7.1 The Unified KYC Architecture: In-Person Verification (IPV), Proof of Identity, and Address for Individuals

The Uniform KYC Framework in Securities Markets

To eliminate fragmented, redundant verification across stockbrokers, depository participants, mutual fund AMCs, and portfolio managers, SEBI established a Uniform KYC Architecture across the entire securities market. Under this regime, an investor completes KYC once with any registered capital market intermediary, and that verification holds good across all other SEBI-registered entities.

+---------------------------------------------------------------------------------------------------+
|                                  THE UNIFIED KYC VERIFICATION TRIAD                               |
+-----------------------------------+---------------------------------------------------------------+
| 1. Permanent Account Number (PAN) | - Sole mandatory identifier for all capital market transactions|
|                                   | - Verified real-time against Income Tax Department database   |
+-----------------------------------+---------------------------------------------------------------+
| 2. Officially Valid Documents     | - Proof of Identity (PoI) and Proof of Address (PoA):         |
|    (OVDs)                         |   Aadhaar, Passport, Driving License, Voter Identity Card     |
+-----------------------------------+---------------------------------------------------------------+
| 3. In-Person Verification (IPV)   | - Mandatory physical or digital (VIPV) face-to-face check     |
|                                   |   to prevent identity theft and ghost account creation        |
+-----------------------------------+---------------------------------------------------------------+

Deconstructing Officially Valid Documents (OVDs)

Under Rule 2(1)(d) of the PML Rules, 2005, an investor must furnish officially valid documents to establish identity and residential address:

• Aadhaar Card: Verified via UIDAI offline XML, QR code scanning, or e-KYC authentication.
• Passport: Mandatory for foreign nationals, Non-Resident Indians (NRIs), and domestic applicants traveling frequently.
• Driving License: Must be current and unexpired.
• Voter Identity Card (EPIC): Issued by the Election Commission of India.

Note on PAN: While PAN is mandatory under SEBI regulations for all financial accounts, it acts primarily as a tax identifier. An OVD (such as Aadhaar or Passport) is required alongside PAN to establish verified residential address and legal identity.

In-Person Verification (IPV) Mandate

To eliminate identity theft, impersonation, and "mule" accounts operated on behalf of unseen criminals, SEBI mandates that every intermediary conduct an In-Person Verification (IPV):

1. Physical IPV: A registered employee or authorized person of the intermediary physically meets the investor, verifies original documents against submitted copies, and affixes a signed, dated stamp stating "Originals Verified & IPV Done".
2. Digital IPV (VIPV): Intermediaries can complete IPV digitally using secure, real-time video streaming applications with automated anti-spoofing and geo-tagging controls.

7.2 Digital KYC Systems, Online KYC Mobile Applications, and Non-Individual Entity Due Diligence

Regulatory Framework for Digital KYC Apps

Under SEBI circulars, intermediaries can deploy proprietary or vendor-built Online KYC Applications (web portals and mobile apps) to onboard clients seamlessly across India:

+---------------------------------------------------------------------------------------------------+
|                        ONLINE KYC APPLICATION TECHNICAL SPECIFICATIONS                            |
+-------------------+-------------------------------------------------------------------------------+
| Liveness          | System must perform automated live facial detection (verifying natural micro- |
| Detection (AI)    | movements, eye blinking, smiling, or head tilting) to prevent photo spoofing  |
+-------------------+-------------------------------------------------------------------------------+
| Facial Match Rate | AI algorithm matches client live camera capture against photo in Aadhaar/PoI; |
| Threshold         | Match score must exceed strict statistical confidence threshold (>= 80%)      |
+-------------------+-------------------------------------------------------------------------------+
| GPS Geo-Tagging   | App captures real-time latitude and longitude coordinates; must verify client  |
| Mandate           | is physically located within the sovereign borders of India                   |
+-------------------+-------------------------------------------------------------------------------+
| Video Interaction | Compliance officer conducts live interaction, asks random security questions, |
| & OTP Challenge   | displays dynamic One-Time Password (OTP) for the client to read aloud         |
+-------------------+-------------------------------------------------------------------------------+
| Tamper-Proof      | All video recordings, GPS logs, IP addresses, and document scans must be      |
| Storage           | encrypted, timestamped, and preserved for 5 years post-account closure        |
+-------------------+-------------------------------------------------------------------------------+

Due Diligence Requirements for Non-Individual Entities

When onboarding corporate entities, partnerships, and trusts, the risk of money laundering through complex corporate veils is acute. SEBI mandates an exhaustive documentation protocol:

+---------------------------------------------------------------------------------------------------+
|                         NON-INDIVIDUAL ENTITY KYC DOCUMENTATION MATRIX                            |
+-------------------+-------------------------------------------------------------------------------+
| Corporate Bodies  | - Certificate of Incorporation, Memorandum and Articles of Association (MoA)  |
| & Companies       | - Board Resolution authorizing account opening and designated signatories     |
|                   | - List of Directors with DIN numbers, PANs, and address proofs                |
|                   | - Mandatory **UBO Annexure** identifying all natural persons holding > 10%    |
+-------------------+-------------------------------------------------------------------------------+
| Partnership Firms | - Registration Certificate, Partnership Deed, PAN of the firm                 |
| & LLPs            | - Authorized Signatory List with specimen signatures                          |
|                   | - Mandatory **UBO Annexure** identifying natural persons holding > 10% profits|
+-------------------+-------------------------------------------------------------------------------+
| Trusts & AIFs     | - Registered Trust Deed, PAN of the trust                                     |
|                   | - Details of Settlors, Trustees, and Beneficiaries holding >= 10% interest    |
|                   | - SEBI Registration Certificate (for AIFs / Mutual Funds)                     |
+-------------------+-------------------------------------------------------------------------------+
| Foreign Portfolio | - Valid SEBI FPI Registration Certificate                                     |
| Investors (FPIs)  | - Categorization under Category I (Sovereign/Govt) or Category II             |
|                   | - Complete UBO declaration up to natural person level without bearer shares   |
+-------------------+-------------------------------------------------------------------------------+

7.3 SARAL Form, KYC Registration Agencies (KRAs), CKYCR, and Intermediary Guidelines

The SARAL Account Opening Form

To simplify capital market participation for small retail individual investors intending to trade only in the cash equity segment, SEBI introduced the simplified SARAL Account Opening Form:

• Simplified Documentation: Combines the standard account opening form and KYC form into a streamlined 2-page document.
• Limited Scope: Restricts trading strictly to the cash segment (no derivative exposure, margin trading, or algorithmic trading enabled at inception).
• Reduced Complexity: Cuts out complex legal waivers and foreign compliance annexures, making onboarding effortless for first-time retail investors.

KYC Registration Agencies (KRAs)

Governed by the SEBI (KYC Registration Agency) Regulations, 2011, KRAs are centralized, SEBI-registered institutions that maintain electronic repositories of KYC records for all capital market investors:

Intermediary A onboards Client ---> Uploads KYC Data & OVDs to KRA within 3 Days
                                                 |
                                                 v
                   KRA (CVL, NDML, CAMS, Karvy, DotEx) Validates Records
                   - Validates PAN against Income Tax Database
                   - Validates Aadhaar & Digilocker records
                   - Marks status as "KRA Validated" or "KRA Registered"
                                                 |
                                                 v
Intermediary B onboards same Client ---> Downloads existing verified KYC from KRA!
(Zero duplicate paperwork; Client trades immediately across broking, mutual funds, PMS!)

"KRA Validated" vs. "KRA Registered" Status

Following enhanced SEBI risk norms, KRA records are categorized based on document verification rigor:

• KRA Validated: Independent verification of PAN, Aadhaar (via UIDAI/DigiLocker), mobile number, and email. The client can seamlessly open accounts with ANY intermediary without submitting any fresh documents.
• KRA Registered: Documents accepted, but mobile or email could not be independently validated. The client can continue trading with their existing intermediary, but must complete re-validation when opening an account with a new intermediary.

Dual-Layered Central Architecture: KRA vs. CKYCR

• KRA: Governed by SEBI; serves the securities market specifically (equities, derivatives, commodities, mutual funds, PMS, AIFs).
• CKYCR (Central KYC Registry): Governed by CERSAI and the Ministry of Finance; spans the entire financial sector (commercial banks, NBFCs, insurance companies, pension funds, and securities).
• Securities intermediaries must upload client data to BOTH systems, guaranteeing inter-operable compliance across the Indian financial system.