In January, concerns about money laundering and poor know-your-customer norms led to the Reserve Bank of India’s crackdown on Paytm Payments Bank. The debacle was followed by a major development. In February, the Central Registry of Securitisation Asset Reconstruction and Security Interest—a statutory body under the RBI—decided to build an upgraded central repository for KYC records.

This laid the foundation for the Central KYC Records Registry (CKYCRR) 2.0. Simply put, KYC is a process where customers are required to verify their identity and personal details to avail financial services or instruments. The idea of a centralized, uniform registry was to ease the KYC processes and plug any loopholes to prevent fraud.

To build this repository, the Central Registry of Securitisation Asset Reconstruction and Security Interest (CERSAI) needed technology firms. It floated tenders and then reportedly settled on Infosys (it is not known who the other bidders were). It’s worth mentioning here that Infosys has had a rocky track record with building portals for government projects—the upgraded income tax portal is a case in point.

Coming back to the repository, why exactly was this upgrade needed and what does it entail?

What is CKYCRR? Set up in 2016, the registry serves entities regulated by the central bank, the Securities and Exchange Board of India, the Insurance Regulatory and Development Authority of India and the Pension Fund Regulatory and Development Authority. Entities regulated by these bodies are called reporting entities, or REs. They could be banking companies, financial institutions, intermediaries or individuals carrying on a designated business or profession.

All REs are mandated—under the Prevention of Money Laundering (Maintenance of Records) Rules 2005—to electronically file their customers’ KYC records with the central repository. Once this is done, customers receive a unique 14-digit number. This number is linked with unique ID proofs.

Now, this number simplifies future KYC processes with other REs. Entities could easily pull up customers’ KYC details from the common pool—CKYCRR. This basically eliminates the need for repeated KYC processes and saves time.

This extensive central repository includes records from private and government banks, fintech apps, broking firms, mutual fund houses, insurance aggregators and more. As of January 2024, the repository held 830 million KYC records. So, if it seems like things are on track, then why the update?

Need for an upgrade: REs hesitate to rely solely on this repository. This could be attributed to unreliable data and incomplete customer records. On top of this, scanned documents in the system are often blurry and unclear. As a result, most entities instead opt for video- or DigiLocker-based KYC or face-to-face verification. (DigiLocker is a government-authorized system that allows citizens to store official documents.)

This is one of the issues that the new CKYCRR aims to address. The upgraded system also aims to encourage firms to use the central KYC system more, to improve compliance and increase transparency.

In an earlier edition of News Explainer, we had written about the central KYC registry and risks attached to it. With just the central KYC, and no video KYC, there is the risk of identities being verified without robust measures such as live selfies. Which means there is a risk of fraudulent onboarding by companies. In fact, last year, the central bank labelled the central KYC database high-risk.

This is the other issue that is being addressed by the upgrade. But what will the new repository look like?

CKYCRR 2.0: One of the key areas that the upgraded repository will look at is advanced fraud detection capability. For example, if an individual’s verification is pending or if a customer is listed in fraud databases like the United Nations Security Council sanctions list or the RBI's digital fraud registry, the new system will flag it to the firm pulling up this individual’s details.

A notable upgrade that CKYCRR 2.0 is aiming for is a statistical model that assigns a “confidence level” to each KYC record, ranging from level 1 to level 4. This will be based on criteria set by CERSAI and other regulators. Basically with this, the aim is to shift from a one-size-fits-all approach to a risk-based one. It is yet to be seen how this takes shape, as assigning a risk level to each and every KYC record will be a painstaking task.

Another feature of the upgraded CKYC is that it will be open for citizens to access their KYC records directly—for the first time. Users will receive updates through email or SMS whenever their KYC is uploaded or downloaded by a financial institution, thereby enhancing transparency.

The primary task for the IT firm that bags the project will be to build the digital infrastructure for these features, make the system scalable and migrate all existing data to it. It remains to be seen whether Infosys will be able to pull it off.

Lead illustration by Ujjaini Dutta.