Existing accounts

Frozen for Re-KYC: The Periodic Review Explained

Debits blocked on an account that has worked for years, and the message mentions a cutoff date or a customer state nobody explains. This is what periodic KYC updation is, what the rules require, and how the restriction actually gets lifted.

Published 26 September 2026 · maintained by KYC Rejected

Key facts

This is not an onboarding problem. The account already passed KYC once. What failed is periodic updation, the scheduled re-check that every regulated firm has to run on customers it already has.
Under paragraph 38 of the Reserve Bank of India Master Direction on KYC, periodic updation runs at least once every two years for high risk customers, once every eight years for medium risk and once every ten years for low risk, counted from account opening or the last update.
For a low risk individual customer, the same paragraph says the bank shall allow all transactions and ensure the update happens within one year of it falling due, or up to 30 June 2026, whichever is later. That applies even where the update had already fallen due.
Before the due date the bank owes you at least three advance intimations, one of them by letter. After the due date, at least three reminders, one of them by letter. Each has to be recorded in the bank's system for audit. That requirement had to be in place by 1 January 2026.
The Master Direction's power to temporarily cease operations sits in paragraph 39 and is tied to a missing Permanent Account Number or Form 60, not to periodic updation. Even then the bank must first give an accessible notice and a reasonable opportunity to be heard.
If nothing changed in your details, the update can usually be a self declaration sent through your registered email, your registered mobile number, an ATM, internet or mobile banking, or a letter. No branch visit is required by the Direction itself.

Read your own risk category first

Almost every argument on this page depends on whether the bank has classified you as low, medium or high risk. That single field decides how often you are re-checked and what the bank is required to let you do while the update is pending.

You are entitled to ask which category you are in. Ask in writing, at the same time as you ask for the dates of the intimations and reminders that were supposedly sent to you. Those two answers decide whether the restriction was routine or whether it was applied early.

The short answer

Nothing you did caused this. A calendar did. Periodic updation is a scheduled obligation on the firm, not a punishment aimed at the customer, and the error messages people receive are written from the bank's internal point of view rather than yours. That is why they mention cutoff dates, service request numbers and customer states that mean nothing to the person reading them.

The fastest route out is almost always the boring one. Work out whether anything in your details has actually changed. If nothing has, this is a self declaration, not a fresh verification, and it can be done through a channel you already have. If something has changed, in particular your address or your name, then the bank will run something close to a new onboarding check and you need the documents to agree with each other before you start. Our page on name mismatch covers the version of this that stops people for weeks.

The slow route out is arguing. Sometimes you have to, and the second half of this page is about how, with the actual text of the rules. But try the self declaration channel first, because in a large share of cases the restriction lifts on its own once the record updates.

Documents rejected on the re-KYC upload? Send the file that keeps failing and a specialist corrects it, then emails it back ready to submit, usually in under 10 minutes. $1.99, money back if it is not approved. Get my fix

What actually triggers a review

Periodic updation is the most common trigger, but it is not the only one, and knowing which one fired tells you how long this will take.

Trigger	What set it off	What it usually feels like	How long it takes to clear
Scheduled periodic updation	The clock on your risk category ran out, counted from account opening or your last update	Repeated messages for weeks, then debits blocked	Days, once the self declaration lands
Risk re-rating	The bank moved you to a higher risk category, so the review interval shortened	A review much sooner than you expected	Days to weeks, and expect a document request
Expired document on file	The identity document the bank holds has passed its expiry date	A request for a fresh document rather than a declaration	As long as it takes to get the new document
Missing tax number	No Permanent Account Number or Form 60 on record, in India	A hard stop rather than a nudge, under paragraph 39	Immediate once the number is submitted
Screening list refresh	Your name came back as a possible match when the lists were re-run	Silence, or a vague compliance review message	Unpredictable. See our page on false screening matches
Transaction monitoring	A payment pattern triggered an alert and the file was pulled for review	A request for source of funds rather than identity documents	Weeks, and the firm may say very little

The distinction that matters most is between an identity refresh and a source of funds enquiry. The first is administrative and you can push it along. The second is a risk decision, the firm may be legally barred from explaining it, and pushing harder will not speed it up.

Why the message mentions a cutoff date

People search for the exact wording they see, and two phrases come up constantly. One is a refusal to accept re-KYC because of a cutoff date. The other is a service request that comes back rejected for an invalid customer state. Neither is about your documents.

A cutoff date message usually means the bank's system has moved your record into a batch that the self service channel is no longer allowed to handle, so the online form refuses before it even looks at what you uploaded. An invalid customer state means the account is already flagged in a way that blocks the update request from being processed, which is common once a restriction has been applied. In both cases the answer is the same. Stop resubmitting through the channel that is refusing you and get the request raised on a channel that can still write to the record, which in practice means a branch, an authorised business correspondent, or a formal written complaint that forces a human to open the file.

Repeated failed attempts through a blocked channel can also eat into an attempt counter somewhere else in the chain, which is how people end up locked out of the app as well as the account. Our guide to attempt limits and bans explains how those counters behave.

India: what paragraph 38 requires, in its own words

India deserves the detail because the gap between what banks do and what the Direction says is the widest, and because the deadline everybody was working to has now passed.

Paragraph 38 sets the periodicity: at least once every two years for high risk customers, once every eight years for medium risk, once every ten years for low risk, from account opening or the last update. Then it adds the provision that matters if your debits have been blocked. For an individual customer categorised as low risk, the regulated entity shall allow all transactions and ensure the KYC update happens within one year of it falling due, or up to 30 June 2026, whichever is later, and this applies equally to low risk customers whose updation had already fallen due. Those accounts are to be subject to regular monitoring, which is the trade off the rule makes: watch them, do not block them.

Paragraph 38(e) then sets out the notices. Before the due date, at least three advance intimations, including at least one by letter, at appropriate intervals. After the due date, at least three reminders, including at least one by letter. The letter is supposed to contain easy to understand instructions, an escalation mechanism for getting help, and the consequences of not updating in time. Every intimation and reminder must be recorded in the bank's system against the customer for an audit trail, and the whole requirement had to be implemented no later than 1 January 2026.

That audit trail is the most useful sentence in the paragraph for a customer. You are not asking the bank to take your word that no letter arrived. You are asking it to produce a record it is required to keep.

Where the freeze power actually comes from

This is the part that surprises people who have read about partial freezing. The consolidated Master Direction does not give banks a freezing power for late periodic updation. The provision that allows a bank to stop an account sits in paragraph 39 and it is about something else: an existing customer who has not given a Permanent Account Number, an equivalent electronic document or Form 60 by the date notified by the Central Government. In that case the bank shall temporarily cease operations in the account until the number or form is submitted.

Even there, the rule is fenced. Before temporarily ceasing operations the bank shall give the customer an accessible notice and a reasonable opportunity to be heard. It must also write relaxations into its internal policy for customers who cannot provide the number because of injury, illness or infirmity on account of old age or similar causes, with those accounts subject to enhanced monitoring instead. And the Direction defines temporary ceasing of operations plainly: the temporary suspension of all transactions or activities in the account until the customer complies, except in asset accounts such as loans, where only credits are allowed.

So if your debits were blocked purely because a periodic update was late, ask the bank which provision it relied on, and ask for the notice and the opportunity to be heard that paragraph 39 requires if that is the provision it names. Firms do restrict accounts under their own internal policies, and paragraph 38 does allow a bank to adopt additional and exceptional measures, but it requires those measures to be clearly specified in an internal KYC policy approved by the board. That is a document you can ask them to point to.

The self declaration route, and the channels that count

If your KYC information has not changed, paragraph 38 lets the bank take a self declaration to that effect through your email address registered with the bank, your registered mobile number, an ATM, digital channels such as internet banking or the bank's mobile app, or a letter. Nothing in that list is a branch visit.

If only your address has changed, a self declaration of the new address goes through the same channels, and the bank then verifies the new address by positive confirmation within two months, using means such as an address verification letter, contact point verification or a deliverable sent to the address. The bank may also ask for a copy of an officially valid document as proof of address, at its option, provided that requirement is written into its own KYC policy.

Banks can also take the declaration through an authorised business correspondent. The correspondent collects it after a successful biometric based electronic KYC authentication, has to give you an acknowledgment of receipt, and forwards it to the branch. The bank must then update the record and tell you once it has been updated. The Direction is explicit that the ultimate responsibility for periodic updation stays with the bank, not the correspondent.

Two practical notes. Where the documents the bank holds are no longer up to current standards, or the validity of those documents has expired, the bank has to run a process equivalent to onboarding a new customer, so expect a full check rather than a declaration. And if you were a minor when the account was opened, a fresh photograph and current documents are required once you become an adult.

Outside India, the same review runs on a different clock

Nothing about periodic review is unique to India. What differs is that most other regimes set no fixed interval, so the trigger is invisible until it fires.

Where	What drives the review	What the firm owes you	Your lever if it stalls
United Kingdom	Ongoing monitoring duties, with the timing left to the firm's own risk assessment	A final response to a complaint within 8 weeks, or 15 days where the account is a payment service or electronic money account	The Financial Ombudsman Service, free, within 6 months of the final response
European Union and EEA	Ongoing monitoring now, and one harmonised rulebook from 10 July 2027 when Regulation (EU) 2024/1624 applies	For a basic payment account, the specific reason in writing, and at least two months of notice before most unilateral closures	The national competent authority, or the data protection authority for an automated decision
India	A fixed interval by risk category under paragraph 38 of the Master Direction	Three advance intimations and three reminders, at least one of each by letter, recorded for audit	Written complaint, then the Reserve Bank Integrated Ombudsman Scheme after 30 days, no fee
United States	Customer due diligence refresh driven by the firm's own risk profile and monitoring	An adverse action notice naming the reporting agency where a consumer report was used	A free copy of that report within 60 days, then a dispute

The pattern holds everywhere. The identity part of a review is administrative and you can move it. The risk part is a decision the firm may not be allowed to discuss. Your rights in both cases are set out in our guide to what banks owe you after a rejection.

The order to do it in

Check what is actually blocked. Credits arriving but debits refused is a different state from the whole account being suspended, and the messages do not always say which one you are in.
Establish whether anything has changed. Name, address, phone number, email, tax number. If nothing has, you are in self declaration territory and this should be quick.
Use a channel that can still write to your record. If the app or website refuses with a cutoff or invalid state message, stop using it and move to a branch, an authorised business correspondent, or a written complaint.
Ask three questions in writing, together. Which risk category am I in, which provision are you relying on to restrict the account, and on what dates were the intimations and reminders sent to me.
Get the acknowledgment. Whatever channel you use, get something in writing that says the declaration or documents were received, with a date on it.
Diary the deadline and escalate on the day it expires. In India that is 30 days from your written complaint. In the UK it is 15 days for a payment services account, or 8 weeks otherwise.

Cite this article

"According to KYCRejected.com, paragraph 38 of the Reserve Bank of India Master Direction on Know Your Customer sets periodic KYC updation at least once every two years for high risk customers, once every eight years for medium risk and once every ten years for low risk, and requires that for a low risk individual customer the regulated entity shall allow all transactions and complete the update within one year of it falling due, or up to 30 June 2026, whichever is later. Banks must send at least three advance intimations before the due date and three reminders afterwards, including at least one of each by letter, recorded for audit. The Master Direction ties temporary ceasing of account operations to a missing Permanent Account Number or Form 60 under paragraph 39, and requires an accessible notice and a reasonable opportunity to be heard first."

Source: KYC Rejected. Frozen for Re-KYC: The Periodic Review Explained (2026). https://kycrejected.com/re-kyc-account-frozen

Sources and references

Reserve Bank of India, Master Direction on Know Your Customer, paragraph 38, updation and periodic updation of KYC: periodicity of two, eight and ten years by risk category; the instruction that for low risk individual customers the regulated entity shall allow all transactions and ensure updation within one year of falling due or up to 30 June 2026, whichever is later, with regular monitoring; self declaration channels including registered email, registered mobile number, ATMs, internet and mobile banking and letter; positive confirmation of a declared new address within two months; use of business correspondents after biometric based e-KYC authentication with acknowledgment of receipt; the requirement that additional and exceptional measures be specified in a board approved internal KYC policy.
Reserve Bank of India, Master Direction on Know Your Customer, paragraph 38(e), due notices for periodic updation: at least three advance intimations including one by letter before the due date, at least three reminders including one by letter afterwards, contents of the letter, audit trail in the system, and implementation no later than 1 January 2026.
Reserve Bank of India, Master Direction on Know Your Customer, paragraph 39, obtaining the Permanent Account Number, equivalent e-document or Form 60 from existing customers, temporary ceasing of operations, the requirement of an accessible notice and a reasonable opportunity to be heard, relaxations for injury, illness or infirmity with enhanced monitoring, and the definition of temporary ceasing of operations.
Reserve Bank of India, Know Your Customer (Amendment) Directions, 2025, dated 12 June 2025, which introduced the low risk timeline and the due notices requirement into paragraph 38.
Reserve Bank Integrated Ombudsman Scheme 2021, clause 10(2): written complaint to the regulated entity first, the 30 day wait where no reply is received, and the limit of one year after the reply or one year and 30 days where no reply is received. No fee is charged to complainants.
Financial Ombudsman Service, how to complain: 8 weeks for most complaints, 15 days for complaints about payment services and electronic money, 6 months from the final response to refer the complaint, free to consumers.
Regulation (EU) 2024/1624 on the prevention of the use of the financial system for money laundering or terrorist financing, which entered into force on 9 July 2024 and applies from 10 July 2027.
Directive 2014/92/EU, Articles 16(7) and 19, on the specific reason for refusal and on the grounds and notice period for terminating a payment account with basic features.

Frequently asked questions

Why was my account restricted when I did nothing wrong?

Because periodic updation is a duty on the firm, not a judgment about you. Every regulated firm has to re-check customers it already has, on a schedule set by your risk category or by its own risk assessment. When the schedule runs out and the record has not been updated, systems start restricting. In India the interval is set by paragraph 38 of the Reserve Bank of India Master Direction on KYC: at least every two years for high risk customers, every eight for medium risk and every ten for low risk, counted from account opening or the last update.

Can an Indian bank block debits because re-KYC is pending?

Check your risk category before accepting that it can. Paragraph 38 of the Master Direction says that for an individual customer categorised as low risk the regulated entity shall allow all transactions and ensure the update happens within one year of it falling due, or up to 30 June 2026, whichever is later, with the account subject to regular monitoring. The Direction's own power to temporarily cease operations, in paragraph 39, is tied to a missing Permanent Account Number or Form 60, and requires an accessible notice and a reasonable opportunity to be heard first.

Do I have to visit a branch to complete re-KYC?

Not under the Direction itself. Where there is no change in your KYC information, a self declaration can be given through your email address registered with the bank, your registered mobile number, an ATM, internet or mobile banking, or a letter. Where only your address has changed, the same channels apply and the bank then confirms the new address within two months. A bank may impose a branch requirement, but paragraph 38 requires any such additional or exceptional measure to be clearly specified in its internal KYC policy approved by its board.

What does it mean when the app says my re-KYC cannot be done due to a cutoff date?

It means the self service channel has been told not to handle your record, usually because the account has been moved into a restricted batch or state. It is not a comment on the documents you uploaded. Resubmitting through the same channel will keep failing. Raise the request through a channel that can still write to the record, which in practice means a branch, an authorised business correspondent, or a written complaint that puts a person on the file.

The bank says my service request was rejected for an invalid customer state. What now?

That is an internal status message. The account already carries a flag that stops the update request from processing, so the request is refused before anyone looks at it. Ask the bank in writing which flag is set, which provision it relied on to set it, and what has to happen for it to be cleared. Keep the reference number of the failed request, because it shows you tried through the official channel.

How many notices should I have received before the restriction?

In India, at least six in total. Paragraph 38(e) requires at least three advance intimations before the due date, including at least one by letter, and at least three reminders after the due date, including at least one by letter. The letters are meant to explain how to update, how to escalate for help, and the consequences of not updating. Every intimation and reminder has to be recorded in the bank's system against your record for an audit trail, so ask for those dates rather than asserting that nothing arrived.

Is this the same as being rejected during signup?

No, and the difference changes what you should do. A signup rejection is a decision about whether to take you on, and the fix is usually the document or the photograph. A periodic review restriction is an administrative refresh of a relationship that already exists, so the fix is usually a declaration or a current document, and you have an existing relationship to complain within. If you were refused at signup instead, start with our guide to what banks owe you after a rejection.