What it is
KYC stands for Know Your Customer. It is the process through which a bank, broker, mutual fund or other financial firm confirms who you are before it lets you open an account or use its services. In practice this means checking identity and address documents and keeping a record of them.
Our KYC glossary page covers the basic definition. The core idea is simple: a firm should know who it is dealing with, so that accounts are not opened in false names or used for fraud.
How it works
KYC has two broad stages. The first is onboarding, when you submit documents and the firm verifies them. The second is ongoing upkeep, often called a KYC review or refresh, when the firm checks that its records are still current.
How often a review happens depends on the rules for each type of customer. For foreign portfolio investors (FPIs, which are overseas investors buying Indian securities), SEBI deals with this through a circular on the periodicity, meaning the time gap, of KYC review. Details of the new gap sit in the circular itself, and we do not state them here.
For you as an ordinary customer, the practical point is that firms hold copies of your identity documents, so how they store and protect that data matters as much as how they collect it.
Why it is in the news
Two separate stories brought KYC into focus on 30 October 2026.
First, SEBI issued a press release (No. 67/2026) and a circular titled “Rationalisation of periodicity of KYC review for FPIs”. The titles indicate that SEBI is changing how often FPIs have to go through KYC review, as part of what it calls ease of compliance. Our related coverage tracks that change.
Second, AU Small Finance Bank said it was looking into a possible leak of data linked to its vehicle loan customers. This followed a claim by a hacker group that it had broken through the lender’s cyber defences, according to a PTI report carried by ThePrint. The bank said the matter relates to a software-as-a-service platform managed and hosted by Salesforce. BusinessLine reported that the bank’s own systems remain unaffected and that all banking services are operating normally.
The Economic Times reported that Salesforce said it found no vulnerability at its end. The same report said the information reportedly compromised includes KYC records and personal identification documents. This is a reported claim under investigation, not a confirmed finding. See our coverage of the AU Small Finance Bank probe for updates.
What it means for you
The two stories show both sides of KYC. Regulators want records to be accurate and reviewed on a sensible schedule, and they are adjusting that schedule for FPIs. At the same time, the more documents a firm stores, the more important their security becomes.
- Keep your contact details with your bank or lender up to date, so any notice about a review or an incident reaches you.
- Share KYC documents only through the official channels of the institution you deal with.
- If your lender writes to you about an incident, read the message carefully and verify it through the lender’s official channels before acting on it.
If you are an FPI or work with one, read the SEBI circular for the exact revised timelines that apply to your category.
