KYC Before Payment for Research Analysts: KRA Checks, MITC E-Sign, Then Fees

KYC before payment: the order that keeps an RA compliant

For a SEBI-registered Research Analyst, onboarding a paying client has a fixed order: complete KYC, take the client's consent on your terms and MITC, and only then collect the fee. Get the order wrong, by sending a payment link first and asking for documents later, and you have charged a fee before consent. That is one of the first things a compliance auditor checks.

This guide covers what SEBI requires for RA client KYC, how the KRA system fits in, and how to design an onboarding flow that keeps KYC and e-sign ahead of payment. The rules are from the RA Regulations and SEBI's Master Circular for Research Analysts dated 6 February 2026.

What SEBI requires

• KYC for fee-paying clients. Regulation 25(1) requires RAs to follow the KYC procedure for their fee-paying clients and keep KYC records as SEBI specifies. SEBI's FAQs clarify that KYC applies to clients paying fees directly for research services.
• Through a KRA. The standard terms say the RA shall collect, store, upload and check KYC records of clients with a KYC Registration Agency (KRA) as SEBI specifies.
• Consent before service or fee. No research service may be rendered and no fee charged until the client consents to the terms and conditions, including the MITC.
• Records for five years. KYC records, signed terms and records of interactions with clients and prospective clients must be kept for at least five years, and longer if a dispute is open.

Who needs KYC

Count families correctly at onboarding. The fee cap of ₹1,51,000 a year applies per family for individual and HUF clients, and for client-level segregation PAN is the control record and a family counts as one client. Capture PAN and family links in the same step as KYC. See what an RA may charge.

How KRA KYC works for an RA

KYC Registration Agencies hold KYC records for investors in the securities market. Many of your clients will already have a KRA record from opening a demat or mutual fund account. For an RA, that means:

• Check first. Look up the client's PAN with a KRA. If a valid record exists, you can generally use it rather than collecting documents again. Follow the KRA's rules on which record statuses can be relied on.
• Upload when needed. If the client has no record, or the record is incomplete, collect the KYC documents and upload the record to the KRA.
• Store what you used. Keep the KYC data or record you relied on, with the date of the check, in the client's file.

Access to KRA systems usually comes through a KRA directly or through a technology provider that is connected to one. Ask your provider which KRA it uses and what it stores.

An onboarding flow that keeps payment last

Mistakes to avoid

• Payment link first. Collecting money from a payment page shared on social media or messaging, then asking for KYC and consent. This charges a fee before consent.
• Access before KYC. Adding a client to a paid Telegram channel or app before KYC is complete.
• Renewals without fresh consent. For existing clients, terms must be disclosed and consent taken on or before the renewal date or next fee due date, whichever is earlier.
• Losing the link. Not being able to show which KYC check and which signed version of the terms came before which payment.

Protecting client data

KYC data is personal and sensitive. The investor charter gives clients a right to privacy and confidentiality, and requires RAs to protect clients' confidential information from unauthorised use. In practice:

• Collect only what KYC and your services need.
• Restrict access to KYC files to the people who need them.
• Check where your software vendors store client data. RAs give SEBI a half-yearly undertaking on compliance with the CERT-In advisory on Software as a Service solutions, which is concerned with critical data leaving India.
• Never ask for, or accept, clients' trading, demat or bank logins or OTPs. The MITC says the RA will never ask for them.

What the auditor will check

The annual compliance audit will typically sample client files and look for:

• completed KYC, checked with a KRA, for every fee-paying client;
• signed terms and MITC dated before the first payment;
• invoices and payment records matching the plan the client signed for;
• records of interactions kept for five years.

KYC before payment on AlphaQuark

AlphaQuark runs onboarding for RAs in this order under their own brand: KYC with KRA lookup, MITC e-sign, then payment and invoice, with each step timestamped against the client. Access to plans, Telegram channels and alerts starts only after payment and ends with the paid period. See the RA platform, and our guide to collecting subscription payments.