Peridian Securities IFSC Ltd., a GIFT City-based stock broker registered with IFSCA, onboarded a new client, Chandrakar, on March 14, 2025 after completing his KYC process in full. The physical KYC documents were retaine

The IFSCA (KYC Registration Agency) Regulations, 2025 aim to strengthen trust in the IFSC ecosystem by establishing a unified, secure, interoperable, and regulated KYC framework. By clearly defining operational responsibilities and compliance standards for KRAs and financial institutions, the regulations ensure smooth functioning of capital market activities while safeguarding client information. The Regulated Entity shall have the following functions and obligations The Regulated Entity must perform the initial KYC/due diligence of the Client, upload the KYC information with proper authentication on the system of the KRA, furnish the scanned images of the KYC documents to the KRA, and retain the physical KYC documents. The Regulated Entity must upload the KYC information on the system of KRA within 3 working days from the date of completion of KYC process or any other timeline as specified by the IFSCA from time to time. When the Client approaches another Regulated Entity subsequently, the Regulated Entity must verify and download the Client's details from the system of KRA. Upon receipt of information on change in KYC details and status of the Clients by the Regulated Entity or when it comes to the knowledge of the Regulated Entity, at any stage, the Regulated Entity shall be responsible for uploading the updated information on the system of KRA and retaining the physical documents. A Regulated Entity must not use the KYC data of a client obtained from the KRA for purposes other than it is meant for; nor must it make any commercial gain by sharing the same with any third party including its affiliates or Associates. A Regulated Entity must have the ultimate responsibility for the KYC of its Clients, by undertaking enhanced KYC measures commensurate with the risk profile of its clients. The Regulated Entity must integrate its systems with the KRA to facilitate seamless movement of KYC documents to and from the Regulated Entity to the KRA. The IFSCA may, after taking into consideration the relevant factors, exempt certain classes of Regulated Entities from the applicability of these regulations. In the given case, Peridian Securities IFSC Ltd. has committed following two major regulatory breaches. The delay in uploading KYC data (8 days vs. the permitted 3 days) violates the operational standards of the KRA framework. Internal 'system migration' is generally not accepted as a valid excuse for statutory delays. Sharing Chandrakar's data with an associate company without explicit consent for commercial gain (cross-selling) is a severe breach of data confidentiality and violation of point (d) mentioned above.