As of 29 August 2026, every new insurance policy in India, whether life, health or general, needs the client's KYC. IRDAI's Master Guidelines on AML/CFT, 2022 took effect on 1 November 2022 for life insurers and on 1 January 2023 for general and health insurers. Clients can complete KYC with a 14-digit CKYC identifier, Aadhaar-based e-KYC, video KYC or officially valid documents, plus PAN or Form 97 where applicable.
This guide explains what the rules actually say, which documents and methods count, how the Central KYC Records Registry (CKYCR) works, and what you, as the agent, should and should not do with your clients' identity documents.
What KYC rules apply to insurance policies in India?
KYC (Know Your Customer) is the process an insurer uses to verify a client's identity, address and photograph before it starts a relationship. In insurance, KYC flows from the Prevention of Money-laundering Act, 2002 (PMLA) and the PML (Maintenance of Records) Rules, 2005, which IRDAI applies to insurers through its Master Guidelines on Anti-Money Laundering/Counter Financing of Terrorism (AML/CFT), 2022.
The guidelines (ref. IRDAI/IID/GDL/MISC/160/8/2022, dated 1 August 2022) cover all classes of life, general and health insurance. They say that for every new customer, client due diligence with valid KYC documents must be done at the start of the relationship. They were due to apply from 1 November 2022, but IRDAI's circular of 26 October 2022 moved the start date to 1 January 2023 for general and health insurers. IRDAI later amended the guidelines on 10 October 2023, mainly on beneficiaries, politically exposed persons and group-wide controls.
What changed for general insurance in 2023?
Under the older AML/CFT guidelines for general insurers from 2013, general insurers had to carry out KYC at the settlement stage, and only where a claim payout or premium refund crossed ₹1 lakh. From 1 January 2023, a motor, health or home insurance buyer has to complete KYC when the policy is bought, just as a life insurance buyer does. In practice, KYC moved from the claim desk to the point of sale.
Who counts as a client?
The guidelines define a client broadly: it can be the proposer, policyholder, master policyholder, life assured, beneficiary or assignee. So, depending on the stage, the insurer may verify more than one person on the same policy.
What documents count for insurance KYC?
For an individual, the insurer must verify identity, address and a recent photograph. The core list comes from the PML Rules definition of an officially valid document (OVD), and RBI's KYC Master Direction lists the same documents:
- Passport
- Driving licence
- Proof of possession of Aadhaar number
- Voter's identity card issued by the Election Commission of India
- NREGA job card signed by a State Government officer
- Letter from the National Population Register containing name and address
If the identity document already shows the address, no separate address proof is needed. Where a client authenticates with Aadhaar but lives somewhere else now, the IRDAI guidelines allow a self-declaration of the current address. Clients who cannot complete Aadhaar authentication because of injury, illness or old age, or who simply do not wish to, can submit OVDs instead. Where a client hands over an Aadhaar card or letter as proof and authentication is not required, Rule 9(16) of the PML Rules requires the Aadhaar number to be redacted or blacked out.
IRDAI's Master Circular on Protection of Policyholders' Interests, 2024 also notes that insurers ask prospects for age, identity and address proof for underwriting and KYC, and that the KYC process may be online or offline.
When is PAN needed?
The IRDAI guidelines require PAN or Form 60 (wherever applicable) alongside KYC. Since 1 April 2026, the Income-tax Act, 2025 and the Income-tax Rules, 2026 (G.S.R. 198(E), published in the Gazette on 20 March 2026) govern this. Rule 159, which replaces the old Rule 114B, requires PAN on the commencement of an account-based relationship with an insurer where the insurance premium exceeds ₹50,000 during a financial year (serial number 14 of its table). An individual without PAN files a declaration in Form 97, which takes over the role of Form 60. A minor with no taxable income quotes the PAN of a father, mother or guardian.
Insurers may still ask for PAN on smaller policies under their own processes, since the guidelines also allow "any other documents as may be required by the insurer".
What are the ways to complete KYC for a policy?
The IRDAI guidelines list six routes, plus PAN or Form 60 (now Form 97) where applicable:
- Aadhaar online authentication, available only to insurers notified by the government under Section 11A of the PMLA
- Aadhaar offline verification, using the Aadhaar XML file or Secure QR code
- Digital KYC, as defined in the PML Rules
- Video Based Identification Process (VBIP), a consent-based video KYC option
- The KYC identifier allotted by the CKYCR
- Officially valid documents
How does video KYC work in insurance?
VBIP is optional and needs the client's informed consent. The insurer or a specifically trained authorised person records a live video, captures the client's location to confirm they are physically in India, matches the face with the Aadhaar, OVD or PAN, and varies the questions so the call cannot be pre-recorded. A printed copy of e-PAN is not valid. The call must be triggered from the insurer's own domain, not a third-party app, and recordings hosted with a third party or in the cloud must stay in India.
What is CKYC and how does the KYC identifier work?
The Central KYC Records Registry (CKYCR) is a central database of KYC records for the financial sector. The government notified CERSAI to perform this role through Gazette Notification S.O. 3183(E) dated 26 November 2015. When a client's record is first uploaded, CERSAI's CKYC Operating Guidelines say the registry generates a 14-digit KYC identifier, often called the CKYC number, that banks, mutual funds and insurers can all use. Some identifiers carry a letter prefix, such as M for minor accounts or O for OTP-based e-KYC accounts.
The rules that matter for your clients, from the IRDAI guidelines and Rule 9 of the PML Rules:
- If the client gives a KYC identifier, the insurer retrieves the record from CKYCR and should not ask for the same documents again, unless details have changed, the record is incomplete or outdated, the documents' validity has lapsed or extra checks are needed.
- If the client does not give one, the insurer searches CKYCR and records the identifier if it exists.
- If there is no record, the insurer captures KYC in the prescribed template and uploads it to CKYCR within 10 days of starting the relationship.
- Once CKYCR allots the identifier, the insurer must share it with the policyholder confidentially.
- For Aadhaar-based KYC, only the redacted Aadhaar number (last four digits) goes to CKYCR.
- Updated details must reach CKYCR within seven days, and CKYCR then alerts the other institutions that hold the client's record.
- The insurer must take the client's consent each time it downloads a CKYC record, and CKYCR sends the client an SMS whenever a record is fetched.
Change is also coming from the top. Paragraph 100 of the Union Budget 2025-26 speech, delivered in February 2025, announced that a revamped Central KYC Registry would be rolled out in 2025, along with a streamlined system for periodic updating.
How does KYC work step by step for a new policy?
Here is the usual sequence, condensed from the IRDAI guidelines. Your insurer's portal or app will show its own version of these steps.
Two points in the middle step deserve attention. Simplified due diligence applies only to individual policies with aggregate premium up to ₹10,000 a year, and only for low-risk clients with no suspicion of money laundering. Enhanced due diligence applies to high-risk profiles, which the guidelines list as including non-residents, high net worth individuals, trusts, charities, NGOs, firms with sleeping partners and politically exposed persons.
The guidelines also say premium should not be disproportionate to income or assets. A proper financial needs analysis that records the client's income helps the proposal pass this test.
How does KYC work for NRIs, minors, group policies and claims?
NRIs
Non-residents fall in the guidelines' high-risk category, so expect higher verification and counter-checks. Video KYC under the guidelines geotags the client to confirm they are physically present in India, so a client abroad will usually need another route. Ask the insurer for its NRI checklist before you promise a timeline.
Minors
For a child plan, the parent is usually the proposer, and the parent's KYC is what the insurer needs at issuance. For PAN purposes, Rule 159(2)(a) of the Income-tax Rules, 2026 lets a minor with no taxable income quote a parent's or guardian's PAN.
Group policies
For group life, health or general cover, the insurer collects KYC of the master policyholder or legal entity and its beneficial owners. The master policyholder keeps member details and shares them with the insurer when required.
Claims, maturity and other payouts
KYC returns at the payout stage. Before paying on surrender, maturity, death, refunds or reimbursement, insurers must carry out due diligence on the policyholder, beneficiaries, legal heirs or assignees, and they must not pay third parties except as the contract allows. Since the October 2023 amendment, a life insurer must also record a named beneficiary's full name as soon as the beneficiary is designated, and verify that person's identity at payout. This is why a nominee is asked for identity documents during a death claim. The guidelines also flag clients who cancel in the free-look period repeatedly at short intervals.
When does a client need to update or redo KYC?
Re-KYC usually comes up in these situations:
- Change of address or other details. The Citizens' Charter in IRDAI's Master Circular on Protection of Policyholders' Interests, 2024 lists change of address as a servicing request where KYC norms must be complied with, with a 7-day turnaround.
- Older policies without KYC. Where existing clients lacked KYC, the 2022 guidelines gave insurers two years to collect it for low-risk clients and one year for all others.
- Unusual activity. Ongoing due diligence applies when additional premiums or top-ups do not fit the client's profile.
- Periodic updation. Insurers must upload updated KYC records to CKYCR as part of periodic updation, including in-force and paid-up policies without an identifier, and since 2023 must keep due diligence data up to date, particularly for high-risk clients.
What does the DPDP Act mean for the ID copies you hold?
Under the Digital Personal Data Protection Act, 2023, whoever decides why and how personal data is processed is a data fiduciary. Section 6(1) limits consent to the personal data necessary for the stated purpose. Section 8(5) requires reasonable security safeguards, and the Schedule allows penalties of up to ₹250 crore for failing to take them. Section 8(7) requires erasure once the purpose is no longer served, unless another law requires retention.
These duties are not yet enforceable. Under the commencement notification of 13 November 2025, the consent and Data Fiduciary duties in Sections 3 to 17 and the penalty provisions come into force 18 months later, in May 2027, along with most of the DPDP Rules, 2025. Following them now is simply good practice, and it costs you little: insurers, which must retain KYC records for at least five years after a relationship ends, hold the legal record, so an agent rarely needs a personal copy. For a fuller walk-through, see our DPDP Act guide for insurance agents.
What this means for insurance agents
The insurer is responsible for KYC, but the guidelines expect insurers to write KYC duties into intermediary contracts and to act against intermediaries who repeatedly expose them to AML risk. Your conduct at the point of sale matters.
Do:
- Ask every client for their CKYC identifier first. It can save them from re-submitting documents.
- Use only the insurer's official KYC link, app or form, and let the client complete Aadhaar OTPs themselves.
- Check that the name and date of birth match across PAN, Aadhaar and the proposal before you submit.
- Where a physical Aadhaar copy is used, ask the client to black out the Aadhaar number except the last four digits.
- Tell clients that nominees and legal heirs will also face verification at claim time.
Do not:
- Keep photos of Aadhaar, PAN or passports in your phone gallery or chat threads after the proposal is submitted.
- Run a video KYC yourself on a personal app; VBIP must be triggered from the insurer's domain by the insurer or its authorised persons.
- Suggest splitting premiums or using another person's documents to avoid PAN or KYC checks.
- Tell a client if you learn that an insurer has filed or may file a suspicious transaction report; the guidelines forbid tipping off.
These habits also support the wider duties in our IRDAI compliance checklist for insurance agents.
What should agents do now?
A practical KYC checklist for your practice:
- Note each client's CKYC identifier (not their ID images) in your client records.
- Delete stored ID scans you no longer need once policies are issued, and keep any that remain in one secure place.
- Before every sale, confirm whether total annual premium crosses ₹50,000 so PAN or Form 97 is ready.
- Keep your insurer's NRI, group and minor KYC checklists handy.
- Prepare nominees early by explaining payout KYC when you review nominations.
- Track pending KYC and address updates as follow-ups; agency software such as Polisync can help you keep these records organised.
- Recheck insurer KYC instructions and your own data habits before May 2027, when the DPDP Act's consent, security and erasure duties come into force.