Lenders get 31 days to go live on RBI's new KYC rules
A KYC rule change should be a configuration event. In most Indian banks and NBFCs, it is still a release cycle.
The RBI's KYC Amendment Directions, 2026 are expected to be notified by November 30 and operationalized by December 31. That leaves roughly 31 days between the circular landing and the rule going live across every onboarding and servicing journey. The final text will set the specifics. What every lender controls today is how quickly its stack can absorb a change, whatever that change turns out to be.
Due diligence is now something you prove, case by case
The context has shifted. On October 29, the Supreme Court said banks and other financial institutions must compensate digital fraud victims where a failure of due diligence enabled the crime. The bench also said it will examine the RBI's proposed KYC Amendment Directions before issuing further orders (source). That changes what KYC means inside a lender.
Due diligence is no longer a checkbox ticked once at onboarding. It is evidence a lender may have to produce for a specific customer, against the specific rule that applied on that specific day. If you cannot say which version of the rule governed a decision, you cannot defend it.
Why a KYC change still takes a quarter
The problem is structural, not regulatory. In most lenders, KYC logic lives in code, scattered across:
- The customer onboarding journey
- The loan origination system (LOS)
- Partner and LSP integrations
- Servicing and re-KYC flows
One rule change then means tickets in every system, regression cycles in each, and a seat on the release train. A 31-day regulatory window meets a quarterly release calendar. Something gives, and it is usually either the deadline or the audit trail.
The fix: KYC rules as versioned configuration
The answer is architectural. Hold KYC rules as versioned configuration rather than code, with four properties:
- Effective-dated, so a rule switches on at the right moment and not before
- Maker-checker approved, so compliance owns the change, not a developer
- Testable in a sandbox, so you see the impact before customers do
- Reversible, so a wrong call is a rollback, not an incident
Then stamp every customer decision with the rule version that governed it. Two things change at once. A rule change ships in weeks, inside the regulatory window rather than after it. And answering an auditor's question becomes a query, not a forensic reconstruction of what the system did eighteen months ago.
How Trustt approaches it
The real gap in most stacks is KYC policy scattered across journeys and vendors. Trustt's Digital Identity Suite treats eKYC, video KYC, eSign and consent capture as one configurable layer, and stamps each decision with the rule version and consent record behind it.
Because the rule lives in one place, a change is made once and flows through onboarding, origination and servicing together. That is hard to achieve when separate point tools are stitched together, each with its own copy of the policy.
The one question for CXOs this week
If a KYC rule changed on December 1, how many systems would need a release?
If the answer is more than one, that is where to start. Not with the circular, which none of us can change, but with the architecture, which all of us can.
Quick answers
- When do the RBI KYC Amendment Directions, 2026 take effect? They are expected to be notified by November 30, 2026 and operationalized by December 31, 2026, leaving about 31 days to implement.
- What is configuration-driven KYC? KYC rules held as effective-dated, maker-checker approved, versioned configuration instead of hardcoded logic, so one change applies across every journey.
- Why does rule versioning matter for audits? When each customer decision carries the rule version that governed it, a lender can evidence due diligence for any case on any date with a single query.
