PAN and KYC Process

Permanent Account Number (PAN) is a ten‑digit alphanumeric identifier issued by the Income Tax Department under the PAN Act, 1961. It is mandatory for any financial transaction that exceeds a prescribed limit, such as opening a demat account, mutual fund investment, or securities trading.

The Know Your Customer (KYC) norms are prescribed by SEBI (Securities and Exchange Board of India) under the KYC (Know Your Customer) Regulations, 2011 and the Prevention of Money‑Laundering Act, 2002. These regulations require every client to be identified, verified, and recorded before any advisory or transaction service is rendered.

For the NISM exam, the regulator’s name (SEBI), the governing statutes (PAN Act, KYC Regulations), and the purpose of these requirements (client identification, fraud prevention, AML compliance) are often asked directly.

• SEBI – the primary regulator for investment advisers.
• Income Tax Department – issues PAN.
• Financial Intelligence Unit‑India (FIU‑IND) – monitors AML compliance.

PAN consists of five letters, four numbers, and a checksum letter (e.g., ABCDE1234F). It links all financial transactions of an individual or entity, enabling the tax department to track taxable income.

Why is PAN essential for an Investment Adviser? It helps in verifying the client’s tax status, facilitates TDS (Tax Deducted at Source) compliance, and is required for filing client‑level transaction reports with SEBI.

How to obtain PAN? The client can apply online via NSDL or UTIITSL portals, or submit a physical Form 49A at a PAN centre. The adviser must obtain a copy of the PAN card and verify it using the Income Tax Department’s e‑PAN verification service.

• Online verification – instant and preferred.
• Physical verification – acceptable if electronic verification is unavailable.

Step 1 – Client Onboarding Form: The adviser collects the client’s personal details, investment objectives, risk profile, and PAN. This information is recorded in the adviser’s CRM system.

Step 2 – Document Collection: The client provides proof of identity (Aadhaar, passport, driving licence), proof of address (utility bill, bank statement), and PAN copy. For corporate clients, additional documents such as Certificate of Incorporation and Board Resolution are required.

Step 3 – Verification: Each document is cross‑checked against the originals. The PAN is verified electronically; address proof is verified through a recent utility bill (not older than three months).

Step 4 – Risk‑Based KYC: For high‑value or politically exposed persons (PEPs), enhanced due‑diligence is performed, including source‑of‑funds verification.

Step 5 – Record Keeping: All verified documents are stored digitally for a minimum of five years, as mandated by SEBI. The adviser must be able to retrieve them for audit within 30 days.

• Electronic storage – encrypted, backed‑up, and access‑controlled.
• Physical storage – secure, fire‑proof cabinets.

Individuals: Aadhaar card (or passport/driving licence), recent utility bill, PAN card, passport‑size photograph.

Non‑Resident Indians (NRIs): Passport, overseas address proof, PAN, OCI/PIO card if applicable, and a recent bank statement from the NRI account.

Corporate Entities: Certificate of Incorporation, Memorandum & Articles of Association, PAN of the company, Board Resolution authorising the signatory, and address proof of the registered office.

Trusts & Partnerships: Trust deed or partnership deed, PAN of the trust/partnership, identity proof of the trustees/partners, and address proof.

• All documents must be original or notarised copies.
• Electronic copies are acceptable if they are clear and legible.

SEBI mandates that KYC verification be completed before any advisory service or transaction execution. The adviser must obtain the client’s PAN and complete the document verification within 30 days of onboarding.

If the adviser fails to comply, SEBI may impose penalties ranging from ₹1 lakh to ₹5 lakh per violation, and in severe cases, suspend or cancel the adviser’s registration.

Repeated non‑compliance can trigger criminal proceedings under the Prevention of Money‑Laundering Act, with imprisonment up to five years.

• First breach – warning and fine.
• Second breach – higher fine and possible suspension.

The adviser is the primary point of contact for KYC collection. He/she must explain the necessity of each document, guide the client through the electronic verification process, and ensure that no client is onboarded without a verified PAN.

Advisers also have a duty to perform periodic reviews. SEBI requires a fresh KYC update every three years for individuals and five years for entities, unless any material change occurs.

Failure to maintain up‑to‑date KYC can lead to the adviser being held personally liable for regulatory breaches, making this a high‑weightage topic in the exam.

• Initial KYC – before first transaction.
• Periodic review – every 3/5 years.

Advisers can verify PAN through three main channels: (1) Income Tax Department’s e‑PAN service, (2) NSDL’s PAN verification API, and (3) manual cross‑check of the PAN card’s details against the client’s ID proof.

e‑PAN provides instant confirmation of PAN status (active, cancelled, or pending). The API integration is preferred for high‑volume advisers as it automates the verification and logs the response for audit.

Manual verification is acceptable for low‑volume or offline advisers but must be documented with a signed acknowledgment from the client.

• e‑PAN – real‑time, online.
• API – batch processing, audit trail.
• Manual – paper‑based, higher risk of error.

SEBI mandates that all KYC records, including PAN copies, must be retained for a minimum of five years from the date of the last transaction or the termination of the client relationship, whichever is later.

Records must be stored securely, with encryption for digital files and restricted physical access for hard copies. The adviser should maintain an index of client IDs, document types, and storage locations to facilitate quick retrieval during inspections.

Audits may request random samples; non‑availability of any document can result in a penalty of up to ₹2 lakh per missing file.

• Digital storage – encrypted servers, regular backups.
• Physical storage – locked cabinets, fire‑proof rooms.