The Complete CKYC Lifecycle for NBFCs: From Customer Onboarding to CKYC Number Storage
Most NBFC operations teams know they need to do CKYC. Far fewer can map precisely what happens at each decision point — when to Search, when to Download, when to Generate, what to do with a partial match, and how the CKYC number finally gets stored. This guide covers all of it, stage by stage.
- Why the Full Lifecycle View Matters
- Stage 1: CKYC Search API
- Stage 2A: Download API — When a Record Exists
- Stage 2B: Generation API — When No Record Exists
- Stage 3: Data Matching — The Decision Nobody Talks About
- Stage 4: CKYC Number Stored
- Full Process Flow Diagram
- Who Owns Each Stage in Your Organisation?
- Frequently Asked Questions
Why the Full Lifecycle View Matters
CKYC compliance is often spoken about as a single event — "upload the customer's KYC to CERSAI." In practice, it is a multi-stage process with branching decision points, each of which has its own API call, its own failure modes, its own regulatory obligation, and its own operational owner.
The consequences of not understanding the full lifecycle are visible in rejection rates, onboarding delays, and audit findings. An NBFC that only understands the Generation API will miss the Search step — registering customers who already have a CKYC record, creating duplicates in CERSAI and triggering validation failures. An NBFC that handles Search and Download but has no process for partial match resolution will find CKYC numbers sitting unlinked in a queue while compliance deadlines pass.
This guide maps the complete lifecycle — from the moment a new customer applies, through every branch condition, to the moment the CKYC number is stored against their record. It draws directly from CERSAI's process requirements and HSS's operational experience processing CKYC for BFSI institutions across India.
Stage 1: CKYC Search API
The first step in every CKYC onboarding flow is a search — checking whether the customer already has a KYC record registered with CERSAI. This step is mandatory and must happen before any attempt to generate a new record. Skipping it and going straight to Generation is the most common CKYC processing error NBFCs make, resulting in duplicate record rejections from CERSAI.
The Search API accepts the customer's PAN number, Aadhaar number, or other identity details. CERSAI searches its registry and returns one of two outcomes: a record found (with the customer's KIN), or no record found.
Stage 2A: Download API — When a Record Exists
When the Search API confirms a CKYC record exists, the Download process is triggered. This is a two-step flow introduced under CKYCRR 2.0's OTP consent framework — an important change from the earlier single-step download.
Step 1 — Download Initiate: The institution calls the Download Initiate API with the customer's KIN. CERSAI sends an OTP to the customer's registered mobile number and returns a session reference token to the institution.
Step 2 — Validate OTP: The customer receives the OTP and provides it to the institution (via the onboarding interface). The institution calls the OTP Validation API with the token and OTP. On success, CERSAI returns the full CKYC record — identity details, address, documents, and photograph.
Stage 2B: Generation API — When No Record Exists
When no CKYC record exists for the customer, the institution submits the full KYC data package to CERSAI via the Generation API. This is the most data-intensive step in the lifecycle — requiring structured identity fields, address details, KYC verifier information, and base64-encoded documents.
The Generation API is an asynchronous process. Unlike the Search or Download APIs which return results in real time, the Generation API accepts the submission and returns a transaction ID. The actual CKYC number (KIN) is allocated by CERSAI after their internal validation — which can take from a few hours to several working days.
The institution must poll the Status API using the transaction ID to check when the KIN has been assigned. Once assigned, it proceeds to Stage 4 — CKYC Number storage.
Struggling with high Generation API rejection rates?
HSS's pre-submission validation engine checks every field and document against CERSAI rules before the API call — achieving sub-2% rejection rates consistently across our NBFC clients.
Stage 3: Data Matching — The Decision Nobody Talks About
Stage 3 only applies to the Download path (Stage 2A). Once the full CKYC record is returned from CERSAI, the institution must compare it against the data the customer provided during current onboarding. This comparison determines whether the CKYC number can be stored immediately or whether an update workflow must be triggered first.
This is the stage most NBFCs handle inconsistently — and it is the stage that causes the most compliance audit findings. The matching logic must be formalised, documented, and consistently applied across every onboarding case.
Full Match — What It Means and What to Do
A full match occurs when all key identity fields in the downloaded CKYC record align with the data the customer provided during onboarding — name, date of birth, address, PAN, and photograph. When a full match is confirmed, the institution can immediately store the CKYC number against the customer's record and complete the onboarding workflow. No manual intervention is required.
Partial Match — The Workflow Most Teams Get Wrong
A partial match occurs when one or more fields differ between the CKYC record and the current onboarding data. Common partial match scenarios include: address change since the last KYC registration, name spelling variation, or contact details update. A partial match does not mean the CKYC process fails — it means a specific update workflow must be triggered before the CKYC number is stored.
Stage 4: CKYC Number Stored
On successful completion — whether through a Full Match directly from the Download path, successful resolution of a Partial Match, or KIN allocation via the Generation path — the 14-digit CKYC Number (KIN) is stored against the customer's record in the institution's system.
This is not just a database update. It must trigger downstream notifications to CRM, LMS, and any other connected system that needs to reference the customer's CKYC status. An audit log entry must be created with the timestamp, match type, and source of the KIN.
Full Process Flow Diagram
The diagram below maps every stage and decision point in the complete CKYC onboarding lifecycle — from the initial customer application through to final CKYC number storage.
Who Owns Each Stage in Your Organisation?
One of the most common operational gaps in NBFC CKYC programmes is unclear ownership — multiple teams touch the lifecycle but nobody owns it end to end. Here is the ownership model that works.
| Stage | Primary Owner | Supporting Owner | What They Must Do |
|---|---|---|---|
| Stage 1 — Search | Technology / CBS team | Operations | Ensure API call is triggered automatically at onboarding; log all search results |
| Stage 2A — Download | Technology / CBS team | Onboarding agent / branch | Handle OTP flow; log consent event with timestamp; retrieve and store full record |
| Stage 2B — Generation | Operations / CKYC team | Technology | Validate data and documents pre-submission; submit via API; track transaction ID; poll status API |
| Stage 3 — Data Matching | Operations / Compliance | Technology | Run comparison logic; classify match type; trigger update workflow for partial matches; document decisions |
| Stage 4 — Store KIN | Technology / CBS team | Operations | Update customer record; create audit log entry; notify downstream systems; confirm completion |
Want to see this lifecycle fully automated for your NBFC?
HSS manages the complete CKYC lifecycle — Search, Download, Generation, Matching, and Storage — as a fully managed service. Your operations team monitors outcomes, not processes.
Frequently Asked Questions
Ready to Run a Seamless CKYC Lifecycle?
HSS manages end-to-end CKYC operations for NBFCs, HFCs, and banks across India — from the first Search API call to final CKYC number storage. One team, one workflow, zero manual handoffs.
Talk to Our CKYC Team Explore Our ServicesThis article is for informational purposes only. For institution-specific compliance guidance, consult your legal and regulatory team.
