SEBI Guidelines for KYC Norms in the Securities Market

The foundation of the AML process

Chapter 7 carries 8 marks out of 50 — 16% of the paper, jointly the heaviest chapter.

Learning Objective- After studying this chapter, you should know about: The KYC guidelines and process to be followed by every SEBI registered intermediary to obtain and verify the Proof of Identity (PoI) and Proof of Address (PoA) from the client at the time of commencement of an account-based relationship.

KYC and Client Due Diligence (CDD) policies as part of KYC are the foundation of an effective Anti-Money Laundering process. The KYC process requires every SEBI registered intermediary to obtain and verify the Proof of Identity (PoI) and Proof of Address (PoA) from the client at the time of commencement of an account-based relationship.

Both documents, not one — the workbook's first sample question tests exactly this.

And the anonymity rule carries over: the registered intermediaries shall not open or keep any anonymous account or account in fictitious names or account on behalf of other persons whose identity has not been disclosed or cannot be verified. The intermediaries shall also continue to abide by circulars issued by SEBI from time to time for prevention of money laundering.

7.1.1 Uniform KYC format

SEBI registered intermediaries shall perform KYC in securities market through physical mode/ digital (online or app based) mode. To bring about uniformity in securities market, all SEBI registered intermediaries shall use the same KYC form and supporting documents.

The account opening form (AOF) for client shall be divided into two parts.

a) Part I of the AOF shall be the KYC form which shall capture the basic details about the client. For this purpose, all registered intermediaries shall use the KYC templates provided by Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI) for individuals and for legal entities for capturing the KYC information.

b) Part II of the form shall obtain the additional information specific to the area of activity of the intermediary, as considered appropriate by them.

Part I is uniform and CERSAI-based; Part II is the intermediary's own.

7.1.2 PAN — the unique identification number

In order to strengthen the KYC norms and identify every participant in the securities market with their respective PAN thereby ensuring sound audit trail of all the transactions, PAN shall be the unique identification number for all participants transacting in the securities market, irrespective of the amount of transaction.

The workbook's second sample question asks which number that is — PAN.

Note "irrespective of the amount of transaction" — the same no-threshold principle that governs CDD.

How it is checked: the registered intermediaries shall verify the PAN of their clients online at the Income Tax website without insisting on the original or copy of PAN card.

Online verification, and the card need not be produced.

And a live requirement: as per the provisions of Income-tax Act, 1961 (Income Tax Act), the PAN allotted to a person shall become inoperative if it is not linked with Aadhaar.

Since PAN is the key identification number and part of KYC requirements for all transactions in the securities market, all registered intermediaries shall ensure valid PAN in the KYC documentation for all clients. Status of Aadhaar and PAN linkage shall be flagged at the system of KRA.

7.1.3 Exemptions from PAN

The following are exempted from the mandatory requirement of PAN:

i. Transactions undertaken on behalf of Central Government and/or State Government and by officials appointed by Courts e.g., Official liquidator, Court receiver etc. (under the category of Government) for transacting in the securities market.

ii. Investors residing in the state of Sikkim.

iii. UN entities/multilateral agencies exempt from paying taxes/filing tax returns in India.

iv. SIP of Mutual Funds up to ₹50,000/- per year.

Four exemptions, and the workbook's third sample question confirms the first — the statement about government and court-appointed officials is True.

Two clarifications:

In case there is change in the name subsequent to issuance of PAN of the client, registered intermediaries can collect the PAN card proof as submitted by the client provided it is supported by a marriage certificate issued by the State Government or gazette notification, indicating such a change of name.

The e-PAN issued by Central Board of Direct Taxes (CBDT) can also be produced by client for KYC compliance. e-PAN is a digitally signed PAN card issued in electronic format by the Income-tax department.

7.1.4 Proof of Identity

Registered intermediaries at the time of commencement of an account based relationship shall identify their clients, verify their identity and obtain information on the purpose and intended nature of the business relationship.

And the names must match: the name as mentioned in the KYC form shall match the name as mentioned in the Proof of Identity (PoI) submitted.

The officially valid documents, defined as per Rule 2(d) of the PML Rules:

• i. the passport.
• ii. the driving licence.
• iii. proof of possession of Aadhaar number.
• iv. the Voter's Identity Card issued by Election Commission of India.
• v. job card issued by NREGA duly signed by an officer of the State Government.
• vi. the letter issued by the National Population Register containing details of name address; or
• vii. any other document as notified by the Central Government in consultation with the Regulator.

Seven officially valid documents.

And two more where simplified measures apply: where simplified measures are applied for verifying the identity of the clients, the following documents shall also be deemed to be officially valid document: i. Identity card/ document with applicant's photo, issued by the Central/State Government Departments, Statutory/Regulatory Authorities, Public Sector Undertakings, Scheduled Commercial Banks and Public Financial Institutions; ii. Letter issued by a gazetted officer, with a duly attested photograph of the person.

7.1.5 Proof of Address

The same seven officially valid documents are accepted as PoA.

And where the OVD lacks a current address, Rule 9(18) supplies four deemed documents for the limited purpose of proof of address, provided that the client shall submit updated officially valid document... with current address within a period of three months of submitting the following documents:

• i. utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill).
• ii. property or municipal tax receipt.
• iii. pension or family pension payment orders (PPOs) issued to retired employees by Government Departments or Public Sector Undertakings, if they contain the address.
• iv. letter of allotment of accommodation from employer issued by state or central government departments, statutory or regulatory bodies, public sector undertakings, scheduled commercial banks, financial institutions and listed companies and leave and licence agreements with such employers allotting official accommodation.

Two months for the bill; three months to produce a proper OVD.

Aadhaar: where the client submits proof of possession of Aadhaar number as an OVD, he may submit it in such form as is issued by the UIDAI.

Name changes: a document shall be deemed to an officially valid document even if there is a change in the name subsequent to its issuance provided it is supported by a Marriage Certificate issued by the State Government or a gazette notification, indicating such change of name.

Non-residents and foreign nationals

For non-residents and foreign nationals, (allowed to trade subject to RBI and FEMA guidelines), copy of passport/Persons of Indian Origin (PIO) Card/Overseas Citizenship of India (OCI) Card and overseas address proof is mandatory.

In case the officially valid document presented by a foreign national does not contain the details of address, the documents issued by the Government departments of foreign jurisdictions and letter issued by the Foreign Embassy or Mission in India shall be accepted as proof of address.

If any proof of address is in a foreign language, then translation into English shall be required. If correspondence and permanent address is different, then proof for both shall be submitted.

7.1.6 Third-party correspondence address

Registered intermediaries at the time of commencement of an account based relationship shall determine whether the client purports to act on behalf of juridical person or individual or trust and the registered intermediary shall verify that any person purporting to act on behalf of such client is so authorized and verify the identity of that person.

A client can authorize to capture address of a third party as a correspondence address, provided that all prescribed 'Know Your Client' norms are also fulfilled for the third party. The intermediary shall obtain proof of identity and proof of address for the third party. The intermediary shall also ensure that client due diligence norms as specified in Rule 9 of PML Rules are complied with in respect of the third party.

Full KYC on the third party, not just the client.

7.1.7 Beneficial ownership

SEBI Master Circular SEBI/HO/MIRSD/MIRSDSECFATF/P/CIR/2024/78 dated June 06, 2024... has prescribed the approach to be followed towards identification of beneficial ownership.

Whenever it is apparent that the securities acquired or maintained through an account are beneficially owned by a party other than the client, that party shall be identified using client identification and verification procedures.

The registered intermediaries shall conduct ongoing CDD where inconsistencies are noticed in the information provided. The objective is so that the intermediary is aware of the clients on whose behalf it is dealing.

And documents must be refreshed: intermediaries shall periodically update all documents, data or information of all clients and beneficial owners collected under the CDD process.

Audit: the stock exchanges and depositories shall monitor the compliance of the aforementioned provision on identification of beneficial ownership through half yearly internal audits. In case of mutual funds, compliance of the same shall be monitored by the Boards of the Asset Management Companies and the Trustees and in case of other registered intermediaries, by their Board of Directors.

7.1.8 Documents for non-individual clients

In case of non-individuals, additional documents (certified copies of equivalent e-documents) to be obtained are mentioned below.

i. Corporate body:

• Certificate of incorporation.
• Memorandum and Articles of Association.
• Board Resolution for investment in securities market.
• Power of Attorney granted to its managers, officers or employees, as the case may be, to transact on its behalf.
• Authorised signatories list with specimen signatures.
• Copy of the balance sheet for the last financial year (initially for the last two financial years and subsequently for every last financial year).
• Latest share holding pattern including list of all those holding control, either directly or indirectly, in the company in terms of SEBI takeover Regulations, duly certified by the company secretary/whole time director/ MD (to be submitted every year).
• Photograph, POI, POA, PAN and DIN numbers of whole-time directors/two directors in charge of day to day operations.
• Photograph, POI, POA, PAN of individual promoters holding control - either directly or indirectly.

Note the two annual items — the balance sheet and the shareholding pattern.

ii. Partnership firm:

• Certificate of registration (for registered partnership firms only).
• Copy of partnership deed.
• Copy of the balance sheet for the last financial year...
• Authorised signatories list with specimen signatures.
• Photograph, POI, POA, PAN of Partners.

iii. Trust:

• Certificate of registration (for registered trust only).
• Copy of Trust deed.
• Copy of the balance sheet for the last financial year...
• List of trustees certified by managing trustees/CA.
• Photograph, POI, POA, PAN of Trustees.

iv. HUF:

• Deed of declaration of HUF/ List of coparceners.
• Bank pass-book/bank statement in the name of HUF.
• Photograph, POI, POA, PAN of Karta.

v. Unincorporated association or a body of individuals:

• Proof of Existence/Constitution document.
• Resolution of the managing body & Power of Attorney granted to transact business on its behalf.
• Authorized signatories list with specimen signatures.

vi. Banks/Institutional Investors: Copy of the constitution/registration or annual report/balance sheet for last financial year... · Authorized signatories list with specimen signatures.

vii. Army/ Government Bodies: Self-certification on letterhead · Authorized signatories list with specimen signatures.

viii. Registered Society:

• Copy of Registration Certificate under Societies Registration Act.
• List of Managing Committee members.
• Committee resolution for persons authorised to act as authorised signatories with specimen signatures.
• True copy of Society Rules and Bye Laws certified by the Chairman/Secretary.

The workbook's fourth sample question turns on this list — a future trade plan is not among the documents required.

One item appears in every category: the authorised signatories list with specimen signatures.

7.1.9 Mobile number and email

The registered intermediaries shall upload the details of mobile number and email address on the KRA system. It shall be ensured that the mobile number/email addresses of their employees/authorized persons, distributors etc. are not uploaded on behalf of clients.

The client's own contact details, never the intermediary's staff.

7.1.10 Digital KYC

In order to enable the online KYC process for establishing account-based relationship with the registered intermediary, client's KYC shall be completed through digital (online / Application (App) based) KYC, in person verification through video, online submission of officially valid document / other documents, using electronic/digital signature, including Aadhaar e-Sign.

The fifteen requirements:

i. The client visits the website/App/digital platform of the registered intermediary and fill[s] up the online KYC form and submit[s] requisite documents.

ii. SEBI registered intermediaries shall obtain the express consent of the client before undertaking online KYC.

iii. The PAN, name, photograph, address, mobile number and email ID of the client shall be captured digitally and officially valid document shall be provided as a photo / scan of the original under electronic/digital signature, including Aadhaar e-Sign and the same shall be verified.

iv. Any officially valid document other than Aadhaar shall be submitted through Digiocker / using electronic/digital signature, including Aadhaar eSign.

v. The mobile number of client accepted as part of KYC should preferably be the one seeded with Aadhaar.

vi. Mobile and email shall be verified through One Time Password (OTP) or other verifiable mechanism.

vii. Aadhaar shall be verified through UIDAI's authentication/ verification mechanism. And under PML Rule 9(16), every intermediary shall, where the client submits his Aadhaar number, ensure that such client redacts or blacks out his Aadhaar number through appropriate means where the authentication of Aadhaar number is not required.

viii. e-KYC through Aadhaar Authentication service of UIDAI (e-KYC) or offline verification through Aadhaar QR Code/ XML file can be undertaken, provided the XML file or Aadhaar Secure QR Code generation date is not older than 3 days from the date of carrying out KYC.

Three days — a short shelf life.

ix. The usage of Aadhaar shall be optional and purely on a voluntary basis by the client.

x. Any document, except for the documents mentioned in the First Schedule of the Information Technology Act, 2000, shall be authenticated by a client by way of electronic/digital signature including Aadhaar e-Sign.

xi. A client can use the electronic/digital signature, including Aadhaar e-Sign service to submit the document to the registered intermediary.

xii. In case of non-individual clients, intermediaries shall exercise caution and satisfy themselves regarding the genuineness of the authorization and identity of the authorized signatories.

xiii. The electronic/digital signature, including Aadhaar e-Sign shall be accepted in lieu of wet signature on the documents provided by the client. The cropped signature affixed on the online KYC form under electronic/digital signature, including Aadhaar e-Sign shall also be accepted as valid signature.

xiv. Bank details of the client shall be captured online and signed cancelled cheque shall be provided as a photo / scan of the original under electronic/digital signature including Aadhaar e-Sign. Bank account details shall be verified by Penny Drop mechanism or any other mechanism using API of the Bank. The name and bank details as obtained shall be verified with the information provided by client.

The Penny Drop mechanism — a small test credit to confirm the account belongs to the named client.

xv. Completion happens in one of two ways: the client shall take a print out of the completed KYC form and after affixing their wet signature, send the scanned copy / photograph of the same to the registered intermediary under electronic/digital signature including Aadhaar e-Sign, or affix online the cropped signature on the filled KYC form and submit the same... under electronic/digital signature including Aadhaar e-Sign.

And "original seen and verified" is satisfied digitally where the OVD is provided as a clear photograph or scanned copy of the original officially valid document, through the electronic/digital signature including Aadhaar e-Sign, or as digitally signed document of the officially valid document, issued through the DigiLocker by the issuing authority.

Accessibility: in order to ensure accessibility and inclusiveness of Digital KYC to persons with disabilities, SEBI has issued guidelines for intermediaries.

7.2 Features of the online KYC App

SEBI registered intermediary can implement its own App for undertaking online KYC of clients.

The App shall facilitate taking photograph, scanning, acceptance of officially valid document through Digilocker, video capturing in live environment and usage of the App only by authorized person of the intermediary.

And the anti-fraud features: the App shall also have features of random action initiation for client response to establish that the interactions are not pre-recorded along with time stamping and geo-location tagging to ensure the requirement like physical location being in India etc. are also implemented.

Random actions defeat a recording; geo-tagging proves the client is in India.

Quality standards: registered intermediaries shall ensure that the process is a seamless, real-time, secured, end-to-end encrypted audio-visual interaction with the client and the quality of the communication is adequate to allow identification of the client beyond doubt.

Liveliness: registered intermediaries shall carry out the liveliness check in order to guard against spoofing and such other fraudulent manipulations.

Audit: the intermediaries shall, before rolling out and periodically, carry out software and security audit and validation of their App. The intermediaries can have additional safety and security features other than as prescribed above.

7.2.1 In-Person Verification

It shall be mandatory for all the registered intermediaries to carry out IPV of their clients.

What is recorded: the intermediaries shall ensure that the details like name of the person doing IPV, his designation, organization with his signatures and date are recorded on the KYC form at the time of IPV.

And it need not be repeated: the IPV carried out by one SEBI registered intermediary can be relied upon by another intermediary.

Who may perform it. For stock brokers, their Authorised Persons (appointed by the stock brokers after getting approval from the concerned Stock Exchanges) can perform the IPV. For mutual funds, their Asset Management Companies (AMCs) and the distributors who comply with the certification process of National Institute of Securities Market (NISM) or Association of Mutual Funds (AMFI) and have undergone the process of 'Know Your Distributor (KYD)', can perform the IPV.

Additionally, entities registered as Category 1 Execution Only Platform (EOP) can perform the IPV. And in case of applications received by the mutual funds directly from the clients (i.e., not through any distributor), they may also rely upon the IPV performed by the scheduled commercial banks.

Video IPV

To enable ease of completing IPV of an investor, intermediary may undertake the Video in Person Verification (VIPV) of an individual investor through their App. The seven-step process:

a) Intermediary through their authorised official, specifically trained for this purpose, may undertake live VIPV of an individual client, after obtaining his/her informed consent. The activity log along with the credentials of the person performing the VIPV shall be stored for easy retrieval.

b) The VIPV shall be in a live environment.

c) The VIPV shall be clear and still, the client in the video shall be easily recognisable and shall not be covering their face in any manner.

d) The VIPV process shall include random question and response from the investor including displaying the officially valid document, KYC form and signature or could also be confirmed by an OTP.

e) The intermediary shall ensure that photograph of the client downloaded through the Aadhaar authentication / verification process matches with the investor in the VIPV.

f) The VIPV shall be digitally saved in a safe, secure and tamper-proof, easily retrievable manner and shall bear date and time stamping.

g) The intermediary may have additional safety and security features other than as prescribed above.

When IPV is not required

IPV shall not be required in the cases where:

a) the KYC of the client has been completed using the Aadhaar authentication/ verification of UIDAI.

b) the KYC form has been submitted online, documents have been provided through Digilocker or any other source which could be verified online.

7.2.2 KUA and sub-KUA

Registered intermediaries for reasons such as online on-boarding of clients, client convenience, increased efficiency and reduced time for client onboarding would prefer to use Aadhaar based e-KYC facility to complete KYC of the client. The e-KYC service launched by UIDAI shall be accepted as a valid process for KYC verification.

The mechanism: entities notified by the Central Government shall be allowed to undertake Aadhaar Authentication under section 11A of the PMLA. These entities would be registered with UIDAI as KYC user agency (KUA)/sub KYC user Agency (sub-KUA). The KUAs shall allow the SEBI registered intermediaries as sub-KUA to undertake Aadhaar Authentication of their clients for the purpose of KYC.

The nine entities registered as KUAs:

(i) Bombay Stock Exchange Limited (ii) National Securities Depository Limited (iii) Central Depository Services (India) Limited (iv) CDSL Ventures Limited (v) NSDL Database Management Limited (vi) NSE Data and Analytics Limited (vii) CAMS Investor Services Private Limited (viii) Computer Age Management Services Private Limited (ix) National Stock Exchange of India Limited (NSE).

How an intermediary joins: SEBI registered intermediaries who want to undertake Aadhaar authentication services through KUAs, shall enter into an agreement with any one KUA and get themselves registered with UIDAI as Sub-KUAs. The agreement in this regard shall be as prescribed by UIDAI.

One KUA, one agreement, registration as a sub-KUA.

The legal basis is section 11A of the PMLA, and the process follows the circular dated May 09, 2019 of the Department of Revenue (DoR), Ministry of Finance (MoF).

7.3 The SARAL account

For individual clients participating in the cash segment without obtaining various other facilities such as internet trading, margin trading, derivative trading and use of power of attorney, address proof is relaxed:

a. Individual client may submit only one documentary proof of address (either residence/correspondence or permanent) while opening a trading account and / or demat account or while undergoing updation.

One proof, not two.

b. Where that proof is not the current residence, the intermediary may take a declaration of the residence/correspondence address on which all correspondence shall be made... No proof is required to be submitted for such correspondence/residence address. On a change, client may intimate the new address for correspondence to the intermediary within two weeks of such a change, and the address may be verified by the intermediary through 'positive confirmation' such as: i. acknowledgment of receipt Welcome Kit/ dispatch of contract notes / any periodical statement, etc. ii. telephonic conversation; iii. visits, etc.

c. Where the client gives an address other than the OVD address, the registered intermediaries shall forward the KYC completion intimation letter through registered post/ speed post or courier. And on return of that letter for wrong / incorrect address, addressee not available etc., no transactions shall be allowed in such account and intimation shall also sent to the Stock Exchange and Depository.

d. The registered intermediaries and KRAs shall flag such accounts in their records/systems.

7.3.1 Confidentiality

Registered intermediaries shall keep confidential every information maintained, furnished or verified, save as otherwise provided under any law for the time being in force.

7.4 and 7.5 KYC Registration Agencies

A mechanism of Know Your Client Registration Agency (KRAs) in the securities market has been developed for centralization of the KYC records. The KRAs shall be administered under SEBI KYC Registration Agency (KRA) Regulations, 2011.

Guidelines for intermediaries

The client shall be allowed to open an account with intermediaries and transact in securities market as soon as the KYC process is completed.

After doing the initial KYC of the new clients, the intermediary shall forthwith upload the KYC information on the system of the KRA within 3 working days from the date of completion of KYC process.

Three working days.

If documents are incomplete: the KRA shall inform the same to the intermediary who shall forward the required information / documents promptly to KRA.

For existing clients, the KYC data shall be uploaded by the intermediary provided they are in conformity with details sought in the uniform KYC format, and the intermediary shall ensure that there is no duplication of data in the KRA system.

Records may be electronic: the intermediaries shall maintain electronic records of KYCs of clients and keeping physical records would not be necessary.

And two continuing duties: the intermediary shall promptly provide KYC related information to KRA, as and when required. The intermediary shall have adequate internal controls to ensure the security / authenticity of data uploaded by it.

Guidelines for KRAs

KRA system shall provide KYC information in data and image form to the intermediary.

KRA shall send a letter to the client within 2 working days of the receipt of the initial/updated KYC documents from intermediary, confirming the details thereof and maintain the proof of dispatch.

Two working days for the KRA's confirmation letter; three for the intermediary's upload.

KRA(s) shall develop systems, in co-ordination with each other, to prevent duplication of entry of KYC details of a client and to ensure uniformity in formats of uploading / modification / downloading of KYC data by the intermediary.

KRA shall maintain an audit trail of the upload / modifications / downloads made in the KYC data, by the intermediary in its system.

Annual audit: KRA shall ensure that a comprehensive audit of its systems, controls, procedures, safeguards and security of information and documents is carried out annually by an independent auditor. The Audit Report along with the steps taken to rectify the deficiencies, if any, shall be placed before its Board of Directors. Thereafter, the KRA shall send the Action Taken Report to SEBI within 3 months.

And PAN exemptions must be visible: KRA systems shall clearly indicate the status of clients falling under PAN exempt categories viz. investors residing in the state of Sikkim, UN entities / multilateral agencies exempt from paying taxes / filing tax returns in India, etc.

With effective implementation of SEBI guidelines for KYC norms in Securities Market by market intermediaries, SEBI's crucial role in maintaining market integrity, investor confidence, and the orderly functioning of India's financial markets can be duly and efficiently achieved.