What the RBI’s KYC Updation Deadline Means for Transaction Monitoring of Low-Risk Accounts

The RBI KYC updation deadline for low-risk customers is often quoted as 30 June 2026. The text is more careful than that. Paragraph 42(2) of the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025 tells a bank to allow all transactions for a low-risk individual customer and to ensure updation of KYC within one year of its falling due or up to 30 June 2026, whichever is later.

The rule was introduced by the RBI’s KYC (Amendment) Directions of 12 June 2025 and carried into the Commercial Banks Directions issued on 28 November 2025. It remains in the version the RBI updated on 1 October 2026. Two duties travel with it: the bank must subject these accounts to regular monitoring, and it must send due notices and keep a record of them.

As at 27 October 2026 the window has already closed for some accounts and is still open for others. That makes this a monitoring governance question as much as a KYC one: a defined population of accounts is operating on an ageing profile while the bank stays fully responsible for monitoring them.

Treating overdue low-risk accounts as a tagged cohort gives the bank one place to evidence monitoring, notices and resolution.

How the window in paragraph 42(2) works

The wording sets a floor, not a single date. For a low-risk individual whose KYC fell due before 30 June 2025, one year from the due date ends before 30 June 2026, so the later date, 30 June 2026, applies. For an account whose KYC falls due after that point, one year from the due date is later and governs. The paragraph also applies to low-risk individuals whose periodic updation had already fallen due when the rule was introduced.

The dates below are worked examples calculated from the wording of paragraph 42(2). A bank’s own cut-offs should come from its records of each customer’s due date.

Monitoring continues while the profile ages

Paragraph 42(2) is explicit that accounts of these customers are subject to regular monitoring. Paragraph 55 requires alert software that compares transactions with the customer’s risk categorisation and updated profile. An account with overdue KYC has a profile that is not freshly updated, so the comparison is weaker, and the Directions do not say how to compensate. A practical response is to know exactly which accounts are in the overdue cohort and to test, at the six-monthly review of categorisation required by paragraph 41, whether low risk is still the right category for each.

The notice trail is also a monitoring record

Paragraph 42(7) requires at least three advance intimations before the due date, including at least one by letter, and at least three reminders afterwards for customers who have not complied, including at least one by letter. Each must be recorded in the bank’s system against the customer for audit trail, and the bank was to implement the process not later than 1 January 2026. For a monitoring team the record answers the question a supervisor is likely to ask about an overdue low-risk account: what did the bank do, and when?

Paragraph 18 adds that a bank must not reject an application for onboarding or periodic updation without application of mind, and that the officer must record the reasons.

A cohort control for overdue low-risk accounts

Treating the overdue population as a defined cohort gives the bank one place to evidence what it has done. This is a design suggestion, not a requirement of the Directions.

What to put in front of the Audit Committee

Paragraph 12 requires quarterly audit notes and compliance to be submitted to the Audit Committee. The cohort gives that submission something specific to report.

How Nexiant supports monitoring of overdue-KYC cohorts

FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. For a cohort control, the useful tests of any capability are whether accounts can be tagged and filtered in monitoring, whether rules can treat the cohort differently through a documented configuration, and whether alerts, notices and category changes sit in one case record. Nexiant brings these questions together across KYC, fraud and monitoring as a design discipline, not as a claim about one integrated system.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.