Last Updated on: 22nd October 2026 | Last Reviewed on: 22nd October 2026
Key Takeaways
- The obligation is statutory, not just regulatory. Rule 9(14)(ii) of the PML Rules requires every reporting entity to formulate and implement a Client Due Diligence Programme. Rule 9(14)(iii) requires that programme to include policies, controls and procedures approved by senior management. That applies whether the regulator is RBI, SEBI, IRDAI, PFRDA, IFSCA, a professional institute or the Director of FIU-IND.
- Board approval is an RBI uplift on a statutory floor. The PML Rules require senior management approval. Paragraph 6(1) of the 2025 Directions requires approval by the Board of Directors or a committee to which the Board has delegated the power. Entities outside the RBI perimeter should check which standard binds them before writing the approval clause.
- Two named officers, and they cannot be the same person. Paragraph 14 covers the Designated Director and paragraph 15 the Principal Officer. Paragraph 14(3) is explicit that the Principal Officer shall not be nominated as the Designated Director. Rule 2(ba) of the PML Rules dictates who the Designated Director must be, by entity type.
- The policy must define who counts as Senior Management. Paragraph 12(1) makes that a compliance requirement. Policies routinely use the phrase a dozen times without ever defining it, which is a finding waiting to happen.
- A compliant policy runs three clocks, not one. The enterprise risk assessment is reviewed at least annually under paragraph 10(2). Customer risk categorisation is reviewed at least once every six months under paragraph 41(1). Periodic KYC updation run on two, eight and ten years by risk band under paragraph 42(1). Most drafts carry only the third.
- The audit route is prescribed. Paragraph 12 requires independent evaluation of the compliance function, a concurrent or internal audit system to verify KYC and AML compliance, and submission of quarterly audit notes and compliance to the Audit Committee. Name that route in the policy.
- Decision-making cannot be outsourced. Paragraph 13 prohibits outsourcing the decision-making functions of determining compliance with KYC norms. Vendors can execute. They cannot decide.
- Customer acceptance has a floor as well as a filter. Paragraph 18 says the Customer Acceptance Policy shall not result in denial of a banking or financial facility to members of the public, especially those who are financially or socially disadvantaged, including Persons with Disabilities. It also requires the officer concerned to record the reasons for any rejection.
- A KYC policy is a component of the AML/CFT policy, not a synonym for it. The clearest statement of that relationship in Indian regulation is clause 1.5(b) of the IFSCA Guidelines, 2022: every Regulated Entity shall develop a KYC Policy which shall be part of its AML/CFT/CPF policy.
- Anything citing the 2016 Master Direction is now out of date. On 28 November 2025, the Reserve Bank replaced the Master Direction on KYC of 25 February 2016 with entity specific Directions. The replacement citation for banks is given in full later in this article.
- The penalty reaches individuals. Section 13(2) of the PMLA lets the Director impose a written warning, a direction to comply, a direction to furnish reports, or a monetary penalty of not less than Rs 10,000 and up to Rs 1,00,000 for each failure, on the reporting entity or its designated director or any of its employees.
Quick Answer: What a KYC Policy Must Contain
A KYC policy is a Board approved document setting out how a regulated entity accepts, identifies, risk-rates and monitors its customers. The policy must contain four elements: the Customer Acceptance Policy, risk management, Customer Identification Procedure, and Ongoing Due Diligence. Rule 9(14)(ii) of the PML Rules, 2005 imposes the statutory obligation.
Source: Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, paragraph 6(1) and 6(2). The statutory obligation to have such a programme at all sits in Rule 9(14)(ii) of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005.
What is a KYC Policy?
A KYC policy is the document in which a regulated entity specifies how it accepts and identifies customers, manages their risk, exercises ongoing monitoring, maintains records, and reports suspicious transactions. For all reporting entities under the PMLA, it is required by rule 9(14)(ii) of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005.
The RBI KYC Directions bind only RBI regulated entities, that is, banks, co-operative banks and NBFCs. Every other reporting entity works from rule 9(14) of the PML Rules, which sets the statutory floor that the RBI Directions then build on. Entities that are not reporting entities under the PMLA carry no KYC policy obligation under that Act, though their own sector regulator may impose one.
Sources: RBI Commercial Banks KYC Directions, 2025, paragraph 6(1) and 6(2); PML (Maintenance of Records) Rules, 2005, rule 9(14)(ii) and 9(14)(iii).
The Difference Between a KYC Policy and an AML Policy
KYC policy and AML policy are routinely conflated. The IFSCA AML, CTF and KYC Guidelines, 2022 state the relationship most cleanly: the KYC policy is a component of the AML/CFT/CPF policy. Where an AML/CFT/CPF policy already carries a full customer due diligence chapter meeting the statutory requirements, a separate KYC policy is not required.
In practice the split falls roughly like this.
Question | KYC policy | AML/CFT policy |
What it governs | The customer relationship: acceptance, identification, verification, risk rating, updation and the monitoring that flows from the customer’s risk profile | The whole compliance programme: governance, reporting, sanctions screening, training, record keeping, internal controls, group wide arrangements and independent testing |
Core question it answers | Do we know who this customer is, and is that knowledge up to date? | Are we detecting, preventing and reporting money laundering, terrorist and proliferation financing across the business? |
Anchor provisions | The rule 9 of the PML Rules | Chapter IV of the PMLA; rules 3, 3A, 7 and 8 of the PML Rules. |
Typical length | Fifteen to forty pages depending on product range | Longer, and usually supported by a separate procedures’ manual |
Who owns the detail | Onboarding, operations and the KYC function | The Principal Officer and the compliance function |
Relationship | A module inside the AML/CFT/CPF policy, per IFSCA clause 1.5(b) | The parent document |
Why the Policy Must Be Board-Approved
Approval sits at two levels: senior management (statutory floor) and the Board (RBI requirement). Board approval means the Board takes responsibility for the policy and its implementation.
Sources: PML Rules, rule 9(14)(iii); RBI Commercial Banks KYC Directions, 2025, paragraphs 6(1), 6(4)(i), 6(4)(ii), 7 and 11.
Who Needs a KYC Policy
Entity type | Instrument that supplies the KYC policy detail |
Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 28 November 2025, updated as on 29 December 2025 | |
Reserve Bank of India (Non-Banking Financial Companies – Know Your Customer) Directions, 2025 | |
Other RBI-regulated entity classes | The consolidation of 28 November 2025 issued KYC Directions separately for each of eleven regulated entity types. Cite the one that matches your licence, not the commercial banks version |
Authorised Persons under FEMA | A.P. (DIR Series) Circular No. 16, dated 28 November 2025. Authorised Persons regulated by the Department of Regulation follow their own entity-specific KYC Directions; those not so regulated are governed by the NBFC KYC Directions, 2025 |
SEBI Master Circular on KYC norms for the securities market, dated 12 October 2023, read with the SEBI KRA Regulations, 2011 | |
Insurers | IRDAI Master Guidelines on AML/CFT, 2022, dated 1 August 2022, in force from 1 November 2022, as amended by Circular dated 10 October 2023 |
PFRDA Master Circular PFRDA, issued 23 January 2023 and updated as on 25 September 2025 | |
IFSCA AML, CTF and KYC Guidelines, 2022, Gazette Notification dated 28 October 2022, updated as on 26 February 2026 | |
Chartered accountants, company secretaries and cost accountants in practice | AML and CFT Guidelines for professionals holding certificates of practice from ICAI, ICSI and ICMAI, dated 19 June 2023, for the activities notified under the relevant notification |
Virtual digital asset service providers | Notified as reporting entities by notification dated 7 March 2023, with the Director of FIU-IND designated as regulator by notification dated 9 November 2023 |
Real estate agents | AML, CFT and CPF guidelines for real estate agents dated 29 November 2023, following designation as DNFBPs by notification dated 28 December 2020 |
Dealers in precious metals and stones | AML, CFT and CPF Guidance dated 29 November 2023, following designation as DNFBPs by notification dated 28 December 2020 |
AML and CFT Guidelines for Multi State Cooperative Societies, effective 11 October 2024, following designation as DNFBPs by notification dated 4 May 2018 |
Banks carry the heaviest version of these obligations, and the Commercial Banks Directions are the most detailed instrument in the set, which is why they are used as the worked example throughout this article. Our guide to KYC in banking covers how the same requirements land in everyday branch and digital onboarding.
Get a KYC Policy Built for Your Business
A ready-made template won’t fit your products, customers or risks. We draft a KYC policy tailored to how your business actually works, ready for Board approval.
The Four Elements RBI Requires in a KYC Policy
The Commercial Bank Directions Paragraph 6(2) mandates four elements: Customer Acceptance Policy, Risk Management, Customer Identification Procedure, and Ongoing Due Diligence. The section below expands these into 23 functional clauses.
Element | Named at | Where the detail lives | What the policy has to state |
1. Customer Acceptance Policy | Para 6(2)(i) | Chapter III, paras 16 to 19 | Who you will and will not onboard, the twelve mandatory acceptance conditions in para 17, and the non-denial floor in para 18 |
2. Risk Management | Para 6(2)(ii) | Chapter IV, para 20, read with paras 10 and 11 | The enterprise ML/TF risk assessment, the customer risk categorisation methodology, and the parameters used |
3. Customer Identification Procedures | Para 6(2)(iii) | Chapter V, paras 21 to 27 | When identification is triggered, what is collected, and which verification modes are permitted |
4. Monitoring of Transactions | Para 6(2)(iv) | Paras 39 to 41 and para 55 | Ongoing due diligence, the transaction types that must be monitored, alert generation and the six-monthly risk review |
Element 1: Customer Acceptance Policy
Paragraph 16 of the direction is one sentence: the bank shall frame a Customer Acceptance Policy. Paragraph 17 then sets out twelve things the entity shall do, expressed without prejudice to the generality of what a Customer Acceptance Policy may otherwise contain. These are not suggestions and a policy that omits them is incomplete.
- Open no account in an anonymous, fictitious or benami name.
- Open no account where the entity is unable to apply appropriate customer due diligence measures, whether because the customer will not cooperate or because the documents or information furnished are unreliable. Where it cannot comply with the relevant measures, it shall consider filing a suspicious transaction report.
- Undertake no transaction and commence no account-based relationship without following the customer due diligence procedure.
- Specify the mandatory information to be sought for KYC purposes at onboarding and during periodic updation.
- Obtain additional information, where the internal KYC policy has not specified such an information requirement, with the explicit consent of the customer.
- Apply the customer due diligence procedure at the Unique Customer Identification Code level, so that an existing KYC-compliant customer opening another account or taking another product does not have to go through a fresh identification exercise.
- Follow the customer due diligence procedure for all joint account holders when opening a joint account.
- Clearly spell out the circumstances in which a customer is permitted to act on behalf of another person or entity.
- Put in place a suitable system to ensure the customer’s identity does not match any person or entity named in the sanctions lists indicated in Chapter IX.
- Verify the Permanent Account Number, if obtained, from the verification facility of the issuing authority.
- Verify the customer’s digital signature on an equivalent e-document, if obtained, under the Information Technology Act, 2000.
- Verify the Goods and Services Tax number from the search or verification facility of the issuing authority, where GST details are available.
Paragraph 18 requires that the policy shall not deny facilities to disadvantaged persons; rejections must be recorded with reasons; rejected applicants must have a review route. Paragraph 19 permits an exception: where suspicion of money laundering would be tipped off by performing CDD, file a Suspicious Transaction Report instead.
Sources: RBI Commercial Banks KYC Directions, 2025, paragraphs 16, 17(1) to 17(12), 18 and 19.
Element 2: Risk Management
Risk management operates at two levels: enterprise risk assessment (paragraph 10) covering customers, countries, products, services, transactions and channels, reviewed annually and presented to the Board and Senior Management; and customer risk categorisation (paragraph 20) assigning each customer a low, medium or high rating, reassessed at least every six months. The Explanation permits use of third-party assessments, but the entity retains responsibility.
Sources: RBI Commercial Banks KYC Directions, 2025, paragraphs 10(1), 10(2), 10(3), 11, 20(1) to 20(4) and the Explanation to paragraph 20.
Element 3: Customer Identification Procedures
Paragraph 21 specifies when identification is triggered and what information must be obtained. Paragraph 21(7) prohibits opening accounts on introduction. The specific documents required are set out by customer type in a separate guide; reference that from the policy rather than reproducing it.
Trigger | Provision | Threshold or condition |
Commencement of an account-based relationship | Para 21(1) | Always |
International money transfer for a non-account holder | Para 21(2) | Always |
Doubt about authenticity or adequacy of identification data already obtained | Para 21(3) | Always |
Selling third-party products as agent, selling own products, payment of credit card dues, sale and reloading of prepaid or travel cards, and any other product | Para 21(4) | More than Rs 50,000 |
Transactions for a walk-in, non-account-based customer | Para 21(5) | Equal to or exceeding Rs 50,000, whether a single transaction or several that appear connected |
Reason to believe a customer is intentionally structuring a transaction into a series below the threshold | Para 21(6) | Structuring below Rs 50,000 |
Element 4: Monitoring of Transactions
Paragraph 39 requires ongoing due diligence on all customers and close examination of transactions for consistency with the customer’s profile. Paragraphs 40-41 specify transaction types requiring attention and align monitoring extent to risk category. Paragraph 55 requires systems to document and escalate monitoring. The section covers this fully.
Sources: RBI Commercial Banks KYC Directions, 2025, paragraphs 39, 40(1) to 40(4), 41(1), 41(2) with its Explanations, and 55.
What Paragraph 6 Requires Beyond the Four Elements
This is the section that separates a policy which passes review from one which does not. Paragraph 6 does not stop at sub paragraph (2). Sub paragraph (3) adds four further things the KYC policy shall inter alia include, and sub-paragraph (4) requires two additional Board approved policies to sit alongside it.
Provision | Additional requirement | Drafting consequence |
Para 6(3)(i) | Periodic updation of KYC | The updation regime is a required contents item of the policy itself, not merely an operational procedure kept elsewhere |
Para 6(3)(ii) | Any exceptional measures for KYC updation, such as requiring a recent photograph, physical presence, or a more frequent updation schedule than the minimum prescribed | If you intend to apply anything stricter than the statutory minimum to any customer segment, the policy has to say so. You cannot impose it operationally off the back of a silent policy |
Para 6(3)(iii) | Obtaining a copy of an OVD or deemed OVD for the purpose of proof of change of address during KYC updation | Paragraph 42(3)(iii) makes this optional but requires the entity to clearly specify the requirement in its internal KYC policy. Silence means you cannot ask for it |
Para 6(3)(iv) | Providing the facility of updation and periodic updation of KYC at any branch | A customer convenience obligation that has to be stated as policy, not left as a service standard |
Para 6(4)(i) | Board-approved policies detailing a robust due diligence process for managing requests to change the registered mobile number for accounts opened in non-face-to-face mode | A separate Board-approved policy. Frequently missing entirely, and a live fraud vector |
Para 6(4)(ii) | A policy approved by the Board or a committee headed by the Chairman, CEO or Managing Director, establishing parameters for approving cross-border correspondent banking relationships, with post facto Board or committee approval for new relationships | Only relevant if you have correspondent relationships, but where relevant the approval route is prescribed and unusual |
The practical test is simple. Open your current policy and search it for the phrase exceptional measures, for any statement about updation at any branch, and for the mobile number change process. If all three are absent, the document does not meet paragraph 6 even if all four elements are present and well written.
Is Your Policy Missing Key Sections?
Most KYC policies cover the basics but leave out sections that reviewers look for first. We find the gaps before your regulator or auditor does.
A Structure for a KYC Policy
What follows is a working table of contents. Twenty-three clauses, each one carrying the paragraph or rule that requires it. Draft in this order and the document builds itself: who the policy binds, who is accountable, who you will accept, how you identify them, how you rate them, how you watch them, what you keep, what you report, and who checks the work.
Cite provisions inside clauses, not footnotes. Keep operational detail in annexures so the body text survives operational changes. These two habits create policies that remain stable between Board reviews.
Clause 1: Purpose, Scope and Applicability
State what the document is for, which entity it binds, and which parts of the business it reaches. Cover four things: the purpose (giving effect to rule 9(14)(ii) of the PML Rules and paragraph 6(1) of the 2025 Directions); the entity (full legal name, registration number, regulator); the perimeter (all branches, lines, channels, products); and overseas branches and subsidiaries (rule 3A requires group-wide coverage, applying the more demanding standard where host law is less strict).
Source: rule 3A of the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005; rule 9(14)(ii) of the same Rules; paragraph 6(1) of the RBI KYC Directions, 2025.
Clause 2: Definitions
Define three key terms. Senior Management (paragraph 12(1)): name the roles, not individuals. Beneficial Owner: reproduce the threshold by customer type, not a paraphrase that collapses them. Politically Exposed Person: use the explanation in paragraph 45. Add operational definitions: customer, walk-in customer, officially valid document, e-document, account relationship, periodic updation. Quote source instruments where they define terms; note where the entity fills gaps.
Source: paragraph 12(1) and the Explanation to paragraph 45 of the RBI KYC Directions, 2025; rule 2 of the PML Rules for the statutory definitions.
Clause 3: Governance and Accountability
Name five accountability roles with defined owners. Rule 2(ba) defines the Designated Director by entity type; paragraph 14(3) requires the Principal Officer to be different. Paragraph 13 states that decision making functions of KYC compliance cannot be outsourced. Record for both officers’ names, designations, contact details and communication to FIU-IND per rule 7(1); rule 7(2) makes the Principal Officer responsible for furnishing rule 3 information; rule 7(4) places the observance duty on the entity, designated director, officers and employees.
Role | What the policy must record | Source |
Board of Directors | Approves the KYC policy and reviews it. For RBI-regulated entities the Board may delegate approval to a committee, and the policy should name that committee if the power has been delegated. | Para 6(1) |
Audit Committee of the Board | Receives the quarterly audit notes and compliance on KYC and AML. Name the reporting line and the frequency. | Para 12 |
Senior Management | Defined by the entity under paragraph 12(1). Carries the approvals the Directions reserve to it, including PEP relationships. | Paras 12(1), 45 |
Designated Director | Named individual responsible for overall compliance with the PMLA and the Rules. Who this has to be is fixed by rule 2(ba) and varies by entity type. | Para 14, rule 2(ba) |
Principal Officer | Responsible for reporting to FIU-IND. Cannot also be the Designated Director. | Paras 14(3), 15 |
Clause 4: Customer Acceptance Policy
This clause converts paragraph 17’s requirements into actionable statements. At minimum, state:
- No account is opened in an anonymous, fictitious or benami name.
- No account is opened where the entity is unable to apply appropriate Customer Due Diligence measures, whether because the customer is non-cooperative or because the data or documents supplied are unreliable. Say what the officer does instead: consider filing a Suspicious Transaction Report, and do not tip off the customer.
- No transaction or account based relationship is undertaken without following the CDD procedure, and mandatory information is obtained at the point of opening.
- Optional or additional information is obtained with the customer’s explicit consent, separately from the mandatory set, and after the account is opened.
- The CDD procedure is followed for all joint account holders, not just the first-named one.
- Circumstances in which a customer is permitted to act on behalf of another person or entity are clearly spelt out.
- Suitable systems are in place to ensure the identity of the customer does not match any person or entity whose name appears in the sanctions lists circulated by the Reserve Bank.
- Where a Permanent Account Number is obtained, it is verified from the verification facility of the issuing authority. Where an equivalent e-document is obtained, its digital signature is verified.
Then draft the non-denial floor as a positive obligation. Paragraph 18 provides that the Customer Acceptance Policy shall not result in denial of a banking or financial facility to members of the general public, especially those who are financially or socially disadvantaged, including Persons with Disabilities. Read it as three drafting duties: no acceptance criteria that exclude those groups, a recorded reason for every rejection evidencing application of mind, and a route by which a rejected applicant can be reconsidered.
Paragraph 19 permits an exception: where suspicion of money laundering exists, and CDD would tip off the customer, file a Suspicious Transaction Report instead. Write this as a named exception with an escalation path.
Source: paragraphs 17, 18 and 19 of the RBI (Commercial Banks – Know Your Customer) Directions, 2025. Entities outside the RBI perimeter should read rule 9 of the PML Rules together with their own regulator’s instrument.
Clause 5: Customer Categorisation and Risk Assessment Methodology
Enterprise level: document a risk assessment covering customers, countries, products, services, transactions and channels, reviewed annually and presented to the Board and Senior Management. Customer level: categorise each customer as low, medium or high risk, keep categorisation confidential, name rating factors, re-assess at least every six months.
Source: paragraphs 10, 11, 20 and 41(1) of the RBI KYC Directions, 2025; Reserve Bank of India Guidance Note on Internal Risk Assessment for Money Laundering and Terrorist Financing, 10 October 2024.
Clause 6: Customer Identification Procedure for Individuals
Obtain identity, current address, permanent address, recent photograph, and Permanent Account Number or Form 60. Verify from officially valid documents or e-documents per the Directions’ prescribed routes. Paragraph 21(7) prohibits opening an account on introduction. The CDD procedure applies to all joint holders. Keep document lists in an annexure so the body survives changes to acceptable documents; reference our KYC documents guide rather than duplicating it.
Source: Chapter V of the RBI KYC Directions, 2025, in particular paragraph 21.
Clause 7: Customer Identification for Non-Individuals and Beneficial Owners
For the entity: record constitutional documents, registration particulars, PAN, proof of address, identity of authorised persons with their individual CDD. For the beneficial owner, apply the thresholds from the beneficial owner definition table; note that the senior managing official is a fallback, not a shortcut. Our corporate KYC guide sets out the document requirements for each customer type.
Customer type | Beneficial owner test |
Company | The natural person who, whether acting alone or together, or through one or more juridical persons, has a controlling ownership interest or who exercises control through other means. Controlling ownership interest means ownership of or entitlement to more than 10 per cent of the shares or capital or profits. |
Partnership firm | The natural person who, whether acting alone or together, or through one or more juridical persons, has ownership of or entitlement to more than 10 per cent of the capital or profits. |
Unincorporated association or body of individuals | The natural person who, whether acting alone or together, or through one or more juridical persons, has ownership of or entitlement to more than 15 per cent of the property or capital or profits. |
Trust | Identification of the author of the trust, the trustee, the beneficiaries with 10 per cent or more interest in the trust, and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership. |
Where no natural person is identified | The relevant natural person who holds the position of senior managing official. |
Start With a Clear Picture of Your Risks
A strong KYC policy is built on a sound risk assessment. We help you assess your customer, product and channel risks so your policy rests on solid ground.
Clause 8: Permitted Modes of Identification and Verification
List only the routes the entity uses; for each state that may use it, for which products, and what must be captured. A policy listing mode the entity never implements will fail an audit. Two cross-cutting rules: Aadhaar numbers must be redacted or blacked out; e-documents must have digital signature verification, not merely observation.
Mode | What the policy needs to fix |
Face-to-face at a branch or business location | Who is authorised to certify, how originals are sighted, and how the certification is recorded on the copy. |
Digital KYC | The prescribed process for capturing a live photograph of the customer together with the officially valid document, geo-tagging, and the authorised officer’s credentials. Name the application and the access controls. |
Video-based Customer Identification Process | The technical and operational requirements: an audio-visual interaction initiated from the entity’s own domain, live location capture, random question sequencing to establish liveness, sequential recording, encryption, and concurrent audit of the process. Name the officials authorised to perform V-CIP. |
Aadhaar OTP-based e-KYC | Only for customers who consent, only where the entity is permitted to authenticate, and subject to the limits the Directions place on accounts opened by this route, including the balance, aggregate credit and completion requirements. State the route to full KYC before those limits bite. |
Offline verification of Aadhaar | How the XML or QR-based offline record is captured and validated, and the redaction requirement for the Aadhaar number. |
Retrieval from the Central KYC Records Registry | When the entity pulls an existing record using the KYC Identifier, what it does if the record has changed, and when it must obtain fresh documents anyway. |
Our walkthrough of the KYC process sets out how these modes sequence in practice.
Source: Chapter V of the RBI KYC Directions, 2025, covering Digital KYC, V-CIP, Aadhaar-based e-KYC authentication and offline verification.
Clause 9: Enhanced Due Diligence
Enhanced Due Diligence is not one procedure but a set of named situations with its own trigger. List them: non-face-to-face onboarding (apply first-transaction controls); Politically Exposed Persons (gather sufficient information, establish source of funds, obtain Senior Management approval); accounts from high-risk jurisdictions, correspondent relationships, wire transfers lacking complete information; and trusts, charities, NGOs with opaque ownership. For each situation state trigger, additional information required, approval level, and monitoring uplift.
Source: paragraphs 44 and 45 of the RBI KYC Directions, 2025 and the Explanation to paragraph 45 defining Politically Exposed Persons.
Clause 10: Simplified Due Diligence
Simplified due diligence applies only if the entity uses these categories. Paragraph 47: Self Help Groups open on CDD of office bearers. Paragraph 48: Foreign students’ NRO accounts on passport with visa, photograph, admission letter. Paragraph 49: Foreign Portfolio Investors on SEBI-specified documents. Paragraph 28: Small Accounts with limits (credits Rs 1,00,000/year, withdrawals/transfers Rs 10,000/month, balance Rs 50,000). State the reduced information set, monitoring and trigger to move to the standard category. Not acceptable on suspicion of money laundering or inconsistency with national risk assessment.
Source: paragraphs 28, 47, 48 and 49 of the RBI KYC Directions, 2025; the Explanation to rule 9(14)(i) of the PML Rules.
Clause 11: Sanctions and Watchlist Screening
Screening is absolute; there is no low-risk exemption. The lists: UN ISIL and Al-Qaida Sanctions Lists, Taliban 1988 List, UAPA sections 35 and 51A designations, WMD Act designations. Screening points: at onboarding, before transaction execution, on every list update, periodically across the existing book. On a match: freeze the account without delay, report to the FIU and the designated authority per the Order dated 2 February 2021. The false-positive process: who adjudicates, on what evidence, within what time, and how the decision is recorded.
Source: paragraphs 56 to 62 of the RBI KYC Directions, 2025; sections 35 and 51A of the Unlawful Activities (Prevention) Act, 1967 and the Order dated 2 February 2021 thereunder; the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005.
Clause 12: Ongoing Due Diligence and Transaction Monitoring
Identification happens once; monitoring happens every day. Exercise ongoing due diligence on all customers; closely examine transactions to ensure consistency with knowledge of the customer, business, risk profile and source of funds. Align monitoring extent to risk category. Monitor for: large and complex transactions with no apparent economic rationale; transactions exceeding prescribed thresholds; high account turnover inconsistent with balance; third party cheques/drafts with unusual patterns.
State the alert scenarios and thresholds; who reviews alerts and within what time; when alerts escalate to the Principal Officer; how the file/no-file decision is recorded. The decision not to file is as much a decision as the decision to file. Review risk categorisation and applicability of enhanced due diligence at least every six months. Terminate relationships where CDD cannot be applied. Document the monitoring system; if technology assisted, state who owns the model.
Source: paragraphs 39, 40, 41 and 55 of the RBI KYC Directions, 2025. The obligation to monitor also sits independently in rule 9 of the PML Rules.
Clause 13: Periodic Updation of KYC
Periodic updation runs on a risk-banded clock. Where there is no change, a self-declaration via any channel (registered email, ATM, online banking, mobile app, letter) suffices. Where there is a change, obtain fresh information and verify per CDD procedures. State the reminder sequence, notice period, and point at which operations are restricted, with prior intimation and reasonable opportunity given.
Customer risk category | Updation interval |
High risk | At least once every two years |
Medium risk | At least once every eight years |
Low risk | At least once every ten years |
Clause 14: CKYCR Upload and the KYC Identifier
The CKYCR obligation has two directions. Upload: file KYC records in the prescribed template within the timeline from account opening; name the timeline and reconciliation process. Download and use: where a customer supplies a KYC Identifier, retrieve the records and do not require resubmission unless there has been a change, the record is not current, or fresh verification is needed. Updated records go back to CKYCR.
Source: the CKYCR provisions of the RBI KYC Directions, 2025, read with rule 9(1A) and rule 9A of the PML Rules.
Clause 15: Record Keeping and Retention
Retention is statutory; the two clocks run from different events. Records must be kept in hard or soft form, reconstructible for prosecution, with confidentiality and access controls applied. The policy should record formats, state that records can be produced to the FIU or the regulator on request and name the destruction control: records destroyed only after the retention period expires and after checking that no investigation or regulatory request is live. Name who signs off on destruction.
Record | Retention period | Runs from |
Records of all transactions referred to in rule 3 | Five years | The date of the transaction between the client and the reporting entity |
Records of the identity of clients and beneficial owners, and account files and business correspondence relating to clients | Five years | The date of cessation of the business relationship or the closure of the account, whichever is later |
Clause 16: Reporting to FIU-IND
The reporting clause belongs in the KYC policy because the KYC record is the evidentiary base. Record: the report types (Cash Transaction Report, Suspicious Transaction Report, Counterfeit Currency Report, Non-Profit Organisation Transaction Report, Cross Border Wire Transfer Report where applicable); that the Principal Officer furnishes reports to the Director, FIU-IND in prescribed form; the internal timeline from alert to filing; and the prohibition on disclosing reports.
Source: section 12 of the PMLA, 2002; rules 3, 7 and 8 of the PML Rules; the reporting provisions of the RBI KYC Directions, 2025.
Clause 17: Confidentiality and Tipping Off
Confidentiality: KYC information used only for that purpose without express consent for other uses. Tipping off: customer risk categorisation and reports filed are not disclosed; paragraph 19 goes further, in that where suspicion exists and performing CDD would tip off the customer, do not perform CDD, file a report instead. Disclosure exceptions: to regulator, FIU-IND, law enforcement under lawful process, and auditors. Any other disclosure requires approval. The Digital Personal Data Protection Act, 2023 governs processing, retention and security.
Source: paragraph 19 and the confidentiality provisions of the RBI KYC Directions, 2025; section 12 of the PMLA on the prohibition on disclosure. The data protection position should be verified against the notifications in force at the time of drafting.
Does Your Team Know How to Apply the Policy?
Even a well-written policy fails if staff don’t follow it. We run practical, role-based KYC training for frontline teams, compliance staff and senior management.
Clause 18: Outsourcing and Third-Party Reliance
Paragraph 13 prohibits outsourcing decision-making on KYC compliance. A vendor can capture documents, run screening, host platforms; cannot decide on acceptance, match adjudication or CDD sufficiency. For permitted outsourced activities: entity remains responsible; customer information used only for the agreed purpose; entity, auditors and regulator have access to records and premises; service provider performance is monitored. Third-party reliance: obtain information immediately, satisfy copies are available without delay, satisfy the third party is regulated or monitored.
Source: paragraph 13 of the RBI KYC Directions, 2025 on the outsourcing prohibition, read with the third-party reliance provisions of the Directions and rule 9 of the PML Rules.
Clause 19: New Products, New Technologies and New Delivery Channels
A short clause that keeps the policy relevant between reviews. The entity must identify and assess money laundering and terrorist financing risks arising from new products, business practices, delivery mechanisms and technologies, assessed before launch or use. Convert into a gate: no new product, channel or technology goes live without a documented risk assessment signed off by the named owner, filed with the enterprise risk assessment for the annual review. Name the owner and the sign-off.
Source: the new products and technologies provisions of the RBI KYC Directions, 2025, read with paragraph 10 on risk assessment.
Clause 20: Training and Awareness
An ongoing employee training programme is required so staff are adequately trained in CDD and KYC, with content differing by staff group. Fix five variables for audit: who (by role group); how often (minimum frequency); what (policy, identification and reporting of suspicious transactions, tipping-off prohibition, changes in law); how evidenced (test comprehension); who owns the programme (and to whom reporting goes). Extend to Board and Senior Management.
Source: the employee training provisions of the RBI KYC Directions, 2025, read with rule 9(14) of the PML Rules, which requires the Client Due Diligence Programme to include an ongoing employee training programme.
Clause 21: Independent Evaluation, Concurrent Audit and the Audit Committee
Paragraph 12 prescribes three things. Independent evaluation of the compliance function distinct from the people who run it. A concurrent or internal audit system specific to KYC and AML verification, not a general audit touching onboarding. Quarterly audit notes and compliance submitted to the Board’s Audit Committee. Name the owner of each submission and the reporting calendar. Where the entity operates V-CIP, concurrent audit attaches specifically to that process.
Source: paragraph 12 of the RBI KYC Directions, 2025.
Clause 22: Policy Review, Version Control and Board Sign-Off
State the review cycle (at least annually, aligned with the enterprise risk assessment), triggers for off-cycle review (amendments to law, new regulator instruments, changes in business or geography), approval route, and version control discipline. Front page should carry version number, approval date, approving body, effective date, next review date and owner. Back page change log records what changed, why, and under which authority.
Source: paragraphs 6(1) and 10(2) of the RBI KYC Directions, 2025.
Clause 23: Consequences of non-compliance
Section 13(2) of the PMLA empowers the Director to issue written warnings, direct specific compliance, direct periodic reporting, or impose monetary penalties for failure to comply. The penalty attaches to each failure (systemic gaps multiply) and reaches the designated director and employees individually, not only the entity. Add the internal consequence: disciplinary route for employee breaches and escalation for repeated breaches. Cross-refer to the entity’s HR framework.
Source: section 13(2) of the Prevention of Money-Laundering Act, 2002.
Annexures Worth Attaching
Keep these outside the Board-approved body text so that operational change does not require a Board resolution. Say in clause 22 who may update an annexure and on whose authority.
Annexure | Contents | Owner |
A. Document matrix | Acceptable officially valid documents and equivalent e-documents, by customer type | Compliance |
B. Risk rating methodology | Factors, weights, scoring and the mapping to low, medium and high | Compliance / Risk |
C. Risk categorisation review calendar | The six-monthly review schedule and the responsible reviewer by portfolio | Compliance |
D. Periodic updation calendar | Two, eight and ten year cycles by risk band, with the reminder and restriction sequence | Operations |
E. EDD checklists | One checklist per named EDD situation, with the approval level for each | Compliance |
F. Sanctions list sources | The lists screened, the source of each, update frequency and the escalation matrix | Compliance |
G. Alert scenarios and thresholds | Monitoring scenarios, thresholds, review timelines and escalation triggers | Compliance / Technology |
H. Reporting formats and timelines | Report types, internal deadlines and the filing workflow | Principal Officer |
I. Outsourced activity register | Vendors, activities outsourced, contract references and last review date | Operations |
J. Training calendar | Role groups, frequency, curriculum and evidence of completion | Compliance / HR |
K. Forms | Form 60, self-declaration formats, consent forms and the rejection record | Operations |
L. Version history | Version, approval date, approving body, summary of changes and authority for each change | Compliance |
Due for Your Annual Policy Review?
A review that only changes the date on the cover won’t hold up under scrutiny. We carry out a proper review and give you a clear record of what was checked and changed.
How to Write a KYC Policy: A Seven-Step Sequence
The clause list tells you the structure. These steps tell you the order.
Step 1: Establish which instruments bind the entity
Before writing, list the law. Every entity is bound by PMLA and PML Rules. RBI-regulated entities are bound by the 2025 Directions. Other entities are bound by their sector regulator’s instrument. Confirm each instrument’s current version.
Step 2: Complete the enterprise risk assessment first
The risk assessment is an input to the policy, not an output. Customer categorisation thresholds and monitoring rules come from the assessment.
Assess risks across categories; the rulebook name: customers, countries and geographic areas, products, services, transactions and channels. Document the assessment.
Step 3: Map the four elements, then map what sits beyond them
Take paragraph 6(2) and build the spine: Customer Acceptance Policy, risk management, Customer Identification Procedure, and Ongoing Due Diligence. Then layer on governance, periodic updation, record keeping, reporting and assurance.
Step 4: Draft the governance layer before the operational layer
Name the Board, Audit Committee, Senior Management, Designated Director and Principal Officer. Check that rule 2(ba) defines your Designated Director correctly and that paragraph 14(3) is satisfied (Principal Officer is different).
Step 5: Write the operational clauses, and write them as instructions
Work through clauses 4 to 21. The test for each clause: can an onboarding officer with no other knowledge read it and act correctly?
Push operational detail into annexures as you go. The body text should be stable enough to survive three years without a Board resolution.
Step 6: Set the three clocks and put them in one calendar
A compliant policy runs three separate review cycles: the enterprise risk assessment (annual), the customer risk categorisation (at least every six months), and the periodic updation (risk-banded clock). Put them in one calendar.
Cycle | Frequency | Owner |
Enterprise ML and TF risk assessment review | At least annually | Risk / Compliance |
Customer risk categorisation review | At least once every six months | Compliance |
Periodic KYC updation | Two years high risk, eight years medium, ten years low | Operations |
KYC policy review and Board sign-off | At least annually, plus event-driven | Compliance / Board |
Audit notes and compliance to the Audit Committee | Quarterly | Internal Audit |
Step 7: Take it through independent review before it goes to the Board
Have someone who did not draft the policy read it against the source instruments, clause by clause, using the reviewer checklist later in this article. Fix what they find, then put the document to the Board or the committee holding the delegated power, and record the resolution reference, the date and the effective date on the front page.
Keeping the KYC Policy Current
A KYC policy has a shelf life measured in months, not years. Two review mechanisms keep it alive, and one specific event has just made a large number of Indian KYC policies partly obsolete.
The annual review
The policy is reviewed at least annually and re-approved. Anchor the review to the enterprise risk assessment review so that a change in the risk picture flows straight into the policy rather than waiting for the next cycle.
The review should be genuine. Trigger reviews for: amendments to the PMLA or the PML Rules; new regulator instruments; changes in business, meaning new products, channels, geographies or customer segments; audit findings; changes in the Designated Director or Principal Officer; or changes in governance, procedures or organisational structure.
The November 2025 RBI Reorganisation
On 28 November 2025, the Reserve Bank reorganised the Directions. Entities must identify which Directions apply, re-map every citation in the policy because paragraph numbers changed, check for substantive changes, and take the updated policy to the Board. The transitional deadline for periodic updation of low-risk customers has now closed.
Source: Reserve Bank of India press release dated 28 November 2025, “Reserve Bank of India issues Consolidated Master Directions” (Press Release 2025-2026/1588); Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, including paragraph 42(2).
KYC Policy Requirements by Regulator
The statutory floor is identical for everyone: rule 9(14) of the PML Rules requires a documented Client Due Diligence Programme approved by senior management. What differs is what each regulator adds on top, particularly whether approval must come from the Board.
Regulator | Instrument | What it adds to the statutory floor |
RBI | Entity-specific KYC Directions, 2025 (Commercial Banks, NBFCs and other categories), issued 28 November 2025 | Board approval, or approval by a committee to which the Board has delegated the power. Four named key elements plus four further inclusions and two additional Board approved policies. Prescribed audit route to the Audit Committee. Defined review clocks. |
SEBI | Master Circular on Know Your Client Norms for the Securities Market, 12 October 2023, and the AML/CFT Master Circular for commodity derivatives | Written policies and procedures for the securities market perimeter, KRA-based KYC registration and record-keeping, and intermediary specific client identification and monitoring obligations. |
IRDAI | Master Guidelines on Anti-Money Laundering and Counter Financing of Terrorism, as amended | An AML/CFT/CPF programme covering internal policies, procedures and controls, with training differentiated by staff group, and insurance-specific due diligence at proposal, assignment, surrender and claim stages. |
PFRDA | Master Circular on KYC/AML/CFT for the pension sector | Express requirement that the KYC/AML/CFT policy be approved by the Board of Directors where the entity is a company, or by the management that takes significant decisions where it is not. Periodic review based on risk exposure. Where the entity already holds a Board-approved policy under another financial sector regulator, NPS activities may be included in that policy rather than duplicated. |
IFSCA | IFSCA (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022 | The clearest statement in Indian regulation of how the two documents relate. Clause 1.5(a) requires an AML,CFT and CPF policy approved by the Governing Body or a delegated committee. Clause 1.5(b) requires every Regulated Entity to develop a KYC Policy which shall be part of its AML-CFT policy. |
ICAI, ICSI and ICMAI | Guidelines for relevant persons carrying out notified financial transactions | An AML/CFT/CPF policy that is board-approved in the case of firms, periodically reviewed, and that expressly includes client acceptance and KYC policies. Written procedures to implement the client due diligence process under rule 9. Five-year retention of identification documents. |
FIU-IND (Director) | PMLA, 2002 and the PML Rules, 2005 for reporting entities without a sectoral regulator | The statutory floor applies directly: a documented Client Due Diligence Programme with policies, controls and procedures approved by senior management, plus registration and reporting obligations. |
Three practical readings of that table.
The approval standard is not uniform. The Rules say senior management. RBI, PFRDA and IFSCA each raise it, in slightly different language. An entity should write the approval clause against the highest standard that binds it, not against the statutory minimum.
A single policy can serve two regulators, but only if it says so. The PFRDA position is the clearest example: an entity with an existing Board-approved KYC/AML/CFT policy under another financial sector regulator may include its NPS activities in that policy. Multi-regulated groups should take that route deliberately, with a mapping annexure showing which clause satisfies which instrument, rather than operating parallel documents that drift apart.
The professions are inside the perimeter. Chartered accountants, company secretaries and cost accountants carrying out the notified financial transactions are reporting entities, and the guidelines issued through their institutes require a policy that expressly includes client acceptance and KYC. This is the group most likely to believe the obligation does not reach them.
Avoid Costly KYC Policy Mistakes
The same policy errors show up in inspection after inspection, and every one of them is avoidable. Let our experts check your policy before it becomes a finding.
5 Common KYC Policy Mistakes
These are the findings that recur. Each one is avoidable at the drafting stage and expensive to fix after an inspection.
1. Naming the same person as Designated Director and Principal Officer
The sector-specific instruments explicitly prohibit it in their terms. This is visible from the governance clause without any testing, which makes it a free finding for an auditor.
2. Running one clock instead of three
The PML Rules prescribe three KYC updation timelines: two years for enhanced due diligence, eight years for regular CDD, and ten years for simplified due diligence, along with updates when relevant information changes. With three clocks running, tracking the right deadline for each customer can become a compliance challenge.
3. Treating screening as risk-based
Sanctions screening is absolute. There are no low-risk exemptions and no threshold below which it does not apply. A policy that fold’s screening into the risk-based approach has created an exposure under section 51A of the UAPA, which is a criminal statute rather than a regulatory one.
4. Putting operational detail in the Board-approved body text
Thresholds, document lists, vendor names and form formats in the body mean that every operational change needs a Board resolution. What happens is that the change is made in practice and the policy quietly falls out of date, which is worse than either option.
5. Reviewing by re-dating
A review that changes the date on the cover and nothing else is not a review. When a supervisor asks what the last review considered, the answer must be a record of the questions asked and the conclusions reached, not a version number increment.
KYC Policy Review Checklist
Use this before the document goes to the Board, and again at each annual review. It is written the way a reviewer would work governance first, because a governance failure invalidates everything below it.
# | Check | Source |
1 | Does the policy name the correct entity-specific instrument currently in force, and not the 2016 Master Direction? | RBI PR 28.11.2025 |
2 | Is the policy approved by the Board, or by a committee holding a traceable delegation, with the resolution reference on the front page? | Para 6(1) |
3 | Are the Designated Director and the Principal Officer both named, and are they different people? | Paras 14, 15, 14(3) |
4 | Does the Designated Director meet the rule 2(ba) test for the entity’s constitution? | Rule 2(ba) |
5 | Is Senior Management defined? | Para 12(1) |
6 | Does the policy name the independent evaluation, the concurrent or internal audit system, and quarterly reporting to the Audit Committee? | Para 12 |
7 | Does it state that decision-making functions on KYC compliance are not outsourced? | Para 13 |
8 | Are all four key elements present as identifiable clauses? | Para 6(2) |
9 | Are the four further inclusions under paragraph 6(3) present? | Para 6(3) |
10 | Are the two additional Board-approved policies under paragraph 6(4) in place and cross-referenced? | Para 6(4) |
11 | Does the Customer Acceptance Policy cover all of the paragraph 17 requirements? | Para 17 |
12 | Does it carry the non-denial floor and require reasons for rejection to be recorded? | Para 18 |
13 | Is the enterprise risk assessment documented, and reviewed at least annually? | Para 10 |
14 | Does the policy specify the non-intrusive additional information used to build the customer risk profile? | Para 20 proviso |
15 | Is customer risk categorisation reviewed at least once every six months? | Para 41(1) |
16 | Is periodic updation set at two, eight and ten years by risk band, with the clock running from opening or last updation, whichever is later? | Para 42(1) |
17 | Has the expired low-risk transitional provision been removed? | Para 42(2) |
18 | Does the policy state that no account is opened on the basis of an introduction? | Para 21(7) |
19 | Are the beneficial owner thresholds reproduced correctly for each customer type, with the senior managing official as a fallback only? | PML Rules, Chapter V |
20 | Are only the verification modes the entity actually operates listed, each with an owner and controls? | Chapter V |
21 | Is the Aadhaar redaction requirement stated? | Chapter V |
22 | Does EDD name each situation with its own trigger, approval level and monitoring uplift, including PEP approval both to open and to continue? | Paras 44, 45 |
23 | Does SDD name only the categories the entity uses, with limits, residual monitoring and an exit trigger, and does it carry the no-simplified-measures-on-suspicion rule? | Paras 28, 47-49; rule 9(14)(i) |
24 | Is sanctions screening absolute, with named lists, screening points, action on match without delay, and a false-positive process? | Paras 56-62, UAPA s.51A |
25 | Does ongoing due diligence name alert scenarios, review timelines, escalation and the record of a decision not to file? | Paras 39-41, 55 |
26 | Are the CKYCR upload timeline, the reconciliation and the rejection queue owner recorded, along with the KYC Identifier download route? | Rule 9A, Chapter on CKYCR |
27 | Are the two retention clocks stated correctly, transactions from the transaction date and identity records from cessation or closure? | PMLA s.12, rule 10 |
28 | Is a destruction control in place with a live-matter check and a named approver? | PMLA s.12 |
29 | Is the tipping-off prohibition stated, including non-disclosure of the risk categorisation? | Paras 19, 20; PMLA s.12 |
30 | Is there a pre-launch risk assessment gate for new products, channels and technologies, with a named sign-off? | Chapter on new technologies |
31 | Does training differentiate by staff group and evidence comprehension, not just attendance? | Rule 9(14), Directions |
32 | Does the policy carry a version table, a change log and a next review date? | Para 6(1) |
33 | Does it state the section 13(2) consequences, including that penalties apply for each failure and reach individuals? | PMLA s.13(2) |
A policy that clears all thirty-three is not automatically good, because a checklist tests presence rather than quality. But a policy that fails any of the first seven has a governance problem that no amount of operational detail will offset.
Conclusion
A KYC policy is a governance instrument, not a compliance artefact. It fixes who the entity will do business with, who decides, who checks, and what happens when the answer is no. Everything else in the customer onboarding chain, from the document a branch officer asks for to the alert a monitoring system raises three years later, traces back to a clause in that document.
Three things are worth carrying away. The obligation is statutory and reaches every reporting entity through rule 9(14)(ii) of the PML Rules. The sector-specific instruments govern and provide a process for compliance with the core rules. The four key elements in paragraph 6(2) of the RBI commercial bank directions are a floor, with paragraphs 6(3) and 6(4) adding six further requirements on top. And the document must be kept alive on three clocks, with the 28 November 2025 reset making a re-citation exercise urgent for every RBI-regulated entity that has not already done one.
If the policy sits inside a wider AML programme, and it should, read this alongside our guides to AML policies and procedures under the PMLA and to AML policy, controls and procedures in India. The KYC policy is the customer-facing component of that programme; those pages cover the rest of it.
AML India helps regulated entities draft, review and refresh KYC and AML/CFT/CPF policy documentation against the instrument that binds them. If your policy still cites the 2016 Master Direction, that is the place to start.
Didn’t Pass Every Point on the Checklist?
If your policy fell short on even one item, we can help you fix it quickly. Get a complete, review-ready KYC policy without the guesswork.
Frequently Asked Questions
A KYC policy is a formally approved document that sets out how the entity accepts customers, verifies their identities, assesses and monitors risk, maintains records, and reports suspicious transactions. For for all reporting entities, it is required by rule 9(14)(ii) of the PML Rules.
The four key elements are Customer Acceptance Policy, risk management systems, Customer Identification Procedure, and procedures for Ongoing Due Diligence and Transaction Monitoring.
Yes. The obligation is statutory under rule 9(14)(ii) of the PML Rules, 2005, not merely regulatory.
Yes, Rule 9(14)(iii) of the PML Rules requires senior management approval as the floor. Senior management must approve the reporting entity’s policy and ensure it remains aligned with applicable AML, CFT, and CPF requirements.
The KYC policy is a component of the AML/CFT/CPF policy, not a separate or alternative document. If the AML policy already includes a full customer due diligence chapter, a separate KYC policy is not required, if chapter covers the statutory substance.
At least annually. Additionally, trigger reviews for amendments to the PMLA or PML Rules, new regulatory instruments, changes in business, product, geography or customer segment, and audit findings. Set the annual review date to align with the enterprise risk assessment.
Accountability is layered. The Board approves and oversees; Senior Management owns implementation; the Designated Director and Principal Officer carry named responsibilities; and the compliance officer handles execution and monitoring.
No. A template is a starting structure, not compliant as-is. Every policy must be tailored to the entity’s regulated status (which instruments apply), business model (products, channels, customer segments), geography and risk profile, and organisational structure.
Periodic updation is the requirement to refresh customer KYC information on a risk-banded clock. Where there is no change, a self-declaration via any channel suffices. Where there is a change, fresh information and verification are required.
Non-compliance is actionable in its own right. On a finding of failure, the Director may issue a written warning, direct specific compliance measures, direct periodic reporting, or impose a monetary penalty, and the penalty attaches to each failure rather than to the entity once. A policy that exists but is not followed offers no defence: what is examined is the record of its application.
About the Author
Pathik Shah
FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)
Pathik is a Chartered Accountant with more than 26 years of experience in governance, risk, and compliance. He helps companies with end-to-end AML compliance services, from conducting Enterprise- Wide Risk Assessments to implementing the robust AML Compliance framework. He has played a pivotal role as a functional expert in developing and implementing RegTech solutions for streamlined compliance.
Reach Out to Pathik
