AML / KYC Compliance for NBFCs and Reporting Entities

All NBFCs registered with RBI are subject to the Master Direction on KYC 2016 (as updated by circular RBI/2021-22/25 dated May 10, 2021) from the date of registration, regardless of size. Customer Due Diligence (CDD) must be completed before establishing any account relationship under Rule 9(1) of the Prevention of Money Laundering (Maintenance of Records) Rules 2005. There is no turnover or asset threshold — the obligation attaches to the NBFC license itself.

EDD is mandated under paragraph 38 of the RBI KYC Master Direction for high-risk customers, including Politically Exposed Persons (PEPs) and their family members, non-face-to-face customers, customers from FATF high-risk jurisdictions, and any account where the source of funds is unclear. EDD requires senior management approval to open the account, identification of the beneficial owner under Rule 9(3) PML Rules (ownership threshold: 25% for companies, 15% for trusts), and a periodic review cycle of 2 years instead of the standard 8–10 years.

Yes — the obligation under Section 12(1)(b) PMLA read with Rule 8 of PML Rules 2005 arises upon forming a reasonable suspicion, not upon confirmation. An STR must be filed with FIU-IND within 7 working days of the suspicion being formed. Confidentiality is mandatory — tipping off the customer about an STR filing is prohibited under Section 12A PMLA and can attract separate penal action. Failure to file an STR attracts a fine of ₹10,000 to ₹1 lakh per day of default under Section 13(2) PMLA.

Section 12(1)(a) PMLA requires reporting entities to maintain records of all transactions (including attempted transactions) for a minimum of 5 years from the date of the transaction. KYC identification documents must be retained for 5 years after the business relationship ends — not from onboarding — per Rule 10 of PML Rules 2005. For NBFCs, the RBI Master Direction additionally requires that records be made available to regulators and law enforcement on demand within the same 5-year window, with no extension of the retention period for ongoing accounts.

Yes — Video-based Customer Identification Process (V-CIP) is a permissible alternative to in-person KYC under Rule 9(1A) of PML Rules 2005, inserted by the Prevention of Money Laundering (Maintenance of Records) Amendment Rules 2020. The NBFC must comply with RBI circular DOR.AML.REC.17/14.01.001/2021-22 requirements: a live video call, Aadhaar OTP-based e-KYC, PAN verification via NSDL/UTIITSL, facial match, and geo-tagging of the customer location. V-CIP customers still require risk categorisation and the same periodic refresh schedule as in-person KYC customers.