Harun Raaj & AssociatesHarun Raaj & Associates
+91 93008 97008Contact
Business Compliance & Labour Law

AML / KYC Compliance for NBFCs and Reporting Entities

AML / KYC

Start — upload documents, pay when ready →Talk to a CAWhatsApp us
SCOPEConfirmed in writing

Overview

AML and KYC compliance is the legal obligation of banks, NBFCs, fund managers, and other reporting entities to know their customers and report suspicious activity, under the Prevention of Money Laundering Act 2002 (PMLA) read with the Prevention of Money Laundering (Maintenance of Records) Rules 2005. Every client relationship must pass customer due diligence — identity, address, beneficial ownership and purpose — and designated entities must register with FIU-IND and file the required reports. Regulators layer their own directions on top, most importantly the RBI's Know Your Customer (KYC) Master Direction for banks and NBFCs.

For a finance or fund business, KYC is not an onboarding form — it is the operating system of the client relationship. Every investor, borrower or customer must be verified before the relationship begins, records must be kept for the prescribed period, and the compliance function must be able to demonstrate to the regulator that the process actually ran. The obligation is continuous: existing relationships must be re-verified, and transactions that look suspicious must be reported to FIU-IND without tipping off the customer.

The cost of treating AML as an afterthought is severe. Failure to comply with the PMLA obligations is a criminal contravention: the PMLA provides for rigorous imprisonment for non-compliance with the reporting and record-keeping obligations of Section 12 (VERIFY: the exact penal provisions as amended), and regulators can cancel registrations, impose penalties and restrict businesses. For an NBFC or fund, an AML failure is not a fine — it is potentially the end of the licence.

This service is for NBFCs, fund managers, fintechs, and other reporting entities that need a working AML/KYC framework. We design the KYC policy and procedures aligned to the PMLA Rules 2005 and the RBI KYC Master Direction, implement customer due diligence and risk classification, set up the FIU-IND reporting process, and run training and reviews so the framework survives regulatory inspection.

How It Works

  1. 1

    Regulatory Mapping

    We map your obligations under the PMLA 2002, PML Rules 2005 and the RBI KYC Master Direction for your entity type.

    Harun Raaj & Associates does this3-5 days
  2. 2

    Policy & Procedures Drafting

    We draft the KYC policy, customer due diligence procedures and risk classification framework.

    Harun Raaj & Associates does this1-2 weeks
  3. 3

    FIU-IND Registration & Reporting

    We register the entity with FIU-IND and set up the reporting process for the prescribed returns and suspicious transactions.

    Harun Raaj & Associates does this1-2 weeks
  4. 4

    Implementation & Staff Training

    We roll out the framework with your team and train staff on customer identification and red flags.

    Harun Raaj & Associates does this1 week
  5. 5

    Periodic Review & Audit Support

    We review the framework periodically and support you through regulatory inspections and queries.

    Harun Raaj & Associates does thisOngoing

Frequently Asked Questions

Our NBFC just crossed the RBI threshold — when does KYC compliance become mandatory?
All NBFCs registered with RBI are subject to the Master Direction on KYC 2016 (as updated by circular RBI/2021-22/25 dated May 10, 2021) from the date of registration, regardless of size. Customer Due Diligence (CDD) must be completed before establishing any account relationship under Rule 9(1) of the Prevention of Money Laundering (Maintenance of Records) Rules 2005. There is no turnover or asset threshold — the obligation attaches to the NBFC license itself.
What is Enhanced Due Diligence (EDD) and which customers trigger it?
EDD is mandated under paragraph 38 of the RBI KYC Master Direction for high-risk customers, including Politically Exposed Persons (PEPs) and their family members, non-face-to-face customers, customers from FATF high-risk jurisdictions, and any account where the source of funds is unclear. EDD requires senior management approval to open the account, identification of the beneficial owner under Rule 9(3) PML Rules (ownership threshold: 25% for companies, 15% for trusts), and a periodic review cycle of 2 years instead of the standard 8–10 years.
Do we need to file an STR even if the transaction was ultimately not suspicious?
Yes — the obligation under Section 12(1)(b) PMLA read with Rule 8 of PML Rules 2005 arises upon forming a reasonable suspicion, not upon confirmation. An STR must be filed with FIU-IND within 7 working days of the suspicion being formed. Confidentiality is mandatory — tipping off the customer about an STR filing is prohibited under Section 12A PMLA and can attract separate penal action. Failure to file an STR attracts a fine of ₹10,000 to ₹1 lakh per day of default under Section 13(2) PMLA.
How long must KYC records and transaction records be retained?
Section 12(1)(a) PMLA requires reporting entities to maintain records of all transactions (including attempted transactions) for a minimum of 5 years from the date of the transaction. KYC identification documents must be retained for 5 years after the business relationship ends — not from onboarding — per Rule 10 of PML Rules 2005. For NBFCs, the RBI Master Direction additionally requires that records be made available to regulators and law enforcement on demand within the same 5-year window, with no extension of the retention period for ongoing accounts.
Can Video KYC (V-CIP) satisfy the KYC requirement for new NBFC customers?
Yes — Video-based Customer Identification Process (V-CIP) is a permissible alternative to in-person KYC under Rule 9(1A) of PML Rules 2005, inserted by the Prevention of Money Laundering (Maintenance of Records) Amendment Rules 2020. The NBFC must comply with RBI circular DOR.AML.REC.17/14.01.001/2021-22 requirements: a live video call, Aadhaar OTP-based e-KYC, PAN verification via NSDL/UTIITSL, facial match, and geo-tagging of the customer location. V-CIP customers still require risk categorisation and the same periodic refresh schedule as in-person KYC customers.

Ready to get AML / KYC Compliance for NBFCs and Reporting Entities?

File a request in under 2 minutes. Our team contacts you within 24 hours.

Start — upload documents, pay when ready →