Re-KYC for Banks and NBFCs: RBI Rules, Timelines and How to Automate It

For banks and NBFCs, completing KYC once is not enough. Customer information changes, identification documents expire, and regulatory requirements demand periodic updates. Managing these changes across thousands or millions of customer accounts can create a significant operational burden.

The re-KYC process for banks ensures that existing customer records remain accurate, current and aligned with Reserve Bank of India (RBI) requirements. However, manual follow-ups, fragmented customer data, document verification delays and inconsistent communication can make periodic KYC updates difficult to manage.

RBI's risk-based framework establishes different update frequencies for high-, medium- and low-risk customers. It also provides simplified methods for customers whose KYC information has not changed.

For financial institutions, the challenge is to meet these requirements while reducing unnecessary customer visits, improving completion rates and maintaining reliable audit records.

This guide explains the re-KYC meaning, applicable RBI rules, timelines, customer verification methods and how banks and NBFCs can use intelligent automation to manage the process more efficiently.

What Is Re-KYC in Banking?

Re-KYC (Re-Know Your Customer) is the process of reviewing and updating the identity, address and other due diligence information of existing customers. It helps banks and NBFCs maintain accurate records throughout the customer relationship.

Unlike initial KYC, which is conducted when establishing a customer relationship, re-KYC focuses on keeping previously collected information current.

Under RBI guidelines, periodic KYC updation follows a risk-based approach. Financial institutions must consider the customer's risk classification, changes in personal or business information and the adequacy of existing records.

The re-KYC process may involve:

• Confirming that existing customer information remains unchanged.
• Updating residential or business addresses.
• Obtaining revised identification or supporting documents when required.
• Reviewing customer profiles and risk classifications.
• Updating records in internal systems and the Central KYC Records Registry (CKYCR), where applicable.
• Maintaining evidence of customer communication, verification and completion.

Importantly, re-KYC does not always require customers to submit fresh documents or visit a bank branch. RBI permits simplified processes in eligible cases, including self-declarations through approved communication and digital channels.

The appropriate method depends on the customer's circumstances, applicable regulatory requirements and the institution's approved KYC policy.

What Are the RBI Re-KYC Guidelines for Banks and NBFCs?

RBI requires regulated financial institutions to keep customer due diligence (CDD) information accurate and up to date.

The applicable framework includes the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025 and the Reserve Bank of India (Non-Banking Financial Companies – Know Your Customer) Directions, 2025, as amended.

Both frameworks establish risk-based periodic updation requirements, although institutions must follow the directions specifically applicable to their regulatory category.

RBI Re-KYC Timelines Based on Customer Risk

The minimum periodic updation frequency depends on the customer's risk classification.

These intervals are calculated from the date of account opening or the last KYC updation.

They represent minimum regulatory frequencies. A bank or NBFC may need to update KYC sooner based on its risk assessment, material changes in customer information or applicable enhanced due diligence requirements.

For example, a customer classified as high risk whose last KYC update was completed in July 2025 would ordinarily require the next periodic update by July 2027, unless an earlier review becomes necessary.

Financial institutions must document their periodic KYC updation policies and obtain the required approval from their Board or an authorised Board committee.

Special Provisions for Low-Risk Individual Customers

RBI introduced additional customer-protection measures for low-risk individuals whose periodic KYC updates are due.

Under the applicable provisions, regulated institutions must allow transactions for eligible low-risk individual customers and ensure that KYC is updated within:

• One year from the date periodic KYC becomes due; or
• June 30, 2026;

whichever is later.

This provision also covers eligible low-risk individual customers whose periodic KYC had already become overdue.

For example, if a low-risk customer's periodic KYC fell due on October 1, 2026, the applicable one-year period would extend to October 1, 2027, subject to the governing requirements.

However, this provision does not eliminate the obligation to complete re-KYC. Institutions must continue monitoring such accounts and complete the required updates within the applicable period.

It should not be interpreted as a general extension for medium- or high-risk customers.

RBI Requirements for Re-KYC Notifications and Reminders

An important part of periodic KYC compliance is informing customers before their update becomes due.

Under the RBI framework, banks and NBFCs must provide:

1. At least three advance intimations before the periodic KYC due date, including at least one by letter.
2. At least three reminders after the due date to customers who have not completed the process, including at least one by letter.

These communications must be issued at appropriate intervals through available communication channels.

Institutions must also maintain records of the intimations and reminders in their systems for audit purposes.

The applicable directions required implementation of this communication framework no later than January 1, 2026.

A reminder should provide clear instructions on how customers can update their information, where they can seek assistance and the consequences, if any, of failing to complete the process.

For banks and NBFCs, re-KYC reminder calls and digital notifications are therefore part of a broader regulatory communication workflow, not merely an optional customer engagement activity.

Automated campaigns can support these requirements, but digital outreach alone does not replace the prescribed letter-based communications.

How Does the Re-KYC Process for Banks Work?

The re-KYC process for banks typically involves identifying customers due for periodic updates, notifying them, collecting the required information and confirming completion.

The precise workflow varies depending on customer risk, account type, information changes and the institution's operating model.

Step 1: Identify Customers Due for Re-KYC

Banks first identify customers approaching their periodic KYC due dates.

This requires reviewing information such as:

• Customer identification number.
• Customer risk category.
• Date of account opening.
• Date of last KYC updation.
• Current KYC status.
• Registered contact details.
• Outstanding documentation or verification requirements.

A centralised process can help teams identify upcoming obligations and create customer segments for follow-up.

Institutions should also consider changes in customer risk classification that may require earlier action.

Step 2: Send Advance Re-KYC Notifications

Once eligible customers are identified, the institution initiates the required communication process.

Customers may receive notifications through registered contact channels such as SMS, email, mobile banking or other supported methods, alongside the mandatory letter-based intimations.

Messages should clearly explain:

• Why the KYC update is required.
• When it must be completed.
• Which update methods are available.
• Whether additional documents are necessary.
• How customers can contact the institution for assistance.

The objective is to provide customers with a straightforward way to understand and complete the requirement.

Step 3: Determine Whether Customer Information Has Changed

An important part of the periodic KYC update is determining whether the customer's existing information remains accurate.

For individual customers, the process generally follows one of three paths.

Where only the customer's address has changed, RBI permits a self-declaration of the new address. The institution must verify the declared address through positive confirmation within two months.

Depending on the circumstances and the approved KYC policy, additional proof of address may be requested.

This distinction helps avoid unnecessary document collection from customers whose existing information remains valid.

Step 4: Collect and Verify Documents Where Required

When fresh documentation is necessary, banks and NBFCs must verify the information using methods permitted under the applicable RBI framework.

These may include:

• Verification of officially valid documents (OVDs).
• Aadhaar-based e-KYC where legally permitted and applicable consent requirements are satisfied.
• Video-based Customer Identification Process (V-CIP), subject to applicable requirements.
• Other authorised customer due diligence methods.

For eligible customers, periodic KYC can also be updated through permitted digital and non-digital channels.

Document intelligence can help institutions process documents submitted during this stage.

For example, AI-powered KYC document verification can support document classification, information extraction, field validation and the identification of inconsistencies requiring human review.

However, automated document processing should not be confused with regulatory approval or completion of all customer due diligence obligations.

Step 5: Update Customer Records

After the required verification is completed, the institution updates the customer record.

Depending on the workflow, this may involve updating:

• Customer identification and demographic information.
• Address and contact details.
• Relevant supporting documents.
• Customer risk information.
• Internal KYC status and completion dates.
• Applicable CKYCR records.

Where required, the institution must also provide acknowledgement or confirmation of the completed update.

The completed record should support subsequent reviews, regulatory reporting and internal audits.

Step 6: Follow Up on Pending Cases

Not every customer completes re-KYC after the first notification.

Some customers may be unavailable, have outdated contact information or require assistance with the process.

Institutions should identify pending cases and initiate appropriate follow-ups.

The follow-up workflow must distinguish between:

• Customers who have not responded.
• Customers who have acknowledged the requirement.
• Customers awaiting document verification.
• Customers who need human assistance.
• Customers whose re-KYC is complete.

This distinction helps reduce redundant outreach while directing operational attention to cases that remain unresolved.

What Makes Manual Re-KYC Difficult for Banks and NBFCs?

Periodic KYC updation is a recurring regulatory obligation. At enterprise scale, it can involve substantial coordination between customer service, operations, compliance and technology teams.

Several operational challenges make manual execution difficult.

High Customer Outreach Volumes

A financial institution with a large customer base may need to contact substantial numbers of customers across different risk categories and due dates.

Manual calling and follow-up processes can place additional pressure on contact centre teams.

Incomplete or Outdated Contact Information

Customers may have changed their mobile numbers, addresses or preferred communication channels since onboarding.

Unsuccessful outreach increases the need for alternative communication methods and manual investigation.

Repetitive Customer Questions

Many customers have similar questions:

• Why do I need to update KYC again?
• Can I complete the process online?
• Do I need to visit a branch?
• What documents are required?
• What happens if I miss the deadline?

Handling these enquiries individually can consume significant contact centre capacity.

Fragmented Customer Communication

Customer communication may take place across voice calls, SMS, email, WhatsApp and branch interactions.

When these channels operate independently, teams may struggle to determine whether a customer has already responded or completed an update.

Manual Document Processing

Where supporting documents are required, manual classification, data extraction and verification can increase turnaround time.

Inconsistent data entry also creates additional reconciliation work.

Incomplete Audit Evidence

A successful re-KYC process requires more than confirmation that a message was sent.

Institutions need to maintain appropriate records of notifications, customer responses, verification decisions and completed updates.

An effective automation strategy must address these operational dependencies rather than automate reminders in isolation.

How Can Banks and NBFCs Automate the Re-KYC Process?

Re-KYC automation combines customer data, risk-based scheduling, multichannel communication, document processing and workflow tracking to support periodic KYC updates.

The objective is to reduce repetitive manual work while maintaining institutional control over customer verification and regulatory compliance.

A practical automation model has five components.

1. Risk-Based Customer Segmentation

The first component identifies customers who are due for periodic KYC updation.

Customer records can be segmented using existing risk classifications, due dates and outstanding requirements.

For example:

• High-risk customers approaching their two-year update.
• Medium-risk customers nearing their eight-year update.
• Low-risk customers eligible for simplified self-declaration.
• Customers with incomplete documentation.
• Customers requiring additional verification or manual review.

Risk classification must remain governed by the institution's approved policies and applicable RBI requirements.

Automation can use approved classifications to schedule workflows. It should not independently redefine regulatory risk categories without appropriate controls.

2. Automated Re-KYC Reminder Calls

Voice AI can help banks and NBFCs conduct routine customer outreach at scale.

An AI voice agent can explain why a KYC update is required, provide general instructions, answer supported questions and direct customers to an approved completion channel.

For example, an automated reminder might say:

"Your periodic KYC update is due. You can complete the process using the approved channels provided by your bank. Would you like information about the available options?"

Depending on the implementation, the voice workflow can capture customer intent, identify assistance requests and escalate unresolved cases to authorised personnel.

YuVoice, YuVerse's enterprise conversational AI platform, supports intelligent voice interactions, workflow automation and human escalation.

These capabilities are relevant to re-KYC reminder calls, particularly where institutions need to manage recurring, high-volume customer communication.

The bank or NBFC must still control the approved script, customer identification requirements, permissible disclosures, calling practices and escalation rules.

3. Multichannel Re-KYC Communication

Voice calls alone may not reach every customer.

Some customers respond more readily to written notifications, while others may prefer digital self-service channels.

An effective communication strategy can use several channels according to the customer's needs and available contact information.

For example:

YuChat's omnichannel messaging platform supports customer communication across channels including WhatsApp, RCS and SMS.

For broader customer outreach orchestration, YuCamp's AI-powered campaign management platform supports scheduled communication journeys across voice, SMS, email and WhatsApp.

These capabilities can help institutions design coordinated reminder workflows.

For instance, a customer who does not respond to an initial digital notification may be included in a subsequent voice outreach campaign, subject to the institution's approved communication rules.

The institution must separately ensure that mandatory letters are issued and recorded.

4. Automated Document Intelligence

Where re-KYC requires new documents, intelligent document processing can reduce the manual effort involved in reviewing them.

Document automation may support:

• Identifying document types.
• Extracting relevant customer information.
• Checking mandatory fields.
• Comparing information across documents.
• Identifying potential inconsistencies or tampering.
• Flagging cases requiring further review.

YuVerse's YuAccess document intelligence platform supports document classification, extraction, verification and validation.

For banking workflows, these capabilities can assist teams handling identification documents and supporting records.

However, document extraction accuracy does not establish the authenticity of a customer's identity or satisfy every applicable KYC requirement by itself.

Institutions must retain appropriate verification controls, approved procedures and human review for exceptions.

5. Workflow Tracking and Exception Management

The final component connects customer communication with operational status tracking.

A useful re-KYC workflow should distinguish among several states:

Banks should define these statuses in their internal systems and determine how communication platforms, document-processing tools and customer record systems exchange the necessary information.

Such connections require appropriate integration design and validation. They should not be assumed to exist automatically between independent products.

Example: An Automated Re-KYC Journey for an NBFC

Consider a hypothetical NBFC serving customers across several Indian states.

A segment of its existing customer base is approaching periodic KYC updation.

The NBFC wants to improve timely completion while reducing manual follow-up.

An illustrative workflow could operate as follows.

Customer identified for periodic KYC

Approved risk category, last update date and due date

Advance notifications scheduled

Required letters and approved digital communication

Customer responds

Digital channel, voice agent, branch or authorised assistance

No change

Eligible self-declaration

Information changed

Document or address verification as required

Institutional validation and exception review

Apply approved CDD checks and resolve discrepancies

KYC record updated

Completion confirmation, required records and audit trail

Illustrative workflow, not a claim of a preconfigured end-to-end YuVerse integration.

In this model, YuVoice can support conversational outreach, YuCamp can coordinate scheduled communication, and YuAccess can assist with document processing where additional verification is required.

The NBFC remains responsible for regulatory interpretation, customer due diligence, record maintenance and completion of the required KYC process.

The operational benefit comes from assigning routine tasks to appropriate automation tools while preserving human oversight for cases that require judgment.

How Should Banks Measure Re-KYC Automation Performance?

Successful automation should improve completion efficiency without weakening verification standards.

Banks and NBFCs should evaluate both operational performance and compliance-related controls.

These metrics should be interpreted together.

For example, a higher automated contact rate is useful only if it contributes to customer understanding and successful completion.

Similarly, reducing document review time should not come at the expense of identification accuracy or necessary compliance checks.

Institutions should also track customer complaints, unsuccessful communication attempts and outstanding cases by risk category.

Best Practices for Implementing Re-KYC Automation

Automation should be introduced through a controlled implementation rather than replacing the entire existing process at once.

Start With a Regulatory Requirements Matrix

Document the requirements applicable to the institution and its customer segments.

Include risk-based timelines, notification obligations, permitted verification methods and recordkeeping responsibilities.

This provides a baseline against which automated workflows can be evaluated.

Use Customer Risk and Status to Determine the Workflow

Avoid sending identical reminders or document requests to every customer.

A low-risk customer eligible for self-declaration may require a substantially simpler journey than a high-risk customer with material changes in information.

Automated workflow selection should follow the institution's approved requirements.

Design Communication for Clarity and Accessibility

Customers should be able to understand why the update is necessary and how to complete it.

Use clear language and provide support through accessible channels.

Where appropriate, multilingual conversational AI can assist customers who are more comfortable communicating in regional Indian languages.

Maintain Appropriate Privacy and Security Controls

KYC workflows involve sensitive personal information.

Institutions should evaluate data access, authentication, retention, processing arrangements and applicable privacy requirements before deployment.

Customer communications should avoid unnecessary disclosure of sensitive information.

Voice agents should direct customers to approved verification channels rather than requesting confidential credentials or OTPs during unsolicited calls.

Keep Humans in Control of Exceptions

Automation is particularly useful for repeatable tasks.

However, complex identity discrepancies, suspected fraud, disputed records and unusual customer circumstances require appropriate investigation.

Human review and escalation should be part of the workflow design.

Validate the Workflow Before Scaling

Start with a controlled pilot involving a defined customer segment.

Evaluate completion rates, communication quality, document exceptions and audit records.

Expand only after the institution confirms that operational and regulatory requirements are being met.

Common Mistakes to Avoid in Re-KYC Automation

Several implementation mistakes can undermine the effectiveness of an otherwise well-designed programme.

Treating every customer as high risk: This creates unnecessary friction and increases document collection requirements beyond what may be needed.

Confusing notification delivery with KYC completion: Sending reminders does not mean the customer's information has been successfully updated.

Ignoring mandatory letter-based communications: Digital messaging and AI reminder calls do not independently satisfy every prescribed notification requirement.

Requesting fresh documents from every customer: Eligible self-declaration processes should be considered where permitted.

Using disconnected systems without reconciliation: Communication and verification records must be linked appropriately to the correct customer and workflow.

Automatically marking cases as compliant: A completed automated step is not necessarily evidence that all regulatory requirements have been met.

Failing to provide human assistance: Customers with accessibility needs, identification difficulties or unresolved discrepancies may require additional support.

Avoiding these mistakes helps institutions maintain a practical balance between operational efficiency, customer experience and regulatory control.

Where YuVerse Fits Into Re-KYC Automation

YuVerse is a Last-Mile AI Company focused on turning AI capabilities into operational outcomes across customer conversations, documents and decisions.

For re-KYC workflows, the most relevant capabilities involve customer engagement, communication orchestration and document intelligence.

YuVoice — Conversational AI

Supports AI-powered voice interactions, customer assistance and escalation to human personnel. It can be evaluated for routine re-KYC reminder and enquiry workflows.

Explore YuVoice

YuCamp — Campaign Management

Supports scheduled, multichannel communication journeys across voice, WhatsApp, SMS and email. Relevant to coordinated KYC reminder programmes.

Explore YuCamp

YuAccess — Document Intelligence

Supports classification, extraction, verification and validation of documents, helping institutions manage document-heavy KYC workflows.

Explore YuAccess

YuChat — Omnichannel Messaging

Supports customer messaging across multiple digital channels and can assist with approved digital notifications and customer enquiries.

Explore YuChat

These capabilities address different components of the re-KYC journey.

Their use within an institution should be evaluated against existing customer systems, regulatory requirements, integration architecture and operational controls.

The objective is to make routine customer interactions and document handling more efficient while ensuring that the financial institution retains responsibility for compliance decisions.

Frequently Asked Questions

What is the re-KYC meaning under RBI guidelines?

Re-KYC refers to the periodic updation of existing customer information under RBI's Know Your Customer requirements. Banks and NBFCs must keep customer due diligence records accurate and current. Depending on the customer's risk category and circumstances, the process may involve self-declaration, information updates or additional document verification.

How often is re-KYC required for banks and NBFCs?

RBI prescribes periodic KYC updation at least once every two years for high-risk customers, eight years for medium-risk customers and ten years for low-risk customers. Institutions may require earlier updates when circumstances or applicable risk-based requirements justify them.

Can customers complete re-KYC online without visiting a branch?

Yes. RBI permits eligible periodic KYC updates through digital channels, including self-declarations where customer information remains unchanged. Other approved methods, such as applicable Aadhaar-based e-KYC or V-CIP, may also be available. The required method depends on the customer's circumstances and the institution's approved procedures.

What happens if a customer does not complete re-KYC on time?

The institution must follow the applicable RBI requirements, including prescribed notifications and reminders. Further action depends on customer risk, the nature of the outstanding requirement and applicable customer-protection provisions. Eligible low-risk individual customers receive the specific transaction-continuity protection described in the RBI framework.

How can AI automate re-KYC reminder calls?

AI voice agents can conduct routine outreach, explain the purpose of periodic KYC updates, respond to supported questions and route customers to approved completion channels. When connected through an appropriately designed workflow, customer responses can help determine subsequent follow-up actions. The institution must maintain suitable communication, privacy, verification and audit controls.

Can re-KYC automation replace manual verification completely?

No. Automation can support communication, document extraction, validation and workflow management, but it does not remove the financial institution's responsibility for customer due diligence. Complex cases, document discrepancies and regulatory exceptions may still require authorised human review.

Conclusion

The re-KYC process for banks and NBFCs is an ongoing part of customer due diligence, not a one-time documentation exercise.

RBI's risk-based timelines, simplified update methods and customer notification requirements provide a framework for keeping records current while reducing unnecessary inconvenience.

For financial institutions, effective implementation requires coordination across customer communication, document verification, internal systems and compliance operations.

Automation can improve this process by reducing repetitive outreach, simplifying eligible customer journeys and helping teams identify cases that need attention.

YuVerse brings relevant Last-Mile AI capabilities to these operational challenges through conversational AI, multichannel engagement and document intelligence.

For banks and NBFCs evaluating re-KYC automation, the next step is to assess how existing workflows can be made more efficient without compromising customer experience or regulatory control.

Talk to the YuVerse team to explore AI-powered customer engagement and document-processing workflows for your institution.