SEBI Directs Firms to Align KYC Systems with FATCA/CRS Reporting

India’s Securities and Exchange Board of India (SEBI) directed registered intermediaries that qualify as Reporting Financial Institutions (RFIs) to bring FATCA/CRS reporting and due diligence into customer onboarding and Know Your Customer procedures. The circular is dated November 11, 2026.

The direction targets firms meeting the RFI definition, not every intermediary by default. They must update KYC systems and maintain information needed for their reporting duties.

The rules concern Automatic Exchange of Information, or AEOI. FATCA is a U.S. tax-compliance framework, while CRS provides a shared standard for participating jurisdictions to exchange financial-account information.

RFI intermediaries must build reporting checks into onboarding

Rule 238(8) of the Income-tax Rules, 2026 defines which entities count as RFIs. Registered intermediaries within that category must take steps to comply with Rules 238 to 240, SEBI said in its circular.

The regulator’s direction reaches beyond the act of filing a report. Firms must weave AEOI due diligence into the way they bring customers on board and conduct KYC, while retaining information required under the rules. That places work across onboarding and compliance functions, rather than solely with teams preparing tax reports.

SEBI’s circular states: “Registered intermediaries shall incorporate AEOI reporting and due diligence requirements into their customer onboarding and Know Your Customer (KYC) frameworks”. The direction also instructs firms that qualify as RFIs to take the steps needed to comply with the specified rules.

The revised framework took effect on April 1, 2026

The Income-tax Act, 2025 and Income-tax Rules, 2026 replaced the prior income-tax framework with effect from April 1, 2026. The circular brings the regulator’s instructions into line with the revised law and rules.

For AEOI accounts covered by FATCA and CRS, the new framework uses Section 508 of the Act, Rules 238, 239 and 240, and Form 166. The circular describes Rule 239(12)(a) as requiring regulators to instruct the financial institutions they oversee on reporting and due diligence, and on maintaining account information for reporting.

SEBI issued the direction under Section 11(1) of Chapter IV of the Securities and Exchange Board of India Act, 1992, read with Rule 239(12)(a). Circular No. HO/38/14/(18)2026-MIRSD-POD2/I/25560/2026 was signed by Bhumika Kanojia, Deputy General Manager.

Form 166 XML must include every mandatory field

Reporting teams must revise the software that generates Form 166 XML so it captures all newly required fields. A missing field can stop a submission at the portal’s validation stage.

“Failure to include required fields will result in validation errors on the Income Tax portal.”

The circular specifies that all new mandatory fields must be included. It does not describe a separate penalty in the direction’s stated software requirement.

Intermediaries must upload client certifications to KRA systems

Firms must upload FATCA and CRS certifications collected from clients to the systems of KYC Registration Agencies (KRAs). SEBI places the compliance obligation on the intermediary itself:

“The onus of obtaining and reporting the FATCA and CRS certification and related compliances shall lie solely with the respective intermediaries.”

Compliance teams should account for three distinct tasks in carrying out the direction:

• Update customer onboarding and KYC processes to incorporate AEOI reporting and due diligence.
• Add every mandatory field to Form 166 XML-generation software.
• Upload client certifications to KRA systems and consult the Central Board of Direct Taxes’ Guidance Note on FATCA and CRS, dated July 24, 2026.

The guidance note provides direction for RFIs on FATCA and CRS. The circular gives no completion date for the KYC and reporting-system changes.