KYC and AML Essentials for Bankers
Customer Due Diligence, risk categorisation, periodic updation intervals and reporting to FIU-IND under PMLA, in one revision note.
Key points
- KYC rules for banks come from the RBI Master Direction – Know Your Customer (KYC) Direction, 2016, framed under the Prevention of Money-laundering Act, 2002 (PMLA) and the PML Rules, 2005.
- Four pillars of a KYC policy: Customer Acceptance Policy, Risk Management, Customer Identification Procedure and Monitoring of Transactions.
- Periodic updation: at least once every 2 years for high-risk, every 8 years for medium-risk and every 10 years for low-risk customers.
- Reports go to the Financial Intelligence Unit – India (FIU-IND): CTR, STR, CCR, NTR and CBWTR.
- Records of transactions and identification must be preserved for at least 5 years.
What KYC is meant to do
Know Your Customer is the process by which a bank establishes who its customer is, understands the nature of the customer's business, and monitors the account so that it is not used for money laundering or terrorist financing. It protects the bank from legal and reputational risk and is a statutory obligation under PMLA.
The four pillars of a KYC policy
| Element | What it covers |
|---|---|
| Customer Acceptance Policy (CAP) | No account in anonymous or fictitious names; no account where CDD cannot be completed; checks against sanctions lists before opening. |
| Risk Management | Categorising customers as low, medium or high risk based on identity, social/financial status, nature of business, location and products used. |
| Customer Identification Procedure (CIP) | Verifying identity and address using Officially Valid Documents (OVDs), Aadhaar-based e-KYC, Video-based CIP (V-CIP) or the Central KYC Records Registry (CKYCR). |
| Monitoring of Transactions | Ongoing due diligence; closer watch on high-risk accounts and on transactions inconsistent with the customer's profile. |
Customer Due Diligence (CDD)
- Simplified / normal CDD applies to most individual customers.
- Enhanced Due Diligence (EDD) applies to high-risk customers, Politically Exposed Persons (PEPs), non-face-to-face relationships and complex structures.
- For legal entities, the bank must identify the Beneficial Owner – the natural person who ultimately owns or controls the customer.
- The KYC identifier generated by CKYCR can be used to fetch records, so the customer need not submit the same documents again.
Periodic updation (Re-KYC)
| Risk category | Minimum frequency |
|---|---|
| High risk | Once every 2 years |
| Medium risk | Once every 8 years |
| Low risk | Once every 10 years |
Where there is no change in KYC information, an individual customer can give a self-declaration through registered email, mobile, ATM, internet/mobile banking or a letter; fresh documents are not required. A change of address can be updated with a self-declaration, with the new address verified within a stipulated period.
Reporting to FIU-IND
| Report | What is reported |
|---|---|
| CTR – Cash Transaction Report | Cash transactions above ₹10 lakh, and integrally connected cash transactions that together exceed ₹10 lakh in a month. Filed monthly, by the 15th of the following month. |
| STR – Suspicious Transaction Report | Any transaction, cash or not, that gives rise to suspicion. Filed within 7 working days of the bank concluding that it is suspicious. Attempted transactions are also reported. |
| CCR – Counterfeit Currency Report | Cash transactions where forged or counterfeit notes were used as genuine. |
| NTR – Non-Profit Organisation Transaction Report | Receipts by non-profit organisations above ₹10 lakh (or its equivalent in foreign currency). |
| CBWTR – Cross-Border Wire Transfer Report | Cross-border wire transfers above ₹5 lakh where either the origin or destination is in India. |
Record keeping
Records of all transactions and of identification data must be preserved for at least five years from the date of the transaction or from the end of the business relationship, as applicable, and made available to authorities when required.