Significant challenges remain in building a secure CKYC

India’s regulatory architecture is aligning different processes to simplify the customer experience across the financial sector. At the heart of the transformation is the Central Know Your Customer Registry (CKYC), an information repository established under the Prevention of Money Laundering (PMLA) Rules, 2015.

Managed by the Central Registry of Securitization Asset Reconstruction and Security Interest of India, CKYC aims to create a single digital KYC record for every financial customer, streamlining access to banking, insurance, mutual fund and pension services.

After registration, individuals will receive a unique 14-digit CKYC number, enabling them to seamlessly transact across institutions without requiring repetitive documentation.

CKYC is more than a compliance tool; it represents a move toward interoperable digital infrastructure. It complements India’s broader public digital stack alongside Aadhaar, UPI and DigiLocker by ensuring KYC becomes a one-time, universally accepted procedure.

“CKYC eliminates the duplication of KYC submissions, ensuring customers don’t need to undergo the process multiple times. This not only enhances efficiency, but also significantly reduces the risk of document-related fraud,” says Sumanta Ghosh, Chief Technology Officer at Bandhan Life.

The process works through institutions uploading KYC data (such as the Permanent Account Number, or PAN, Aadhaar, and address proof), which is verified and stored centrally. Any institution can retrieve the data securely with customer consent.

In April 2025, Securities and Exchange Board of India (Sebi) chairman Tuhin Kanta Pandey told the media: “Markets regulator Sebi is actively working with the Ministry of Finance and other financial regulators on setting up a centralised KYC system. We’re really trying to have a system which will be very, very effective.”

Dynamic Identity Management

CKYC 2.0, expected to be rolled out in 2025, will be a Cloud-native, Artificial Intelligence (AI)-enabled platform offering real-time, secure and dynamic identity management.

Privacy and security have been key concerns around a centralised system for data storage and collection. Several measures, such as the 14-digit unique identifier and masked identity number, have been introduced to address the concerns.

“Additional measures, including strengthening infrastructure security, using AI as a tool to detect breaches and potential security threats, stringent access management features and regular audits can also be explored. Blockchain can be a very useful technology to store tamper-proof data and control access to the sensitive data,” says Shilpa Mankar Ahluwalia, partner at the law firm Shardul Amarchand Mangaldas.

Customer empowerment is also in focus. The revamped CKYC will allow individuals to view their KYC status, receive alerts when institutions access their data, and potentially initiate updates themselves.

“Integration with DigiLocker is also being strengthened to eliminate the need for paper-based verification,” says Ahluwalia.

From a market integration standpoint, a key development under discussion is the ability for KYC Registration Agencies (KRAs) regulated by Sebi to directly upload data to CKYC.

“At present, KRAs operate independently, primarily in the securities and mutual fund space. However, if they are allowed to participate in the CKYC upload process, the result would be a unified and harmonised KYC framework across the financial sector. Enabling this would streamline processes and reduce duplication,” says E. S. Varadarajan, Chief Process and Risk Officer at Computer Age Management Services (CAMS).

Discussions are also under way on expanding the scope of CKYC beyond identity. Future iterations may include declarations under the Foreign Account Tax Compliance Act (FATCA) and Common Reporting Standards (CRS)— international tax agreements that require financial institutions to provide information and even risk profiling about foreign account holders to tax authorities to combat tax evasion.

They would transform CKYC into a comprehensive client information repository rather than a basic identity validation tool, says Varadarajan.

Challenges And The Way Ahead

The road to seamless identity verification is not without bumps.

A glaring issue is data quality. Banks sometimes upload incomplete, inconsistent or poor-quality KYC records, resulting in clutter that renders documents undecipherable, says Harsh Roongta, founder of Fee Only Investment Advisers. “CKYC accepts poor-quality submissions unlike KRAS in the securities market who thoroughly verify data. This lack of standardisation dilutes the registry’s effectiveness and creates confusion during customer onboarding and verification,” he adds.

Data quality issues can include mismatched names, blurred photos and incorrect document tags.

Amendments to the RBI master directions on KYC, effective November 6, 2024, enable banks to establish an account-based relationship with customers based on CKYC, without the need to provide documentation again.

With this, customers can avoid re-submitting PAN, Aadhaar and photos with every new investment or loan application.

“This could resolve data inaccuracies as this has placed additional responsibilities on banks to ensure the veracity of due diligence measures and data posting; these records can now be used as is, to establish new relationships and enhance the onboarding customer experience. Records updated once can now be re-used, without the need to perform the same act multiple times.

“Collaborative efforts required from banks, financial intermediaries and regulators to promote widespread usage of CKYC shall enable consumption of reverse feed to make it the preferred mechanism for all financial activities,” says Alok Rastogi, head of the Corporate Centre at RBL Bank.

First-Time Investors

Customer experience of first-time investors and the underbanked is another issue. “Those who have not linked their Aadhaar and PAN can’t invest. But even after registration, validation is required. But for that, OTP doesn’t last long; so you have to repeat the process if your investor isn’t available at that time,” says Agra-based Shefali Satsangee, founder of mutual fund distributor Funds Ve’daa.

She adds that delays in record activation or rejection of documents without clear reasons often push users away from digital channels.

The lack of uniformity across regulators adds another layer of complexity. While CKYC is overseen by the Ministry of Finance, sectoral regulators like RBI, Sebi, the Insurance Regulatory and Development Authority of India and the Pension Fund Regulatory and Development Authority continue to maintain separate KYC protocols, creating duplication and compliance fatigue for institutions and consumers alike.

Lastly, and more fundamentally, CKYC’s governance model prioritises surveillance over service delivery.

Central Registry of Securitisation Asset Reconstruction and Security Interest has been notified as the CKYC agency under the PMLA, placing it effectively under the control of the Enforcement Directorate, whose primary mandate is to prevent money laundering. Unlike KRAs that operate within the securities market to facilitate investor transactions, CKYC lacks a commercial or investor-facing orientation

“This enforcement-heavy framework limits innovation and discourages investment-friendly features. Without a clear mandate to enhanced financial access, CKYC has become an additional compliance burden rather than a tool for empowering investors,” says Roongta.

Regulatory alignment and convergence are also important to resolve CKYC issues. Regulators must align their standards and processes to forge a uniform KYC framework that seamlessly caters to banking, insurance, capital market and pension segments.

The road ahead for CKYC lies in regulatory alignment with recalibration of CKYC’s governance framework, technological modernisation and customer empowerment and engagement. 

@Riddhima765