KYC Identifier

A client should not have to prove who they are twice to the same financial system. The KYC Identifier is how that promise is kept.

It is a unique number or code assigned to a client by the Central KYC Records Registry. The registry issues it after checking that the client does not already have a record. The reporting entity is then told the number, and must pass it on to the client in writing.

After that, the number does the work of the paperwork. A second firm asks the client for the KYC Identifier, or looks it up at the registry. It then downloads the records online. And it must not ask the client for the same documents again.

There are only three reasons to ask again, and they are all about the record being wrong or not enough — never about the second firm preferring its own forms.

Think of it as a locker number rather than a locker. The records live at the registry. The identifier is how you open the right drawer.

The definition (Chapter 3, footnote to Rule 9(1B)). Know Your Client (KYC) Identifier means the unique number or code assigned to a client or customer by the Central Know Your Customer Records Registry.

The life of an identifier, in Rule 9 of the PML Rules.

The three exceptions in Rule 9(1C). A client may be asked for the same records again only where:

1. there is a change in the information of the client as existing in the registry's records;
2. the record or information retrieved is incomplete, or not as per the current applicable KYC norms prescribed by the respective regulator; or
3. the entity considers it necessary to verify identity or address, including current address, under the regulator's guidelines, or to perform enhanced due diligence, or to build an appropriate risk profile of the client.

The IFSC carve-out. Under Rule 9A(1), in an International Financial Services Centre no receiving, storing, safeguarding or retrieving of records is required for a client who is a foreign national. So inside GIFT IFSC the identifier machinery runs for Indian clients and stops at the door for foreign ones.

Illustrative. The clocks and the exceptions are the workbook's.

Ms Leena Rao, a resident Indian, opens an account with Narmada Bank (IFSC Banking Unit) on 3 March 2025.

Three months later, at a second firm. On 20 June she subscribes USD 60,000 to a fund run by Sabarmati Global FME (IFSC). Sabarmati asks for her KYC Identifier, retrieves her records online, and does not ask for the passport and PAN copies again.

Then something changes. She moves house. Sabarmati collects the new address on 1 July and must furnish it to the registry within 7 days — by 8 July. It files on 4 July. The registry updates the record and informs every reporting entity that has dealt with her, so Narmada Bank learns of the change without her telling it, and retrieves the updated record under Rule 9(1H). Because Sabarmati sent the updated information, Sabarmati is now responsible for verifying the authenticity of that address.

Where a fresh demand is allowed. A third firm retrieves her record in August and finds it carries no PAN, which current norms require. That is exception 2 — incomplete or not as per current applicable KYC norms — so it may ask her directly. A fourth firm rates her high risk and needs source-of-wealth evidence for enhanced due diligence. That is exception 3.

Where the machinery stops. In the same week Sabarmati onboards Meridian Capital Pte Ltd, a Singapore client. Full customer due diligence is done, but under Rule 9A(1) no registry filing is required in an IFSC for a foreign national client — so no KYC Identifier is issued, and there is nothing for a later firm to retrieve.

Two clients, one week, one identifier.

Chapter 3 (The Prevention of Money-laundering (Maintenance of Records) Rules, 2005) carries the whole sequence — Rule 9(1A) to 9(1H) with the footnote definition — and Rule 9A(1) with the IFSC carve-out for foreign nationals.

Expect the two clocks as a computation question: 10 days to file the records, 7 days to furnish an update. Expect a "when may a reporting entity ask the client for the same KYC records again?" question, which tests the three Rule 9(1C) exceptions. And expect the carve-out: for a foreign national client of an IFSC unit, the registry obligations do not apply.

• Ten days to file, seven days to update. Two different clocks for two different acts. Filing runs from the commencement of the account-based relationship.
• The identifier is a key, not a record. It is a unique number or code; the KYC records themselves sit with the registry.
• It must be communicated to the client in writing. The registry issues it to the reporting entity, not to the client.
• The no-repeat rule has exactly three exceptions, and "the new firm prefers its own forms" is not one of them. The three are a change in the client's information, an incomplete or outdated record, and a need to verify address, perform enhanced due diligence or build a risk profile.
• Responsibility follows the last touch. Under Rule 9(1E) the entity that did the last verification, or sent the update, answers for its authenticity — not the entity that opened the first account.
• Registry records are restricted. They may be used only to verify identity or address, and may not be passed to any third party without the client's, the Regulator's or the Director's authority. That is a different rule from third-party reliance, which is about taking records in.
• In an IFSC there is no registry obligation for a foreign national client. The carve-out in Rule 9A(1) is about nationality, not about where the unit sits — an Indian client of an IFSC unit is filed like anybody else.
• Do not confuse the KYC Identifier with PAN. In the securities market's KRA system PAN is the identifier; the KYC Identifier is the registry's own number.