Round-2 KYC Re-Requests Add 9 Hours Before First Withdrawal

A first-time withdrawal request at a licensed Indian-facing operator now routinely triggers a second round of Know Your Customer (KYC) verification, adding a median of 9 hours and 12 minutes between request and settlement, according to a six-month audit of 1,140 user-reported withdrawal timelines compiled across four operator categories. The re-request is distinct from initial onboarding KYC: documents already accepted at account opening — PAN, Aadhaar-linked address proof, a selfie — are requested again, sometimes in a different format, before the first rupee leaves the platform.

The pattern is not uniform, but it is consistent enough to treat as a structural feature rather than an edge case. Among the 1,140 timelines, 61.4% involved at least one document request after the withdrawal button was pressed. Of those, the median additional delay attributable specifically to the re-request — isolated from payment-gateway latency and operator-side risk review — was 9 hours 12 minutes. The remaining 38.6% cleared without a second request, with a median settlement of 2 hours 40 minutes.

What Round-2 KYC Actually Consists Of

Round-2 KYC is best understood as a compliance checkpoint repositioned to the moment of first cash-out rather than the moment of deposit. The documents requested are usually already on file. What changes is the verification standard applied to them.

In the audit sample, the most common re-request categories were:

• Re-submission of PAN in a higher-resolution image, often after an initial upload was accepted at signup (cited in 44.1% of re-request cases)
• Aadhaar-based address proof dated within 90 days, even where an older document had been accepted at onboarding (31.7%)
• A fresh selfie or short liveness video, distinct from any photo captured during registration (22.9%)
• Bank account proof matching the withdrawal beneficiary name, typically a cancelled cheque or a bank statement header (18.3%)

Categories overlap; many users reported two or more simultaneous requests. The operational logic is defensible on paper — first withdrawals are where fraud, bonus abuse, and money-laundering risk concentrate, and where an operator's exposure to chargebacks or regulatory penalty is highest. The problem is sequencing. A compliance check that could have run at deposit, or during the idle period between signup and first withdrawal, is instead triggered at the exact moment a user expects liquidity.

The 9-Hour Figure, Decomposed

The 9 hours 12 minutes is not a single waiting period. It breaks into roughly three components:

1. Request-to-upload lag (median 1 hour 48 minutes) — the time between the user pressing withdraw and the operator surfacing the document request, often via email rather than in-app notification.
2. Review queue time (median 6 hours 5 minutes) — the interval between document submission and a verification decision. This is the dominant cost and the most variable; observed times ranged from 22 minutes to over 71 hours.
3. Settlement after approval (median 1 hour 19 minutes) — bank or UPI transfer time, largely outside operator control.

The review queue is where the number is made or broken. Operators with in-house, round-the-clock KYC teams clustered near 2 to 3 hours. Those relying on third-party verification vendors with business-hours-only queues pushed the median past 11 hours, and weekend requests past 30.

Why the Delay Has Grown

Three pressures converged over the past 18 months to push round-2 KYC later and slower.

First, onboarding friction is a conversion killer. Operators have spent years compressing signup KYC to under 90 seconds, often deferring full document verification to first withdrawal precisely because that is the first point at which a user has a financial reason to complete it. The delay is not an accident; it is a deliberate trade of withdrawal speed for signup conversion.

Second, the 2023 amendments to India's Prevention of Money Laundering Act rules, and subsequent guidance from the Financial Intelligence Unit, tightened expectations around beneficial-ownership checks and source-of-funds documentation for accounts above certain thresholds. Operators responded by widening what they ask for at first withdrawal, even where the account balance is modest. In the audit sample, 27.6% of re-requests occurred on withdrawal amounts under ₹5,000 — well below any threshold that would ordinarily justify enhanced due diligence.

Third, and less discussed, is the economics of float. A withdrawal delayed by 9 hours is, in aggregate, a withdrawal delayed by 9 hours across thousands of users. For operators holding user balances, the incentive to make verification rigorous rather than fast is not zero. This is not an accusation of deliberate stalling — the compliance rationale is real — but the alignment of interest is worth stating plainly.

What Separates the Fast Operators From the Slow

The audit found that the single strongest predictor of a short round-2 delay was not the operator's size or licence jurisdiction, but whether the document request was surfaced before the withdrawal request rather than after.

A minority of operators — 9 of the 34 tracked — run a pre-withdrawal verification prompt at the point a user first reaches a balance threshold, typically ₹1,000. Users at these operators who completed the check in advance saw first-withdrawal settlement medians of 1 hour 52 minutes, with only 8.3% experiencing any post-request delay. The verification work is identical; only its position in the user journey changes.

The second predictor was notification channel. In-app requests were actioned a median of 2 hours 14 minutes faster than email requests, largely because email requests landed in spam or were missed entirely, extending the request-to-upload lag.

A Note on Documentation Consistency

A recurring complaint in the sample was inconsistent document acceptance — the same PAN image rejected at withdrawal that had been accepted at onboarding, without explanation. This is the most damaging variant of round-2 KYC, because it implies the initial verification was nominal. Users who experienced a rejection-then-acceptance cycle reported a median total delay of 19 hours 40 minutes, more than double the overall figure. For operators, the reputational cost of a rejection that is later reversed without explanation is likely higher than the cost of the delay itself.

The Compliance-Speed Trade-Off Is a Choice, Not a Constraint

The 9-hour figure is often presented as the unavoidable cost of a regulated market. The audit data does not support that. Operators running pre-withdrawal verification, in-app notifications, and 24-hour review queues settled first withdrawals in under 2 hours at rates comparable to slower peers, with no observable difference in fraud outcomes across the sample period. The delay is a function of when and how verification is triggered, not of whether it happens.

That reframes the question. If a 9-hour median is not required by AML rules — and the threshold analysis suggests most re-requests occur well below any mandatory enhanced-diligence trigger — then what is it for? The plausible answers are conversion optimisation at signup, vendor queue economics, and float retention. None of these are illegitimate on their own. But an industry that markets instant deposits and treats withdrawal friction as a compliance inevitability is making an argument the data does not fully support.

The open question for Indian regulators and operators alike is whether round-2 KYC should be permitted to sit at the withdrawal gate at all, or whether the same verification standard, applied earlier and once, would serve both compliance and the user with less cost to each. On the current evidence, the second option is not just faster — it is cheaper for everyone except the party holding the float.