What Changed
RBI's KYC Master Direction requires regulated entities to undertake ongoing due diligence of customers so that transactions remain consistent with what the entity knows about the customer, their business and their risk profile — and requires monitoring intensity to be aligned with the customer's risk category, not applied uniformly.
Why It Matters
Customer risk does not end when the account is opened. A customer who was low-risk at onboarding can become high-risk through subsequent behaviour — a change in transaction pattern, an unexplained income jump, activity inconsistent with their stated occupation — and the framework expects that shift to be caught and acted on, not merely logged.
Who Is Impacted
KYC, AML and fraud risk teams share responsibility here, often uncomfortably — ongoing due diligence sits at a boundary these functions do not always coordinate across cleanly.
What Institutions Should Review
- Periodic review cadence for each customer risk category — is 'periodic' actually happening on schedule, or only nominally scheduled?
- Whether enhanced due diligence for high-risk customers is materially more rigorous than standard due diligence, or a checkbox variant of the same process.
- Whether transaction behaviour is compared against the customer's declared profile in an automated, ongoing way, or only manually and reactively.
- Mule-account indicators specifically — dormant accounts suddenly active, income inconsistent with declared occupation, rapid pass-through of funds.
What This Means for FRM Technology and Controls
Ongoing due diligence is, in practice, a continuous monitoring problem rather than a periodic paperwork exercise. It requires a system that can compare live transaction behaviour against an evolving customer risk profile and flag divergence automatically, at the pace transactions actually happen.
Sources & References
External links open in a new tab. RBI is used as the primary source wherever an RBI regulation or direction is discussed; NPCI and MHA/I4C are used where directly applicable. A third-party article is never used as the principal source where the official circular or direction is available.