AML Laws and Regulations for Commercial Banks in India 2026

Yes. The Prevention of Money Laundering Act, 2002, treats banking companies as reporting entities, and banks were among the first institutions brought under the Act. Being a reporting entity means the bank has legal duties to verify its customers, monitor how they transact, keep records and report cash, suspicious and cross-border transactions. The Reserve Bank of India supervises how banks meet these duties, and they are mandatory, not a matter of choice.

Yes. This guide covers the commercial banks regulated under the RBI (Commercial Banks – Know Your Customer) Directions, 2025, which are the public sector banks, the private sector banks and the foreign banks operating in India. They share the same legal base and the same RBI Commercial Banks Direction. It does not cover small finance banks, payments banks, local area banks, regional rural banks or cooperative banks, which have their own directions and their own guides.

They are the RBI’s detailed instructions to banks on know-your-customer and anti-money-laundering work. Issued on 28 November 2025 as part of the RBI’s consolidated Master Directions, they rest on Section 35A of the Banking Regulation Act, 1949, read with the PMLA and the PMLR. They cover customer identification, customer due diligence, beneficial ownership, ongoing due diligence, record management and reporting, and they are the documents a bank’s compliance team works from.

No. Those are separate bank categories with their own RBI KYC Directions, 2025 and their own guides. A small finance bank, payments bank, local area bank, regional rural bank or cooperative bank should read the guide for its own category, not this one. This page is read from the position of a commercial bank, and applying it to another bank type would point you to the wrong Direction.

The everyday business of a commercial bank is where the exposure sits: opening and operating accounts, accepting deposits, lending, trade finance, correspondent banking, and domestic and cross-border payments and remittances. Each is a channel that can be misused for laundering or terror financing, which is why the PMLA, the PMLR and the RBI Commercial Banks KYC Directions 2025 require customer due diligence, ongoing monitoring, sanctions screening and reporting across all of them.

The beneficial owner is the natural person who ultimately owns or controls a customer, even when a company, partnership or trust holds the account. For a company or a partnership, the threshold is a controlling interest of more than 10 percent of the shares, capital or profits. For an unincorporated association or body of individuals it is more than 15 percent. For a trust it covers the author, the trustees, beneficiaries with a 10 percent or more interest, and anyone exercising ultimate effective control. Control can also be exercised through other means, such as the right to appoint most of the directors, so the bank must look beyond the paperwork to the real person in charge.

The bank refreshes customer KYC on a risk-based cycle called periodic updation. Under the KYC Directions 2025, this is at least once every 2 years for high-risk customers, once every 8 years for medium-risk customers and once every 10 years for low-risk customers. The bank can and should update sooner if something changes, such as a change in ownership or unusual activity on the account.

Under Rule 3 of the PMLR a bank reports cash transactions over Rs 10 lakh, a series of connected cash transactions adding up to more than Rs 10 lakh in a month, cash transactions involving counterfeit currency, forged valuable security or forged documents, receipts by non-profit organisations of more than Rs 10 lakh, all suspicious transactions of any value including attempted ones, and cross-border wire transfers of more than Rs 5 lakh, or its equivalent in foreign currency, where either the origin or destination of funds is in India. These are filed with FIU-IND as cash transaction reports, suspicious transaction reports and cross-border wire transfer reports, among others.

Banks keep records for five years under Section 12 of the PMLA, but on two clocks. Transaction records run for five years from the date of the transaction. Identity records, account files and business correspondence run for five years after the business relationship ends or the account is closed, whichever is later. The records must be retained so the bank can produce them quickly when the RBI, FIU-IND or law enforcement requests them.

The RBI can impose monetary penalties and order the bank to fix its controls, and FIU-IND can issue compliance orders with penalties of its own. In FY 2024-25, FIU-IND issued 8 compliance orders with penalties exceeding Rs 30 crore. Where an account is linked to money laundering, the Enforcement Directorate can also attach property and prosecute, so weak compliance carries both financial and reputational costs.

For a partnership firm, the beneficial owner is the natural person who holds a controlling interest of more than 10 percent of the capital or profits of the partnership, or who otherwise controls it. This 10 percent partnership threshold was introduced by the 2023 amendment to the PMLR, down from the earlier 15 percent. Where no such natural person can be identified, the bank identifies whoever exercises control through other means.

Reports on cash transactions involving counterfeit currency, forged valuable security or forged documents are filed monthly, by the 15th day of the succeeding month, under Rule 3 and Rule 8 of the PMLR. They follow the same monthly cycle as cash transaction reports and cross-border wire transfer reports, unlike suspicious transaction reports, which are filed promptly once the Principal Officer is satisfied.