CKYC Registry for Indian Fintechs: What the Rules Require and What We Could Not Confirm

In short

CERSAI runs the Central KYC Records Registry (CKYCR). A regulated entity must upload a new customer's KYC records within 10 days of starting an account-based relationship, and send updates within seven days.
If a customer gives a CKYC number and consents, the entity must fetch the record from the registry instead of asking for the same documents again.
The technical side (API fields, file formats, certificates, fees) sits in CERSAI documents we could not open, so this page does not describe it.

Checked 31 October 2026 against the sources listed at the end.

1. What the CKYC Registry is

The Central KYC Records Registry is the central store for KYC records. The Prevention of Money-Laundering (Maintenance of Records) Rules, 2005 describe it as an entity that can "receive, store, safeguard and retrieve KYC records in digital form". The same Rules define the KYC Identifier as "the unique number or code assigned to a client by the Central KYC Records Registry".

The Reserve Bank of India says the Central Government authorised CERSAI (the Central Registry of Securitisation Asset Reconstruction and Security Interest of India) by a 2015 Gazette notification to act as the registry. The public name for the identifier is the CKYC number or KIN. Several bank and news pages describe it as 14 digits long. The RBI and PML Rules texts we read give no length.

The registry's website is ckycindia.in, where RBI's bank direction says a customer can access their KYC Identifier.

2. A checklist of what the rules ask of a regulated entity

This list comes from the RBI rules for banks and the PML Rules. We read two RBI texts: the Commercial Banks KYC Directions, 2025 and the 2016 Master Direction. Their registry rules match on the points below. If you are not a commercial bank, read the direction that covers your entity type.

[ ] Be a reporting entity. The PML Rules put the duty to file KYC records on a "reporting entity". The rules page we read does not define that term, so ask your compliance adviser whether it covers you.
[ ] Register with the registry and test first. A 2020 explainer by Vinod Kothari & Company says registration is through the CKYCR portal, needs a board resolution appointing an authorised representative, and includes testing on a testbed before approval. We could not open the registry's own pages to confirm the current steps.
[ ] Use the registry's templates. RBI says CERSAI has issued operational guidelines and KYC templates for individuals and for legal entities, and may revise them.
[ ] Upload within 10 days. Capture the customer's KYC records and upload them within 10 days of the account-based relationship starting.
[ ] Flag OTP-based e-KYC accounts. When you upload, say clearly that the account was opened with OTP-based e-KYC.
[ ] Tell the customer their KYC Identifier. Once the registry generates it, the entity must make sure it is communicated to the customer.
[ ] Search and download before asking for documents. If the customer gives a KYC Identifier with explicit consent, fetch the record online.
[ ] Send updates within seven days. If you get updated information, furnish it to the registry. When the registry tells you another entity changed a record, retrieve it and update your own copy.

3. Dates and deadlines

Item	What the source says	Where
Upload of new records	Within 10 days of commencement of an account-based relationship	PML Rules, Rule 9(1A); RBI Master Direction 2016, para 56(b); RBI Commercial Banks KYC Directions 2025, para 65(2)
Updated information	Within seven days, or a period the Central Government notifies	RBI Commercial Banks KYC Directions 2025, para 65(8)
Individual accounts (scheduled commercial banks)	New accounts opened on or after 1 January 2017	RBI Master Direction 2016, para 56(e)
Legal entity accounts	Opened on or after 1 April 2021, on the legal-entity template	RBI Master Direction 2016, para 56(f)

The PML Rules page we read shows Rule 9(1A) with "ten days" in square brackets, which suggests it was amended. It does not say from what. Some older material gives three days. We found no source for three days and do not use it.

4. Fetching a record instead of asking again

RBI's rule for banks is that a bank must not ask a customer to submit the same KYC records again when it has a KYC Identifier and can get the records online. There are exceptions. The bank may ask again if the customer's information in the registry has changed, the records are incomplete or not compliant, a document's validity has lapsed, or the bank thinks it needs to verify identity or address, do enhanced due diligence or build a risk profile.

The RBI direction says a bank that downloads current, compliant records "shall not be required to re-verify" the customer's identity or address. The entity that last uploaded or updated the record is responsible for that check.

5. What we could not confirm

Guides online list API names, FI codes, certificate types, SFTP folders, encryption settings, image sizes, error codes and response times. This page states none of them. We could not read a CERSAI or ckycindia.in document that sets them out, because the registry's own pages did not load for us.

What a secondary source adds: TeamLease RegTech, summarising a CERSAI notice dated 4 August 2026, reports that CKYCR 2.0 onboarding of reporting entities began on 10 August 2026 and that a mock run covered the web application, API, bulk upload and SFTP. The same site reports a CKYCR 2.0 API document, issued 5 June 2026, that covers onboarding, API security, technical specifications, testing and production deployment, and a sandbox for testing. We did not see the CERSAI documents themselves.

6. What a builder should do

Ask your compliance lead which RBI direction (or SEBI, IRDAI or PFRDA rule) applies to the regulated entity you work for. This page covers the RBI texts only.
Put the 10-day upload and seven-day update deadlines in the product spec as hard limits, and store the date the account-based relationship began.
Store the KYC Identifier when the registry returns it, and show it to the customer.
Design onboarding so a customer can enter a KYC Identifier, consent, and skip document upload, with the exceptions in section 4 sending them back to the document path.
Get the current CERSAI API document and operating guidelines from the registry once your entity is registered. Build from those, not from a blog.

Questions people ask

What is a CKYC number?

It is the KYC Identifier the registry assigns to a customer. The PML Rules define it as the unique number or code assigned to a client by the Central KYC Records Registry. SBI Card's FAQ describes it as a unique 14-digit identifier, and a Business Today report of 21 July 2026 says the same. A customer can see theirs on ckycindia.in.

How soon must a regulated entity upload a new customer's KYC record?

Within 10 days of the start of an account-based relationship. This is in Rule 9(1A) of the PML Rules as shown on FIU-India's site, and in the RBI's 2016 Master Direction and its 2025 direction for commercial banks. Updated information goes to the registry within seven days.

Can a bank ask for the customer's documents again after getting a CKYC number?

Usually not, if the customer gave the number with explicit consent and the bank can fetch the record online. RBI lists the exceptions: changed registry information, incomplete or non-compliant records, lapsed document validity, or a need to verify identity or address, do enhanced due diligence or build a risk profile.

Who is responsible for checking identity if I rely on a downloaded record?

The entity that last uploaded or updated the record. RBI's direction for commercial banks says a bank relying on current, compliant registry records need not re-verify identity or address, but it still owns the rest of customer due diligence.

Where are the API specifications, fees and certificate rules?

We could not confirm them. The registry's pages did not open, so this page does not state them. A TeamLease RegTech summary says CERSAI published a CKYCR 2.0 API document in June 2026 and that the document is in the downloads section of the official CKYC website. Read it there, and read the operating guidelines, before you plan the build.