CKYCRR Compliance for Reporting Entities under PMLA and IFSCA

No. In the IFSC, the CKYCR requirements apply to entities carrying on the eleven activities listed in clause 11.6(e) of the IFSCA Guidelines. An entity outside that list assesses its position under the PML Rules, its sectoral framework and any specific IFSCA directions rather than assuming clause 11.6 applies to it.

Payment service providers, finance companies undertaking core activities, IFSC banking units, bullion trading or clearing members, broker dealers, clearing members, depository participants, investment advisers, fund management entities, and general and life insurers. Confirm your licensed activity against the current list before applying the workflow.

The Guidance Note exempts a foreign-national client from the CKYCR filing requirement, while allowing voluntary submission subject to specified documents. Because the clause heading uses Indian-resident language, document how you treat foreign nationals, NRIs and mixed cases and apply it consistently.

On the face of the Guidance Note, an NRI who remains an Indian national falls within the Indian-national filing requirement. However, clause 11.6 is headed as applying to Indian-resident natural and legal entities. The regulated entity should therefore document its interpretation, distinguish nationality from residence, and obtain regulatory clarification where the customer or product structure creates uncertainty.

Under the IFSCA Guidelines, the general cycle is annually for high-risk customers, once every three years for medium-risk and once every five years for low-risk. Where an identity document expires, conduct CDD afresh, and where nothing has changed, a self-declaration or authorised-signatory confirmation suffices.

Only to a resident Indian customer who already holds a client relationship within the regulated entity’s financial group in India, under the 2 January 2026 circular. Where the group and the IFSC entity assign different risk categories, the stricter periodicity applies. It is not the general IFSC cycle.

Yes. The CERSAI Operating Guidelines require the reporting entity to obtain and retain the customer’s download consent every time a record is downloaded. That consent is a separate control from any authentication step.

No. Where an individual record is fetched via API or a screen-based interface to establish an account-based engagement, CKYCRR triggers an OTP to the registered mobile as an authentication step. Consent is obtained and retained separately, and other download modes may use different authentication factors.

Yes, in the situations set out in Rule 9(1C): where the information has changed, the record is incomplete or does not meet current norms, a document has expired, current-address verification is needed, or enhanced due diligence applies. Otherwise the record is reused via the identifier.

Obtain the missing information from the customer, verify it, and update the record on CKYCRR within the applicable timeline, rather than proceeding on an incomplete record or creating a duplicate. Keep evidence of what was obtained and when the record was completed.

Capture it, match it to the customer master, retrieve the latest record, compare field by field, update connected systems, re-screen where identity or connected-party data has changed, reassess risk where material, and record that the refresh was closed.

No. Retrieving a CKYC record does not remove the obligation to identify and verify the customer’s beneficial owners, understand the ownership and control structure, and apply any enhanced measures, including the source-of-funds measure where a beneficial owner is an Indian national.

No. Sanctions, PEP and adverse-media screening, ongoing monitoring and suspicious-transaction reporting remain the entity’s own obligations. A CKYC record is a shared identity record, not a substitute for these controls.

The registry withdraws the record. It can be re-uploaded only if no match is then found. Searching before uploading and reconciling probable matches promptly avoids both duplicates and withdrawals.

Searches, consents, downloads, uploads, updates and reconciliation decisions should form part of the entity’s CDD and compliance audit trail and be retained under its record-retention policy. In the IFSC, necessary records must generally be retained for at least six years, or longer where another applicable law requires it.

It begins on commencement of the account-based relationship, not merely when the application is received or documents are collected. Each entity should define the commencement event for every product in its policy and system logic, for example account opening, activation or execution, based on its legal and sectoral framework.

The PML Rules state ten days and seven days without describing them as working days. A reporting entity should avoid configuring the deadlines as working-day periods unless an applicable regulator or official instruction expressly permits that interpretation.

The express exemption in the Guidance Note is worded for a client who is a foreign national, which naturally describes a natural person. The position of foreign legal entities should be assessed separately in light of the clause heading, Rule 9A and any applicable IFSCA instructions, rather than assumed.

Yes. The IFSCA Guidance Note contemplates voluntary submission of a foreign national’s KYC record, subject to the specified documents, even though filing is not mandatory for foreign-national clients.