AML / KYC Compliance (NBFCs)

All NBFCs registered with the RBI are Reporting Entities under Section 12 of the Prevention of Money Laundering Act 2002 (PMLA). This includes NBFC-MFIs, NBFC-Factors, HFCs, and deposit-taking NBFCs. The FIU-IND registration and AML/CFT programme obligations apply from the date of RBI registration — there is no de-minimis turnover threshold for PMLA compliance.

Under Rule 9 of the Prevention of Money Laundering (Maintenance of Records) Rules 2005 (PMLA Rules), the policy must cover Customer Due Diligence (CDD) procedures, risk categorisation of customers (low/medium/high), Enhanced Due Diligence (EDD) triggers, suspicious transaction reporting (STR) to FIU-IND, and record retention for 10 years. The RBI Master Direction on KYC (updated January 2024) layered additional requirements on digital KYC and Video-Based Customer Identification Process (VCIP).

Under Rule 8 of the PMLA Rules, an STR must be filed with FIU-IND within 7 days of an NBFC's internal determination that a transaction is suspicious. Cash Transaction Reports (CTRs) for transactions above Rs 10 lakh must be filed by the 15th of the following month. Non-filing or late filing can attract penalties under Section 13 of PMLA up to Rs 1 lakh per day of default.

The RBI Master Direction on Know Your Customer (KYC) Direction 2016 (as amended) sits alongside PMLA and is binding on all RBI-regulated entities including NBFCs. It mandates Officially Valid Document (OVD) collection, Aadhaar-based eKYC under Section 11A of PMLA read with the Aadhaar (Targeted Delivery) Act 2016, periodic KYC updation, and beneficial ownership identification for entities under Rule 9(1)(c) of the PMLA Rules. Non-compliance can trigger both RBI supervisory action and PMLA enforcement.

Penalties under PMLA Section 13 range from Rs 10,000 to Rs 1 lakh per day for record-keeping or reporting failures; adjudication orders can also result in suspension of business under Section 13(2). Separately, the RBI can impose monetary penalties under Section 58B of the RBI Act 1934 for KYC direction violations — recent RBI orders on NBFCs have ranged from Rs 5 lakh to Rs 2.5 crore depending on the nature and duration of the breach.