Chapter 10: SEBI (KYC Registration Agency) Regulations, 2011

Prior to 2011, investors opening accounts across multiple financial intermediaries (such as a broker, depository participant, and mutual fund) had to submit physical KYC documentation separately to each entity. The SEBI (KYC Registration Agency) Regulations, 2011 established the KYC Registration Agency (KRA) system to eliminate duplicate documentation, streamline investor onboarding, and centralize client identification records.

Eligibility Criteria for KRAs (Regulation 3)

A Certificate of Registration to act as a KRA can be granted only to:

1. A recognized stock exchange;
2. A registered depository;
3. A registered registrar to an issue and share transfer agent with a minimum net worth of ₹25 Crores;
4. Any other entity specifically permitted by SEBI.

Capital Adequacy Mandate

Every KRA must continuously maintain a minimum net worth of ₹25 Crores. The KRA must be a dedicated, specialized subsidiary equipped with secure server infrastructure, disaster recovery sites, and ISO-certified data security architecture.

The KRA system operates through reciprocal obligations between onboarding intermediaries and central KRAs.

Obligations of the Intermediary (Regulation 16)

• KYC Collection & In-Person Verification (IPV): The intermediary must collect customer KYC details, examine original identification documents, and conduct mandatory IPV (or Video In-Person Verification - VIPV).
• Upload Timelines: The intermediary must upload verified KYC data and scanned documents to the KRA system within thirty (30) calendar days of account opening (compressed to 3 working days under updated circulars).
• Physical Document Retention: Where physical forms are collected, the original documents must be safely stored and made available upon audit request.

Obligations of the KRA (Regulation 14 & 15)

• Centralize, store, and safeguard electronic KYC records.
• Validate KYC details by verifying PAN with the Income Tax database, verifying mobile numbers and email addresses, and matching Aadhaar records.
• Inter-KRA Interoperability: KRAs must synchronize records across all registered KRAs (such as CVL KRA, NDML KRA, DOTEX KRA, CAMS KRA, Karvy/KFin KRA) within 24 hours, ensuring that an investor onboarded through one KRA can immediately trade through any other intermediary without repeating KYC.

Modern onboarding integrates digital verification mechanisms that improve compliance efficiency and speed up account opening.

Digital Onboarding Channels

1. Aadhaar e-KYC (UIDAI): Direct biometric or OTP-based electronic verification via UIDAI.
2. Offline Aadhaar XML / QR Code Verification: Tamper-proof offline XML verification where the investor's Aadhaar number is masked, storing only the last four digits.
3. DigiLocker Integration: Direct API retrieval of digitally signed identity documents (PAN card, driving license) from the government DigiLocker repository.
4. Video In-Person Verification (VIPV): High-resolution live video interaction incorporating randomized dynamic OTPs, geo-tagging, live facial recognition, and anti-spoofing liveness detection.

Central KYC Registry (CKYCR) Coordination

Under Central Government guidelines, KRAs and intermediaries must also interface with the Central KYC Registry (CKYCR) operated by CERSAI:

• Every individual customer is assigned a unique 14-digit KYC Identification Number (KIN).
• Once a KIN is generated, any financial institution across banking, insurance, pensions, or securities can retrieve verified records directly.

Surrender and Cancellation of KRA Registration

A KRA cannot unilaterally cease operations. It must obtain prior written approval from SEBI and seamlessly transfer its entire digital database, audit logs, and document archives to another operational KRA designated by SEBI, ensuring zero disruption to capital market participants.

As core repositories of sensitive identity data, KRAs are subjected to specialized regulatory governance to ensure operational integrity and data protection.

Internal Audit and Systems Review

• Half-Yearly Internal Audit: Every KRA must subject its operations, computer networks, and data storage systems to a comprehensive half-yearly internal audit conducted by an independent chartered accountant or certified information systems auditor (CISA).
• Inspection by SEBI: SEBI conducts periodic inspections to verify whether the KRA validates PAN and Aadhaar records within regulatory turnaround times, prevents unauthorized data modifications, and enforces zero-trust access controls.

Cybersecurity and Client Record Portability

• Data Encryption: All investor biometric hashes, identity documents, and demographic details stored in the KRA database must be encrypted both in transit (TLS 1.3) and at rest (AES-256).
• Seamless Portability: When an investor switches brokers or adds an investment account, the new intermediary retrieves the verified KYC record from the KRA electronically using the client's PAN and date of birth/incorporation, without requesting physical documents from the client.