Account opening is one of the most important control areas in depository operations. A demat account is created only after the Participant has completed the prescribed KYC, identity and address verification, documentation and system-entry checks. A well-designed internal audit helps identify gaps before they lead to regulatory observations, incorrect client records or investor complaints.

1. Purpose and scope

The objective of an account-opening audit is to verify whether sampled accounts were opened in accordance with the applicable SEBI requirements, NSDL Business Rules, current NSDL Master Circulars and the DP’s approved procedures. The auditor should select a sample from the account-opening register/system and trace each account from the original or digitally maintained application through supporting documents to the data recorded in the depository system (DPM). The checklist should be updated whenever regulatory instructions change.

2. Key audit checklist

☐ Account opening form and KYC — Check that the prescribed account-opening form and applicable KYC form are complete, legible and duly authenticated. Review mandatory fields, client category, account type/sub-type, names, date of birth/incorporation, contact details and correspondence/permanent address. Blank or inapplicable fields should be dealt with as required by the prescribed process.

☐ Identity, address and PAN — Verify that valid proof of identity and address, PAN and other applicable supporting documents are available and valid for the client category. Check PAN verification and consistency of names/details across the form, PAN, KYC records and supporting documents. For non-individual clients, verify entity constitution documents and authorised signatory/beneficial-owner information as applicable.

☐ In-person verification (IPV) / digital verification — Confirm that the required IPV or permitted digital/video-based verification was completed, recorded and retained in line with current requirements. Where applicable, check the verifier’s details, date, photograph/document checks and evidence of the verification.

☐ Signatures, declarations and authorisations — Compare signatures on the form and relevant declarations with the signature image/record captured in DPM. Check joint-holder signatures, guardian details for minors, authorised signatories, nominee/nomination or opt-out declarations, and other applicable instructions. Ensure that mandatory acknowledgements and client consents are present.

☐ Rights & Obligations and account-opening kit — Verify that the client was provided the prescribed Rights and Obligations document and that acknowledgement is retained. Check the client’s preference for physical or electronic delivery of standard documents and, where electronic delivery is used, ensure the required delivery logs/evidence are maintained.

☐ Bank details and other supporting records — Check the bank proof and recorded bank details, including account-holder name and relevant identifiers, against the application and supporting evidence. Review any third-party correspondence address or exceptional documentation against the specific conditions and approvals required by current rules.

☐ DPM/system data accuracy — Trace key fields from the signed application and KYC records to DPM: client name, PAN, date of birth/incorporation, address, contact details, bank details, account type, joint-holder sequence and other relevant flags. Confirm that scanned documents and signature images are complete, readable and linked to the correct client account.

☐ Approval, audit trail and record retention — Check maker-checker or other prescribed approval controls, account activation date, pending-document exceptions, timestamps and evidence of review. Confirm that records can be retrieved promptly and are retained securely for the applicable period, with access restricted to authorised personnel.

3. Reporting audit observations

For every exception, record the account reference (using secure identifiers), sample size, nature of the deviation, applicable requirement, risk/impact, supporting evidence and management response. Quantify the number of accounts affected wherever possible. Classify findings by risk, agree corrective action and target dates, and follow up unresolved items in the next review. Avoid recording unnecessary personal data in the working paper or report.

Conclusion