Finding · F-RBI-04
Credit line activated before KYC completion (KYC MD §16)
OpenKYC-01 · Customer accounts are activated only with complete KYCCustomer OnboardingQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.31 · ITGC-BP-01 · RBI-KYC-MD-2016-16
mapped
Policy
KYC / AML Policy
pol-kyc
Control
KYC-01
Customer accounts are activated only with complete KYC
Application
Meridian Customer Portal · Salesforce (Sales + Financial Services Cloud)
mapped
Evidence · Q3
3 items
2 approved · 1 pending · 0 rejected
Test · Q3
Fail
TST-RBI-KYC-01 · Medium confidence
Finding
F-RBI-04 · High
Open
Action
Arjun Kapoor
REM-F-RBI-04 · In Progress
Validation
Pending
as recorded
Observation
Raised 2026-10-08 in the RBI Regulatory Controls — Q4 2026 Periodic Internal Audit (Meridian Internal Audit (IS Audit cell)). Onboarding case ONB-2026-04418 (Kaveri Agro Exports LLP) moved to Approved and the credit line was activated on the portal while the beneficial-owner declaration document was still 'Pending upload'. First-level check performed by Northstar BPO.
Applications: Meridian Customer Portal, Salesforce (Sales + Financial Services Cloud).
Potential risk
Unauthorised or erroneous transactions could go undetected and expose Meridian to financial loss and regulatory action.
Root cause
Salesforce approval checked document upload, not verification, for beneficial-owner declarations.
Agreed action plan
Account frozen pending document; Salesforce validation rule hardened so 'Approved' requires all mandatory documents verified; Northstar retrained. Tracked as T-007, T-008, T-023 in Prismet Tasks.
Management response: Account frozen pending document; Salesforce validation rule hardened so 'Approved' requires all mandatory documents verified; Northstar retrained.
- Action
- REM-F-RBI-04
- Owner (FPR)
- Arjun Kapoor
- Target date
- 22 Oct 2026
- Priority
- High
- Status
- In Progress
- Validation
- Pending · planned 22 Oct 2026
Evidence for this control (5)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-033 | Meridian Customer Portal: Activated accounts linked to approved case | KYC-01 | Meridian Customer Portal | 6 Oct 2026 | Under review |
| Q2-EV-037 | Salesforce (Sales + Financial Services Cloud) · policy document (Q2) | KYC-01 | Salesforce (Sales + Financial Services Cloud) | 20 Jun 2026 | Accepted |
| Q2-EV-038 | Meridian Customer Portal · screenshot (Q2) | KYC-01 | Meridian Customer Portal | 25 Jun 2026 | Accepted |
| RBI-REQ-032 | Salesforce: Approved onboarding cases have complete KYC checklist | KYC-01 | 6 Oct 2026 | Accepted | |
| RBI-REQ-033 | Meridian Customer Portal: Activated accounts linked to approved case | KYC-01 | Meridian Customer Portal | 5 Oct 2026 | Accepted |
Tests of this control (2)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-RBI-KYC-01 | KYC-01 · Customer accounts are activated only with complete KYC | Q3 2026 Unified Program Review | 4 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Fail | Medium |
| TST-Q2-KYC-01 | KYC-01 · Customer accounts are activated only with complete KYC | Q2 2026 Unified Program Review | 20 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Pass with Observation | High |