AML Laws and Regulations for Local Area Banks in India

Across that framework, the regulations require a local area bank to do the following. This article keeps each at the level required by law; a compliance requirements guide explains how to do each. 

• Register with FIU-IND. Enrol on the FINnet 2.0 / FINGate 2.0 portal so the institution can file its reports. 

• Appoint officers. Appoint a Designated Director and a management level Principal Officer under Rule 7 of the PMLR and the RBI Directions. The same person cannot hold both roles, and both are informed to FIU-IND and the RBI. 

• Conduct the internal risk assessment. Run an ML and TF risk assessment across customers, products, channels and geographies, document it, and take its outcome to the board, as the RBI Directions and the IRA Guidance require. 

• Document AML policy, controls and procedures. Adopt a board approved policy that turns the risk assessment into the institution’s operating procedures. 

• Customer identification and CDD. Identify and verify every customer and the beneficial owner (a controlling interest of more than 10 per cent for a company or partnership, and more than 15 per cent for an unincorporated association or body of individuals, with the separate trust test), with enhanced due diligence for politically exposed persons and high risk customers, Rule 9 of the PMLR and the RBI Local Area Banks KYC Directions 2025. Given the deposit and lending business, the identification of account holders and any beneficial owner, and the scrutiny of cash deposits and the source of funds, are central. 

• Ongoing monitoring and periodic updation. Monitor transactions on an ongoing basis, and refresh KYC at least once every 2, 8 and 10 years for high, medium and low risk customers. Review each customer’s risk categorisation at least once every six months. 

• Sanctions screening. Screen customers and beneficial owners against the designated lists under Section 51A of the UAPA and Section 12A of the WMD Act, and freeze and report any match, verifying the relevant UNSC and domestic lists daily. 

• Correspondent banking and wire transfers. For any correspondent banking relationship and for cross border and domestic wire transfers, apply the specific due diligence the PMLR and the RBI Directions require, including gathering and passing on complete originator and beneficiary information and assessing the respondent institution. A local area bank rarely runs large correspondent networks, but the duty applies wherever it moves funds across borders or for another institution. 

• Regulatory reporting. File cash transaction reports for cash above Rupees 10 lakh, suspicious transaction reports of any value, counterfeit currency reports, and cross border wire transfer reports of Rupees 5 lakh or more where applicable, under Rule 3 and Rule 8 of the PMLR. Cash and related reports are filed monthly, by the 15th day of the succeeding month; suspicious transaction reports are filed promptly once the Principal Officer is satisfied, through FINnet 2.0. 

• Record management, CKYCR and FINnet 2.0. Keep transaction records for five years from the date of the transaction, and identity records, account files and correspondence for five years after the relationship ends, under Section 12 of the PMLA. Upload customer KYC records to the CKYCR under Rule 9A, and file all prescribed reports through FINnet 2.0. 

• Training and awareness. Train staff by role to apply the controls and recognise red flags in a local bank, such as large cash deposits inconsistent with the customer’s profile, structuring below thresholds, and third party operation of local accounts. 

• Independent testing and audit. Test the programme through internal audit, compliance assurance or independent review, and close every finding. 

• Run group wide controls. Where the bank is part of a group, apply AML and CFT programmes at group level, including for branches and majority owned subsidiaries, as the RBI Directions require.