the work.
Record Keeping for Verification Evidence
Verification that cannot be evidenced later has limited value in a supervisory review.
What Must Be Retained and For How Long
Paragraph 50 sets two distinct clocks, and conflating them is a common error. Records of transactions between the bank and the customer, domestic and international, must be maintained for at least five years from the date of the transaction. Records of identification of customers and their addresses must be retained in accordance with Rule 10 of the PML Rules and the applicable regulatory directions. The applicable statutory retention requirement should be stated together with the relevant regulatory provision.
The first runs from an event. The second runs from the end of a relationship that may last decades.
The Explanation to paragraph 50 widens what counts as an identification record: the expressions “records of the identification” and “identification records” include updated records of the identification data, account files, business correspondence and the results of any analysis undertaken. Identification records include updated identification data, account files, business correspondence and the results of analysis undertaken under the applicable provisions. Records supporting customer due diligence and risk assessment should therefore be retained in accordance with the applicable record keeping requirements.
Paragraph 50 also requires the bank to make identification records and transaction data swiftly available to competent authorities on request, to maintain information permitting reconstruction of an individual transaction including its nature, amount, currency, date and parties, and to hold records in hard or soft format with a system allowing easy and quick retrieval.
Uploading to CKYCR
Under Rule 9(1A) of the PML Rules and the applicable RBI Directions, the reporting entity must furnish the electronic copy of the client’s KYC records to CKYCR within ten days after commencement of an account based relationship.
Where additional or updated information is obtained from a customer, where additional or updated information is obtained under Rule 9(1C), the reporting entity must furnish the updated information to CKYCR within seven days, or such other period as may be notified by the Central Government. CKYCR then updates the existing record and informs the reporting entities that have dealt with the client. Paragraph 65(8) states the same seven day obligation and adds that KYC records for accounts opened before the phase in dates must be uploaded at the time of periodic updation, or earlier if updated information is received.
Once the KYC Identifier is generated, the reporting entity must communicate it to the client in accordance with the applicable RBI Directions. The KYC Identifier does not itself replace the reporting entity’s applicable verification and CDD obligations.
Note the asymmetry: ten days at onboarding, seven days for an update. Systems built to a single deadline get the second one wrong.
Identity Verification Across Indian Regulators
The obligation is statutory and uniform; the operating rules are sectoral. The instrument that binds you depends on who regulates you.
Sector | Regulator | Governing instrument |
RBI | Reserve Bank of India (Commercial Banks — Know Your Customer) Directions, 2025, RBI/DOR/2025-26/169, DOR.AML.REC.No.88/14.01.002/2025-26, dated November 28, 2025, updated as on December 29, 2025 | |
RBI | Reserve Bank of India (Non-Banking Financial Companies — Know Your Customer) Directions, 2025, dated November 28, 2025, updated as on December 29, 2025 | |
Other RBI regulated entity types | RBI | Entity specific Know Your Customer Directions, 2025 issued on the same date for categories including Urban Cooperative Banks, Rural Cooperative Banks, Local Area Banks, All India Financial Institutions and Asset Reconstruction Companies |
SEBI | Master Circular SEBI/HO/MIRSD/MIRSDSECFATF/P/CIR/2024/78 dated June 06, 2024 | |
Insurers | IRDAI | Master Guidelines on AML/CFT, 2022, Ref. IRDAI/IID/GDL/MISC/160/8/2022 dated August 1, 2022, in force from November 1, 2022 |
PFRDA | Master Circular PFRDA/Master Circular/2024/04/PoP-02, updated as on September 25, 2025 | |
IFSCA | IFSCA AML, CTF and KYC Guidelines, 2022, updated as on February 26, 2026 | |
Virtual Digital Asset service providers | Director, FIU-IND | Ministry of Finance notification S.O. 1072(E) dated March 7, 2023 bringing VDA activities within the reporting entity net, read with S.O. 4877(E) dated November 9, 2023 |
One instrument should not appear on this list and still does, in a great deal of published content: the Master Direction — Know Your Customer Direction, 2016. On November 28, 2025, the Reserve Bank replaced it with the function wise, entity specific Directions above. Any policy, training deck or article that cites the 2016 Master Direction as current is citing a withdrawn instrument, and its paragraph numbering no longer matches.
Conclusion
Identity verification is a narrow technical step with unusually wide consequences. Everything downstream — the risk rating, the screening result, the monitoring baseline, the beneficial ownership picture, the evidential record a supervisor will eventually ask for — inherits whatever quality that step produced.
The Indian framing is more specific than vendor literature. The standard is reliable and independent sources of identification. The acceptable evidence is enumerated. The beneficial ownership thresholds are fixed at 10, 10, 15 and 10 per cent with a senior managing official fallback. The screening cadence is daily, running to two designated list regimes. The retention clocks are five years from the transaction and five years from relationship end. The determination of whether KYC norms are satisfied cannot leave the regulated entity, no matter how much of the workflow does.
If you are building or reviewing a verification programme, the highest yield questions are usually the structural ones. Is screening running after verification rather than before it? Is the control test running against shareholders agreements and board appointment rights, or only against a shareholding register? Is the three month clock on deemed OVDs actually tracked? Is the WMD Act designated list in the screening configuration alongside the UAPA lists? Is monitoring calibrated to the updated profile, or to the one captured at onboarding?
For the wider framework this step sits inside, start with our pillar guide to what KYC is and the rules that govern it in India.
Is Your Identity Verification Process Strong Enough?
Weak checks at onboarding can create compliance risks that surface much later. Let our experts review your process and show you where it can be improved.
Frequently Asked Questions
Identity verification is the process of testing a customer’s claimed identity against reliable and independent evidence, rather than simply recording what the customer says. In Indian AML law it forms part of customer due diligence, which paragraph 5(2)(v) of the RBI (Commercial Banks — Know Your Customer) Directions, 2025 defines as identifying and verifying the customer and the beneficial owner using reliable and independent sources of identification.
Identification collects the claim; verification tests it. Recording a customer’s name, address and document number is identification. Confirming those details against an Officially Valid Document, an Aadhaar authentication response, an offline verified Aadhaar data object or a retrieved CKYCR record is verification. A file that contains only the first has not met the standard.
No. Identity verification is one component of KYC. A full KYC and CDD process also requires understanding the purpose and intended nature of the relationship, understanding the customer’s business and its ownership and control, identifying and verifying beneficial owners, screening, risk categorisation and ongoing monitoring.
Paragraph 5(1)(xiv) of the 2025 Directions lists six Officially Valid Documents: the passport, the driving licence, proof of possession of Aadhaar number, the Voter’s Identity Card issued by the Election Commission of India, the NREGA job card signed by a State Government officer, and the National Population Register letter containing name and address. PAN or Form No. 60 is required in addition. Certain documents, such as a utility bill not more than two months old, are deemed OVDs for proof of address only, and an OVD carrying the current address must follow within three months.
More than 10 per cent of shares, capital or profits for a company; more than 10 per cent of capital or profits for a partnership firm; more than 15 per cent of property, capital or profits for an unincorporated association or body of individuals, which includes societies; and 10 per cent or more interest for beneficiaries of a trust, alongside the author, the trustee and any natural person exercising ultimate effective control. Where no natural person is identified under the first three limbs, the beneficial owner is the senior managing official. The same thresholds appear in Rule 9(3) of the PML Rules, paragraph 5(1)(iv) of the RBI Directions and SEBI’s Master Circular of June 6, 2024.
No. Paragraph 13 of the 2025 Directions provides that the bank shall ensure it does not outsource the decision making functions of determining compliance with KYC norms. A vendor may run capture, matching, liveness and screening technology, but the determination that a customer is verified must be made inside the regulated entity. Paragraph 22(5) adds that where CDD is relied on from a third party, the bank retains ultimate responsibility.
An individual is verified directly, against a document, an authentication response or a live interaction. A legal entity is verified indirectly, through constitutional documents that establish its existence and through paragraph 23 verification of the natural people behind it — the beneficial owners and the managers, officers or employees holding an attorney to transact. Paragraphs 33 to 37 set out the documents for companies, partnership firms, trusts, unincorporated associations and other juridical persons.
Liveness detection establishes that the face presented to a camera belongs to a living person present at the time, rather than a photograph, a screen replay, a mask or a synthetically generated video injected into the stream. For V-CIP it is required: paragraph 27(1)(v) requires the application to have face liveness and spoof detection components, as well as face matching technology with a high degree of accuracy. The Explanation clarifies that specific facial gestures such as blinking or smiling are not mandatory, and that the bank must take due cognisance of any special needs of the customer.
Under paragraph 42, periodic updation is required at least once every two years for high risk customers, once every eight years for medium risk customers and once every ten years for low risk customers, from account opening or the last updation. A transitional provision in paragraph 42(2) requires low risk individual customers to be allowed all transactions with updation completed within one year of falling due or up to June 30, 2026, whichever is later. Where the CDD documents held have expired, a full onboarding equivalent process is required rather than a self-declaration.
It depends on why. An administrative failure calls for a documented decision: paragraph 18 prohibits rejecting an onboarding or periodic updation application without application of mind and requires the officer to record the reasons. Where the failure gives rise to a suspicion of money laundering or terrorist financing, Rule 8(2) of the PML Rules requires the principal officer to furnish the information promptly in writing by fax or electronic mail to the Director, FIU-IND, and paragraph 19 requires the CDD process to be halted rather than pursued where continuing it would tip off the customer. Filing an STR does not by itself justify restricting the account.
The Prevention of Money-Laundering Act, 2002 and the PML (Maintenance of Records) Rules, 2005 create the obligation, with section 11A of the Act setting out the permitted modes of verifying identity and section 12AA providing for enhanced due diligence on specified transactions. The operating detail comes from your sector regulator: the RBI’s entity specific Know Your Customer Directions, 2025 for banks and NBFCs, SEBI’s Master Circular of June 6, 2024 for securities market intermediaries, the IRDAI Master Guidelines on AML/CFT, 2022 for insurers, the PFRDA Master Circular for the pension sector, and the IFSCA AML, CTF and KYC Guidelines, 2022 for IFSC entities.
About the Author
Pathik Shah
FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)
Pathik is a Chartered Accountant with more than 26 years of experience in governance, risk, and compliance. He helps companies with end-to-end AML compliance services, from conducting Enterprise- Wide Risk Assessments to implementing the robust AML Compliance framework. He has played a pivotal role as a functional expert in developing and implementing RegTech solutions for streamlined compliance.
Reach Out to Pathik
