DEV Community: BeFisc

The PAN Alternative, Its Form 97 Successor and What Lenders Must Verify

BeFisc — Mon, 12 Oct 2026 09:32:00 +0000

Form 60 is the declaration a person without a Permanent Account Number (PAN) files when entering a transaction that otherwise requires PAN, such as opening a bank account. Under the Income-tax Rules, 2026, in force from 1 April 2026, Form 60 has been replaced by Form No. 97, and Rule 114B by Rule 159.

Customers look for it when a bank asks for a PAN they do not have. Compliance teams look for it when an auditor asks why part of a portfolio has no PAN on file.

The 2026 rules changed the form’s number, narrowed where it can be used, and raised several PAN thresholds. This guide covers what changed, what RBI still requires, and how to verify and monitor no-PAN customers.

What Form 60 Is, and Why It Is Now Form 97
Form 60 was a declaration under the second proviso to Rule 114B of the Income-tax Rules, 1962. It let a non-corporate person without PAN complete a specified transaction by giving identity, address, and income details instead.

The Income-tax Act, 2025 and the Income-tax Rules, 2026 took effect on 1 April 2026 and renumbered most forms. The Income Tax Department’s rule pages and forms FAQ confirm this mapping:

Legacy (Rules, 1962) Current (Rules, 2026) Purpose
Rule 114B Rule 159 Transactions where PAN must be quoted
Form 60 Form No. 97 Declaration by a person without PAN
Rule 114D Rule 160 Reporting of declarations received
Form 61 Form No. 98 Statement of declarations received
Rule 159 sits under section 262 of the Income-tax Act, 2025, which replaced section 139A. Customers will keep asking for “Form 60 instead of PAN”, so SOPs should say Form 97 with “formerly Form 60” alongside.

One caution: RBI’s KYC Directions, as updated on 18 September 2026, still refer to “Form No. 60 as defined in Income-tax Rules, 1962”. Until RBI aligns the wording, document how your policy maps it to Form 97.

Transactions That Need PAN or a Declaration
Rule 159 lists 16 transactions where PAN must be quoted. The key change: a Form 97 declaration is accepted for only six of them (serial numbers 11 to 16). For the other ten, a person without PAN must apply for one.

PAN mandatory, no declaration route
Credit card applications and demat account opening, for all transactions.
Cash deposits or withdrawals aggregating Rs 10 lakh or more in a financial year with a bank or post office.
Mutual fund units, RBI bonds, debentures or bonds above Rs 50,000; securities contracts and unlisted shares above Rs 1 lakh; vehicles above Rs 5 lakh.
Declaration still accepted
Opening a bank account (other than a time deposit), and time deposits above Rs 50,000 or Rs 5 lakh in aggregate in a year.
Insurance premium above Rs 50,000 in a year.
Cash payments above Rs 1 lakh to a hotel, restaurant or event venue, and goods or services above Rs 2 lakh per transaction.
Immovable property above Rs 20 lakh. Above Rs 45 lakh, the person must apply for PAN.
Thresholds rose from the legacy table. Khaitan & Co’s April 2026 analysis notes the hotel bill trigger moved from Rs 50,000 to Rs 1 lakh, and property from Rs 10 lakh to Rs 20 lakh.

Who Can File the Declaration and What It Contains
Rule 159 allows the declaration from “any person, not being a company or a firm” without PAN. That covers individuals, HUFs, trusts, associations of persons, local authorities and certain foreign companies. Minors without taxable income quote a parent’s or guardian’s PAN instead.

Form 97 asks for more than Form 60 did. It runs in six parts: the coded nature of the transaction; a declaration of PAN status and whether income exceeds the taxable limit; identity and address details including a masked Aadhaar number; transaction value, cash component and payment mode (UPI now has its own code); supporting documents for identity, address and date of birth with document numbers; and a signed verification acknowledging prosecution for false statements.

Customers searching “form 60 pdf” should use incometax.gov.in or the bank’s branch copy.

Form 61 and Form 98: Reporting Duties for Recipients
Rule 160 requires specified recipients to report what they collect:

Declarations received from April to September are reported in Form No. 98 by 31 October.
Declarations received from October to March are reported by 30 April of the next financial year.
Statements go online to the Director of Income-tax (Intelligence and Criminal Investigation).
Declarations must be retained for six years from the end of the financial year of the transaction.
Banks should confirm that reporting systems match the Form 98 schema and that retention reads six years, longer than the five-year PMLA horizon.

Form 60 in Banking KYC: What RBI Requires
For individuals, paragraph 23 of RBI’s KYC Directions requires “PAN or the equivalent e-document thereof or Form No. 60” alongside proof of identity and address. The declaration is therefore a lawful alternative at onboarding, not a gap in KYC.

Paragraph 43 covers existing customers. A bank must obtain PAN, its e-equivalent, or Form 60 by a date the Central Government notifies. If the customer does not comply, the bank temporarily ceases operations in the account until PAN is submitted. The Directions add guardrails:

Customers get accessible notice and a reasonable opportunity to be heard before suspension.
Policy should relax the requirement for customers unable to provide PAN due to age-related infirmity, with enhanced monitoring.
If a customer declines in writing, the bank closes the account after settling obligations.
These rules sit within the wider For NBFCs, the parallel Directions follow the same logic, covered in our note on.

Where BeFiSc fits: IDProof lets a lender verify PAN when one exists and, when a customer files a no-PAN declaration, check the identity and address documents behind it through Aadhaar routes, DigiLocker, face match, and name match. Book a PAN and Form 60 verification workflow demo to see the flow end to end.

Where No-PAN Declarations Are Misused
Most filers are legitimate: students, homemakers, agricultural earners, and new-to-credit customers. The risk sits in a minority of declarations used to keep activity out of view:

A customer who holds PAN files the declaration anyway, so a deposit does not attach to their PAN record.
One person files declarations at several institutions, splitting activity that would otherwise cross a PAN trigger.
The declared income is “below taxable limit” while account turnover says otherwise.
Mule accounts are opened without PAN using borrowed identity documents, then used to receive fraud proceeds.
PANs not linked with Aadhaar by 30 June 2023 became inoperative (Ministry of Finance press release, 28 March 2023), and some of those holders present a no-PAN declaration instead. That is not a valid substitute for a PAN the person already holds. Checking separates “has no PAN” from “has a PAN that needs fixing”.

Verifying This at Scale for Your Business
A no-PAN declaration should route a customer into a defined workflow, not a manual exception queue:

Attempt PAN discovery first, and run a check on any number offered.
Confirm the product falls in Rule 159 serials 11 to 16; if not, the declaration route is closed.
Verify the Part E documents at source through Aadhaar-based e-KYC, DigiLocker, or OVD checks, with name match across them.
Test the income declaration against the product. A high-limit account with “below taxable income” deserves review.
Tag the account as no-PAN so monitoring rules, Form 98 reporting, and periodic updation pick it up.
Prompt for PAN at triggers such as limit increases, cash activity approaching Rs 10 lakh in aggregate, or periodic KYC updation.
No-PAN accounts with rising cash or rapid pass-through flows belong on your enhanced list.

Key Takeaways
Form 60 is now Form No. 97 and Rule 114B is now Rule 159 under the Income-tax Rules, 2026, effective 1 April 2026.
The declaration route covers six transaction types, including bank account opening; credit cards, demat accounts, and large cash activity need PAN.
Recipients report declarations in Form No. 98 by 31 October and 30 April and keep them for six years.
RBI’s KYC Directions still accept “PAN or Form No. 60” for individuals, with the legacy reference awaiting alignment.
Treat no-PAN customers as a monitored segment and prompt for PAN at risk triggers.
Conclusion
The move from Form 60 to Form 97 is more than a renumbering. By pushing credit cards, demat accounts, and large cash activity into PAN-only territory, the 2026 Rules shrink the space where a declaration can stand in for PAN.

For regulated entities, the response is operational: update forms and SOPs, map RBI’s legacy wording, and treat every no-PAN relationship as a verified, tagged, and monitored segment. Done well, these customers become easy to serve and hard to misuse

POA Full Form in KYC: Proof of Address Rules, Deemed OVDs, and Digital Verification

BeFisc — Mon, 12 Oct 2026 09:21:39 +0000

The POA full form in KYC is Proof of Address: a document or verified data source that establishes where a customer lives. In legal contexts, POA also means Power of Attorney, an authority to act for someone else. In Indian banking and fintech onboarding, POA almost always means proof of address under RBI’s KYC rules.

Most people who look up the POA full form want to know which document will satisfy a bank. Address is also the KYC attribute that goes stale fastest. People move for jobs, rent new flats, and keep old Aadhaar addresses for years. A lender that verifies identity carefully but treats address as a formality ends up with collections, CPV, and fraud-investigation teams chasing customers who were never where the file said.

This guide explains what counts as proof of address under RBI’s KYC Directions, how deemed OVDs and the three-month rule work, how current and permanent address differ, and how regulated entities verify address digitally without inviting edited utility bills into the file.

What the POA Full Form Means in KYC
In KYC, the POA full form is Proof of Address. It sits beside POI (Proof of Identity) as one of the two pillars of customer identification. For individuals, RBI’s KYC Directions require the bank to establish both, generally through an Officially Valid Document (OVD) or its verified digital equivalent.

Why does the address matter so much? It anchors several downstream obligations:

Communication and legal notices, including periodic KYC update reminders sent by letter.
Collections and recovery, where a wrong address converts a soft bucket into a write-off.
Risk assessment, since address feeds geography-based risk and fraud clustering.
Regulatory reporting, where suspicious transaction reports need accurate customer particulars.
What RBI Accepts as Proof of Address
For banks, the current text is the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, dated 28 November 2025 and updated on 18 September 2026; other regulated entities have parallel directions. Paragraph 5(1)(xiv) defines the OVDs that serve as POA.

Officially Valid Documents
Passport.
Driving licence.
Proof of possession of Aadhaar number.
Voter’s Identity Card issued by the Election Commission of India.
Job card issued by NREGA, signed by a State Government officer.
Letter issued by the National Population Register with name and address.
Deemed OVDs and the three-month rule
When the OVD a customer holds does not show the current address, the Directions allow certain documents to be “deemed OVDs” for the limited purpose of proof of address:

Deemed OVD Condition
Utility bill (electricity, telephone, post-paid mobile, piped gas, water) Not more than two months old
Property or municipal tax receipt As issued by the local authority
Pension or family pension payment order Issued to retired employees by government departments or PSUs, containing address
Employer accommodation allotment letter or leave and licence agreement From specified employers such as government departments, PSUs, scheduled banks and listed companies
The concession is temporary. The customer must submit an OVD with the current address within three months. A sound onboarding system sets a diary date on day one and escalates on day 75, not day 95.

Our guide covers the full CDD framework around these definitions.

Current Address vs Permanent Address
Knowing the POA full form does not settle which address the proof covers. Permanent address is what the OVD says. Current address is where the customer actually lives. For many urban borrowers and migrant workers, the two differ.

The Directions handle this gap in two ways. At onboarding, where a customer submits Aadhaar and wants to record a different current address, paragraph 23 allows a self-declaration to that effect. During periodic KYC updation, paragraph 42 allows a customer to self-declare a new address, which the bank must verify through positive confirmation within two months, using methods such as an address verification letter, contact point verification, or deliverables.

A self-declared address without later confirmation is the weakest POA in your book. Treat it as a pending state, not a closed one.

POA Rules in Securities and Insurance
The POA full form and the OVD logic carry across regulators, with sector variations:

SEBI: Investors complete KYC once through a KYC Registration Agency, and intermediaries accept proof of address such as a utility bill or passport, alongside Aadhaar-based e-KYC.
IRDAI: The Master Guidelines on AML/CFT, 2022 (1 August 2022) require insurers to obtain address proof through OVDs aligned with the PML Rules, applied on a risk basis.
The practical point for groups with banking, broking and insurance arms: the document lists overlap, but freshness rules and exceptions can differ. Map each product to its regulator’s text.

How to Verify Address Digitally
Collecting a POA document is easy, and the POA full form tells you only what to collect. Proving that the address on it is genuine and current is the real work. Digital methods fall into three tiers.

Tier 1: Source-fetched address
Aadhaar offline e-KYC XML, which UIDAI digitally signs and which contains the holder’s address; the signature check detects tampering. See our guide.
DigiLocker-issued documents, such as driving licences and Aadhaar, are pulled directly from the issuer with consent. Our guide explains the flow.
Name match across the fetched record and the application to confirm the address belongs to the applicant.
Tier 2: Corroborated address
Where the address comes from a deemed OVD or self-declaration, corroborate it: compare against bureau or utility records where lawfully available, check PIN code and locality consistency, and use geo-tagged selfies or device location during onboarding where the customer consents.

Tier 3: Physical confirmation
Contact point verification, address verification letters, and courier deliverables close the loop for high-risk segments and for self-declared addresses awaiting positive confirmation.

A detailed comparison of these methods is in our guide.

Where BeFiSc fits: It retrieves identity and address data through Aadhaar routes and DigiLocker, then applies name matching so you know the address belongs to the applicant. Book an address verification demo to see source-fetched POA replace uploaded copies in your onboarding flow.

Address Proof Fraud Patterns
Whatever the POA full form promises, deemed OVDs are where most address fraud enters, because they are easy to edit and hard to check against source.

Edited utility bills: Name, address, or bill date changed in a PDF editor. Watch for mismatched fonts, misaligned fields,s and bill numbers that fail the issuer’s format.
Borrowed addresses: Genuine bills from a relative or landlord, used by a borrower who never lived there.
Rented-room clusters: Many unrelated applicants sharing one address, a common sign of mule recruitment or synthetic identities.
Stale Aadhaar addresses: Not fraud by itself, but a source of failed CPV and collections leakage when the customer moved years ago.
Agent-supplied documents: Bills sourced by DSAs or field agents rather than the customer, often reused across files.
The defence is layered: prefer source-fetched POA, run document tamper checks on any upload, and flag addresses shared across unrelated applications.

Building an Audit-Ready Address Trail
For inspectors, the POA full form is shorthand for evidence. They do not ask whether you collected a POA. They ask how you know it was valid on the day you relied on it. For each customer, the file should show:

The POA source (OVD type, deemed OVD, Aadhaar XML, DigiLocker, or self-declaration).
The verification method and timestamp, including signature validation for XML and issuer response for DigiLocker.
The consent record for any data fetched.
The three-month OVD follow-up status, where a deemed OVD was used.
The positive-confirmation evidence for any self-declared address change.
Key Takeaways
The POA full form in KYC is Proof of Address; in legal documents, POA usually means Power of Attorney.
RBI accepts six OVDs as POA, plus deemed OVDs (such as utility bills up to two months old) for current address, with an OVD due within three months.
Self-declared current addresses are permitted in defined cases but need positive confirmation.
Source-fetched address through Aadhaar offline XML or DigiLocker is stronger evidence than any uploaded copy.
Edited utility bills and shared addresses are the main fraud vectors; layered checks and a clean audit trail address both.
Conclusion
Once you get past the POA full form, proof of address looks like the simplest box in a KYC form. In practice, it is where stale data, edited documents, and borrowed identities concentrate, and where collections and compliance costs surface months later.

Regulated entities that move from uploaded copies to source-fetched addresses, treat deemed OVDs and self-declarations as time-bound states, and keep an evidence trail for each will find the POA question settled at onboarding rather than reopened in recovery.

Build smarter compliance with BeFisc.