Covers RBI-regulated banks, payment system providers and other regulated entities.

The main requirements are to maintain customer acceptance, identity verification, beneficial ownership, risk classification, ongoing due diligence, sanctions screening and record-retention controls.

Customer due diligence builds a reliable picture of the person or organisation receiving a financial service. Collecting a name is different from verifying identity, and identifying a company's registered owner is different from understanding its ultimate beneficial owners or controllers. The purpose and expected use of the relationship provide context for assessing later transactions.

Risk-based treatment changes the depth and frequency of the work. Higher-risk circumstances can require additional information or enhanced review, while any simplified approach remains subject to the conditions of the governing framework. Customer information also changes over time: ownership, representatives, business activity and expected payment patterns can all affect the original assessment.

The operational outcome is a documented relationship between identity evidence, the risk decision and ongoing monitoring. Onboarding should feed the transaction-review process, and unusual activity should feed back into the customer assessment. Due diligence is therefore an ongoing information and decision-making process, rather than a one-time collection of documents or a name-screening result.

The instrument also addresses reporting and evidence: maintain KYC and transaction records and report prescribed suspicious or threshold transactions to FIU-IND.