SEBI (KYC Registration Agency) Regulations, 2011

What this chapter covers

This chapter carries 2 per cent of the III-A examination.

LEARNING OBJECTIVES: After studying this chapter, you should know about: Registration of a KYC Registration Agency (KRA) · Functions and obligations of KRA and intermediaries · Code of conduct of KRA · Guidelines for intermediaries, KRA's and in-person verification

10.1 Introduction

The provisions of the Prevention of Money Laundering Act, 2002 (PMLA), have made it mandatory for all Intermediaries to comply with the 'Know Your Client' (KYC) norms of the applicants desirous of trading / investing / dealing in the securities market.

KYC means the procedure prescribed by SEBI for identifying and verifying the proof of address and identity and compliance with rules, regulations, guidelines, and circulars issued by SEBI or any other authority for Prevention of Money Laundering from time to time.

SEBI, on December 1, 2011 has notified the SEBI (KYC Registration Agency) Regulations, 2011. SEBI further issued the guidelines on December 23, 2011 to effectively implement the Regulations.

The first review question asks which regulations SEBI notified to implement the KYC guidelines — the SEBI (KYC Registration Agency) Regulations, 2011.

What a KRA is: the KRA is a centralized agency that will maintain and make available the information provided by a client to an intermediary to comply with the KYC norms.

One agency, many intermediaries — the client does his KYC once.

On accessibility: the Hon'ble Supreme Court in its judgement dated April 30, 2025, emphasized the need for equal and accessible inclusion of persons with disabilities for availing financial services and directed to ensure that the process of digital KYC is accessible to persons with disabilities, and SEBI is committed to the cause of enabling equal access of services of its registered intermediaries to persons with disabilities, including persons with visual impairments.

10.2 Registration as a KRA

SEBI shall consider the application... from an applicant who is a fit and proper person and who belongs to one of the following categories... provided that any conflict of interest does not exist between the role of the applicant as KRA and other commercial activities of the applicant, its associates and group companies:

(a) A wholly owned subsidiary of a recognized stock exchange, having a nation-wide network of trading terminals, or;

(b) A wholly owned subsidiary of a depository or any other intermediary registered with the Board or;

(c) A wholly owned subsidiary of a Self-Regulatory Organization (SRO) registered under SEBI (Self-Regulatory Organization) Regulations, 2004.

Three categories, all wholly owned subsidiaries — and note the conflict of interest bar, which extends to associates and group companies.

The applicant also has to assure SEBI about the organizational capabilities, technology and systems and safeguards for maintaining data privacy and also measures undertaken for preventing unauthorized data sharing. Further, the applicant should also have a net worth of at least Rs. 25 crores on a continuous basis.

Rs. 25 crore, continuously.

On the certificate:

The certificate of registration shall be valid unless it is suspended or cancelled by SEBI.

The grant of certificate of registration shall be subject to the payment of such fees and in such manner as specified in Schedule II.

The KRA shall immediately intimate the Board, details of changes that have taken place in the information that was submitted while seeking registration.

Where the KRA proposes change in control, it shall obtain prior approval of the Board for continuing to act as such after the change.

Prior approval for a change in control; immediate intimation for other changes.

The fees: Application Fee (non-refundable) – Rs. 50,000 · Registration Fees – Rs. 1,00,000 · Annual Fees – Rs. 1,00,000.

10.3 Surrender

A KRA who wishes to surrender the certificate of registration must satisfy SEBI about the factors, as it may deem fit, including but not limited to the following:

Arrangements made by KRA for maintenance and preservation of records and other documents · redressal of investor grievances · transfer of records of its clients · arrangements made by it for ensuring continuity of service to the clients · defaults or pending action, if any.

Five questions, the same five the Intermediaries Regulations ask.

On and from the date of the surrender or cancellation of the certificate, the KRA shall:

return the certificate of registration which has been cancelled, to SEBI and shall not represent itself to be a holder of the certificate · cease to carry on any activity in respect of which the certificate had been granted · transfer its activities to another entity holding a valid certificate of registration to carry on such activity and allow its clients to withdraw any assignment given to it, without any additional cost to such client · make provisions as regards liability incurred or assumed by it · and take such other action including the action relating to any records or documents that may be in custody or control of such person.

"Without any additional cost to such client" — the client does not pay for the KRA's exit.

10.4 Functions and obligations

The KRA shall obtain the KYC documents of the client from the intermediary.

The KRA's functions

a) Prepare the Operating Instructions in co-ordination with other KRA(s)

b) Have electronic connectivity with other KRAs in order to establish interoperability among KRAs — inter-operability means the ability of the KRA to determine whether the KYC documents of the client are in the custody of another KRA.

c) Have a secure data transmission link with other KRA(s) and with each intermediary that uploads the KYC documents on its system and relies upon its data.

The second review question follows — the secure links run to both other KRAs and intermediaries.

d) Be responsible for storing, safeguarding and retrieving the KYC documents and submit to SEBI or any other statutory authority as and when required.

e) KRA shall carry out an independent validation of the KYC records uploaded onto its system by the intermediary.

f) Retain the KYC documents of the client, in electronic form for the period specified by rules made under the Prevention of Money Laundering Act, 2002... as well as ensuring that retrieval of KYC information is facilitated within the stipulated time period.

g) Any information updated about a client shall be disseminated by KRA to all intermediaries that avail of the services of the KRA in respect of that client.

One update reaches every intermediary the client uses.

h) Ensure that the integrity of the automatic data processing systems for electronic records is maintained at all times.

i) Take all precautions necessary to ensure that the KYC documents/records are not lost, destroyed or tampered with and that sufficient backup of electronic records is available at all times at a different place.

Backup at a different place — geographic separation, not merely a second copy.

j) Have adequate mechanisms for the purposes of reviewing, monitoring and evaluating its controls, systems, procedures and safeguards.

k) Cause an audit... to be carried out periodically and take corrective actions for deficiencies, if any and report to SEBI.

l) Take all reasonable measures to prevent unauthorized access to its database.

m) Have checks built in its system so that an intermediary can access the information only for the clients who approach him.

An intermediary cannot browse the database — only the records of clients who come to it.

n) Appoint a compliance officer who shall be responsible for monitoring the compliance of the Act, rules and regulations... and for redressal of client's grievances. The compliance officer shall immediately and independently report to SEBI any non-compliance observed by him.

o) Send a letter to each client after receipt of the KYC documents from the intermediary, confirming the client's details thereof.

p) Take adequate steps for the redressal of the grievances of the clients within one month of the date of receipt of the complaint and keep the client and SEBI informed; KRAs must also develop the monitoring mechanism through internal audits and inspections and encourage investors to use SCORES for lodging their grievances.

q) KRA shall maintain an audit trail of any upload/ modification /download regarding the KYC records of each client.

r) The KRA shall ensure compliance with the Investor Charter specified by the Board, and s) bring it to notice by disseminating the Investor Charter on their websites / through e-mail and displaying the Investor charter at prominent places in offices.

The intermediary's obligations

a) The intermediary shall perform the initial KYC/due diligence of the client, upload the KYC information with proper authentication on the system of the KRA, furnish the scanned images of the KYC documents to the KRA, and retain the physical KYC documents — with a proviso allowing a mutual fund's Registrar to an Issue and Share Transfer Agent to do the initial KYC and upload.

b) The intermediary or the mutual fund... shall furnish the physical KYC documents or authenticated copies thereof to the KRA, whenever so desired by the KRA.

c) When the client approaches another intermediary subsequently, the intermediary shall verify and download the client's details from the system of KRA — and on learning of any change, shall be responsible for uploading the updated information on the system of KRA and retaining the physical documents.

d) An intermediary shall not use the KYC data of a client obtained from the KRA for purposes other than it is meant for; nor shall it make any commercial gain by sharing the same with any third party including its affiliates or associates.

Not even affiliates.

e) The intermediary shall have the ultimate responsibility for the KYC of its clients, by undertaking enhanced KYC measures commensurate with the risk profile of its clients.

The KRA is a repository; responsibility stays with the intermediary.

f) The intermediary shall integrate its systems with the KRA to facilitate seamless movement of KYC documents.

10.5 Code of conduct — twenty clauses

A KRA shall make all efforts to protect the interest of its clients · maintain high standards of integrity, dignity and fairness... and fulfil its obligations in a prompt, ethical and professional manner · exercise due diligence, ensure proper care and exercise independent professional judgment, promptly displaying on its website any change in registration status/any penal action taken by SEBI or any material change in a financial position that may adversely affect the interests of clients.

Confidentiality: a KRA shall not divulge to anybody either orally or in writing, directly or indirectly, any confidential information about the clients... without taking prior permission of its clients, except where such disclosures are required to be made in compliance with any law for the time being in force.

Fair competition and disclosure: no unfair competition, and it shall display on its website adequate and appropriate information about its business, including contact details of persons and services available to clients.

Grievances redressed in a timely and appropriate manner, with reasonable efforts to avoid misrepresentation.

Compliance and candour: abide by the Act and regulations, and shall not make an untrue statement or suppress any material fact in any documents, reports, papers or information furnished to SEBI; and ensure SEBI is promptly informed about any action, legal proceeding, etc., initiated against it in respect of any material breach or non-compliance.

No advice: a KRA or any of his employees shall not render, directly or indirectly, any investment advice about any security in the publicly accessible media, nor make a recommendation to any client who might be expected to rely thereon to acquire, dispose of or retain any securities.

People and controls: employees must be fit and proper and otherwise qualified to act... including having relevant professional training or experience; there must be internal control procedures and financial and operational capabilities which can be reasonably expected to protect its operations, its clients from financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions; and the KRA shall be responsible for the acts or omissions of its employees.

Governance: adequate freedom and powers to its compliance officer · senior management, particularly decision-makers have access to all relevant information about the business on a timely basis · good corporate policies and corporate governance are in place · adequately trained staff · and its own internal code of conduct, which may cover professional excellence and standards, integrity, confidentiality, objectivity, avoidance of conflict of interests, disclosure of shareholdings and interests.

Market conduct: a KRA shall not be party to (a) creation of false market; (b) price rigging or manipulation; (c) passing of unpublished price sensitive information.

Operational discipline: a proper inward and outward system for all types of mail received and dispatched in all forms · the maker-checker concept in its activities to ensure the accuracy of data · and no manipulative, fraudulent practices in the process of identification, verification and updation of a Client's KYC information with a view to distorting market equilibrium or making personal gains.

10.6 Operating guidelines

For intermediaries

Once the initial KYC of the new clients are done, the intermediary shall immediately upload the KYC information on the system of the KRA and send the KYC documents (KYC application form and supporting documents of the clients) to the KRA within 10 working days from the date of execution of documents by the client and maintain the proof of dispatch.

The third review question — 10 working days.

Where documents are incomplete, that shall be communicated to the intermediary who shall forward the required information / documents promptly to KRA.

No duplication: while uploading the clients' data the intermediary shall ensure that there is no duplication of data in the KRA system.

When KYC is done: the intermediary shall carry out KYC when the client chooses to trade/ invest / deal through it.

Risk-based approach: intermediaries must follow the risk-based due diligence approach and conduct ongoing client due diligence based on the risk profile and financial position of the clients.

Electronic records suffice: the intermediaries shall also maintain electronic records of KYCs of clients and keeping physical records would not be necessary. It shall promptly provide KYC related information to KRA, as and when required.

And internal controls to ensure the security /authenticity of data uploaded by it.

For KRAs

KRA system shall provide KYC information in data and image form to the intermediary.

KRA shall send a letter to the client within 10 working days of the receipt of the initial/updated KYC documents from intermediary, confirming the details thereof and maintain the proof of dispatch.

Ten working days each way — the intermediary to upload, the KRA to confirm.

KRA(s) shall develop systems, in coordination with each other, to prevent duplication of entry of KYC details of a client and to ensure uniformity in formats.

KRA shall maintain an audit trail of the upload / modifications / downloads made in the KYC data.

The annual audit: KRA shall ensure that a comprehensive audit of its systems, controls, procedures, safeguards and security of information and documents is carried out annually by an independent auditor. The Audit Report along with the steps taken to rectify the deficiencies, if any, shall be placed before its Board of Directors. Thereafter, the KRA shall send the Action Taken Report to SEBI within 3 months.

Annual, independent, to the board, then to SEBI within three months.

KRA systems shall clearly indicate the status of clients falling under PAN exempt categories.

The fourth review question — True.

And an important practical rule: a client can start trading/investing/dealing with the intermediary and its group/subsidiary/holding company as soon as the initial KYC is done and other necessary information is obtained. The remaining process of KRA can still be in progress at that time.

The KRA process does not hold up the client.

**KRAs too must follow the risk-based due diligence approach and conduct ongoing client due diligence based on the risk profile and financial position of the clients.

The 2022 amendment and validation

SEBI KRA Regulations, 2011, has been amended on January 28, 2022 vide a Gazette Notification No. SEBI/LAD-NRO/GN/2022/72.

KRAs shall continue to act as repository of KYC data in the securities market and shall be responsible for storing, safeguarding and retrieving the KYC documents.

KRAs shall independently validate records of those clients (existing as well as new) whose KYC has been completed using Aadhaar as an OVD. The records of those clients who have completed KYC using non-Aadhaar OVD shall be validated only upon receiving the Aadhaar Number.

Three things validated: a. Aadhaar through Unique Identification Authority of India (UIDAI) authentication/verification mechanism. b. Mobile number and e-mail ID using OTP validation (only in cases where mobile number and e-mail ID provided by client are not seeded with Aadhaar) c. PAN using the Income Tax Database.

In-person verification

To bring uniformity in the KYC procedure across intermediaries, the IPV requirements for all the intermediaries have been streamlined by SEBI. Intermediaries registered with SEBI as Stock Brokers, KRAs, Depository Participants, Mutual Funds, Portfolio Managers, Venture Capital Funds and Collective Investment Schemes need to mandatorily carry out IPV for all their clients.

Seven categories, and IPV is mandatory for all their clients.

The intermediary has to ensure that the details of the person carrying out the IPV are recorded on the KYC form at the time of IPV. The IPV carried out by one SEBI registered intermediary shall be relied upon by another intermediary. For Stock Brokers, their Authorised persons may perform the IPV.

Done once, relied on by all — the same principle as the KRA record itself.

The cases

Case 10.1 — Tradebulls Securities

An inspection of KYC procedures on May 28-29, 2013 produced six findings.

Old forms: the TSL continued with old KYC forms till March 01, 2012, which were supposed to be discontinued with effect from September 22, 2011.

Late uploads: on the back-office data for March 2013 to May 2013, the delay in uploading KYC forms in 172 cases was in the range of 14 to 253 days — against the requirement to upload within 10 working days from the date of execution of documents by the client.

Existing clients not uploaded at all by the date of inspection.

Form design: a check box had been added beside the signature, and in certain cases, the clients had signed against all market segments — a practice not found by the Inspection to be in line with the intent of the said SEBI Circular.

Signatures everywhere: clients had signed at all places (individual/ non-individual/ declaration by HUF/ sole proprietorship, company etc) in KYC form, even which may not be applicable to him, and in most sampled cases the box for not nominating anyone was ticked — which may apparently have happened as a client would have signed the nomination form, whereas the box for not nominating anyone would have been ticked later.

IPV details missing: though the official conducting IPV had signed the document, however, the name, designation and other details of the official carrying out IPV were not recorded.

The conclusion: TSL failed to adhere to the prescribed code of conduct in respect of the high standard of integrity, promptitude, fairness, due skill, care and diligence.

Penalty: Rs. 10,00,000 under Section 15HB.

Case 10.2 — Aadinath Securities

Aadinath had not uploaded client KYC details as required, and complied belatedly in December 2015 i.e., much beyond the permissible time. Later inspections showed no adverse findings pertaining to KYC and KRA indicating implementation of corrective action.

But delay was still a default: the reason shown by Aadinath Securities is not plausible and Aadinath Securities cannot be exonerated for such inordinate delay.

And the reasoning that matters: uniform KYC and uploading of information on the KRA portal are meant to protect the integrity of the securities market and to implement anti money laundering measures. The timelines stipulated therein are of the essence and cannot be ignored for such a long period as found in this case. The lapse of Aadinath Securities being a registered stockbroker clearly shows a lack of due diligence and care on its part. Lapse in this case with regard to non-compliance with these circulars are not venial and would attract penalty action.

"The timelines... are of the essence" — and not venial, that is, not trivial.

Penalty: Rs 1 lakh under section 15HB.

The chapter's review questions confirm that SEBI notified the SEBI (KYC Registration Agency) Regulations, 2011 to implement the KYC guidelines; that a KRA must have secure data transmission links with both other KRAs and intermediaries; that an intermediary must upload KYC information and send documents to the KRA within 10 working days; and that it is True that KRA systems must clearly indicate the status of clients falling under PAN exempt categories.