How long should you keep KYC documents in India?

Two questions get asked as though they are one, and they are not:

• How long must we keep a record of the KYC we performed?
• How long must we keep a readable image of the customer's identity document?

The first has a reasonably clear answer. The second, in most institutions, has never actually been asked — and the default answer in practice is "forever, because deleting things is frightening and nobody built the job".

The rough shape of the obligation

For most regulated financial entities in India, record-keeping obligations flow from anti-money-laundering law and the KYC directions issued under it. The commonly applied figure is five years — from the date of a transaction, or from the cessation of the business relationship, depending on the record in question. Sector regulators layer their own requirements on top, and specific products — a twenty-year mortgage, a life policy — carry their own commercial reasons to hold a file for far longer than any statutory minimum.

Notice what the obligation is about: records. The requirement is to be able to demonstrate that identification was carried out and what was relied upon. Whether that demands a full-resolution readable scan of the customer's Aadhaar card, held for the duration, is a different question — and it is the question worth putting to your counsel, because it is the one that determines your actual exposure.

What most institutions hold, versus what they need

Held	Purpose it serves	Could it be masked?
The full-resolution original scan	Proves what was collected and when.	A masked copy proves the same thing.
Extracted fields in the CRM	Operational use: name, DOB, address.	Not a document; governed by database access control.
The full identifier in a database column	De-duplication and matching.	Frequently servable by a hash or a reference instead.
Verification outcome and timestamp	The actual audit evidence.	Contains no identifier at all.

Read that table with an auditor in mind. Almost everything they will ask for is in rows two and four. Row one is what everybody keeps and row one is where nearly all the breach exposure sits.

The compounding problem

Retention risk does not sit still. A file collected in 2019 and held for a decade will, over that decade, be copied into a new document management system, replicated to a DR site, captured in hundreds of backup snapshots, exported for a migration, sampled for an audit, and possibly shared with a co-lender or an acquirer.

By year seven, "how many copies of this Aadhaar number do we hold" is genuinely unanswerable at most institutions. The document has propagated into systems that did not exist when it was collected.

This is why the question "should we mask before storage" is not really about storage. It is about what a single stored object becomes over ten years.

Practical positions

Keep the record, not the readable identifier

Store a masked copy as the evidential record, the extracted fields you have an operational reason for, and the verification outcome. This satisfies the demonstrate-what-you-did requirement while dropping the part of the file that is worth stealing.

Decide retention per document, not per file

A loan file is not one thing. The sanction letter, the KYC document and the bank statement have different purposes and different useful lives. Most retention policies treat the folder as atomic, which means everything is held for the longest period that applies to anything in it.

Write down when the clock starts

"Five years" is ambiguous until you say five years from what. Account closure, last transaction, and loan maturity give materially different dates, and different systems in the same institution frequently disagree about which is being used.

Actually build the deletion job

The uncomfortable observation: most institutions have a documented retention policy and no implemented deletion. The policy says seven years; the storage bucket has objects from 2014. Masking at ingestion is partly attractive because it degrades gracefully — if the deletion job is never built, what survives is at least not a readable national identifier.

Remember versioning and backups

Deleting or overwriting an object in a versioned store leaves the prior version in place. Backups have their own retention, usually longer than anyone assumes. A deletion programme that has not accounted for both has not deleted anything.

The question to take to counsel

Not "how long must we keep KYC documents" — you will get the statutory answer and it will not help you decide anything. Ask instead:

"For the retention period that applies to us, does a masked copy of the identity document, together with our extracted fields and verification record, satisfy the obligation — or is an unmasked image specifically required?"

In our experience the answer is more often the former than institutions expect, and nobody had asked because the default was never examined. If the answer for your entity is genuinely the latter, that is worth knowing precisely too — it turns an unexamined habit into a deliberate, defensible decision.