Onboarding NRI, OCI and Foreign National Clients Online: What SEBI’s New KYC Circular Means for Intermediaries

If you are a SEBI-registered intermediary, you have probably had this conversation: an NRI client in Dubai or an OCI cardholder in the US wants to sign up, but your digital KYC cannot be completed because they are not in India. The client either waits for their next trip home, struggles through a slow paper process, or simply goes elsewhere.

SEBI has now fixed this. Its new circular allows intermediaries to complete KYC of individual clients living abroad fully online, from the client’s country of residence, as long as that country meets global anti-money-laundering standards. The new process applies from December 3, 2026.

The opportunity comes with responsibility. The circular lays down detailed rules on documents, original verification and video KYC that you must build into your systems and policies. This blog explains, in plain English and in a logical order, what has changed, how the new process works, and what you need to do before the deadline.

1. First, What Is Your KYC Obligation?

KYC stands for “Know Your Client.” Before you start an account-based relationship with any client, you must identify the client, verify their identity, and understand the purpose and intended nature of the relationship. This is a core requirement under SEBI’s rules and the Prevention of Money Laundering law.

Once KYC is complete, the record is shared with a KYC Registration Agency (KRA) and is also available through the Central KYC Records Registry (CKYCRR). This lets other intermediaries fetch the record instead of collecting everything from the client again.

2. To Whom Is This Circular Applicable?

The circular is addressed to the following market participants:

•         All intermediaries registered with SEBI under Section 12 of the SEBI Act, 1992. This includes, among others:

◦          Stock brokers and depository participants

◦          Mutual funds / asset management companies and registrars and transfer agents

◦          Portfolio managers and managers of alternative investment funds

◦          Investment advisers and research analysts

◦          Merchant bankers, bankers to an issue and other registered intermediaries

•         Recognised stock exchanges

•         Recognised clearing corporations

•         All depositories

In addition, KYC Registration Agencies (KRAs) have specific duties under the circular, such as verifying details and tagging them as “validated”.

Which clients does it cover?

The circular deals with individual “Persons Resident Outside India” (PROI). This means three types of clients:

•         Non-Resident Indians (NRIs) – Indians who are not residents for income tax purposes.

•         Overseas Citizens of India (OCIs) – holders of an OCI card issued by the Government of India.

•         Foreign nationals – citizens of other countries.

It covers individuals only. Non-individual clients such as companies, trusts, firms and funds are not covered.

3. What Was the Problem Earlier?

Under SEBI’s KYC Master Circular of October 2023, an intermediary doing digital KYC had to make sure that the client was physically located in India at that time. The video verification captured the client’s GPS location to prove it.

In practice, this meant you could not digitally onboard a client who was living abroad. You either had to wait for the client to visit India or rely on a slow, paper-heavy process with couriers and attested copies. SEBI did give some relief in December 2025, but only for NRIs doing re-KYC, not for new clients.

4. What Has Changed? The Four Big Shifts

Change 1 – The “client must be in India” rule is relaxed. For individual clients living in a FATF-compliant country, you may accept KYC information and supporting documents digitally.

Change 2 – Attribute-wise “validated” tagging. The KRA will tag each detail in the KYC record (PAN, passport, address, mobile, email) as “validated” once it is verified with an official or source database. All KYC records remain portable and can be shared with other intermediaries, even if some details are not yet validated.

Change 3 – Reliance on KYC done by others. You may rely on KYC done by another SEBI-registered intermediary (record from the KRA) or by an entity regulated by RBI, IRDAI, PFRDA or IFSCA (record from CKYCRR).

Change 4 – Tighter video verification. Your authorised official must be present during the VIPV, and the VIPV process must be subject to concurrent audit.

5. How the New KYC Process Works, Step by Step

Step 1: Ask for PAN and CKYC ID, then fetch existing records

When a client approaches you to start a relationship or update KYC, ask for their PAN and CKYC ID (the unique number given by CKYCRR), if available. Then retrieve the client’s existing KYC records, meaning both information and documents, from the KRA and CKYCRR.

Step 2: Ask for additional details only when needed

If the client’s record already exists, you should ask the client for more details only in these situations:

•         There is a change in the client’s existing details.

•         The details fetched are incomplete or do not meet current norms.

•         The client’s officially valid document has expired.

•         You consider it necessary to re-verify the client’s identity or address.

•         You need to carry out enhanced due diligence or build an appropriate risk profile of the client.

Any updated information must be sent to the KRA, which will update the record and inform all other intermediaries linked to that client.

Step 3: Collect and verify documents and details

Here is what you must collect from the client and how it must be verified:

What	What you collect	How you verify it
PAN	Only the PAN number. Do not insist on the original or a copy.	Verify with the Income Tax database. The KRA will also verify PAN and name and tag it as validated.
Passport	A copy of the passport. Also collect the OCI card, where applicable.	Verify the passport, if feasible. The KRA will also verify it, if feasible.
KYC form	KYC information in the CKYCRR template for individuals – as an original physical form, a scanned physical form under e-signature, or a digital form under e-signature.	Review for completeness and accuracy.
Specimen signature	A wet signature on the physical form, or a cropped signature image under e-signature.	If submitted digitally, the client must sign on paper live during the VIPV, and you must check that it matches.
Proof of identity and address	Any one officially valid document (OVD) or deemed OVD. The current address must be the client’s overseas address. If a foreign national’s OVD has no address, accept a document from a foreign government department or a letter from a foreign embassy or mission in India.	Match the address in the KYC form with the OVD and, if feasible, with the official database. The KRA will do the same.
Mobile and email	Mobile number (Indian or international) and email ID. The Aadhaar-linked mobile and email may be preferred.	Verify through OTP or another verifiable method (mobile, if feasible). If the mobile cannot be verified, send all communication to the verified email.

Step 4: Original Seen and Verified (OSV), or an approved alternative

Ordinarily, you must see the original OVD used for identity and address proof and collect physical self-attested copies. If the client cannot produce the original, you may accept any one of the following instead:

1.       An equivalent e-document through DigiLocker.

2.       An equivalent e-document issued by the issuing authority through a verifiable mechanism.

3.       Aadhaar e-KYC authentication using OTP, biometric or face authentication.

4.       A copy attested by a certifying authority – a Notary Public, an authorised official of an overseas branch of a scheduled commercial bank registered in India, a branch of an overseas bank with which Indian banks have relationships, a Court Magistrate, a Judge, or the Indian Embassy or Consulate General in the client’s country.

Make sure that:

•         Every attested copy shows the date, place, name and licence number or employee code (if any) of the certifying authority.

•         The name of your official who did the OSV and the date and time stamp are recorded at the time of OSV.

Step 5: In-Person Verification through video (VIPV)

You must carry out In-Person Verification (IPV) of the client and record the name of your official and the date and time stamp. Where physical IPV is not feasible, as it usually will not be for a client living abroad, you may carry out a Video In-Person Verification (VIPV). Your VIPV system must meet all of these ten safeguards:

1.       The client’s consent is recorded in an auditable and tamper-proof way.

2.       The system gives random prompts for the client to respond to, so the video cannot be pre-recorded.

3.       The uninterrupted video recording captures live GPS coordinates (geo-tagging) and the date and time stamp using tamper-proof technology.

4.       Connections from spoofed IP addresses, VPNs or proxy servers are blocked.

5.       The client’s IP address comes from India or a FATF-compliant country and matches the country stated in the KYC form and the OVD.

6.       The client’s photo is clearly captured and matches the photo in the form and the OVD.

7.       Data is encrypted end-to-end between the client’s device and your platform.

8.       Your authorised official is present during the VIPV.

9.       The system checks face liveness and detects spoofs, without excluding persons with special needs.

10.   The VIPV process is subject to concurrent audit to ensure its integrity.

You may add further safety and security features in line with your own risk management policy.

Step 6: Upload the KYC record to the KRA

Once KYC of an individual PROI client is complete, you must send the KYC information to the KRA within 3 working days of completing the KYC process.

6. Can You Rely on KYC Done by Others?

Yes. You may rely on:

•         KYC done by another SEBI-registered intermediary, based on the record obtained from the KRA. This record will show, detail by detail, whether each attribute is “validated” or not.

•         KYC done by an entity regulated by another financial sector regulator (RBI, IRDAI, PFRDA or IFSCA), based on the record obtained from CKYCRR.

However, you remain ultimately responsible for the KYC of your clients, including carrying out enhanced due diligence suited to the client’s risk profile. Relying on someone else’s KYC does not shift this responsibility.

7. Other Important Points

•         Documents must be in English. If a client submits a document in another language, it must be translated into English and attested by a certifying authority before submission.

•         Re-KYC is covered. The same process applies for re-KYC of clients living in a FATF-compliant country.

•         Foreign Portfolio Investors (FPIs). Where an individual foreign national seeks registration as an FPI, SEBI’s FPI Master Circular dated May 30, 2024 will continue to apply.

•         Cyber security. The infrastructure used for KYC must comply with SEBI’s Cyber Security and Cyber Resilience Framework.

8. What Is NOT Covered by the New Process?

•         Clients living in FATF non-compliant countries. For these clients, the existing KYC process continues to apply. Keep track of the lists published by FATF.

•         KYC completed before the effective date. KYC done before December 3, 2026 continues to be governed by the existing provisions. You do not need to redo it merely because of this circular.

9. When Does It Start?

The circular comes into effect for onboarding of individual PROI clients (except those in FATF non-compliant countries) from December 3, 2026, which is 30 days from the date of issue. From that date:

•         The KYC Master Circular of October 12, 2023 is superseded to the extent covered.

•         The circular of August 22, 2011 on simplifying trading account opening is superseded to the extent covered.

•         The circular of December 10, 2025 relaxing geo-tagging for NRI re-KYC is fully superseded.

10. What Should You Do Now?

Policy

•         Update your KYC / anti-money-laundering (PMLA) policy to include the new PROI process, document list, OSV alternatives and reliance on third-party KYC, and get it approved before December 3, 2026.

•         Add a step in your onboarding flow to check whether the client’s country of residence is FATF-compliant.

•         Define when enhanced due diligence will be done for PROI clients, as part of your risk management policy.

Technology

•         Get written confirmation from your KYC or VIPV vendor that the platform meets all ten VIPV safeguards.

•         Arrange for concurrent audit of the VIPV process and ensure an authorised official attends each VIPV.

•         Confirm that your KYC infrastructure complies with SEBI’s Cyber Security and Cyber Resilience Framework.

Operations

•         Train your onboarding and compliance staff on accepted documents, certifying authorities and the English-language rule.

•         Record the official’s name and date and time stamp for every OSV and IPV.

•         Set up a tracker so every PROI client’s KYC is uploaded to the KRA within 3 working days.

•         Update your client communication and FAQs so NRI and OCI clients know what to keep ready.

11. Quick FAQs

Q. Can we now onboard an NRI living in the UAE without the client visiting India?

Yes, from December 3, 2026, provided the client’s country is FATF-compliant at that time and the VIPV meets all prescribed safeguards.

Q. Do we need a copy of the client’s PAN card?

No. You only need the PAN number, verified with the Income Tax database. You should not insist on the original or a copy.

Q. Can we accept a foreign mobile number?

Yes. Both Indian and international numbers are allowed. If the mobile number cannot be verified, all communication must go to the client’s verified email.

Q. Can we rely on KYC done by the client’s bank?

Yes, through the record obtained from CKYCRR. But you remain responsible for the client’s KYC and for any enhanced due diligence.

Q. Do we need to redo KYC of existing NRI clients?

No. KYC completed before December 3, 2026 continues under the existing provisions. The new process will apply when such clients come up for re-KYC.

Q. What if the client connects to the video call through a VPN?

The VIPV system must block it. The client’s IP address must come from India or a FATF-compliant country and match the country in the KYC form and OVD.

Final Word

This circular opens the door to a large and growing pool of overseas investors who can now be onboarded without travelling to India. At the same time, it puts clear responsibility on intermediaries to run a secure, well-documented and audited process. Intermediaries who update their policies, test their video KYC systems and train their teams before December 3, 2026 will be best placed to benefit.

If you need help updating your KYC policy or reviewing your VIPV process, Compliancify Consulting can help. Visit compliancifyconsulting.com or call +91 9873570047.

Disclaimer: This blog is a simplified explanation for general awareness and is not legal advice. Please refer to SEBI circular HO/38/30/12(3)2026-MIRSD-POD2/I/25175/2026 dated November 4, 2026, available on www.sebi.gov.in, for the complete and authoritative text.