Question: My bank says high-risk customers must update KYC every year. Is that the regulatorâ€™s fixed schedule?
Answer: Not exactly. RBI requires periodic KYC updation at least once every two years for high-risk customers, once every eight years for medium-risk customers, and once every ten years for low-risk customers, from account opening or last KYC update.

Supporting evidence:
title: rbi.org.in/bs_viewmasdirections.aspx
quote: periodic updation shall be carried out at least once in every two years for high-risk customers, once in every eight years for medium risk customers and once in every ten years for low-risk customers from the date of opening of the account / last KYC updation
context: books are sought by the company and/or multiple small deposits (generally in cash) across the country in one bank account and/or where a large number of cheques are issued bearing similar amounts/dates, shall be immediately reported to Reserve Bank of India and other appropriate authorities such as FIU-IND.
38.
112
Updation
/ Periodic Updation
of KYC
REs shall adopt a risk-based approach for periodic updation of KYC
ensuring that the information or data collected under CDD is kept up-to-date and relevant, particularly where there is high risk
. However, periodic updation shall be carried out at least once in every two years for high-risk customers, once in every eight years for medium risk customers and once in every ten years for low-risk customers from the date of opening of the account / last KYC updation. Policy in this regard shall be documented as part of REs’ internal KYC policy duly approved by the Board of Directors of REs or any committee of the Board to which power has been delegated.
113
Notwithstanding the provisions given above, in respect of an individual customer who is categorized as low risk, the RE shall allow all transactions and ensure the updation of KYC within one year of its falling due for KYC or upto June 30, 2026, whichever is later. The RE shall subject accounts of such customers to regular monitoring. This shall also be applicable to low-risk individual customers for whom periodic updation of KYC has already fallen due.
a) Individuals:

No change in KYC information: In case of no change in the KYC information, a self-declaration from the customer in this regard shall be obtained through customer’s email-id registered with the RE, customer’s mobile number registered with the RE, ATMs, digital channels (such as online banking / internet banking, mobile application of RE), letter, etc.
Change in address: In case of a change only in the address details of the customer, a self-declaration of the new address shall be obtained from the customer through customer’s email-id registered with the RE, customer’s mobile number registered with the RE, ATMs, digital channels (such as online banking / internet banking, mobile application of RE), letter, etc., and the declared address shall be verified through positive confirmation within two months, by means such as address verification letter, contact point verification, deliverables, etc.
114
Further, REs, at their option, may obtain a copy of OVD or deemed OVD, as defined in paragraph 3(a)(x