The Reserve Bank of India's KYC Master Direction, originally issued in 2016 under the Prevention of Money Laundering Act, has been amended repeatedly and continues to shape how regulated entities identify customers, assess risk and decide how often to revisit that assessment. Two elements matter most for transaction monitoring design: the 10% beneficial-ownership threshold for companies, and the risk-based re-KYC timelines that determine how current a customer's risk profile is expected to stay. This article sets out what each requires and how they should feed into ongoing monitoring.
The beneficial-ownership threshold and why it matters for monitoring
Under the Master Direction, any individual holding 10% or more of shares or voting rights in a company customer must complete full KYC as a beneficial owner. That is not only an onboarding requirement. A transaction monitoring and risk-scoring system that has not correctly captured beneficial ownership at the 10% threshold is working from an incomplete picture of who actually controls the funds moving through an account, which weakens the reliability of any subsequent alert or risk score.
Reporting entities should treat beneficial-ownership data as a live input to risk-based monitoring rather than a static field collected once at onboarding and left unreviewed.
Re-KYC timelines and ongoing risk categorisation
The Master Direction sets risk-based re-KYC timelines, commonly cited as 2 years for high-risk customers, 8 years for medium-risk, and 10 years for low-risk, with non-compliance leading to partial and then full account restrictions after a mandatory notice period. RBI has also issued amendments addressing how low-risk customers are treated during a re-KYC updation window, generally allowing continued transactions while updation is completed, provided the institution actively manages the process rather than allowing it to lapse silently.
For monitoring purposes, a customer's risk category should not be a label set once and forgotten. It is the input that determines how closely transaction activity is scrutinised, so a re-KYC process that runs late or inconsistently directly weakens monitoring calibration for that customer segment.
What this means for NBFCs specifically
Non-banking financial companies operate under the same core KYC Master Direction framework as banks but often have leaner compliance teams managing a similarly complex customer base, including corporate borrowers where beneficial-ownership identification is more involved than for individual retail customers. NBFCs should confirm their current internal deadlines for re-KYC and beneficial-ownership refresh against RBI's latest circulars, since these have been amended multiple times, and build a monitoring escalation path for customers whose re-KYC has lapsed rather than treating a lapsed re-KYC as a purely administrative gap.
Bringing beneficial ownership and re-KYC into a working monitoring programme
A monitoring programme that reflects these requirements well typically links three things: an up-to-date beneficial-ownership record refreshed whenever ownership structure information changes, a risk category that is actually revisited on the Master Direction's timelines rather than only when a customer happens to interact with the institution, and monitoring thresholds that tighten automatically when a customer's risk category is upgraded following a re-KYC review or a beneficial-ownership change. Treating these as connected, rather than as three separate compliance checkboxes, is what turns the Master Direction's requirements into monitoring that actually adapts to changing risk.
