Rationalisation of KYC- Measures for relief or technical advancement?

-Kanakprabha Jethani and Anita Baid (finserv@vinodkothari.com)

Background

Considering the resurgence of the Covid-19 pandemic on the economy, the RBI Governor, on May 5, 2021, announced several measures with a view to infuse liquidity in the economy, avoid another wave of borrower defaults^[1] as well as aid in ease of business during the lockdown.

Out of the several measures announced by the Governor, one was to simplify the KYC process, which is the initial step of any lending transaction. Some of the amendments seem to provide immediate relief from compliance requirements and some are intended to encourage carrying out KYC compliances electronically, given the social distancing norms.

In this regard, the RBI has issued the following notifications:

1. Periodic Updation of KYC – Restrictions on Account Operations for Non-compliance dated May 5, 2021^[2]
2. Amendment to the Master Direction (MD) on KYC dated May 10, 2021^[3]

In this article we intend to discuss the prima facie implications of the amendments introduced by the aforesaid notifications.

Rationalisation of V-CIP

Extension of the Scope

The RBI, in January 2020, had introduced the concept of Video based Customer Identification Process (V-CIP), which is a real-time virtual and interactive mode of Customer Due Diligence (CDD), specifically for individuals. The RBI has revised the definition of V-CIP as follows:

“Video based Customer Identification Process (V-CIP) is an alternate method of customer identification with facial recognition and customer due diligence by an authorised official of the RE by undertaking seamless, secure, live, informed-consent based audio-visual interaction with the customer to obtain identification information required for CDD purpose, and to ascertain the veracity of the information furnished by the customer through independent verification and maintaining audit trail of the process. Such processes complying with prescribed standards and procedures shall be treated on par with face-to-face CIP for the purpose of this Master Direction.” [Emphasis provided]

The amendment in the definition of V-CIP clearly recognises it as an alternate method for customer identification and customer due diligence. Further, the scope of V-CIP has also been extended to include other categories of customers such as proprietorship firms, authorised signatories and beneficial owners of Legal Entities. Further, V-CIP has also been allowed to be used for periodic updation of KYC. The revised provisions of para 18 states as follows:

REs may undertake V-CIP to carry out:

1. CDD in case of new customer on-boarding for individual customers, proprietor in case of proprietorship firm, authorised signatories and Beneficial Owners (BOs) in case of Legal Entity (LE) customers.
   Provided that in case of CDD of a proprietorship firm, REs shall also obtain the equivalent e-document of the activity proofs with respect to the proprietorship firm, as mentioned in Section 28, apart from undertaking CDD of the proprietor.
2. Conversion of existing accounts opened in non-face to face mode using Aadhaar OTP based e-KYC authentication as per Section 17.
3. Updation/Periodic updation of KYC for eligible customers.

In case of persons other than individuals, KYC of the entity as well as the Beneficial Owner (individual) is required to be carried out. Prior to the aforesaid amendments, though there were no explicit provisions, a view could be taken that KYC of beneficial owners/authorised representatives of entities, being individual customers, could be done through the V-CIP process. Post the amendment the same has explicitly been permitted for proprietors in case of proprietorship firms, authorised signatories and BOs in case of Legal Entity (LE).  However, additionally verification of business related KYC documents of the entity can be done only through other modes of KYC.

While the V-CIP for authorised signatories and BOs can be carried out through the V-CIP process, the question on verification of additional documents relating to the business of the entity (for which equivalent e-documents are not available) still lingers.

The V-CIP process could also be used for conversion of existing accounts opened in non-face to face mode using Aadhaar OTP based e-KYC authentication into full KYC compliant accounts.

Further, periodic updation was earlier allowed to be done as per para 16 of the KYC Directions only. On a strict reading of the KYC Directions, one may contend that V-CIP was not allowed to be used for periodic updation. However since V-CIP was allowed for conducting CDD itself, one could have taken the view that there is no reason for not allowing the same for periodic updation. The amendments in this regard, clear out the fog of ambiguity.

Minimum standards of V-CIP

The minimum standards required for carrying out KYC through the V-CIP process have been replaced and divided into three aspects- V-CIP Infrastructure, V-CIP Procedure and V-CIP Records and Data Management. Most of the points have been retained from the existing KYC Master Directions, however, there are certain additional requirement, such as-

1. Allowing technology related outsourcing in compliance with relevant RBI guidelines.
2. Widened scope for collecting identification information- Apart from OTP based authentication (for banks) and Offline verification of aadhaar, KYC records downloaded from CKYC and Equivalent e-document of OVDs have been included.
3. Prevention of connections from IP addresses outside India.

Enabling the use of KYC Identifier

The V-CIP process provided in the KYC Directions requires REs to carry out aadhaar XML verification, as a part of the V-CIP process^[4]. Accordingly, in case a customer submits a KYC identifier, the REs may download the KYC records of the customer from the CKYCR using such KYC identifier and then verify the same with the documents shown by the customer on video call.

Para 57 (j) of the KYC Directions states that-

“(j) Where a customer, for the purposes of establishing an account based relationship, submits a KYC Identifier to a RE, with an explicit consent to download records from CKYCR, then such RE shall retrieve the KYC records online from the CKYCR using the KYC Identifier and the customer shall not be required to submit the same KYC records or information or any other additional identification documents or details, unless –

• there is a change in the information of the customer as existing in the records of CKYCR;
• the current address of the customer is required to be verified;
• the RE considers it necessary in order to verify the identity or address of the customer, or to perform enhanced due diligence or to build an appropriate risk profile of the client.”

Submission of KYC identifier and matching of the same with details provided by the customer in the loan application form was, in itself, considered to be full-fledged and valid KYC^[5]. However, the amendments seem to be putting into question the earlier practice of REs.

Is combining CKYCR verification with V-CIP may be an additional safeguard in the CDD process or is CKYCR verification not a valid KYC in itself?- The amendments leave us wondering!

Submission of e-documents

The amendments enable the submission of electronic documents (including identity documents issued through DigiLocker) as identity proof. The amendment to the KYC Directions in January 2020 introduced the definition of equivalent e-document, which is as under-

“Equivalent e-document means an electronic equivalent of a document, issued by the issuing authority of such document with its valid digital signature including documents issued to the digital locker account of the customer as per rule 9 of the Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016.”

From the definition, it is clear that only the documents issued by the issuing authority or those uploaded on digilocker using digital verification means shall be valid documents for V-CIP. This announcement clears the ambiguity regarding use of OVDs other than Aadhaar for V-CIP process.

With respect to OVDs whose equivalent e-documents are not available, it seems that REs will still have to depend on other modes of KYC.

OTP Based e-KYC

Prior to the amendments, OTP based e-KYC was considered to be a temporary solution for KYC and banks were required to carry out a full-KYC or CDD process in accordance with the KYC Directions within a period of 1 year.

Further, there were several restrictions on such accounts such as:

• the aggregate balance of all the deposit accounts of the customer to not exceed Rs. 1 lakh.
• the aggregate of all credits in a financial year, in all the deposit accounts of the customer not to exceed Rs. 2 lakhs.
• Only term loans shall be sanctioned, that too not exceeding Rs. 60 thousand in a year.

The amendments allow such OTP based authentication accounts to be converted into fully-KYC compliant by carrying out the V-CIP process, thereby removing all such restrictions. This relaxation is relevant from the perspective of commercial banks, since NBFCs were anyway not allowed to carry out OTP based e-KYC under the KYC Directions.

Periodic Updation Requirements

The Governor, in its statement mentioned about introduction of more customer-friendly options, including the use of digital channels for the purpose of periodic updation of KYC details of customers. Considering the same, amendments have been made under the relevant provisions for periodic updation in the KYC Master Directions.

The earlier distinction in conducting the periodic updation of low risk and high or medium risk customers seems to be replaced by individual and other than individual customers. Irrespective of the risk categorisation, in case there is no change in the KYC information, a self-declaration from the customer (both individual and non-individual) in this regard shall be obtained through customer’s registered email-id.

For individual customers, in case of a change only in the address details of the customer, a self-declaration of the new address shall be obtained from the customer through customer’s registered email-id and the declared address shall be verified through positive confirmation within two months, by means such as address verification letter, contact point verification, deliverables etc. However, for non individual customers, in case of any change in KYC information, RE shall undertake the KYC process equivalent to that applicable for on-boarding a new LE customer.

REs shall adopt a risk-based approach with respect to periodic updation of KYC. Any additional and exceptional measures, which otherwise are not mandated under the KYC Master Directions, may be adopted by the REs in its internal KYC policy such as requirement of obtaining recent photograph, requirement of physical presence of the customer, requirement of periodic updation of KYC only in the branch of the RE where account is maintained, a more frequent periodicity of KYC updation than the minimum specified periodicity etc..

One-time Relief from Periodic Updation

The Governor had announced that for customers whose Periodic Updation is pending, there shall be no punitive action against the REs for not carrying out periodic updation till December 31, 2021. Further, REs have been further advised to not restrict operations of such accounts till December 31, 2021, for non-completion of periodic updation.

This one-time relief may be beneficial for REs which carry out KYC/periodical updation through physical means. For those carrying out KYC/periodic updation through contactless or digital modes, not involving any physical interface with the customer, this relief may hold no meaning at all. For such REs, periodic updation using V-CIP (as discussed above) may be the way.

Conclusion

Currently, a huge chunk of Indian population remains devoid of financing and banking facilities due to lack of knowledge and awareness about the digital means of access to financial services. The Governor’s statement seemed to be a push in the direction of digitisation^[6] of financial services, rather than being measures for improvement.

^[1] Read our detailed write-up on Restructuring 2.0- http://vinodkothari.com/2021/05/rbi-means-to-halt-second-wave-of-borrower-defaults-announces-resfra-2-0/

^[2] https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12083&Mode=0

^[3] https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12089&Mode=0

^[4] Read our write-up detailing the V-CIP process- http://vinodkothari.com/2020/01/kyc-goes-live-rbi-promotes-seamless-real-time-secured-audiovisual-interaction-with-customers/

^[5] Read our write-up on Identity Verification through CKYCR http://vinodkothari.com/2020/02/guide-to-identity-verification-through-ckycr/

^[6] Read our write-up on digital lending- http://vinodkothari.com/2020/03/moving-to-contactless-lending/

Refer our other write-ups relating to KYC: