KYC Record Retention Period in India: RBI, PMLA, and DPDP Rules

Updated September 2026. Citations now follow the entity-wise RBI KYC Directions of 28 November 2025, which repealed the 2016 Master Direction.

Banks, NBFCs, payment operators, and housing finance companies hold customer records that at least three frameworks govern at once: the RBI KYC Directions, the Prevention of Money Laundering Act, and the DPDP Act 2023. The retention periods they impose are not identical, and the institution answers to all of them simultaneously.

The Short Answer: Five Years After the Relationship Ends

On 28 November 2025 the RBI repealed the Master Direction on KYC, 2016 and replaced it with a separate KYC Direction for each class of regulated entity. The retention floor did not move. Chapter VII (Record Management) of every one of those Directions carries the same two sub-paragraphs. The NBFC text reads:

“(1) maintain all necessary records of transactions between the NBFC and the customer, both domestic and international, for at least five years from the date of transaction; (2) preserve the records pertaining to the identification of the customers and their addresses, obtained while opening the account and during the course of business relationship, for at least five years after the business relationship has ended;” (Paragraph 47, RBI NBFC Know Your Customer Directions, 2025)

The bank Directions use identical words with “the bank” in place of “the NBFC”. What changes is the paragraph number:

Regulated entity	Instrument (all dated 28 November 2025)	Retention paragraph
NBFCs	RBI NBFC Know Your Customer Directions, 2025	47
All India Financial Institutions	RBI AIFI Know Your Customer Directions, 2025	47
Urban and Rural Co-operative Banks, Regional Rural Banks, Local Area Banks, Payments Banks	The KYC Directions, 2025 for each class	49
Commercial Banks	RBI Commercial Banks Know Your Customer Directions, 2025	50
Small Finance Banks	RBI Small Finance Banks Know Your Customer Directions, 2025	51

Paragraph numbers were read from the text on rbi.org.in on 22 September 2026. Six of the nine Directions were amended on 18 September 2026, and an amendment can renumber. Check the current text before a number goes into a denial notice. The chapter reference, Chapter VII (Record Management), is the same in all nine.

The PMLA (Maintenance of Records) Rules, 2005 carry the same five-year requirement for the records they govern. Two clocks, one floor: transaction records run five years from each transaction, identity records run five years from the end of the relationship.

The ten-year figure that circulates in compliance guidance is not the current statutory minimum for standard KYC. It traces to legacy provisions, to the Payment and Settlement Systems Act framework for certain payment operators, to litigation-driven retention under the Limitation Act for contested accounts, or to internal policies that chose the conservative number. Unless a specific instrument or an active dispute applies, five years is the floor.

The Retention Matrix by Regulator

Data type	Governing instrument	Period	Clock starts
Customer identity records (PAN, Aadhaar, address proof, photographs)	RBI KYC Directions 2025, Chapter VII, sub-paragraph (2); PMLA Rules 2005	Minimum 5 years	End of business relationship
Transaction records	RBI KYC Directions 2025, Chapter VII, sub-paragraph (1); PMLA Rules 2005	Minimum 5 years	Date of each transaction
Broker books, records, and KYC	SEBI Stock Brokers Regulations (5 years under the 1992 Regulations; 8 years under the 2026 Regulations); PMLA framework	5 to 8 years	Per the applicable regulation
Insurer KYC and transaction records	IRDAI AML/CFT Master Guidelines 2022	5 years	Transaction or end of relationship
Insurer claims investigation records	IRDAI Investigation Regulations 2020	3 years (claims below Rs 1 lakh); 5 years (Rs 1 to 10 lakh)	Per regulation
Pension subscriber KYC	PMLA framework as applied to PFRDA-regulated entities	5 years	Post-exit
Board and general meeting minute books	Companies (Management and Administration) Rules 2014, Rule 25	Permanent	n/a
Office copies of board notices and agendas	Secretarial Standards read with the Companies Act 2013	8 financial years	Per standard
App usage logs, marketing preferences, behavioural analytics	No sectoral retention mandate	No statutory minimum beyond the DPDP Rules’ one-year log requirement where it applies	n/a

The line that matters runs between the first rows and the last one: data a law requires you to keep, and data that exists only because your systems collected it. The DPDP Act treats the two very differently.

Where the DPDP Act Fits

Section 8(7) of the DPDP Act requires a Data Fiduciary to erase personal data when consent is withdrawn or the specified purpose is no longer served, unless retention is necessary for compliance with any law in force. Section 12(3) gives the customer the right to request that erasure. The carve-out settles the apparent conflict with the KYC mandates, on three conditions:

1. Name the instrument. “RBI requirements” is not a legal basis. The KYC Direction that applies to your entity class, with its Chapter VII retention paragraph, or the applicable PMLA rule, is. A notice that still cites the 2016 Master Direction cites a repealed instrument.
2. Record the exact period. Five years from relationship end for identity records; five years from transaction date for transaction records.
3. Confine the carve-out to the mandated fields. Everything else follows the standard erasure obligation, whatever else sits in the same customer file.

The RBI-DPDP retention conflict framework covers the resolution mechanism in depth; banks and NBFCs have sector-specific treatments.

The Three Retention Classes

Class	What it holds	On an erasure request
Legally mandated	KYC identity records, transaction records, STRs, beneficial ownership documentation	Retain for the statutory period; refuse erasure in writing with the instrument named; register the denial
Operationally necessary	Loan agreements, guarantees, account statements under contract or audit need	Retain only while a specific law or live contract requires; erase otherwise
Ancillary	Marketing preferences, campaign history, analytics, browsing logs	Erase on request or when the purpose is served

The audit risk lives at the boundary. Retain everything under a generic “regulatory requirements” label and the institution breaches the DPDP Act’s storage limitation for every ancillary field. Erase too aggressively and it breaches the PMLA. Only per-field classification satisfies both, which is why the classification, not the policy document, is the real control.

Two further DPDP Rules provisions shape the schedule. The Rules require retention of personal data, traffic data, and processing logs for one year for the security and investigation purposes they specify, which sets a floor for categories that previously had none. And Rule 8 with the Third Schedule imposes erasure timelines and a 48-hour pre-erasure notice on specified large classes only: e-commerce entities with 2 crore or more registered users, online gaming intermediaries, and social media intermediaries. A typical bank or NBFC sits outside those classes; its retention periods come from its specified purposes and the sectoral mandates above.

What Happens After Five Years

Expiry of the statutory period is a compliance event, not an automatic deletion. The legal basis under the KYC mandates ends, and the DPDP erasure obligation applies in full. The institution must then either erase proactively or respond to erasure requests, unless another live basis, pending litigation, a tax proceeding, an investigation, justifies continued retention with its own documented citation. An institution whose systems cannot tell which records crossed their expiry date cannot execute this step, which is why the retention schedule has to be enforced where the data lives, not in a policy binder.

Common Mistakes

Treating five years as a maximum. It is a minimum. Live disputes and investigations extend it, lawfully, under the same carve-out.

Retaining everything indefinitely. Ancillary data has no mandate behind it. Indefinite retention of marketing and analytics data breaches purpose and storage limitation the day the obligations take effect.

One period for all data. Transaction records, identity records, and marketing data run on different clocks with different bases. A single “retain five years” policy is simultaneously too long and too short.

No denial register. Refusing erasure without a documented, instrument-specific record converts a lawful refusal into an undefendable one. The register is the artefact both the Board and an RBI inspection will ask for.

Where ConsentOS Fits

ConsentOS is built for the boundary this article describes. The Data Inventory portal holds the map of what the institution stores and under which basis. When a customer requests erasure, the Legal Obligation Override flags the statutory-retention conflict and registers the denial with its named instrument and period, while consent records document the basis for everything else. The conflict-of-law register gives the compliance team one place where every retention-versus-erasure decision is documented for inspection.

Run the Gap Assessment to score your retention position against the DPDP Act and your sector’s mandates.