The Reserve Bank of India's Know Your Customer Directions, 2025 for commercial banks are dated 28 November 2025 and updated as on 1 October 2026. They make banks sort customers into low, medium and high risk categories (para 20(1)) and update KYC at least every two, eight or 10 years by tier (para 42(1)).
The 2016 Master Direction had both. Other countries set tiers and dates their own way, as the guide to KYC requirements by country shows.
Two clocks run on every customer of an Indian commercial bank. The risk category is reviewed at least every six months (para 41(1)). The KYC file behind it is updated at least every two, eight or 10 years, so a customer can move from low to high long before its file is due.
What is a KYC risk rating?
A KYC risk rating is the label a firm puts on a customer after its know your customer checks: low, medium or high risk of money laundering and terrorist financing. Banks also call it a client risk rating. The RBI ties it to the bank's own "assessment and risk perception" (para 20(1)), and US rules ask banks to understand each relationship "for the purpose of developing a customer risk profile" (31 CFR 1020.210).
In an AML and CFT program, the rating decides what follows: simplified, standard or enhanced due diligence, who signs off, and when the file is next reviewed. Its advantage for companies is proportion, because a low risk customer is not checked like a high risk one.
The rating has to rest on the customer's own facts. Five US agencies said in their joint statement of 6 July 2022 that "no customer type presents a single level of uniform risk". The rating is the result, and the customer risk assessment is the method that produces it.
What are the low, medium and high risk categories in KYC?
Table 1. The three KYC risk categories compared (as of October 2026).
| Tier | Typical profile | Due diligence | Sign off | RBI KYC update (commercial banks) |
|---|---|---|---|---|
| Low | Regulated financial institutions, listed companies with ownership disclosure, public administrations, low premium life insurance (FATF INR.10 para 17) | Simplified, where the law allows it; never on suspicion | Standard onboarding | At least every 10 years |
| Medium | Not among FATF's examples; each firm writes its own definition | Standard customer due diligence | Standard onboarding | At least every eight years |
| High | Non resident customers, personal asset holding vehicles, nominee shareholders or bearer shares, cash intensive businesses, unusually complex ownership (para 15); foreign PEPs (Recommendation 12) | Enhanced due diligence | Senior management, required for foreign PEPs | At least every two years |
The profiles are FATF's own examples, from the Interpretive Note to Recommendation 10 in the FATF Recommendations (June 2026 text). A low risk customer can get simplified measures, but FATF rules them out "whenever there is a suspicion of money laundering or terrorist financing" (para 21).
None of the five rulebooks on this page defines medium. The RBI leaves it to the bank's assessment, so a medium customer gets standard CDD.
High risk means enhanced due diligence (EDD), with senior management approval: required for foreign PEPs (Recommendation 12), a FATF example for other high risk files (para 20).
The RBI requires three tiers. A fourth, such as "very high" or "prohibited", would be the firm's own addition, not an RBI category.
Which factors decide a customer's risk rating?
The RBI's parameters (para 20(3)) and the FATF, UK and EU rules name the same types of risk in KYC, grouped here in five:
- Customer and ownership. Who the customer is and who owns it. A PEP among the owners raises the tier, so PEP screening runs at onboarding.
- Geography. Where the customer lives, trades and sends money. A lack of adequate AML systems, sanctions such as the UN's or OFAC's, and significant corruption all push it up (high risk countries on FATF and EU lists).
- Product and service. Private banking is on FATF's higher risk list; life cover with an annual premium under USD or EUR 1,000 is on the lower one. Sector specific risk factors belong here: correspondent banking for banks, anonymity for crypto firms.
- Delivery channel. Onboarding without meeting the customer is a high risk factor where no safeguard such as electronic identification is in place (MLR 2017 reg 33(6)). Indian commercial banks rate such customers high, Aadhaar OTP eKYC aside, and monitor the account closely until the identity is verified face to face or by video KYC (para 44(6)).
- Transactions and behavior. The account's purpose, the size of deposits and transactions, and how regular and long the relationship is (FATF para 19, MLR 2017 reg 28(13), AMLR Annex I).
How does the risk rating process turn a score into a tier?
The risk rating process has three steps: collect the KYC facts, score each factor, map the total to a tier. In the illustrative customer risk rating model below, factors score 0, 50 or 100, weights add up to 100 percent, and the bands are low 0 to 39, medium 40 to 69 and high 70 and above.
Table 2. An illustrative risk score for an exporter.
| Factor | Weight | Finding | Score | Points |
|---|---|---|---|---|
| Customer and ownership | 30% | Two layers of ownership | 50 | 15 |
| Geography | 25% | Main buyer in a country under FATF increased monitoring | 100 | 25 |
| Product | 20% | Trade finance | 50 | 10 |
| Channel | 15% | Onboarded in a branch | 0 | 0 |
| Transactions | 10% | Wires in line with turnover | 50 | 5 |
| Total | 100% | 55, medium |
At 55 the exporter is medium and gets standard CDD. Onboard it remotely without a video check and the channel scores 100, adding 15 points: 70, high. An Indian commercial bank would rate it high whatever the score (para 44(6)), and the file records the score, the override and the reason. The RBI keeps that category and its reasons confidential, so the customer is not tipped off (para 20(4)). Table 2 works as a starting template.
In complead, the customer risk assessment and KYC product rates each customer on the firm's own factors and weights, shows each factor's weight and source, and records overrides with their reason.
How often is a KYC risk rating reviewed?
Table 3. Rating review and file update, by jurisdiction (as of October 2026).
| Jurisdiction | Rule | Rating review | File update | Status |
|---|---|---|---|---|
| India, commercial banks | RBI KYC Directions, 2025, paras 41(1), 42(1) | At least every six months | At least every 2 years (high), 8 (medium), 10 (low), from account opening or the last update | Dated 28 November 2025; version as on 1 October 2026 |
| European Union, today | Directive (EU) 2015/849, Article 14(5) | No interval set | At appropriate times, on a risk sensitive basis, and when circumstances change | Applies through national laws |
| European Union, from 10 July 2027 | AMLR Article 26(2), (3) | No interval set | At most 1 year for higher risk customers under enhanced due diligence, 5 years for others; also on a change in circumstances or a relevant new fact | Applies from 10 July 2027 (Article 90) |
| United Kingdom | MLR 2017 reg 27(8), reg 28(11) | No interval set | At other appropriate times on a risk based approach, and when circumstances change; records kept up to date | In force |
| United States | 31 CFR 1020.210(a)(2)(v) | No interval set | On a risk basis | In force |
Only India dates the rating itself. The other rules speak to the file, and only the EU, from 2027, caps the gap between updates.
Between those dates, ongoing monitoring picks up changes in the customer. A review on such a change, with the date as a backstop, is the idea behind perpetual KYC.
What changed in 2026?
- June. The June 2026 FATF Recommendations carry the February 2025 revision: countries must allow and encourage simplified measures where risk is lower (INR.10 para 16).
- 30 June. For low risk individuals with an overdue KYC update, the RBI gave banks until this date, or one year past the due date if later, with all transactions still allowed (para 42(2)).
- 1 October. The RBI's 2025 KYC Directions for commercial banks reach their current version.
How does a firm build the customer risk assessment that produces this rating, and how much weight does each input get?
Related terms
- Customer risk assessment. The method that weighs a customer's factors and produces the rating.
- Enhanced due diligence. The deeper checks a high risk rating sets off.
- Customer due diligence. The identity, ownership and purpose checks every customer gets.
- Simplified due diligence. Lighter checks a firm may use where the rating is low and nothing is suspicious.
- Ongoing monitoring. The watch on a customer's transactions and file that runs for as long as the relationship lasts.
- Perpetual KYC. Reviewing a customer when something changes, with the review date as a backstop.
How this entry was checked. Last reviewed: 28 October 2026. Onur Taner, Customer Success Manager at complead, wrote it, and Ufuk Gürdaş, Compliance Specialist, is its fact checker. On 28 October 2026 each rule was reopened at its source. They are the Reserve Bank of India's Know Your Customer Directions, 2025 for commercial banks (version as on 1 October 2026) and its 2016 Master Direction, the FATF Recommendations with the Interpretive Note to Recommendation 10 (June 2026 text), Regulation (EU) 2024/1624, Directive (EU) 2015/849, the UK Money Laundering Regulations 2017 (regulations 27, 28 and 33), 31 CFR 1020.210 and the US joint statement of 6 July 2022. Tier names follow FATF and RBI wording, and the Table 2 scores are illustrative.
