KYC checklist for small loans: documents to collect and how to protect them
For a small loan, collect a photo, an identity proof such as Aadhaar or voter ID, PAN where available, an address proof, bank or UPI details and a guarantor with photo. Store Aadhaar in masked form, keep only what you need, and check the latest RBI and state requirements that apply to your business.
Why does KYC matter even for small daily loans?
KYC, or know your customer, is how you confirm who you are lending to. For a small daily loan, it does three practical things. It makes it harder for a borrower to take loans from you under different names. It gives you a way to find them if they move. And it gives you a guarantor to speak to if payments stop.
Regulated lenders such as NBFCs have formal KYC rules set by RBI, and others may have requirements under state law or their own policy. This checklist is a general good-practice guide, not legal advice. Check the latest RBI circulars and your state rules for what is mandatory in your case.
Which documents should you collect?
Match the documents to the loan size and your risk. A ₹5,000 first loan to a known vendor needs less than a ₹50,000 loan to a new borrower, but the basic set is the same.
- Recent photograph of the borrower, taken at the time of the application.
- Identity proof: Aadhaar, voter ID or another officially valid document.
- PAN where the borrower has one, particularly for larger loans.
- Address proof: Aadhaar, utility bill, rental agreement or a similar document.
- Phone number, and a second contact such as a family member.
- Bank account number and IFSC, and a UPI ID if the borrower pays by UPI.
- Place of business details and a photograph of the shop or stall.
- Signature or thumb impression on the loan agreement.
How should you handle Aadhaar safely?
Aadhaar numbers are sensitive. Good practice is to collect and display only what you need. Where you show the number on screens, receipts or reports, show it in masked form, for example XXXX XXXX 1234, so that only the last four digits are visible. Do not publish or share it on social media or messaging groups.
Check the number is valid. Aadhaar numbers carry a checksum digit, so a mistyped number can be caught on entry. Also remember that UIDAI has its own rules about how Aadhaar can be collected, used and stored, so follow the latest guidance and take advice if you are unsure.
Limit access. Not everyone in your team needs to see the full number. DailyRupee, for example, stores Aadhaar masked for non-admin users and validates the checksum, so agents see the last four digits only.
How do you pick and document a guarantor?
A guarantor is someone who knows the borrower and agrees to help if repayment fails. Choose someone with a stable address and income, not a relative living in the same house who would have the same problem. Record their name, phone number, address, relationship to the borrower and a photograph.
Explain the role clearly and in the guarantor's language: what they are agreeing to, and what you will and will not ask of them. A guarantor who understands their role is more likely to help early, and less likely to feel misled later. Conduct towards guarantors should follow the same fair-practice principles as conduct towards borrowers.
How should you verify, store and review KYC?
Verify before you lend. Compare the photo with the person, check the name matches across documents and visit the place of business or home when practical. Mark the status of each customer as not started, pending, verified or rejected, and have a manager approve verification rather than the agent who brought the customer.
Store documents securely. Photograph documents with a phone camera at a reasonable size, keep them in a system with access control rather than in a messaging group, and delete documents you no longer need according to your policy and legal obligations. Make sure the whole customer list is not sitting in an unprotected spreadsheet.
Review periodically. Many lenders require KYC to be verified before a loan is sanctioned; some set a rule that no loan may be disbursed to a customer whose KYC is pending. A weekly check of the pending queue stops it from piling up.
What privacy practices should you follow?
Tell borrowers what you collect and why, use it only for the loan, and do not share it except where required. Protect devices with a lock, remove access when an agent leaves, and avoid sending ID images over personal chats. India's data protection law is evolving, so check the latest requirements that apply to you.
Collecting less is the simplest protection. If a document is not useful for the loan or required by a rule that applies to you, do not collect it.
How to complete KYC for a small loan
Meet the borrower and take a photograph
Take a recent photo at the time of application and confirm the name and phone number.
Collect identity and address proof
Record Aadhaar or another valid ID, PAN if available, and an address proof, and store Aadhaar in masked form.
Record bank, UPI and business details
Note the bank account and IFSC, UPI ID, and the address and photograph of the place of business.
Add a guarantor with photo and contact details
Record the guarantor's name, phone, address, relationship and photo, and explain their role.
Get a manager to verify and mark the status
Verify documents against the person, mark the KYC status as verified or rejected, and lend only after approval.
Frequently asked questions
Is KYC mandatory for small loans?
For NBFCs and other regulated lenders, KYC is required under RBI rules. Others may need it under state law or as a matter of good practice. Check the latest rules that apply to you.
Should I store the full Aadhaar number?
Good practice is to store and display it masked, such as XXXX XXXX 1234, and limit who can see the full number. Follow the latest UIDAI and RBI guidance.
Do I need a guarantor for every small loan?
Not by law in every case, but many lenders ask for one because it improves recovery and screening. Decide a policy by loan size and risk.
Can agents take KYC photos on their phones?
Yes, many lenders do. Use a system that stores them securely with access control, rather than sharing them in chat groups.