Periodic KYC Update Reminders and Document Collection in India

What this service is

AiStaffo sets up an AI worker that runs the routine side of periodic KYC refresh for a lender or other regulated entity in India. It keeps a due-date register by risk tier, sends the notices the RBI requires, collects updated documents, checks them for completeness and records the result. A compliance officer approves each update before it is final.

Who it is for

This service suits any Regulated Entity that holds customer accounts subject to the RBI Master Direction on KYC, including banks, non-banking financial companies and payment banks. It also fits the operations or compliance head who now runs re-KYC through spreadsheets, branch call lists and manual follow-ups. A team of five handling a few hundred accounts and a team handling many thousands face the same steps, only at a different volume. The common trigger is the same: due dates are being missed, or the team cannot tell which customers are overdue without a manual check.

What is included

• A due-date register for every customer, set by risk category, with the next due date calculated from the date of account opening or the last KYC update.
• Advance notices and reminders sent by SMS, email or WhatsApp, with a letter route for the mandatory letter notices.
• A secure upload link for updated Aadhaar, address and other identity documents, and a self-declaration path for customers who report no change.
• A completeness check on each returned file, listing what is missing or unclear for a person to review.
• A write-back of each outcome to your loan management or CRM system, with a time-stamped record of every notice sent.
• A queue for your compliance officer showing files ready for approval, with the supporting documents attached.

The due-date register and the rules behind it

The register is the core of the service. The RBI's Master Direction on KYC sets the periodic updation cycle by risk category, counted from account opening or the last update. Your risk categorisation stays with your own compliance team. The worker reads that category and applies the matching cycle.

The RBI's June 12, 2025 amendment directions also require at least three advance intimations before a due date, one of them by letter, and at least three reminders after it, one of them by letter. Each notice must be recorded against the customer for audit trail. The same amendment relaxed the timeline for individual low-risk customers. Such customers may continue operating their accounts and update KYC within one year of the due date or by 30 June 2026, whichever is later. That 30 June 2026 date has now passed, so for low-risk files the one-year limit after the due date is the date your team should now track.

How it runs

1. Audit. We review your current KYC records, the systems that hold them, the risk categories in use and the reminder history. We also check how many files are overdue today.
2. Process map. We write down each step from the first notice to the final write-back, marking every point where a compliance officer must approve, reject or escalate.
3. Build. We connect the worker to your register data and messaging channels, set the notice schedule and the secure upload link, and configure the completeness checks with your compliance team.
4. Run. The worker operates in parallel with your current process for a short period. Your team compares its register and reminders with the existing records before it takes over the routine sends.
5. Support. We monitor notice delivery, failed messages and queue volumes, and adjust the schedule when your policy changes.

A typical plan runs about eight weeks from audit to handover. The audit and process map take roughly two weeks together. The build takes three to four weeks, and the parallel run takes two more. Support continues after handover, and the timeline can stretch if your records are spread across several systems or stored only on paper.

Where a business-correspondent route fits

Banks may use an authorised Business Correspondent to obtain self-declarations where a customer reports no change in KYC information or only a change of address. The RBI requires the bank to record these declarations electronically in its systems after successful biometric e-KYC authentication. Your team decides whether this route applies to your business. The worker only carries the declaration into the queue once your rules allow it. Where a customer reports a change of address, the RBI requires the bank to verify the declared address, and under the FAQs this happens through positive confirmation within two months.

What the client provides

• Access to the customer records that hold account opening dates, last KYC update dates, risk categories and contact details.
• Written KYC policy and the risk categorisation rules your board has approved.
• A named compliance officer who approves every update and every account action.
• Access to your loan or CRM system, with a test environment where possible.
• Approved notice wording in English and any regional languages your customers use.

What it does not cover

The worker does not decide whether a customer is high, medium or low risk, and it does not decide whether an account should be restricted, frozen or closed. It does not judge whether a document is genuine. It checks that the required fields and pages are present and readable, then passes the file to a person. It does not replace your obligations under the Prevention of Money-laundering Act, 2002, and it does not change what your compliance team must report. Customers who do not respond, or whose documents raise questions, still need a human conversation. Automation also adds risk if your customer data is poor. Duplicate records, wrong contact numbers and missing account opening dates will produce wrong due dates until they are cleaned. In that case the audit stage should come first, and the build should wait.