Client KYC, KRA & Onboarding for Research AnalystsKYC for research analysts is mandatory for every fee-paying client. You verify the client, check or upload their record with a SEBI-registered KRA, take consent on your terms and MITC before charging a fee, and keep the records for at least five years.  Last updated: 21 October 2026 Client KYC for a research analyst means verifying every fee-paying client's identity before you charge a fee or send research, then checking and uploading that KYC record with a SEBI-registered KYC Registration Agency (KRA). Under the SEBI (Research Analysts) Regulations, 2014, you must also keep the KYC record, a client register with PAN, the terms and conditions the client accepted and their consent. A digital e-KYC and client onboarding workflow lets you run these steps in order and keep the proof together. This guide covers what the regulations and SEBI's KYC master circular ask of RAs, how a KRA check works, where CKYC fits in, and a practical onboarding sequence. It is a summary, not legal advice: always check the current SEBI regulations and circulars before you change your process. Is KYC mandatory for SEBI research analysts?Yes, for fee-paying clients. Regulation 25(1) of the RA Regulations lists the records an RA must keep, and it includes "Know Your Client records of the fee paying client". The Master Circular for Research Analysts dated February 6, 2026 repeats that an RA or research entity shall follow the KYC procedure for its fee-paying clients and maintain KYC records as SEBI specifies from time to time. SEBI's FAQs in the same master circular clarify the edge cases. KYC is required for clients who pay fees directly for research services. Clients who receive research as a value-added service (for example, broking clients of a research entity) are still clients for other purposes, such as terms and conditions and records of interaction, so do not treat them as outside your compliance net. For the detailed KYC procedure, the RA master circular points RAs to SEBI's Master Circular on KYC norms for the securities market dated October 12, 2023 and the related circulars on KRA uploads to the Central KYC Records Registry. Those documents apply to all SEBI-registered intermediaries, and RAs are one of them. What must an RA collect from a client during onboarding?The KYC master circular sets a uniform KYC form for the whole securities market. Part I is the KYC form itself, based on the CERSAI CKYC templates for individuals and legal entities. Part II is information specific to your service, which for an RA is mainly the terms of the research service. PAN, verified onlinePAN is the unique identifier for every securities market participant. You must verify it online with the Income Tax database rather than insisting on a copy, and the PAN must be valid: an inoperative PAN that is not linked with Aadhaar is a problem for KYC. Proof of identity and addressCollect an officially valid document (OVD) for identity and address. In digital KYC, documents other than Aadhaar are submitted through DigiLocker or under an electronic signature, including Aadhaar e-sign. Mobile number and emailBoth are verified by OTP or another verifiable method and uploaded to the KRA. They must be the client's own details, never an employee's or a sales agent's. Photograph and consentOnline KYC captures the client's photograph digitally, and you must take the client's express consent before starting online KYC. Aadhaar, handled carefullyUse of Aadhaar is voluntary. Intermediaries must not store a client's Aadhaar number in their systems, and where a client submits an Aadhaar copy that does not need authentication, it should be redacted. What is a KRA and how does a KRA check work?A KYC Registration Agency (KRA) is a SEBI-registered entity, governed by the SEBI {KYC (Know Your Client) Registration Agency} Regulations, 2011, that holds KYC records centrally for the securities market. CVL KRA and NDML KRA are two of the agencies registered with SEBI; check SEBI's website for the current list. The point of a KRA is that a client completes KYC once and other intermediaries can rely on it. Step 1: search by PANWhen a new client signs up, you query the KRA with their PAN to see whether a KYC record already exists and what its status is. Step 2: fetch a validated recordIf the record is validated, it is portable: the client does not need to repeat KYC, and you fetch the record from the KRA database. Step 3: fresh KYC and uploadIf there is no usable record, you complete KYC yourself and upload it to the KRA within 3 working days of completing the KYC process, as the KYC master circular requires. Step 4: KRA verificationThe KRA verifies PAN (including PAN-Aadhaar linkage), name and address within 2 days of receiving the record, and also verifies mobile and email. Clients whose attributes cannot be verified are not allowed to transact further until they are. The KRA sends the client a letter confirming the KYC details within 2 working days of receiving initial or updated documents, and keeps an audit trail of uploads, changes and downloads. If a KRA tells you a record is incomplete, you must send the missing details promptly. How does CKYC fit in?The Central KYC Records Registry (CKYCRR), run by CERSAI, is the cross-sector KYC registry used by banks, insurers and securities intermediaries. Under SEBI's circular of June 6, 2024, intermediaries continue to upload, download and modify KYC on the KRA systems, and the KRAs upload the verified or validated KYC information to CKYCRR within 7 days of receiving it (or any other timeline notified under the PML Rules). KRAs started these uploads from August 1, 2024. In practice, an RA's day-to-day KYC work stays with the KRA. CKYC matters mainly because the KYC form follows the CERSAI template and because the records you upload can travel onward to CKYCRR. Do RAs need in-person verification (IPV)?Not in most digital journeys. The KYC master circular says IPV is not required where KYC is completed using Aadhaar authentication or verification by UIDAI, or where the KYC form is submitted online with documents from DigiLocker or another source that can be verified online. Where IPV is needed, an intermediary may use live Video In-Person Verification through its app, with a trained official, random questions, a date and time stamp, and tamper-proof storage of the video. What does a compliant RA onboarding sequence look like?KYC is only one part of onboarding. The RA Regulations and the master circular also require you to disclose your terms and conditions (including the MITC) and take the client's consent before you provide any research or charge any fee. The table below is a practical order of steps. The master circular also lets clients sign their consent in person or through any legally acceptable mode, including DigiLocker-enabled Aadhaar-based e-signature. Our guide to Aadhaar e-sign for client agreements explains how that works, and the MITC guide covers what the terms must say. How long must RAs keep KYC and onboarding records?Regulation 25(2) requires all records to be kept in physical or electronic form for at least five years. Where a record must be signed and you keep it electronically, it must be digitally signed. The KYC master circular adds that intermediaries may keep KYC records electronically, and physical copies are not necessary. If a dispute is raised, keep the related records until it is resolved. See our guide to RA record keeping and call recordings for the full list. Common KYC mistakes RAs makeCharging before consentCollecting payment first and sending terms later breaks the rule that no service is rendered and no fee charged until the client consents. Skipping the KRA uploadDoing KYC in a spreadsheet but never uploading new records to the KRA leaves you out of line with the 3-working-day upload rule. Storing full Aadhaar numbersSaving unmasked Aadhaar copies in shared drives or email threads conflicts with the rule against storing Aadhaar numbers. Using staff phone numbersEntering a relationship manager's mobile or email in place of the client's is specifically prohibited. Run KYC and onboarding in one flowFinuro's onboarding runs KYC checks with CVL KRA and NDML KRA, fetches PAN details and KYC documents, and then moves the client through a sequence you configure per product: KYC, then MITC, then risk assessment, then payment, with each step enabled or bypassed as you choose. Clients sign the MITC by Aadhaar e-sign (through Digio or Cashfree) or email OTP e-sign, and you can bulk download a month of KYC and MITC e-sign documents for your records or audit. See how it works on the e-KYC, e-sign and client onboarding page. Related Finuro features
Frequently asked questionsAnswers to common questions on this topic. Built for SEBI RAs and IAs Onboard clients with KRA checks and e-signRun KYC, MITC consent, risk questions and payment in one configurable flow on Finuro. |
Book a Demo
See how Finuro handles onboarding, recommendations, model portfolios, and billing for your advisory firm. Tell us a little about your practice and we'll walk you through the platform on a live call.