SEBI (KYC Registration Agency) Regulations, 2011

What this chapter covers

This chapter carries about 2 per cent of the III-C examination.

LEARNING OBJECTIVES: After studying this chapter, you should know about: Registration of a KYC Registration Agency (KRA) · Functions and obligations of KRA and intermediaries · Code of conduct of KRA · Guidelines for intermediaries, KRA's and in-person verification.

10.1 Why a KRA exists

The provisions of the Prevention of Money Laundering Act, 2002 (PMLA), have made it mandatory for all Intermediaries to comply with the "Know Your Client" (KYC) norms of the applicants desirous of trading / investing / dealing in the securities market.

And the definition: KYC means the procedure prescribed by SEBI for identifying and verifying the proof of address and identity and compliance with rules, regulations, guidelines, and circulars issued by SEBI or any other authority for Prevention of Money Laundering from time to time.

SEBI, on December 1, 2011 has notified the SEBI (KYC Registration Agency) Regulations, 2011. SEBI further issued the guidelines on December 23, 2011 to effectively implement the Regulations.

That is the first review question — the regulations notified to implement the KYC guidelines are the SEBI (KYC Registration Agency) Regulations, 2011.

What the agency does. The SEBI (KYC Registration Agency) Regulations, 2011... provides that the KRA agency be registered with SEBI. The KRA is a centralized agency that will maintain and make available the information provided by a client to an intermediary to comply with the KYC norms.

One agency, many intermediaries. The client completes KYC once; every intermediary he later approaches draws on the same record.

Accessibility. The Hon'ble Supreme Court in its judgement dated April 30, 2025, emphasized the need for equal and accessible inclusion of persons with disabilities for availing financial services and directed to ensure that the process of digital KYC is accessible to persons with disabilities. SEBI is committed to the cause of enabling equal access of services of its registered intermediaries to persons with disabilities, including persons with visual impairments and in order to make the digital KYC process inclusive and accessible.

10.2 Registration as a KRA

SEBI shall consider the application for the grant of a certificate of registration as a KRA from an applicant who is a fit and proper person and who belongs to one of the following categories — provided that any conflict of interest does not exist between the role of the applicant as KRA and other commercial activities of the applicant, its associates and group companies:

(a) A wholly owned subsidiary of a recognized stock exchange, having a nation-wide network of trading terminals, or;

(b) A wholly owned subsidiary of a depository or any other intermediary registered with the Board or;

(c) A wholly owned subsidiary of a Self-Regulatory Organization (SRO) registered under SEBI (Self-Regulatory Organization) Regulations, 2004.

Three categories, and each requires a wholly owned subsidiary — the KRA must be a separate corporate entity, not a department.

And the applicant must also satisfy SEBI on capability: the applicant also has to assure SEBI about the organizational capabilities, technology and systems and safeguards for maintaining data privacy and also measures undertaken for preventing unauthorized data sharing.

Net worth: the applicant should also have a net worth of at least Rs. 25 crores on a continuous basis.

"On a continuous basis" — not merely at the time of application.

Grant of the certificate.

The certificate of registration shall be valid unless it is suspended or cancelled by SEBI.

The grant of certificate of registration shall be subject to the payment of such fees and in such manner as specified in Schedule II of these regulations.

The KRA shall immediately intimate the Board, details of changes that have taken place in the information that was submitted while seeking registration.

Where the KRA proposes change in control, it shall obtain prior approval of the Board for continuing to act as such after the change.

Note the difference — ordinary changes are immediately intimate[d] afterwards; a change in control needs prior approval.

The fees: i. Application Fee (non-refundable) – Rs. 50,000 · ii. Registration Fees – Rs. 1,00,000 · iii. Annual Fees – Rs. 1,00,000.

10.3 Surrender

A KRA who wishes to surrender the certificate of registration must satisfy SEBI about the factors, as it may deem fit, including but not limited to the following:

Arrangements made by KRA for maintenance and preservation of records and other documents required to be maintained under these regulations · redressal of investor grievances · transfer of records of its clients · arrangements made by it for ensuring continuity of service to the clients · defaults or pending action, if any.

Five factors, the same list that governs an intermediary's surrender under the Intermediaries Regulations.

On and from the date of the surrender or cancellation of the certificate, the KRA shall-

return the certificate of registration which has been cancelled, to SEBI and shall not represent itself to be a holder of the certificate for carrying out the activity for which such certificate had been granted;

cease to carry on any activity in respect of which the certificate had been granted;

transfer its activities to another entity holding a valid certificate of registration to carry on such activity and allow its clients to withdraw any assignment given to it, without any additional cost to such client;

make provisions as regards liability incurred or assumed by it;

take such other action including the action relating to any records or documents that may be in custody or control of such person, within the time period and in the manner, as may be required under these regulations, or as may be directed by SEBI.

Note "without any additional cost to such client" — the client does not pay for the agency's exit.

10.4 Functions and obligations

The KRA shall obtain the KYC documents of the client from the intermediary. The documents shall be as prescribed by SEBI and in terms of the rules, regulations, guidelines and circulars issued by SEBI or any other authority for Prevention of Money Laundering, from time to time.

10.4.1 The KRA

a) Prepare the Operating Instructions in co-ordination with other KRA(s) and issue the same to implement the requirements of these regulations.

b) Have electronic connectivity with other KRAs in order to establish interoperability among KRAs.

And interoperability is defined: inter-operability means the ability of the KRA to determine whether the KYC documents of the client are in the custody of another KRA.

c) Have a secure data transmission link with other KRA(s) and with each intermediary that uploads the KYC documents on its system and relies upon its data.

That is the second review question — links with both other KRAs and intermediaries.

d) Be responsible for storing, safeguarding and retrieving the KYC documents and submit to SEBI or any other statutory authority as and when required.

e) KRA shall carry out an independent validation of the KYC records uploaded onto its system by the intermediary in such a manner as specified by the Board from time to time.

f) Retain the KYC documents of the client, in electronic form for the period specified by rules made under the Prevention of Money Laundering Act, 2002, as well as ensuring that retrieval of KYC information is facilitated within the stipulated time period.

g) Any information updated about a client shall be disseminated by KRA to all intermediaries that avail of the services of the KRA in respect of that client.

One update, every intermediary informed — which is the point of a central agency.

i) Ensure that the integrity of the automatic data processing systems for electronic records is maintained at all times.

j) Take all precautions necessary to ensure that the KYC documents/records are not lost, destroyed or tampered with and that sufficient backup of electronic records is available at all times at a different place.

"At a different place" — the backup must be geographically separate.

k) Have adequate mechanisms for the purposes of reviewing, monitoring and evaluating its controls, systems, procedures and safeguards.

l) Cause an audit of its controls, systems, procedures and safeguards to be carried out periodically and take corrective actions for deficiencies, if any and report to SEBI.

m) Take all reasonable measures to prevent unauthorized access to its database and have audit of its systems and procedures at regular intervals as specified by the SEBI from time to time.

n) Have checks built in its system so that an intermediary can access the information only for the clients who approach him.

Limb (n) is the privacy safeguard. A central database of every investor's KYC would be dangerous if any intermediary could browse it; access is confined to the clients who approach him.

o) Appoint a compliance officer who shall be responsible for monitoring the compliance of the Act, rules and regulations, notifications, guidelines, instructions, etc., issued by SEBI or the Central Government and for redressal of client's grievances. The compliance officer shall immediately and independently report to SEBI any non-compliance observed by him.

"Immediately and independently" — the compliance officer reports to SEBI directly, without waiting for management.

p) Send a letter to each client after receipt of the KYC documents from the intermediary, confirming the client's details thereof.

q) Take adequate steps for the redressal of the grievances of the clients within one month of the date of receipt of the complaint and keep the client and SEBI informed about the number, nature and other particulars of the complaints from such investors. KRAs are also required to develop the monitoring mechanism through internal audits and inspections and encourage investors to use SCORES for lodging their grievances.

One month for grievances.

r) KRA shall maintain an audit trail of any upload/ modification /download regarding the KYC records of each client.

s) The KRA shall ensure compliance with the Investor Charter specified by the Board from time to time.

t) All the registered KRAs shall take necessary steps to bring the Investor Charter, by way of: a) disseminating the Investor Charter on their websites / through e-mail; b) displaying the Investor charter at prominent places in offices etc.

10.4.2 The intermediary

a) The intermediary shall perform the initial KYC/due diligence of the client, upload the KYC information with proper authentication on the system of the KRA, furnish the scanned images of the KYC documents to the KRA, and retain the physical KYC documents.

One exception for mutual funds: in the case of clients of a mutual fund, the Registrar to an Issue and Share Transfer Agent appointed by the mutual fund may perform the initial KYC/due diligence of the client, upload the KYC information with proper authentication on the system of the KRA, and furnish the scanned images of KYC documents to the KRA.

b) The intermediary or the mutual fund, as the case may be, shall furnish the physical KYC documents or authenticated copies thereof to the KRA, whenever so desired by the KRA.

c) When the client approaches another intermediary subsequently, the intermediary shall verify and download the client's details from the system of KRA. And upon receipt of the information on the change in KYC details and status of the clients by the intermediary or when it comes to the knowledge of the intermediary, at any stage, the intermediary shall be responsible for uploading the updated information on the system of KRA and retaining the physical documents.

So the intermediary who learns of a change must upload it — whether or not it was the one that did the original KYC.

d) An intermediary shall not use the KYC data of a client obtained from the KRA for purposes other than it is meant for; nor shall it make any commercial gain by sharing the same with any third party including its affiliates or associates.

Not even with affiliates or associates.

e) The intermediary shall have the ultimate responsibility for the KYC of its clients, by undertaking enhanced KYC measures commensurate with the risk profile of its clients.

This is the most important sentence in the chapter. The KRA is a repository; the ultimate responsibility stays with the intermediary. Downloading a record from the KRA does not discharge it.

f) The intermediary shall integrate its systems with the KRA to facilitate seamless movement of KYC documents to and from the intermediary to the KRA.

10.5 The code of conduct for a KRA

Twenty clauses.

1. A KRA shall make all efforts to protect the interest of its clients.

2. It should maintain high standards of integrity, dignity and fairness in the conduct of its business and fulfil its obligations in a prompt, ethical and professional manner.

3. A KRA shall at all times exercise due diligence, ensure proper care and exercise independent professional judgment. It should ensure that any change in registration status/any penal action taken by SEBI or any material change in a financial position that may adversely affect the interests of clients is promptly displayed on its website.

4. A KRA shall not divulge to anybody either orally or in writing, directly or indirectly, any confidential information about the clients which has come to its knowledge, without taking prior permission of its clients, except where such disclosures are required to be made in compliance with any law for the time being in force.

5. A KRA shall not indulge in any unfair competition. It shall display on its website adequate and appropriate information about its business, including contact details of persons and services available to clients.

6. All investor grievances should be redressed in a timely and appropriate manner. A KRA shall make reasonable efforts to avoid misrepresentation and ensure that the information provided to the clients and intermediaries is not misleading.

7. A KRA shall abide by the provisions of the Act and the rules, regulations issued by the Government and SEBI... It shall not make an untrue statement or suppress any material fact in any documents, reports, papers or information furnished to SEBI.

8. A KRA shall ensure that SEBI is promptly informed about any action, legal proceeding, etc., initiated against it in respect of any material breach or non-compliance by it, of any law, rules, regulations and directions of SEBI or any other regulatory body.

9. (a) A KRA or any of his employees shall not render, directly or indirectly, any investment advice about any security in the publicly accessible media; (b) A KRA shall not make a recommendation to any client who might be expected to rely thereon to acquire, dispose of or retain any securities.

A KRA holds identity records, not investment views — clause 9 keeps the two apart.

10. A KRA shall ensure that any person it employs or appoints to conduct business is fit and proper and otherwise qualified to act, in the capacity so employed or appointed including having relevant professional training or experience.

11. A KRA shall have internal control procedures and financial and operational capabilities which can be reasonably expected to protect its operations, its clients from financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions. The KRA shall be responsible for the acts or omissions of its employees with respect to the conduct of its business.

12. A KRA shall provide adequate freedom and powers to its compliance officer for the effective discharge of its duties.

13. A KRA shall ensure that the senior management, particularly decision-makers have access to all relevant information about the business on a timely basis.

14. A KRA shall ensure that good corporate policies and corporate governance are in place.

15. A KRA should have adequately trained staff and arrangements to render fair, prompt and competent services to its clients.

16. A KRA shall develop its own internal code of conduct for governing its internal operations and laying down its standards of appropriate conduct for its employees and officers in the carrying out of their duties. Such a code may extend to the maintenance of professional excellence and standards, integrity, confidentiality, objectivity, avoidance of conflict of interests, disclosure of shareholdings and interests, etc.

17. KRA shall not be a party to (a) creation of false market; (b) price rigging or manipulation; (c) passing of unpublished price sensitive information in respect of securities which are listed and proposed to be listed in any stock exchange to any person or intermediary.

18. A KRA shall maintain a proper inward and outward system for all types of mail received and dispatched in all forms.

19. A KRA shall follow the maker-checker concept in its activities to ensure the accuracy of data.

The maker-checker principle — one person enters, a second verifies. Clause 19 writes it into the code.

20. A KRA shall not indulge in manipulative, fraudulent practices in the process of identification, verification and updation of a Client's KYC information with a view to distorting market equilibrium or making personal gains.

10.6 Guidelines

For intermediaries

i. Once the initial KYC of the new clients are done, the intermediary shall immediately upload the KYC information on the system of the KRA and send the KYC documents (KYC application form and supporting documents of the clients) to the KRA within 10 working days from the date of execution of documents by the client and maintain the proof of dispatch.

Ten working days from the date of execution of documents — the third review question.

Note the two limbs. The information is uploaded immediately; the documents follow within 10 working days.

ii. In case a client's KYC documents which have been sent to KRA is incomplete, the same shall be communicated to the intermediary who shall forward the required information / documents promptly to KRA.

iii. While uploading the clients' data the intermediary shall ensure that there is no duplication of data in the KRA system.

iv. The intermediary shall carry out KYC when the client chooses to trade/ invest / deal through it.

v. The intermediary is also required to follow the risk-based due diligence approach. Also, they are required to conduct ongoing client due diligence based on the risk profile and financial position of the clients as prescribed by SEBI.

vi. The intermediaries shall also maintain electronic records of KYCs of clients and keeping physical records would not be necessary. It shall promptly provide KYC related information to KRA, as and when required.

vii. The intermediary shall have adequate internal controls to ensure the security /authenticity of data uploaded by it.

For KRAs

i. KRA system shall provide KYC information in data and image form to the intermediary.

ii. KRA shall send a letter to the client within 10 working days of the receipt of the initial/updated KYC documents from intermediary, confirming the details thereof and maintain the proof of dispatch.

Ten working days again — this time for the KRA's confirmation letter to the client.

iii. KRA(s) shall develop systems, in coordination with each other, to prevent duplication of entry of KYC details of a client and to ensure uniformity in formats of uploading / modification / downloading of KYC data by the intermediary.

iv. KRA shall maintain an audit trail of the upload / modifications / downloads made in the KYC data, by the intermediary in its system.

v. KRA shall ensure that a comprehensive audit of its systems, controls, procedures, safeguards and security of information and documents is carried out annually by an independent auditor. The Audit Report along with the steps taken to rectify the deficiencies, if any, shall be placed before its Board of Directors. Thereafter, the KRA shall send the Action Taken Report to SEBI within 3 months.

Annually, by an independent auditor, to the Board, then to SEBI within 3 months.

vi. KRA systems shall clearly indicate the status of clients falling under PAN exempt categories.

That is the fourth review question — True.

vii. A client can start trading/investing/dealing with the intermediary and its group/subsidiary/holding company as soon as the initial KYC is done and other necessary information is obtained. The remaining process of KRA can still be in progress at that time.

The client is not held up by the back office. Once initial KYC is done, trading may begin even while the KRA process continues.

viii. KRA is also required to follow the risk-based due diligence approach. Also, they are required to conduct ongoing client due diligence based on the risk profile and financial position of the clients as prescribed by SEBI.

The 2022 amendment

SEBI KRA Regulations, 2011, has been amended on January 28, 2022 vide a Gazette Notification No. SEBI/LAD-NRO/GN/2022/72. The additional guidelines include:

KRAs shall continue to act as repository of KYC data in the securities market and shall be responsible for storing, safeguarding and retrieving the KYC documents and submit to the Board or any other statutory authority as and when required.

KRAs shall independently validate records of those clients (existing as well as new) whose KYC has been completed using Aadhaar as an OVD. The records of those clients who have completed KYC using non-Aadhaar OVD shall be validated only upon receiving the Aadhaar Number.

During the process of validation, KRAs shall validate the following details:

a. Aadhaar through Unique Identification Authority of India (UIDAI) authentication/verification mechanism.

b. Mobile number and e-mail ID using OTP validation (only in cases where mobile number and e-mail ID provided by client are not seeded with Aadhaar)

c. PAN using the Income Tax Database.

Three validations — Aadhaar through UIDAI, mobile and email by OTP where not seeded with Aadhaar, and PAN against the Income Tax Database.

In-person verification

To bring uniformity in the KYC procedure across intermediaries, the IPV requirements for all the intermediaries have been streamlined by SEBI. Intermediaries registered with SEBI as Stock Brokers, KRAs, Depository Participants, Mutual Funds, Portfolio Managers, Venture Capital Funds and Collective Investment Schemes need to mandatorily carry out IPV for all their clients.

The intermediary has to ensure that the details of the person carrying out the IPV are recorded on the KYC form at the time of IPV.

The IPV carried out by one SEBI registered intermediary shall be relied upon by another intermediary. For Stock Brokers, their Authorised persons may perform the IPV.

One IPV serves all — that is the efficiency the KRA framework is built to deliver.

Two decided matters

Case 10.1: SEBI vs Tradebulls Securities — Rs 10,00,000. SEBI inspected the KYC procedures of M/s. Tradebulls Securities (P) Ltd. (TSL) on May 28-29, 2013, taking a sample check of 17 KYCs carried out at the TSL's Registered Office in Ahmedabad.

Six findings.

Old forms. There was substantial delay by the TSL in implementing the SEBI Circular No. CIR/MIRSD/16/2011 dated August 22, 2011 on KYC. The Inspection has alleged that the TSL continued with old KYC forms till March 01, 2012, which were supposed to be discontinued with effect from September 22, 2011.

Late uploads. Against the requirement to upload forthwith and send documents within 10 working days from the date of execution of documents by the client, the inspection found on the back-office data for the period from March 2013 to May 2013... that the delay in uploading KYC forms in 172 cases was in the range of 14 to 253 days.

Existing clients not uploaded at all. The TSL had delayed implementation of the said SEBI Circular dated April 13, 2012, and till the date of inspection had not uploaded KYC documents as required.

A form altered. Where the circular specified the format wherein the client has to sign against each market segment in which he/she wishes to trade-in, TSL had added another column of check box... along with the signature of the client, and in certain cases, the clients had signed against all market segments. The practice was not found by the Inspection to be in line with the intent of the said SEBI Circular.

Signatures everywhere, nominations nowhere. In certain cases, the client had signed at all places (individual/ non-individual/ declaration by HUF/ sole proprietorship, company etc) in KYC form, even which may not be applicable to him. And in a majority of cases among sample size, there was a tick in the box that client had opted for not nominating anyone — which may apparently have happened as a client would have signed the nomination form, whereas the box for not nominating anyone would have been ticked later.

IPV details missing. Against the requirement that the details of name of the person doing in-person verification (IPV), his/ her designation, organization with signature and date be recorded on the KYC format at the time of In-Person Verification, the inspection found that though the official conducting IPV had signed the document, however, the name, designation and other details of the official carrying out IPV were not recorded.

The conclusion: TSL has failed to adhere to the prescribed code of conduct in respect of the high standard of integrity, promptitude, fairness, due skill, care and diligence, and thereby did not abide by the Act, rules and regulations in term of Regulation 7 read with clauses A (1), A (2) and A (5) of code of conduct for stockbrokers, specified under Schedule II of Brokers Regulations.

The penalty provision: 15HB. Penalty for contravention where no separate penalty has been provided - Whoever fails to comply with any provision of this Act, the rules or the regulations made or directions issued by the Board thereunder for which no separate penalty has been provided, shall be liable to a penalty which may extend to one crore rupees.

The order: a penalty of Rs. 10,00,000/- (Rupees Ten Lakh only) against M/s. Tradebulls Securities Private Limited under Section 15HB of the SEBI Act, 1992.

Case 10.2: SEBI vs Aadinath Securities — Rs 1 lakh. During inspection it was noted that the firm has not uploaded details of its client KYC as stipulated by SEBI in the KRA circular. It claimed it has subsequently complied with the requirements and subsequent inspections conducted (Post Jan 2016) had no adverse findings pertaining to KYC and KRA indicating implementation of corrective action.

But the delay was fatal. In this case admittedly, notice has complied the compliance of the requirements of circulars dated December 23, 2011 and April 13, 2012 in this regard belatedly in December 2015 i.e., much beyond the permissible time. The reason shown by Aadinath Securities is not plausible and Aadinath Securities cannot be exonerated for such inordinate delay.

And the reasoning on why timelines matter: uniform KYC and uploading of information on the KRA portal are meant to protect the integrity of the securities market and to implement anti money laundering measures. The timelines stipulated therein are of the essence and cannot be ignored for such a long period as found in this case. The lapse of Aadinath Securities being a registered stockbroker clearly shows a lack of due diligence and care on its part. Lapse in this case with regard to non-compliance with these circulars are not venial and would attract penalty action in accordance with law.

"Not venial" — not trivial, not excusable.

The order: monetary penalty of Rs 1 lakh on Aadinath Securities under section 15HB of SEBI Act, 1992.

The chapter's review questions confirm that the regulations notified to implement KYC are the SEBI (KYC Registration Agency) Regulations, 2011; that the KRA must have secure data transmission links with both other KRAs and intermediaries; that KYC documents go to the KRA within 10 working days; and that KRA systems shall clearly indicate the status of clients falling under PAN exempt categories — True.