Central KYC (CKYC): What it is, How the Registry Works, and What Changed in 2026

India’s Central KYC Records Registry has been live since 15 July 2016. The idea behind it was to create a central, verified registry that would store the KYC data of customers. This registry would then be used by other regulated institutions that need to verify a customer instead of running all the checks all over again.

Despite being in place, it was not used for a whole decade because there was no rule that clearly stated which party would be held responsible if the data turned out to be wrong. This ambiguity resulted in organizations not using the registry and asking customers for documents anyway.

In December 2025, however, the Reserve Bank of India (RBI) settled that question. This article covers what CKYC is, how the registry works, which institutions must use it, and what the 2025 and 2026 rule changes mean for onboarding.

What is Central KYC?

Central KYC is a national repository that stores verified customer identity records so that regulated financial institutions in India can reuse them instead of collecting documents again. The CKYC’s full form is Central Know Your Customer. When people ask what CKYC means, this reuse function is the answer.

The registry and the body that runs it

The repository itself is called the Central KYC Records Registry, or CKYCR. The Government of India authorised the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI) to operate it through Gazette Notification S.O. 3183(E) dated 26 November 2015, as recorded in the RBI Master Direction on KYC. CERSAI is a government-owned body that already ran a central registry of security interests over property, which is why the two functions sit together.

What is a CKYC number (KIN)?

A CKYC number is the unique identifier the registry assigns to a customer record. RBI calls it the KYC Identifier. CERSAI issues it as a 14-digit number, also written as the KIN, and sends it to the customer by SMS and email, according to the official CKYC portal. Once a customer holds a KIN, any registered institution can use it to fetch that customer’s verified record rather than starting from blank forms.

How Does the Central KYC Records Registry Work?

The registry runs on a cycle of upload, retrieval and update, and each stage carries its own deadline.

Upload after Onboarding

When a regulated entity opens an account-based relationship, it must capture the customer’s KYC record and upload it to CKYCR within 10 days, under Rule 9(1A) of the PML Rules. Scheduled commercial banks have been required to upload new individual accounts since 1 January 2017, other regulated entities since 1 April 2017, and legal entity accounts since 1 April 2021. Older accounts are pushed to the registry at the next periodic update, so the registry fills in gradually rather than all at once.

Retrieval Using the KYC Identifier

At the next institution, the customer supplies the KYC Identifier and gives explicit consent for the record to be downloaded. The institution retrieves the record online instead of requesting fresh documents. The consent is what makes retrieval lawful, so it prevents an institution from pulling a record simply because it holds the number.

Updates and the Seven-day Rule

When an institution receives updated information from a customer, it must send that update to CKYCR within seven days. The registry then notifies every other reporting entity that has dealt with that customer, and each of those entities retrieves the updated record and corrects its own files. One customer telling one bank about a new address therefore corrects the record across every institution holding it.

Which Institutions are Required to Use CKYC?

Reporting to CKYCR is mandatory across India’s regulated financial sector.

Individual customers do not register directly

Individual customers do not register with CERSAI themselves. A record is created for them by the institution that first completes their KYC.

What is the Difference Between CKYC, KYC and eKYC?

The three terms describe different things, and they work together rather than replacing one another.

How the three fit together

Aadhaar eKYC is a way of verifying someone. CKYC is where the verified result is stored. A record held in CKYCR may well have been produced by an Aadhaar-based check, which is why the two are complementary rather than alternatives.

What Changed for CKYC in 2025 and 2026?

Two changes matter more than the rest, and both were made within five weeks of each other at the end of 2025.

The 2016 Master Direction was replaced in November 2025

On 28 November 2025 the RBI repealed the Master Direction on KYC, 2016 with immediate effect and replaced it with separate KYC Directions for each category of regulated entity, including commercial banks, NBFCs, small finance banks, payments banks, and urban and rural co-operative banks. 

Any compliance document, vendor page, or internal policy that still cites the 2016 Master Direction as the governing instrument is now pointing at an outdated rule, so policy references need checking against the current RBI notifications.

Who is now responsible for a CKYC record

On 29 December 2025 the RBI issued amendment directions clarifying accountability for registry records, following an office memorandum from the Department of Revenue dated 18 September 2025. 

The regulated entity that last uploaded or updated a customer’s record in CKYCR is responsible for verifying that customer’s identity and address. An institution that downloads and relies on the record is not required to verify identity or address again, provided the record is current and compliant with the PML Act and Rules. That institution remains responsible for every other part of customer due diligence, including risk rating, screening and ongoing monitoring.

Equivalent amendments were issued the same day for NBFCs, small finance banks, payments banks, urban and rural co-operative banks, regional rural banks, local area banks, asset reconstruction companies and all India financial institutions.

How does CKYC Reduce Onboarding Time and Duplication?

CKYC reduces duplication by removing the document collection step, and it reduces onboarding time because retrieval takes seconds.

What the rules now let you skip

Where a KYC Identifier is available, an institution must seek it or retrieve it from CKYCR, and must not ask the customer to submit the same records again. Following the December 2025 amendment, the downloading institution also does not repeat identity and address verification on a current, compliant record. A customer who has already been verified once can therefore open a second relationship without producing a single document, saving precious time.

Where you still cannot rely on the record

Four exceptions remain. When any one of them applies, the file returns to full document collection.

1. The customer’s information has changed compared with what the CKYCR record holds.
2. The retrieved record is incomplete or does not meet current applicable KYC standards.
3. The validity period of the downloaded documents has lapsed.
4. The institution considers further verification necessary to verify identity or address, to apply enhanced due diligence, or to build an appropriate risk profile.

Why the fourth exception decides your actual pass rate

The first three exceptions are matters of fact, which means either the data has changed, the record is short of a field, or a document has expired. The fourth one is a judgement the institution makes itself, and it is written broadly on purpose.

That makes it the exception that determines how much reuse a firm actually achieves. An institution with weak risk-rating logic will invoke it on most files and lose the benefit the registry was built to deliver, whereas an institution that can provide evidence why no further verification was needed will keep that benefit while staying inside the rule.

How to Find a Customer’s CKYC Number

Onboarding and compliance teams need to establish whether a customer already has a registry record. Customers ask their bank what their own number is.

How a Regulated Entity Retrieves a KYC Identifier

The institution is not dependent on the customer producing the number. The rules require it to seek the KYC Identifier from the customer or retrieve it from CKYCR. So, if a customer was never told their KIN, or has forgotten it, it does not stall onboarding. It would be the institution’s responsibility to then check the registry and retrieve itve the number.

What Happens When no Record Comes Back

If the registry doesn’t hold the CKYC number for that customer, the institution runs full KYC, uploads the record within 10 days of opening the relationship, and CERSAI generates a new 14-digit KIN. Also, that customer’s next institution can then retrieve that number rather than starting the process all over again.

Is CKYC Unique to India?

The CKYC name and the CKYCR apparatus are specific to India. The idea underneath them, which is storing a verified customer record once so that other institutions can reuse it, is not.

Shared registries used by financial institutions

Swift operates a KYC Registry used by close to 6,000 financial institutions and more than 60 central banks across over 240+ countries and territories, according to Swift. It differs from CKYC in one important respect. It holds records that institutions use to check each other, mainly for correspondent banking, rather than records of retail customers.

What this means outside India

Most markets have no direct equivalent to CKYC for individual customers. Institutions elsewhere generally lean on national digital identity schemes or bilateral reuse arrangements instead. The reuse logic therefore transfers across borders even where the registry itself does not.

How Shufti Supports CKYC-Aligned Onboarding in India

Indian compliance teams face a specific problem after the December 2025 amendment. Reliance on a registry record is now permitted, but only where the record is current and compliant, and the institution still has to evidence every other part of due diligence it’s responsible for.

Shufti structures customer data to align with CKYC data fields and supports reuse logic where permitted, so the verification a team performs produces output shaped for the registry rather than output that has to be reworked before it fits. Deployment runs from India-based cloud regions including Mumbai and Hyderabad, or on premises, which is what RBI data localisation expectations require of the underlying data.