What Is a CKYC Number, How to Find It, and How Lenders Verify It

A CKYC number is a national 14-digit code that stays identical across all financial institutions, while a bank CIF is an internal bank code and a KRA status applies only to capital markets.

Borrowers often confuse these three identifiers. A bank Customer Information File (CIF) or Customer ID is an internal code created inside a single bank. As documented in SBI Card's CKYC guidelines, a CIF groups accounts within that bank alone. It uses 11 digits at State Bank of India, or 8 to 9 digits at private lenders. Outside institutions cannot read or use it.

Similarly, a KYC Registration Agency (KRA) status operates under SEBI rules for capital market investments. According to DBS Bank India's regulatory guide, KRAs track compliance against an investor's 10-digit PAN. This produces market-specific statuses like 'KYC Validated', 'KYC Registered', or 'KYC On-Hold'.

In contrast, Protean eGov Technologies explains that the 14-digit CKYC number is a national identifier. CERSAI issues it under central rules. As noted in Ujjivan Small Finance Bank's CKYC guide, this 14-digit code works across four financial regulators: RBI, SEBI, IRDAI, and PFRDA.

Individuals can check their 14-digit CKYC number or download their digital KYC card through five simple digital routes.

1. CERSAI Missed-Call Facility

As outlined in IDFC FIRST Bank's CKYC guidance, CERSAI runs an automated missed-call service. Dialing 7799022129 from your KYC-registered phone prompts CKYCRR to send an SMS with a direct link to download your digital CKYC card.

2. Official CKYCRR Consumer Portal

Individuals can pull records directly from the official CKYCRR consumer portal. Submitting your registered mobile number, captcha, and OTP lets you view and download your 14-digit KIN card.

3. Commercial Bank Net Banking and Mobile Apps

Banks display the 14-digit number inside customer portals. In the SBI Card app, open My Profile, select 'CKYC Details', and unmask the code with OTP verification. State Bank of India customers can check records in OnlineSBI under Personal Details or via the YONO app under Service Request.

4. DigiLocker Central KYC Document Pull

Under DigiLocker's integration with CERSAI, citizens can pull their Central KYC card into DigiLocker. Mobile OTP or Aadhaar verification generates a verified document under the Information Technology Act, 2000.

5. KRA Inquiry Portals

Mutual fund investors can check centralized status through KRA portals like CVL KRA, CAMS KRA, or NDML KRA. Submitting a 10-digit PAN and captcha shows whether the record is validated or needs remediation.

An individual cannot apply for a CKYC number directly on a government portal; an onboarding financial institution must generate it for you.

When opening an account or loan, the onboarding institution acts as a Reporting Entity under the Prevention of Money-laundering Act. The institution verifies your Officially Valid Documents (Passport, Driving License, Voter ID, proof of Aadhaar verification, and PAN verification details).

Under central PML rules and the Reserve Bank of India 2025 KYC Directions for commercial banks, regulated entities must upload verified records to CKYCRR within 10 days of establishing an account relationship. Once CERSAI validates the file, the registry assigns a 14-digit KIN and notifies the customer by SMS. Other lenders can then reuse this central record instead of asking for fresh paperwork.

Lenders and NBFCs verify borrower identity by connecting to CKYCRR backend APIs to search existing records and download verified documentation in real time.

This technical workflow involves two primary steps:

Step 1: Search API Query (API v1.3)

When an applicant applies for credit, the lender queries CKYCRR through the Search API. As analyzed by Think360.ai's technical evaluation, API version 1.3 allows lenders to search records using an applicant's PAN, Aadhaar reference (last four digits or virtual ID hash), 14-digit CKYC number, or mobile number.

Under CKYCRR Communique 2024/06, CERSAI masks the 14-digit identifier on search outputs, releasing the full number only after an authorized download. Under CKYCRR Communique 2026/03, CERSAI introduced mobile-based search across API, bulk, and web channels, requiring search outputs to display a masked mobile number showing only the last four digits.

Step 2: Two-Step OTP Download API

Under CKYCRR Communique 2025/02, CERSAI mandated a two-step OTP download workflow in API version 1.3, barring silent data downloads.

When a lender initiates a download call, CERSAI sends an OTP to the customer's registered phone. The borrower enters this code, and the lender submits it back to CKYCRR for validation.

Upon validation, CKYCRR releases an encrypted payload containing demographic details (name, date of birth, gender, father or spouse name), permanent and correspondence addresses, OVD numbers, and base64 images of the photo, signature, and documents. Under RBI 2025 KYC Directions for commercial banks, the entity that last updated the record carries formal responsibility for verification, allowing subsequent lenders to rely on it.

To offset operational expenses, CERSAI pays reporting entities ₹0.50 for new records and ₹0.25 for updates under CKYCRR Communique 2025/06. Under CKYCRR Communique 2025/18, institutions can flag deceased customer records using documentary proof, appending an 'X' prefix and restricting downloads. For broader architecture, see our guides on CKYCRR full form and functions and Central KYC 2.0.

The primary operational failure in digital CKYC verification happens when a borrower's current mobile number does not match the phone number stored in CKYCRR.

Because CERSAI sends download OTPs strictly to the phone number on file, an outdated number halts the digital journey. If the borrower cannot receive the OTP, the API download fails.

To address this friction, CKYCRR Communique 2026/01 provides two resolution paths:

• •Option 1 (Physical consent and SFTP download): The onboarding institution collects physical written consent from the customer, executes an SFTP bulk download, and updates the mobile number in CKYCRR.
• •Option 2 (Branch visit to existing institution): The customer visits a physical branch of the institution where they originally completed KYC to update their phone number before digital downloads can resume.

Institutions must handle updates carefully. Under CKYCRR Communique 2026/07, CERSAI issued strict directives cautioning reporting entities against modifying customer information, specifically mobile numbers, without prior verifiable customer consent.

In addition, older accounts create verification gaps. As noted in Axis Bank's digital banking documentation, accounts opened before the phased July 2016 rollout of CKYCRR often lack a 14-digit KIN. When a search yields no central record, lenders must route the applicant to full fresh customer due diligence.

For digital lending operations, CKYC verification provides fast access to verified customer records, but managing technical exceptions decides whether onboarding journeys convert or drop off.

The practical implication of the two-step OTP download rule is that digital verification funnels depend heavily on telecom SMS delivery. Because CERSAI routes download OTPs directly through telecom gateways, variable gateway latency can cause borrowers to abandon applications before the code arrives. Product teams can mitigate drop-offs by adding clear on-screen guidance explaining that the OTP comes from CERSAI rather than the lender.

Furthermore, the mobile number mismatch problem requires a defined system fallback. Read together, Communique 2026/01 and Communique 2026/07 mean that lending teams cannot simply overwrite an applicant's outdated phone number during digital onboarding. Doing so without verifiable consent violates registry directives, while relying on offline branch visits under Option 2 breaks instant onboarding.

This suggests lending architectures should implement automated verification cascading. When a CKYC Search API confirms that a record exists but OTP download fails due to an unreachable phone, or when an applicant holds a pre-2016 legacy account lacking a KIN, the system can cascade immediately to alternative digital routes. Routing the applicant to Aadhaar OTP e-KYC or Video KYC (V-CIP) keeps the onboarding session active while maintaining compliance with RBI customer due diligence rules.

KYCKART's onboarding infrastructure orchestrates CKYCRR searches, OTP downloads, and automated verification fallbacks, helping lenders verify borrower identity without manual underwriting friction.