AML Laws and Regulations for Trust and Company Service Providers in India

Across that framework, the regulations require a trust or company service provider to do the following. This article keeps each at the level required by law; a compliance requirements guide explains how to do each. Correspondent banking and wire-transfer duties are not included here because they do not apply to a provider.

• Register with FIU-IND. Enrol with the Financial Intelligence Unit India on the FINnet 2.0 / FINGate 2.0 portal once the firm begins offering the notified trust or company services, so the provider can file its reports.
• Appoint officers. Appoint a Designated Director and a management-level Principal Officer under Rule 7 of the PMLR. The same person cannot hold both roles, and both are to be informed to FIU-IND.
• Conduct the internal risk assessment. Assess money laundering, terror financing and proliferation financing risk across client types, services, structures and geographies, drawing on the FATF TCSP guidance, and keep it current.
• Document AML policy, controls and procedures. Adopt an approved policy that turns the risk assessment into the firm’s operating procedures, as required by the FIU-IND Guidelines.
• Customer identification and CDD. Identify and verify every client and the beneficial owner (a controlling interest of more than 10 per cent for a company or partnership, and more than 15 per cent for an unincorporated association or body of individuals; for a trust, the author, the trustees, beneficiaries with a 10 per cent or more interest and any person exercising ultimate control), with enhanced due diligence for politically exposed persons and high-risk clients, under Section 11A of the PMLA, Rule 9 of the PMLR and the FIU-IND Guidelines. Look through nominee arrangements to the natural person behind the structure.
• Ongoing monitoring and periodic update. Monitor the client relationship on an ongoing basis, and refresh KYC at least once every 2, 8 and 10 years for high, medium and low-risk clients respectively. Review each client’s risk categorisation at least once every six months and decide whether enhanced due diligence is required.
• Sanctions screening. Screen clients, settlors, beneficiaries and beneficial owners against the designated lists under Section 51A of the UAPA and Section 12A of the WMD Act and freeze and report any match. Verify the relevant UNSC and domestic designated lists daily. This duty applies to every provider, from the first engagement.
• Regulatory reporting. File suspicious transaction reports of any value, including attempted transactions, promptly once the Principal Officer is satisfied that a transaction is suspicious, under Rule 8(2) of the PMLR. Where a provider handles cash, it must also file cash transaction reports for cash over Rupees 10 lakh and reports on cash transactions involving counterfeit currency or forged documents, filed monthly by the 15th day of the succeeding month, under Rule 3. Reports are made through FINnet 2.0.
• Record management, CKYCR and FINnet 2.0. Keep transaction records for five years from the date of the transaction and keep identity records and business correspondence for five years after the business relationship ends, under Section 12 of the PMLA. Upload customer KYC records to the Central KYC Records Registry under Rule 9A, reuse an existing record where applicable, and file all prescribed reports through FINnet 2.0.
• Training and awareness. Train staff in correspondence with their role to apply the controls and recognise the red flags of shell-company and nominee-based laundering.
• Independent testing and audit. Test the programme through internal audit, compliance assurance or independent review, and close every finding.