SEBI Digital KYC for NRIs, OCIs and Foreign Nationals from 3 December 2026: Intermediary Controls

Summary: SEBI’s circular dated 4 November 2026 revises the KYC process for an individual person resident outside India and takes effect on 3 December 2026. It covers non-resident Indians, overseas citizens of India and foreign nationals from FATF-compliant countries. The circular enables electronic submission and execution of KYC documents from abroad, validates portability through KYC Registration Agencies and CKYCRR, and permits video in-person verification where physical IPV is not feasible. The facilitation is accompanied by controls: the intermediary that onboards the client retains ultimate responsibility, must apply enhanced due diligence where needed, must verify the required identity and address evidence, and must upload KYC records to a KRA within three working days. This article translates the circular into a practical control map for securities-market intermediaries and explains the evidence that compliance, operations and technology teams should retain before the effective date.

What Changes on 3 December 2026

The circular applies to individual persons resident outside India who are non-resident Indians, overseas citizens of India or foreign nationals of a FATF-compliant country. It is a securities-market KYC measure; it does not by itself decide whether a proposed investment is permitted under FEMA, sectoral limits, sanctions rules or the product rules. Intermediaries must therefore separate client identification from investment eligibility and transaction-level compliance.

An eligible client may submit and execute KYC documents digitally while abroad. The framework also permits reliance on KYC completed by another SEBI-registered intermediary through a KRA, or by another regulated entity through CKYCRR. Reliance reduces repetitive collection, but it does not transfer accountability. The onboarding intermediary must obtain the available record, check the client against its own risk framework and perform additional verification where the record is incomplete, stale, inconsistent or higher risk.

Documents and Address Evidence Require a Consistent Identity Chain

PAN, Passport and OCI Evidence

The client file should contain PAN, passport and an OCI card where applicable, together with identity and address evidence required by the operative KYC framework. A passport may establish several attributes, but the intermediary should not assume that every passport address is current. Names, dates of birth, citizenship, document numbers and expiry dates should be reconciled across the application and retrieved records. Transliteration, initials and married names require a documented matching decision rather than an automated rejection or an unexplained override.

Overseas Address Is the Current Address

For a person resident outside India, the overseas address is the current address. The system should distinguish it from an Indian correspondence address or historical address. Address proof should be legible, valid under the applicable KYC rules and linked to the client. Where a permitted document is not in English, the intermediary should follow its approved translation and certification process. The country field should drive FATF-country screening and should not be inferred only from a mobile number or IP address.

Electronic Execution Must Be More Than an Uploaded Image

Electronic forms and signatures are permitted subject to the checks in the circular and the wider KYC framework. Operations should preserve the original electronic document, signature certificate or other verification result, timestamp, consent record and any tamper-evident hash generated by the platform. A scanned signature pasted into a file is not automatically equivalent to a verifiable electronic execution. The workflow should identify who signed, what version was signed and whether the completed form can be reproduced later.

Technology controls should prevent a staff member from changing material KYC data after the client’s electronic execution without triggering a fresh confirmation. Mandatory fields, validation rules and exception approvals should be logged. If data imported from a KRA or CKYCRR conflicts with a newly submitted document, the discrepancy should be resolved before account activation and the reason recorded.

Video In-Person Verification: A Controlled Live Process

When VIPV Can Be Used

The circular permits video in-person verification where physical IPV is not feasible. The session must be live and conducted by an authorised official. It should support face liveness, geo-tagging and end-to-end encryption. A pre-recorded clip, a video uploaded by the client or a call conducted by an unauthorised vendor agent does not provide the same controlled evidence. The intermediary should define fallback rules for poor connectivity, failed liveness, mismatched documents or a location that creates a risk or legal concern.

What the Session Record Should Show

The record should connect the individual appearing on video with the verified documents and the application. It should capture date and time, authorised official, location information, liveness outcome, document display or verification steps, consent and exceptions. Access to recordings should be restricted, retention should follow the applicable legal and cybersecurity requirements, and the platform should preserve integrity without exposing sensitive data unnecessarily.

KRA, CKYCRR and the Three-Working-Day Upload

Once KYC is completed, the intermediary must submit the record to a KRA within three working days. A control should calculate the deadline from the completion event, account for working days and monitor rejected or pending uploads. A successful API request is not the same as an accepted record; the acknowledgement or status response should be reconciled. Rejections must be resolved promptly and should remain visible on the exception dashboard until accepted.

Where another intermediary’s KYC is retrieved through a KRA, or another regulated entity’s KYC is retrieved through CKYCRR, the onboarding firm should document the attributes obtained, the source, the retrieval date and any supplementary documents collected. The circular’s portability objective is undermined if staff automatically rebuild a complete KYC file without first checking the available record, but prudence is also undermined if staff rely on a record without assessing its quality and currency.

Ultimate Responsibility and Enhanced Due Diligence

The intermediary onboarding the client retains ultimate responsibility for KYC and customer due diligence. It should apply its risk-rating methodology, beneficial-owner and sanctions controls where relevant, source-of-funds or source-of-wealth checks when triggered, and enhanced due diligence for higher-risk facts. FATF-compliant-country status is an eligibility condition in the circular, not a blanket declaration that every client or transaction from that country is low risk.

The file should show a reasoned approval rather than a collection of documents. Compliance should be able to reconstruct why the person was eligible for the digital route, how identity and current address were verified, which external record was relied on, what additional checks were performed and who approved activation. Re-KYC uses the same principles, so the design should support refreshed information and should not be limited to first-time accounts.

Implementation Checklist Before the Effective Date

• Update eligibility rules for NRI, OCI and foreign-national clients in FATF-compliant countries.
• Configure passport, PAN, OCI and overseas-address fields with discrepancy and expiry controls.
• Validate electronic execution, consent, document integrity and post-signature change controls.
• Test VIPV for liveness, geo-tagging, encryption, authorised-official presence and fallback handling.
• Integrate KRA and CKYCRR retrieval with a documented gap and risk assessment.
• Monitor KRA submissions and acknowledgements against the three-working-day requirement.
• Train compliance and operations teams on ultimate responsibility and re-KYC treatment.

Frequently Asked Questions

When does the revised SEBI process become effective?

The circular takes effect on 3 December 2026.

Which clients are covered?

It covers individual persons resident outside India who are NRIs, OCIs or foreign nationals from FATF-compliant countries, subject to the circular and other applicable law.

Can KYC documents be signed while the client is abroad?

Yes. Electronic submission and execution are permitted, subject to validation, audit-trail and wider KYC requirements.

May an intermediary rely on KYC completed elsewhere?

It may use a KRA record from another SEBI intermediary or a CKYCRR record from another regulated entity, but it retains ultimate responsibility and must address gaps or risk triggers.

Is video verification compulsory in every case?

The circular permits VIPV when physical IPV is not feasible. The chosen route must meet the applicable KYC requirements.

What controls are expected for VIPV?

A live process with an authorised official, geo-tagging, face liveness, end-to-end encryption and a retrievable integrity-protected record is required.

How quickly must the completed KYC be sent to a KRA?

The intermediary must submit it within three working days and should retain proof of acceptance, not merely proof that an upload was attempted.

Does the circular also apply to re-KYC?

Yes. The revised process applies to re-KYC as well as onboarding, subject to the operative framework.

Key Takeaways

• The revised process starts on 3 December 2026 and is limited to the eligible individual PROI categories.
• Digital execution and portability reduce repetition but do not shift the onboarding intermediary’s responsibility.
• The overseas address must be treated as the current address and reconciled with the identity chain.
• VIPV requires a live, secure and authorised process with liveness and geo-tag evidence.
• KYC must be submitted to a KRA within three working days, with rejections monitored to closure.

****

Disclaimer: This article is a general editorial explanation of SEBI’s circular dated 4 November 2026 on the KYC process for an individual person resident outside India and is current only to the sources checked on 5 November 2026. It is not a substitute for the circular, the KYC Master Circular, the Prevention of Money-laundering framework, FEMA, sanctions requirements, cybersecurity obligations, data-protection duties, intermediary-specific regulations, exchange or depository directions, or any later clarification. Eligibility for digital KYC does not establish that a proposed investment, remittance, account type or transaction is legally permitted. FATF-country status, citizenship, residency, product eligibility, beneficial ownership, source of funds, tax position and risk classification must be verified for the actual client and transaction. Electronic signatures, VIPV, KRA and CKYCRR integrations require technical, legal, privacy and operational controls that cannot be validated from a general article. Intermediaries should confirm the effective date, document list, prescribed process, retention rules, reporting channel and any system specification from official sources immediately before implementation, and should obtain advice from qualified legal, compliance, technology and information-security professionals. Clients should not treat this article as an assurance that their documents will be accepted. TaxGuru accepts no responsibility or liability for any loss, account rejection, regulatory action, data incident, missed timeline, investment restriction or other consequence arising from reliance on this article, incomplete implementation, a later change in law or a difference between the summary and the reader’s particular facts.