Ask any NBFC operations head what slows an RBI inspection and the answer is rarely the loan itself. It is the KYC file: a PAN copy in the LOS, an address proof in a branch cupboard, a bank statement sitting in someone’s email, and an Aadhaar copy that nobody remembers masking.
In short
- Keep KYC as one record per borrower, not as files spread across the LOS, email and branch storage.
- The RBI KYC Master Direction asks lenders to keep identification and address records for at least five years after the relationship ends, and to update KYC every two, eight or ten years depending on risk.
- Aadhaar needs extra care: mask the number on copies, and keep any Aadhaar numbers you must store in a separate vault.
- Check files when they are captured, not at disbursal or when the inspection team arrives.
Why KYC files fall apart
KYC documents come in through too many doors. A branch officer scans some, a DSA sends others on WhatsApp, the customer uploads a few in the app and the rest arrive by email. Each channel stores its piece somewhere different.
The loan origination system keeps what it needs to make a credit decision, which is not the same as a complete, reviewable KYC record. Expiry dates and re-KYC due dates end up in spreadsheets. When an auditor asks for fifty sample files, the team spends a week rebuilding them.
What RBI expects you to keep, and for how long
The RBI Master Direction on KYC sets the baseline for banks, NBFCs and other regulated entities. A few provisions shape how a KYC record should be built:
- Identity and address records: keep them for at least five years after the business relationship has ended.
- Transaction records: keep them for at least five years from the date of the transaction.
- Periodic updation: update KYC at least once every two years for high-risk customers, every eight years for medium-risk customers and every ten years for low-risk customers, counted from account opening or the last update.
- No change, simple update: where nothing has changed, a self-declaration through registered email, mobile, digital channels or a letter is enough. A new address can be declared the same way and confirmed within two months.
- Central KYC Records Registry: with the customer’s consent, you can retrieve an existing KYC record online using the KYC identifier, and you upload KYC information for new customers.
Go back to the source. The KYC Master Direction is amended often, most recently in August 2025. Use this as a working summary and confirm the details that apply to your entity with your compliance team.
Aadhaar needs its own rules
Two rules matter most. When a customer submits an Aadhaar card as a proof and you are not using it for authentication, RBI says the Aadhaar number should be redacted or blacked out. Separately, UIDAI requires entities that store Aadhaar numbers to keep them in a dedicated Aadhaar Data Vault rather than in ordinary application databases, a requirement it restated in a circular in November 2025.
In practice that means three habits:
- Mask the Aadhaar number at capture, before the copy is saved anywhere
- Keep the masked copy in the borrower’s record, so nobody needs the original
- If your process truly needs the number, hold it only in the vault
Privacy law points the same way. The Digital Personal Data Protection Rules, notified in November 2025, bring most obligations on businesses into force in May 2027. Records you are legally required to keep can stay for that period, but personal data you no longer need should not linger in shared drives and inboxes.
One record per borrower
The fix is structural. Instead of folders by branch or by month, every document is filed against the borrower or the loan. Each one has a type, a date and, where it applies, an expiry. Open the record and the whole file is there.
| Document group | Typical documents | What to check |
|---|---|---|
| Identity and address | PAN, passport, voter ID, driving licence, masked Aadhaar, address proofs | Right document type, name matches the application, proof still valid |
| Income | Salary slips, bank statements, ITRs, financial statements | Period covered, name and account match, no missing months |
| Bank proof | Cancelled cheque, passbook | Account holder and IFSC match the repayment mandate |
| Loan documents | Sanction letter, loan agreement, annexures | Terms match the approved template, all pages signed |
From capture to an inspection-ready file
- Capture. Branch staff, field officers or the customer upload documents from any device. Phone photos are straightened and cleaned automatically.
- Check. Each document is read and checked against its type. Is this really a PAN card? Does the name match the application? Is the address proof current? An incomplete file is flagged now, not at disbursal.
- Mask. The Aadhaar number is masked before the copy is stored, and PAN can be hidden on screen for users who do not need it.
- File to the borrower. Everything lands on the borrower or loan record, with maker-checker approval and a full audit trail.
- Re-KYC on time. Due dates follow the customer’s risk category, and the renewal workflow starts before a proof lapses.
What inspection-ready actually looks like
- Any borrower’s complete KYC file opens with one search
- Every document shows who uploaded it, who approved it and when
- Re-KYC due and overdue cases appear as a list, not as a surprise
- Every Aadhaar copy in the system is visibly masked
- Retention is set by rule, so records stay for the required period and no longer
What about the old paper files?
Most lenders carry years of physical loan files. You do not need to scan everything before you start. Begin with active loans and customers due for re-KYC, then work back through closed accounts that are still inside the retention period. Bulk scanning with automatic sorting into borrower and document type turns this into a project of weeks rather than months.
Where Abscode fits
Abscode DMS for KYC keeps each borrower’s KYC and loan documents as one record. It reads and checks each document against its type, flags incomplete files at capture, masks Aadhaar and PAN on view, and does not store the Aadhaar number itself. It checks files against your KYC or credit checklist, watches validity dates, and schedules periodic re-KYC. Maker-checker approval and a complete audit trail are built in, and retention is configurable.
Abscode is not a loan origination system. It works alongside your LOS as the system of record for documents, and it can digitise your legacy loan files in bulk. It is free for up to 10 users, and you pay for usage rather than per seat. See how it works for lenders, NBFCs and MFIs.
Building KYC into your own app? The Abscode extraction API reads KYC forms, bank statements and payslips into structured JSON, and Aadhaar masking runs on-premise, so KYC documents never leave your infrastructure.
Common questions
How long should lenders keep KYC records in India?
Under the RBI KYC Master Direction, records of a customer’s identity and address must be kept for at least five years after the business relationship ends. Transaction records must be kept for at least five years from the date of the transaction.
How often does KYC have to be updated?
At least once every two years for high-risk customers, every eight years for medium-risk customers and every ten years for low-risk customers, counted from account opening or the last KYC update.
Can we keep copies of Aadhaar cards?
Keep masked copies. When Aadhaar is submitted as a proof without authentication, the number should be redacted or blacked out. Any Aadhaar numbers you are allowed to store should be held only in an Aadhaar Data Vault.
Is a document management system the same as an LOS?
No. The loan origination system runs the credit process. A document management system keeps the complete, checked and approved set of documents for each borrower, with retention, re-KYC and an audit trail. Most lenders need both.
How quickly can we produce files for an inspection?
With one record per borrower, immediately. Search for the borrower or loan, and the full file opens with every document, approval and date in one place.
Does Abscode store Aadhaar numbers?
No. Abscode DMS masks Aadhaar and PAN on view and does not store the Aadhaar number itself.
