The big picture
An investor can have a broker client code, a custody account, a bank account and a regulatory identity linkage at the same time. They are related but serve different purposes. This topic explains the UIN framework and Know Your Customer checks without treating either as a password or a guarantee against misuse. The practical objective is to maintain accurate records, give informed consent and investigate mismatches through verified channels.
Core concepts
Learning objectives
- Explain why UIN differs from a trading login and client code.
- Trace the role of centralised KYC in onboarding.
- Distinguish identity, source-of-funds and ownership evidence.
- Create a secure process for updates, alerts and discrepancies.
Separate the identifiers before using them
1.1 Investor identity versus broker records
NCCPL describes UIN as a centralised investor-registration mechanism that creates a traceable link for stock-market trades and transactions. A broker’s client code identifies the customer relationship in that broker’s system. A custody account records securities under its particular arrangement, while a bank account records money. None of these references should be casually substituted for another on a form simply because the numbers look similar.
1.2 Linkage and traceability
The same eligible investor may have relationships with more than one intermediary, with the correct identity linkage maintained under applicable procedures. That does not mean all account numbers become identical or that holdings are automatically combined into one trading balance. Individual and legal-entity identification follow their relevant categories. Keep a private mapping of identifiers and institution names so a query can identify the right account without exposing a password.
Step-by-step method
- List each identifier and the institution that maintains it.
- Check the legal name and category on each corresponding record.
- Resolve an inconsistent mapping before placing reliance on reports.
A learner changes brokers and receives a new client code. The learner asks how it is linked to the correct investor identity rather than requesting a fresh unrelated identity or assuming the old broker’s custody number can be reused.
Understand centralised KYC and consent
2.1 What customer information establishes
Know Your Customer checks help an authorised institution establish who the customer is, understand the relationship and meet applicable risk-based requirements. NCCPL’s centralised KYC organisation supports information and verification processes used by eligible intermediaries. It is useful to separate the investor-registration function from customer-information records: one identifier does not demonstrate that every KYC field is complete, accurate or current.
2.2 Reuse does not remove accountability
Shared or centralised information can reduce repeated collection when a permitted route and valid consent apply. The receiving intermediary still has its responsibilities and may request clarification or additional evidence. Read who receives information, for what purpose and how corrections are requested. Avoid consenting to an unexplained arrangement merely because an application describes the next button as mandatory; use the institution’s verified support to resolve uncertainty.
Step-by-step method
- Read the relevant customer form and consent statements.
- Identify the authorised intermediary and information being shared.
- Retain confirmation and a route for correcting inaccurate fields.
A bank-based investment route offers to share existing customer information. The learner checks the named recipients and account purpose, then asks whether occupation and contact details need updating first. Reuse of old data is not proof that it is still accurate.
Complete identity verification securely
3.1 Documents, mobile details and biometrics
Verification may involve identity-document validation, registered contact checks, bank information and biometrics under the applicable route. Use the official process and the current instructions for the investor category. The existence of a biometric app does not mean every person must follow the same path, that alternatives never exist or that an old deadline applies indefinitely. Record any route-specific deadline from the current notice or application.
3.2 Failures, exceptions and deadlines
A failed biometric attempt can reflect technical, data-quality or identity issues; it should not be resolved by using another person’s credentials or supplying codes to an unofficial helper. Check the entered details, use official support and preserve the reference for the failed attempt. Independently verify an app or portal before uploading identity documents. A UIN or account identifier helps identify a record; authentication secrets should remain private.
Step-by-step method
- Use verified official links or application listings.
- Match identity, contact and bank information before verification.
- Document failures and seek the authorised correction or exception route.
A legitimate applicant cannot complete contactless verification. The learner records the error, checks document details and contacts verified support for the permitted next step. Repeatedly creating new records can increase confusion rather than solve the original mismatch.
Explain funds, ownership and authorised activity
4.1 Source of funds and source of income
A customer’s occupation describes an activity; it may not explain the origin of a particular investment. Institutions may need evidence of income, accumulated savings or a specific source such as inheritance or an asset sale. Provide a coherent explanation supported by the documents requested for the circumstances. Questions about funding are part of the due-diligence process and should be answered accurately, not treated as a reason to select a convenient but false category.
4.2 Beneficial owner versus authorised operator
The person authorised to give instructions is not necessarily the ultimate beneficial owner. For entities and other arrangements, ownership, control and signatory authority may need separate evidence. Third-party funding or instructions should be assessed under the applicable rules and agreement instead of assumed acceptable. Accurate identification supports traceability but cannot eliminate all fraud or market risk. A verified identity is a control, not an endorsement of an investment.
Step-by-step method
- Distinguish recurring income from the origin of invested money.
- Explain ownership and authority with the appropriate evidence.
- Seek written clarification before accepting third-party arrangements.
A company’s employee is authorised to communicate with a broker, but does not own the company’s assets personally. The onboarding file should establish the entity, its beneficial ownership and the employee’s authority separately instead of merging these roles.
Maintain records and investigate alerts
5.1 Ongoing updates and independent checking
KYC is not completed forever on the opening date. Expired identity documents, changed contact details, a new occupation or a change in control can make an old record inaccurate. Update through the authorised channel and check which institutions require the change. A broker update should not be assumed to propagate automatically to every separate account or service. Keep dated acknowledgements and inspect the next relevant statement.
5.2 A precise discrepancy-resolution routine
Use available NCCPL reports, alerts and investor services as independent checks within their actual scope. Do not promise that every message arrives instantly or covers every event. If an unfamiliar transaction appears, preserve the notice, compare it with your instruction and contact verified support promptly. Identify the date, security, quantity, client reference and expected result. Distinguish an alert-delivery problem from an unauthorised trade; each investigation needs evidence.
Step-by-step method
- Review identity validity and registered contact information periodically.
- Match available reports with your own confirmations.
- Log the discrepancy, supporting records and final explanation.
An investor receives an alert for a quantity that differs from the original order. The learner first checks partial fills and the contract note, then raises a documented query if a mismatch remains. The exercise uses the report as evidence rather than assuming either error or fraud.
A verified identity needs continuing record quality
- Identify the correct customer category
- Collect accurate evidence and consent
- Complete permitted verification
- Link relevant client and investor records
- Review updates and investigate differences
Reference table
| Record | Main purpose | Control question |
|---|---|---|
| UIN linkage | Connect investor identity with market records | Is the correct legal investor linked? |
| Broker client code | Identify a customer relationship | Which broker and client record? |
| Custody account | Record securities holdings | Do quantities and account title reconcile? |
| Bank account | Record funding and payments | Does the authorised title and destination match? |
| KYC information | Maintain verified customer facts | Are details current and supported? |
Glossary of key terms
- Authorised intermediary
- An institution permitted to perform the relevant customer or market function.
- Beneficial ownership
- Ultimate ownership or control under the applicable legal definition.
- Biometric verification
- Identity checking using permitted biological characteristics and the authorised process.
- Client code
- A customer reference maintained within a broker’s relationship records.
- Consent
- Informed permission for a defined information-sharing or operational purpose.
- KYC
- Know Your Customer: identification and risk-based customer-information checks.
- Source of funds
- The origin of the particular money used in an investment.
- UIN
- NCCPL’s investor identification linkage used for market traceability.
Frequently asked questions
Is UIN my trading password?
No. An identity reference and an authentication secret serve different purposes.
Does centralised KYC remove all further questions?
No. Current information and the receiving intermediary’s obligations can require clarification.
Must every investor use one identical biometric process?
No universal process is assumed here. Follow the current instructions and permitted exceptions for the category.
Will changing my broker email update every institution?
Do not assume this. Check each relevant record and obtain acknowledgements.
Common pitfalls
| Common mistake | A better approach |
|---|---|
| Treating all account numbers as interchangeable | Map identifiers to institutions and purposes. |
| Submitting old information unchanged | Review accuracy before reuse or consent. |
| Sharing an OTP with an unofficial helper | Use the verified support and authentication process. |
| Assuming identity checks remove investment risk | Assess business, market and operational risks separately. |
Your learner task
Create a fictional identifier map and KYC update checklist. Identify which fields belong to the broker, custody, bank and centralised records. Design a discrepancy log that gives useful transaction references without recording passwords or authentication codes.
Sources & verification
Use the linked documents to check the factual and regulatory context. Source dates and limitations are stated where relevant. Educational examples and analytical frameworks are not personalised recommendations.
- JISPL · Knowledge curriculum ↗
Course identity and subject coverage; factual corrections are explained in this expanded lesson.
- NCCPL · UIN ↗
Central investor registration and client-code linkage; no claim that an identifier guarantees security.
- NCCPL · Centralised KYC Organisation ↗
Centralised KYC role and authorised intermediaries; check current route-specific procedures.
- NCCPL · Downloads and forms ↗
Current customer forms, investor-system and verification guidance.
- PSX · Investor Awareness Guide ↗
Account agreements, investor responsibilities, records and intermediary verification.
Editorial review: 22 October 2026