KYC / AML & Fit-and-Proper Compliance Advisory

It means your entity has a Board-approved written policy for how you identify who your customers are, assess how risky each customer relationship is, verify their identity documents, watch their transactions for suspicious patterns, and report specific transaction types to the Financial Intelligence Unit-India. It is governed primarily by the RBI Master Direction on KYC and the Prevention of Money-Laundering Act, 2002. It is not a one-time document — it is a living operational process that your compliance team follows every day and that RBI inspects periodically.

It is RBI's assessment of a director's integrity, reputation, financial soundness, and track record — whether they have any conviction, pending criminal proceeding, history of default with a bank or NBFC, or other disqualifying factor that would make their continued directorship a risk to the entity or its stakeholders. For NBFCs it arises specifically under Section 45-IA of the RBI Act, 1934 read with the applicable NBFC Master Direction, and it is assessed both at initial registration and on an ongoing annual basis.

Any entity that is a 'reporting entity' under PMLA and its Rules — this includes NBFCs of every category (asset finance, investment/credit companies, microfinance institutions, housing finance companies), banks, Payment System Operators, Account Aggregators, Full-Fledged Money Changers, and P2P lending platforms. If your entity onboards customers, holds or moves customer funds, or facilitates financial transactions under an RBI authorisation, a KYC/AML programme applies to you.

FIU-IND is the central national agency under the Department of Revenue, Ministry of Finance, responsible for receiving, analysing, and disseminating information on suspicious financial transactions. Every reporting entity under PMLA — which includes RBI-regulated financial entities — must register on the FIU-IND FINnet 2.0 portal, designate a Principal Officer, and file the reports PMLA requires (Cash Transaction Reports, Suspicious Transaction Reports, and others applicable to the entity's business). This is a separate registration and reporting obligation from your RBI Certificate of Registration.

The Principal Officer is the senior individual within a reporting entity responsible for ensuring compliance with PMLA obligations — reviewing flagged transactions, deciding whether a Suspicious Transaction Report should be filed, liaising with FIU-IND, and overseeing the KYC/AML programme's operation. RBI and FIU-IND expect this person to hold sufficient seniority and independence from purely commercial or sales functions to make these judgment calls without undue business pressure.

The periodic KYC updation interval depends on the customer's risk category as assessed under your entity's own risk-categorisation framework — high-risk customers require more frequent updation than low-risk customers, in line with the intervals set out in the RBI Master Direction on KYC. The exact interval your entity applies should be documented in your Board-approved policy and consistently followed, not decided case by case.

V-CIP is a digital, non-face-to-face customer identification method — a live video interaction combined with document verification — that RBI has permitted as an alternative to in-person or physical KYC verification for eligible entity categories and customer types, subject to conditions set out in the Master Direction on KYC. Whether your entity can use V-CIP, and for which customer segments, depends on your specific regulatory category and the conditions RBI has prescribed for that category.

Outcomes range depending on severity — from a formal observation requiring a written remediation plan within a specified timeline, to restrictions on new customer onboarding, to monetary penalty, and in serious or repeated cases, action affecting the entity's Certificate of Registration itself. RBI's supervisory approach is generally proportionate to severity and repeat-offence pattern, but a credible, well-documented remediation response materially affects how the finding is resolved.

It depends on the nature, amount, and recency of the default, and how it is disclosed and assessed under the fit-and-proper framework — a past default is not automatically disqualifying in every case, but it is a factor RBI's Master Direction expects the Board (and RBI, at registration or on query) to specifically assess. Non-disclosure of a known default is a materially more serious issue than the default itself.

Yes. Customers who are or have been entrusted with prominent public functions — domestically or in a foreign country — along with their family members and close associates, require enhanced due diligence under the RBI Master Direction on KYC, including senior management approval for establishing the relationship and more frequent ongoing monitoring than a standard customer.

Beneficial ownership identification means looking through a corporate or legal-entity customer's registered ownership structure to identify the natural person(s) who ultimately own or control it, above a threshold set out in the PML Rules. This prevents a customer from using layered corporate structures to obscure who is actually behind a transaction or account relationship — a core anti-money-laundering safeguard.

The KYC/AML policy is the Board-approved document defining what your entity must do — customer acceptance criteria, risk categorisation, monitoring, and reporting rules. The compliance function (led by the Principal Officer) is the team that operationalises the policy day to day. Internal audit is a separate, independent function that periodically tests whether the policy is actually being followed in practice. All three are distinct and RBI expects to see evidence of each functioning independently.

Yes — fit-and-proper assessment applies to every director regardless of residency status, though the supporting documentation differs. Foreign or NRI directors typically need apostilled or notarised identity and address proof, and declarations covering any regulatory or criminal proceedings in their country of residence in addition to India, since RBI's assessment is not limited to India-based history.

The core PMLA and RBI Master Direction on KYC framework applies across categories, but the specific Master Direction governing your entity — NBFC-ICC, NBFC-MFI, NBFC-HFC, Payment System Operator, Account Aggregator, or FFMC — layers additional entity-specific requirements on top. An NBFC-MFI's customer risk profile and documentation norms, for instance, differ from a Payment System Operator's transaction-monitoring emphasis. A generic one-size-fits-all policy template misses these category-specific nuances.

The Prevention of Money-Laundering (Maintenance of Records) Rules, 2005 prescribe the categories of records reporting entities must maintain — customer identification records, transaction records, and records supporting any Suspicious Transaction Report filed — for the periods specified in the Rules, which can extend well beyond the closure of the customer relationship. The exact retention period should be confirmed against the current Rules at the time of policy drafting, as retention requirements are a specific area regulators periodically revisit.

An STR is a report a reporting entity files with FIU-IND when a transaction — or a pattern of transactions — appears inconsistent with the customer's known profile, lacks an apparent lawful purpose, or otherwise raises a reasonable suspicion of money laundering or terrorist financing, as assessed under the entity's internal monitoring process and the PMLA framework. The Principal Officer is responsible for the internal decision to escalate a flagged transaction into a filed STR.

Yes. The KYC/AML and PMLA reporting obligations apply based on your entity's regulatory category and customer-facing activity, not on whether a specific higher-risk scenario (foreign investment, PEP customer) has actually occurred yet. The framework must be built and ready to correctly handle such scenarios if and when they arise — RBI does not accept 'we have not encountered this yet' as a substitute for having the policy provision in place.

We start from your entity's actual RBI Certificate of Registration and regulatory category — not a generic template — and build the risk-categorisation logic, onboarding workflow references, and reporting process to match how your business actually operates. As a practising CA firm with FEMA and RBI advisory experience since 1986, we also connect the KYC/AML build to adjacent obligations — FEMA reporting where the entity has foreign shareholders, transfer pricing where there is a cross-border group structure, and annual RBI compliance filings — so the policy is not designed in isolation from the entity's broader regulatory footprint.

Common triggers include a new director appointment, a significant shareholding change, an Annual Supervisory inspection, a specific complaint or adverse media report concerning a director, or information RBI receives from another regulator or enforcement agency. RBI can also request fit-and-proper re-certification at any time it considers warranted, independent of the entity's own annual cycle.

A written policy alone is not sufficient. RBI inspection tests operational evidence — actual customer files showing the risk-categorisation and documentation the policy describes, records of staff training, minutes showing Board approval and periodic review, and evidence that flagged transactions were actually escalated and assessed. A policy that reads well but has no supporting operational trail is treated as a significant gap.

PNPC scopes and quotes each KYC/AML & Fit-and-Proper engagement individually, based on the entity's regulatory category, the current state of its policy and governance documentation, the number of directors requiring fit-and-proper assessment, and whether the engagement is a fresh policy build, a periodic review, or inspection remediation. A written scope and fee letter is provided before any work begins.

RBI and FIU-IND expect the Principal Officer to be an internal appointment — a senior individual within the regulated entity with genuine authority over compliance decisions — rather than an outsourced advisory function. PNPC advises on selecting and structuring this role correctly, trains the appointee, and remains available for ongoing guidance, but does not itself hold the Principal Officer designation on the entity's behalf.

Anti-Money Laundering (AML) addresses the concealment of the origin of illegally obtained funds; Combating the Financing of Terrorism (CFT) addresses the movement of funds — which may themselves be legitimately sourced — toward terrorist activity. RBI's Master Directions and PMLA's framework require reporting entities to address both within the same policy and monitoring framework, since the customer due diligence and transaction monitoring mechanisms largely overlap.

A change in shareholding pattern or control of an NBFC — particularly one crossing thresholds defined in the applicable Master Direction — typically requires prior RBI approval or, at minimum, timely intimation, and triggers a fresh fit-and-proper assessment of the incoming significant shareholder or director. The precise threshold and approval requirement depends on the entity's specific NBFC category and the current Master Direction governing it.

While the Indian entity's KYC/AML programme is governed by RBI and PMLA and the UAE affiliate's by UAE Central Bank or relevant UAE regulator's AML/CFT framework, beneficial-ownership consistency, group-level risk assessment, and cross-border customer or fund flows between the two entities benefit from coordinated review — inconsistent beneficial-ownership disclosure between the two jurisdictions is a red flag either regulator can independently identify.

RBI can direct the entity to remove a director found not to meet fit-and-proper criteria, and in serious cases can take supervisory action against the entity for having permitted or continued the appointment. The entity's Board bears responsibility for identifying and acting on a fit-and-proper concern proactively — through its own annual certification and monitoring process — rather than waiting for RBI to identify it.

Fit-and-proper criteria under the applicable RBI Master Direction typically apply to all directors on the Board — not only executive or whole-time directors — since the framework is concerned with the integrity and competence of the Board's collective oversight, not only its day-to-day management. Independent and non-executive directors are equally within scope.

Even a dormant or low-transaction-volume customer account remains within the periodic KYC updation cycle applicable to its assigned risk category — inactivity does not exempt an account from updation, though it may influence the risk categorisation applied. The entity's policy should specify how dormant accounts are handled within the broader KYC updation and monitoring framework.

The Board's role is ongoing, not a one-time approval — it includes periodic review of the policy's continued adequacy, receiving reports from the Principal Officer or compliance function on the programme's operation (including any STRs filed and any inspection or FIU-IND correspondence), and overseeing the annual fit-and-proper certification of its own members. RBI expects to see this as a standing item in Board or Board-committee minutes, not an occasional discussion.

Yes, in many cases KYC verification steps can be outsourced to a third-party technology or verification vendor, but the regulated entity retains ultimate responsibility for KYC/AML compliance — outsourcing the mechanical verification step does not transfer regulatory accountability. The entity's policy should clearly document the vendor arrangement, the data protection and retention terms, and the entity's own oversight process over the vendor's work.

For entities where the KYC/AML and fit-and-proper engagement is tied to a fresh NBFC, PSO, or other RBI licence application, PNPC coordinates the KYC/AML policy and fit-and-proper documentation as part of the broader registration engagement — our NBFC Registration, Annual Compliance & Takeover Advisory service covers the full application process, with this service providing the specific compliance-framework component RBI expects to see.

Cost depends materially on the entity's complexity — number of directors requiring fit-and-proper assessment, whether an existing policy needs revision or a fresh build is required, and whether FIU-IND registration and Principal Officer setup are also in scope. PNPC provides a written, fixed-fee quote after the initial scoping call rather than a generic published rate, since a one-director NBFC-ICC and a multi-branch NBFC-MFI require materially different effort.

For existing retainer clients, PNPC prioritises urgent regulatory queries and typically begins review within days of being notified, given the time-sensitivity RBI and FIU-IND queries usually carry. For new clients approaching us with an active inspection finding, we conduct an expedited scoping call to understand the finding and the RBI-set response deadline before proposing a remediation timeline.