Griffin Consultancy
All insights
General

CKYC 2.0: What India's Upgraded KYC System Means for You

By Griffin Research·28 Jul 2026
KYCReforms

If you've ever opened a bank account, bought a mutual fund, or applied for insurance in India, you've filled out a KYC (Know Your Customer) form—probably more than once, for more than one institution. The government's Central KYC Registry (CKYCRR) was originally built to fix exactly this problem, and it's now being overhauled. Here's what CKYC 2.0 is, when it's arriving, and what actually changes for you.

A Quick Recap: What Is CKYC?

The Central KYC Records Registry is a government-backed system, operated by CERSAI (Central Registry of Securitization Asset Reconstruction and Security Interest of India), that stores a customer's verified identity records in one place. CERSAI was authorized to function as the Central KYC Records Registry through a Ministry of Finance notification dated January 1, 2017. The idea: complete your KYC once with any RBI, SEBI, IRDAI, or PFRDA-regulated entity, and every other regulated entity can pull that same verified record instead of asking you to repeat the process.

In practice, CKYC 1.0 worked more like a shared filing cabinet than a live verification system — institutions uploaded scanned PDFs and images, and other institutions could retrieve those documents when needed.

What's Changing: CKYC 2.0

CKYC 2.0 is a structural overhaul, not just a UI refresh. Finance Minister Nirmala Sitharaman flagged the need for this upgrade in the Union Budget 2025, calling a revamped Central KYC Registry a top priority, and she had indicated the modernized system would arrive in 2025 alongside a new framework for periodic KYC updates.

The core shift is from a document-storage model to a real-time, API-driven verification network. According to industry trackers following the rollout:

  • CKYCRR 2.0 mandates that KYC records be submitted through validated APIs in structured JSON/XML format, rather than the scanned PDFs and images used earlier — enabling straight-through processing.

  • The new framework brings real-time APIs, automated verification, DigiLocker integration, and stronger fraud controls to customer verification.

  • The revamped system introduces facial recognition-based de-duplication and mandatory Aadhaar masking.

  • A national de-duplication mechanism and biometric cross-checks address a gap regulators flagged after synthetic identity fraud emerged as a growing risk among digitally onboarded customers.

  • Risk-based update cycles are now formalised: high-risk customers must be re-verified every 2 years, medium-risk customers every 8 years, and low-risk customers every 10 years, with structured reminders before records lapse.