Client Onboarding and KYC Mistakes for Research Analysts

Last updated: 21 October 2026

The most common client onboarding and KYC mistakes research analysts make are sending research or taking a fee before the client has consented to the terms, skipping the KRA check, missing the 3-working-day deadline to upload fresh KYC, entering staff phone numbers instead of the client's, and storing full Aadhaar numbers. Each breaks a rule in the SEBI (Research Analysts) Regulations, 2014, the RA master circular dated 6 February 2026 or SEBI's KYC master circular. An e-KYC and client onboarding workflow lets you run each step in the right order and keep the proof together.

This post covers ten mistakes, the rule each breaks and how to avoid it. It is a summary, not legal advice: check the current SEBI regulations and circulars before you change your process.

A new subscriber pays, gets added to the channel straight away, and receives the terms and MITC later by email. Research has started before consent exists.

Regulation 24(6) requires an RA to disclose its terms and conditions and take the client's consent on them. Para 1.12(b) of the master circular says no research service may be rendered and no fee charged until that consent is received, and the terms must include the Most Important Terms and Conditions (MITC). Consent may be signed in person or by any legally acceptable mode, including DigiLocker-enabled Aadhaar e-signature.

To avoid it, put consent before payment and before any access to research. Finuro's onboarding lets you set the order per product (KYC, then MITC, then risk assessment, then payment), with Aadhaar e-sign through Digio or Cashfree or email OTP e-sign.

Some RAs collect a PAN card photo and an address proof on WhatsApp and treat that as KYC, without checking whether the client already has a KRA record.

Regulation 25(1)(v) requires KYC records for fee-paying clients, and para 1.13(a) says RAs must follow the KYC procedure SEBI specifies. Under SEBI's KYC master circular, a validated KRA record is portable: the client does not repeat KYC and you fetch the record from the KRA. If there is no usable record, you complete KYC yourself.

To avoid it, start every onboarding with a KRA search by PAN. Finuro runs KYC checks with CVL KRA and NDML KRA, fetches PAN details and KYC documents. Our guide to client KYC and KRA onboarding explains each step.

When an RA completes KYC for a new client, the record often stays in a spreadsheet or drive folder and never reaches the KRA.

The KYC master circular says an intermediary must upload a new client's KYC information to the KRA system within 3 working days of completing the KYC process. The KRA then verifies PAN, name, address, mobile and email, and clients whose details cannot be verified cannot transact further until they are.

To avoid it, keep a list of every fresh KYC with its completion date and upload status, and respond quickly when a KRA reports a record as incomplete. Note that Finuro checks and fetches KRA records; uploading fresh KYC to the KRA stays with you or your KRA access route.

A client types a PAN, nobody checks it, and months later it turns out the name does not match or the PAN is inoperative.

The KYC master circular treats PAN as the unique identifier for securities market participants and requires it to be verified online with the Income Tax database. A PAN that is inoperative because it is not linked with Aadhaar is a problem for KYC.

To avoid it, verify PAN at the first step and stop onboarding until the PAN status is clear. PAN is also your control record for client-level segregation, so a wrong PAN causes problems later too.

Relationship managers sometimes enter their own mobile number or email for a client who "is not good with phones", so OTPs and alerts go to the RM.

The KYC master circular says intermediaries must ensure that mobile numbers and email addresses of their employees, authorised persons or distributors are not uploaded on behalf of clients. In digital KYC, mobile and email must be verified by OTP or another verifiable method, and the mobile number should preferably be the one seeded with Aadhaar.

To avoid it, verify both by OTP sent to the client during onboarding, and check for staff numbers appearing on more than one client record.

Unmasked Aadhaar copies end up in shared drives, email threads and chat histories, where anyone on the team can see them.

The KYC master circular says registered intermediaries must not store or save a client's Aadhaar number in their systems, and where a client submits an Aadhaar copy that does not need authentication, the client should redact or black out the number. Use of Aadhaar is voluntary for the client.

To avoid it, ask clients to mask Aadhaar copies, delete unmasked copies you already hold, and use Aadhaar e-sign or DigiLocker routes that do not need you to keep the number. See our guide to Aadhaar e-sign for client agreements.

Onboarding forms often ask only about the client, so the RA has no way to know that two subscribers belong to the same family.

The fee cap of ₹1,51,000 per annum applies per family of individual and HUF clients (para 1.9(b)). Regulation 2(1)(fc) defines family as the client and their dependent spouse, children and parents, and para 1.10(g) says the client gives an annual declaration or periodic update on dependent family members.

To avoid it, ask for dependent family members and their PANs at onboarding, and refresh the declaration every year. Our RA fee limits guide explains how the family cap works.

Terms get signed, but the investor charter, the AI disclosure or the research-versus-distribution choice never reach the client.

The master circular asks RAs to give clients a copy of the investor charter as part of onboarding (para 7.2) and to disclose the extent of AI tool use when disclosing the terms and conditions (para 1.7(b)). Where the RA's group or family also offers distribution, a new client must be offered the choice of research or distribution services at onboarding, not both (para 1.10(b)).

To avoid it, build one onboarding pack with the terms, MITC, investor charter and AI disclosure, and record each client's segregation choice where it applies. Finuro lets you show the MITC as text or PDF in the onboarding sequence.

Sales chats with prospects happen on personal WhatsApp and are deleted once the client signs up.

Para 1.13(b) and (c) say RAs must keep records of interactions with all clients, including prospective clients before onboarding, wherever a conversation about the services takes place, starting from the first interaction. These can be signed physical records, telephone recordings, emails from the registered email ID, SMS records or other legally verifiable records, kept for five years, or longer if a dispute is raised.

To avoid it, use official numbers and channels for sales conversations and keep them with the client record. Finuro's unified inbox brings email, WhatsApp and Telegram conversations together; see communication records.

When SEBI updates the mandatory terms, RAs often update the onboarding flow for new clients and leave existing subscribers on the old version.

Para 1.12(f) says that for existing clients, the RA must disclose the updated terms and obtain consent on or before the renewal date, or before the next fee is due for continuing the subscription, whichever is earlier. Regulation 25(2) requires records to be kept for at least five years, and electronic records that must be signed have to be digitally signed.

To avoid it, trigger fresh consent before each renewal payment and keep every signed version. Finuro lets you bulk download a month of KYC and MITC e-sign documents for your records or audit.

• PAN verified and KRA searched before anything else.
• Fresh KYC uploaded to the KRA within 3 working days.
• Client's own mobile and email, verified by OTP.
• No stored Aadhaar numbers; masked copies only where needed.
• Dependent family members recorded for the fee cap.
• Terms, MITC, investor charter and AI disclosure consented before payment or research.
• Records kept from the first conversation, and re-consent at each renewal.

Finuro brings KRA checks, PAN and KYC document fetch, a configurable KYC, MITC, risk assessment and payment sequence, and Aadhaar e-sign into one flow. See how e-KYC, e-sign and client onboarding works for research analysts.

• Client consent records: signed MITC and consent PDFs kept with each client
• Subscription billing: collect fees only after consent
• Communication records: client conversations in one place
• SEBI record keeping: onboarding records ready for audit