Fintellect
TF Buzz
Issue Summary:
On 04 August 2025, I received a CKYCR SMS alert from CERSAI stating that SBI Cards and Payment Services Ltd. had fetched my CKYCR (Central KYC Registry) Record bearing reference number 50071620638291.However, I want to clarify upfront:
This appears to be unauthorized access to sensitive financial data.
What is CKYCRR? Why is this serious?
CKYCRR is a centralized KYC repository managed by CERSAI (Central Registry of Securitisation, Asset Reconstruction and Security Interest of India). Banks and NBFCs are allowed to access your CKYC only with your explicit, auditable consent.Fetching CKYC without consent is not just a breach of RBI guidelines, but also:
- A potential violation of privacy
- May result in unauthorized loan or credit card processing
- Could harm your credit score and expose you to financial fraud
What I Did Immediately:
- 📧 Emailed SBI Card Nodal Officer demanding:
- Reason for CKYC fetch
- Internal reference ID or application number
- Verifiable proof of consent (timestamp, IP, OTP, etc.)
- Call recordings or screenshots (if any consent was claimed)
- 📧 Emailed CKYCR (CERSAI) Helpdesk asking:
- How SBI Card was allowed to fetch my CKYC
- If consent was submitted, I requested full traceability logs
Which Rules/Acts Were Violated?
- RBI Master Direction – KYC (Updated June 2025): Consent is mandatory for data fetch.
- CKYC FAQ by CERSAI – Point J: Reporting entities must have auditable customer consent.
- DPDP Act, 2023 (Digital Personal Data Protection): Processing without consent is punishable.
- Information Technology Act, 2000 – Section 43A, 72A
Why This Matters for You:
- Even if you don’t apply for a credit card or loan, your data can still be fetched and misused.
- You may be unaware of unauthorized applications or hits to your credit report.
- Such practices erode trust and can cause financial and reputational harm.
How to Stay Protected:
- Turn on CKYC SMS alerts (if not already enabled).
- Avoid sharing PAN/mobile on random credit card comparison platforms.
- Revoke consent from platforms you no longer use (like Paisabazaar, Bankbazaar, other 3rd parties, etc.).
- Check your CIBIL/CRIF/Equifax/Experian reports regularly for any hard inquiries or accounts you didn’t authorize.
- File a complaint with:
- SBI Cards Nodal Officer (nodalofficer@sbicard.com)
- CKYCR Helpdesk (helpdesk@ckycindia.in)
- RBI CMS: https://cms.rbi.org.in
💬 Has anyone else here noticed CKYCR fetch notifications from banks or NBFCs without consent?
- Check your SMS logs or email alerts.
- Let’s compile names of such entities and raise collective awareness.
– Fintellect
Attachments
