NISM Series IFSCA-01 · Chapter 6: IFSCA Guidelines for KYC Norms

L1 · Foundation

IFSCA Guidelines for KYC Norms

Customer risk assessment and the eight factors, indicators of high and low risk, the three cases where no relationship may be established, the CDD process and its timing including the 30 and 120 day limits, identification of natural and legal persons, V-CIP and digital KYC, beneficial ownership parameters, life insurance beneficiaries, PEPs, enhanced and simplified due diligence, ongoing due diligence and sanctions screening, failure to complete CDD, periodic updation cycles, and how IFSCA differs from other Indian regulators.

26 min read · Worth 20% of the paper · Written from pages 90–110 of the official NISM workbook · Updated 18 September 2026

What this chapter covers

Chapter 6 carries 10 marks out of 50 — 20% of the paper, the largest chapter in the syllabus.

Learning Objective- After studying this chapter, you should know about: The IFSCA KYC guidelines and process to be followed by every Regulated Entity from the client at the time of commencement of an account-based relationship.

6.1 Applicability

The provisions of IFSCA (AML, CFT and KYC) Guidelines apply to every Regulated Entity falling under the purview of IFSCA. The provisions of these Guidelines also apply to a Financial Group of the Regulated Entity, to specified extent.

"Financial Group" means a group that consists of a parent company or of any other type of legal person exercising control and coordinating functions over the rest of the group, together with branches and/or subsidiaries that are subject to AML/CFT policies and procedures at the group level.

Chapter IV – 'Customer Risk Management' of the IFSCA (AML, CFT and KYC) Guidelines deals with assessing the risk posed by a prospective client to the Registered Intermediaries.

Risks identified while assessing the business risks shall be used for the customer risk assessment. So the business risk assessment of Chapter 5 feeds the customer risk assessment here.

The outcome of the Customer risk assessment shall be used to assign the risk rating of the customer as high, medium or low, proportionate to the ML/TF risks.

6.1.1 Assessing customer AML risks

A Regulated Entity shall: i. undertake a risk-based assessment of every customer; and ii. assign the customer a risk rating proportionate to the ML/TF risks.

Every customer — no exceptions.

Timing: the customer risk assessment... shall be completed prior to undertaking Customer Due Diligence for new customers, and also where the Regulated Entity otherwise feels necessary, for existing customers.

Risk assessment comes before due diligence, because the assessment decides how much diligence is required.

The eight factors:

	Factor
i.	identify the customer and Beneficial Owner, if any;
ii.	obtain information on the purpose and intended nature of the business relationship;
iii.	obtain information on, and take into consideration, the nature of the customer's business;
iv.	take into consideration the nature of the customer, its ownership, control structure, and its Beneficial Ownership, wherever applicable;
v.	take into consideration the nature of the customer's business relationship with the Regulated Entity;
vi.	take into consideration the customer's country of origin, residence, nationality, place of incorporation or place of business;
vii.	take into consideration the relevant product, service or transaction; and,
viii.	take into consideration the beneficiary of the policy including any Beneficial Owner of such beneficiary, if it is providing the customer with a life insurance or other similar policy.

In short: who the customer is, who owns it, why it wants the relationship, where it comes from, and what it is buying.

The first sample question offers the first two and answers Both of the above.

And the result stays secret: the risk categorization of a customer and the specific reasons for such categorization shall be kept confidential and shall not be revealed to the customer to avoid tipping off.

6.1.2 Factors indicating high ML/TF risk

(a) Customer risk

	Indicator
i.	Whether the customers are from high-risk businesses / activities / sectors, as well as from other sectors as may be identified by it;
ii.	Whether the ownership structure of the legal person or arrangement appears unusual or excessively complex;
iii.	Whether the business relations are conducted under unusual circumstances (e.g., significant unexplained geographic distance between the Regulated Entity and the customer);
iv.	Whether the companies have nominee shareholders or shares in bearer form;
v.	Whether the legal persons or legal arrangements are personal asset holding vehicles; and,
vi.	Whether the corporate structure of the customer is unusual or excessively complex given the nature of the business.

Most of these point to one worry: it is hard to see who really owns or controls the customer.

(b) Country or geographic risk

	Jurisdictions
i.	jurisdictions with relatively high levels of corruption, organized crime or inadequate AML/CFT measures, as identified by the FATF
ii.	those identified by any credible body as having significant levels of corruption, terrorism financing or other criminal activities
iii.	those identified by credible sources, such as mutual evaluation or detailed assessment reports or published follow-up reports, as not having adequate AML/CFT systems
iv.	those that do not have effective systems to counter ML/TF; or not implementing the AML/CFT measures that are consistent with FATF Recommendations
v.	those subject to sanctions, embargos or similar measures issued by International Organisations or India
vi.	those funding or supporting the terrorism
vii.	those with organizations operating within their territory that have been designated by India, other countries or International Organizations as terrorist organizations.

Note that the exposure counts through the entity's own operations too — either through its own activities (including where its branches and subsidiaries operate in) or the activities of its customers (including the Regulated Entity's network of correspondent account relationships).

(c) Product, service, transaction or delivery channel risk

	Indicator
i.	Whether the service involves private banking;
ii.	Whether the product, service or transaction is one that might favour anonymity;
iii.	Whether the situation involves non-face-to-face business relationships or transactions, without adequate safeguards;
iv.	Whether the payments received are from unknown or unassociated third parties;
v.	Whether the services offered are in relation to nominee directors, nominee shareholders or the formation of companies in another country; and
vi.	Whether there are anonymous transactions or any transaction which involves frequent payments, received from unknown or unassociated third parties.

And a caution: when assessing the risk factors, the Regulated Entity shall examine the overall risk while keeping in mind that the presence of one or more risk factors alone may not always indicate a high risk of ML/TF in a particular situation.

One red flag is not a verdict.

6.1.3 Factors indicating low ML/TF risk

(a) Customer risk factors — whether the customer is:

	Customer
i.	a Government entity;
ii.	public companies listed on a stock exchange and subject to disclosure requirements (either by stock exchange rules or through law or enforceable means), which impose requirements to ensure adequate transparency of beneficial ownership.
iii.	regulated financial institution incorporated or established outside India that is subject to and supervised for compliance with AML/CFT requirements consistent with standards set by the FATF.
iv.	a subsidiary of a regulated financial institution referred to in sub-clause (iii) above, if the law that applies to the Parent entity ensures that the subsidiary also observes the same AML standards as that of its Parent entity.
v.	a public body or a publicly owned enterprise.
vi.	a resident established or registered in a geographical area of low risk.

(b) Product, service, transaction or delivery channel factors

	Product or service
i.	a Contract of Insurance that is non-life insurance;
ii.	a Contract of Insurance that is a life insurance product with no investment return or redemption or surrender value;
iii.	an insurance policy for a pension scheme that does not provide for an early surrender option and cannot be used as collateral;
iv.	a Contract of Insurance which is a reinsurance contract that is ceded by an insurer which is a regulated financial institution;
v.	a pension, superannuation or similar scheme that satisfies the following conditions: (aa) the scheme provides retirement benefits to employees; (bb) contributions to the scheme are made by way of deductions from wages; and (cc) the scheme rules do not permit the assignment of a member's interest.
vi.	a product where the ML/TF risks are adequately managed by other factors such as transaction limits or transparency of ownership; and
vii.	financial products or services that provide appropriately defined and limited services to certain types of customers (e.g., to increase customer access for financial inclusion purposes).

Several of these share a feature: no investment or surrender value, no early surrender option, or limits that keep the risk small.

The same caution applies in reverse — the presence of one or more risk factors alone may not always indicate a low risk.

6.1.4 When no relationship may be established

The Regulated Entity shall not establish the business relationship with the customer, which is a legal person or legal arrangement, in the following cases:

	Bar
(a)	where the ownership or control arrangements of the customer prevent the Regulated Entity from identifying one or more of the customer's Beneficial Owners;
(b)	where there are anonymous accounts, accounts in fictitious names, or a nominee account which is held in the name of one person, but is controlled by or held for the benefit of another person whose identity has not been disclosed to the Regulated Entity; or
(c)	a Shell Financial Institution.

Three absolute bars. The second sample question asks whether limb (a) is true — it is.

6.2 Customer Due Diligence

A Customer or Client means a person who is engaged in a financial transaction or activity with a Regulated Entity and includes a person on whose behalf the person engaged in the transaction or activity, is acting.

A Regulated Entity after assigning risk rating for each Customer proportionate to their AML/CFT risks, shall undertake the Customer Due Diligence:

Customer	Measures
i. All	undertake Customer Due Diligence measures... in respect of all the customers;
ii. High risk	undertake Enhanced Customer Due Diligence measures... in addition to the CDD measures... in respect of the customer who has been assigned 'high risk'; and
iii. Low risk	undertake Simplified Customer Due Diligence measures... by modifying Customer Due Diligence process... in respect of a customer who has been assigned 'low risk'.

Note the difference in wording. Enhanced measures come in addition to ordinary CDD; simplified measures modify it. Nothing removes CDD altogether.

6.2.2 Timing

A Regulated Entity shall undertake the Customer Due Diligence of a customer: i. at the time of establishing business relationship... and ii. after establishing a business relationship — the second being ongoing due diligence.

And it must be repeated if, at any time:

i. in relation to an existing customer, it doubts the veracity or adequacy of documents, data or information obtained for the purposes of Customer Due Diligence;
ii. it suspects ML/TF; or
iii. there is a change in risk-rating of the customer, or it is otherwise warranted by a material change in circumstances of the customer.

Put simply: doubt, suspicion or a changed customer means doing CDD again.

6.2.3 Establishing a relationship before verification

A Regulated Entity may establish a business relationship with a customer before completing the verification... subject to fulfilling the following conditions:

	Condition
i.	the deferral of completion of the verification of the customer or Beneficial Owner is essential in order not to interrupt the normal conduct of a business relationship;
ii.	there is low risk of occurrence of ML/TF activity and any such risks identified can be effectively managed by the Regulated Entity;
iii.	in relation to a bank account opening, there are adequate safeguards in place to ensure that the account is not closed, and transactions are not carried out by or on behalf of the account holder (including any payment from the account to the account holder) before verification has been completed; and
iv.	the verification is completed as soon as reasonably practicable and, in any event, it should not exceed 30 business days after the establishment of business relationship.

If the 30 days cannot be met, the entity shall, prior to the end of the 30-day period: i. document the reason for its non-compliance; ii. complete the verification as soon as possible; and iii. record the non-compliance event for reporting to its Governing Body.

Then two hard consequences.

The Regulated Entity shall suspend business relationship with the customer and refrain from carrying out further transactions (except to return funds to their sources, to the extent that is possible) if such verification remains uncompleted for 30 days after the establishment of business relationship.

The Regulated Entity shall terminate business relations with the customer if such verification remains uncompleted for 120 days after the establishment of business relationship.

Thirty days to suspend, one hundred and twenty to terminate.

And the policy must anticipate it: the entity's AML/CFT systems and controls must include internal risk management policies and procedures concerning the conditions under which such business relationships may be established with a customer before completing verification and should also factor the above time limitation.

6.3 CDD requirements

6.3.1 The four measures

a) Identifying the customer and verifying that customer's identity using reliable, independent source documents, data or information.

b) Identifying the beneficial owner and taking reasonable measures to verify the identity of the beneficial owner, in such a manner that the Regulated Entity is satisfied that it knows who the beneficial owner is. And for legal persons and arrangements, the CDD shall include Regulated Entity taking reasonable steps to understand the nature of the customer's business, its ownership and control structure.

c) Understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship.

d) Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of business relationship to ensure that the transactions that are being conducted, are consistent with the Regulated Entity's knowledge of the customer, customer's business and risk profile, including, where necessary, the source of funds.

The third sample question in Chapter 5 turns on measure (c). A statement that the entity does not obtain information on purpose and intended nature is false.

6.3.2 Identification of the customer

Natural person — at least seven items:

	Natural person
i.	Full name, including any aliases
ii.	Unique Identification Number (such as an Identity card number, passport number, etc.)
iii.	Date of birth
iv.	Nationality
v.	Legal domicile
vi.	Current residential address; (other than a post office box address)
vii.	Contact details such as personal, office or work telephone numbers.

Note the exclusion of a post office box address.

Legal person or legal arrangement — at least five:

	Legal person or arrangement
i.	The full name and any trading name
ii.	Unique identification Number (i.e., Tax identification number or equivalent where this exists, incorporation number or business registration number)
iii.	Registered or business address, and if different, its principal place of business
iv.	Date of establishment, incorporation or registration
v.	Place of incorporation or registration.

And more besides: the entity shall also identify the legal form, constitution and powers that regulate and bind the legal person or legal arrangement. In addition to this, Regulated Entity shall also identify and screen the related parties or connected parties of such customer and should remain apprised of any changes to connected parties.

For each connected party: i. full name, including any aliases; and ii. Unique Identification Number (such as an Identity card number, passport number, etc.).

6.3.3 Verification of identity

A Regulated Entity shall verify the identity of the customer using reliable, independent source data, documents or information. For a legal person it shall verify the legal form, proof of existence, constitution and powers that regulate and bind the customer.

Which documents are best: the most reliable documents to verify the identity of the customer are those which are most difficult to obtain illegally or to counterfeit. These may include government-issued identity cards or current valid passport, reports from independent company registries, published or audited annual reports and other reliable sources of information.

And the effort is calibrated: the rigor of the verification process should be commensurate with the customer's risk profile.

Natural persons. Two things are checked — identity from an OVD with a photograph, and the home address. The exact words: any of the OVD specified under these Guidelines that contains photograph of the customer, name, unique identification number, date of birth and nationality; and residential address based on OVD or recent utility bill, bank statement or such other documents specified under the definition of OVD.

Legal persons. Two things are checked here too.

Name, legal form, proof of existence and constitution, from certificate of incorporation, certificate of good standing, partnership deed/agreement, trust deed, constitutional document, certificate of registration or any other document from a reliable independent source.
Powers, from the constitutional documents, as well as the names of the relevant persons having a Senior Management position... and board resolution or similar document authorising the opening of an account and appointment of its authorised signatories.

6.3.3.3 V-CIP

V-CIP is identification by live video. The full definition:

"Video based Customer Identification Process" or "V-CIP" means an alternate method of customer identification with facial recognition and customer due diligence, by an authorised official of the Regulated Entity, by undertaking seamless, secure, live, informed & consent based audio-visual interaction with the customer to obtain identification information required for Customer Due Diligence purpose, and to ascertain the veracity of the information furnished by the customer through independent verification and maintaining audit trail of the process.

Its status: such processes complying with prescribed standards and procedures shall be treated on par with face-to-face customer identification procedure.

What it may be used for:

(a) CDD in case of new customer on-boarding for individual customers, proprietor in case of proprietorship firm, authorised signatories and Beneficial Owners (BOs) in case of customers which are non-natural persons.
(b) Updation/Periodic updation of KYC for eligible customers.

In plain words, V-CIP is a live video call in which an official sees the customer, checks his identity and records the process. Done to standard, it counts the same as meeting in person.

Note the heading — V-CIP Process for Onboarding Indian Nationals.

6.3.3.4 Digital KYC for Indian nationals

Digital KYC for Indian nationals needs three kinds of document. They are collected when an account-based relationship starts. They are also collected from an Indian national who is a beneficial owner, authorised signatory or power of attorney holder of a legal entity. The exact words: for undertaking CDD of Indian nationals, the entity shall obtain while establishing an account-based relationship or while dealing with the individual who is a beneficial owner, authorised signatory or the power of attorney holder related to any legal entity:

	Document
(a) Identity and address	the Aadhaar number where the customer decides to submit his Aadhaar number voluntarily; or the proof of possession of Aadhaar number where offline verification can be carried out; or the proof of possession of Aadhaar number where offline verification cannot be carried out or any OVD or the equivalent e-document thereof containing the details of the customer's identity and address; and
(b) PAN	the Permanent Account Number or the equivalent e-document thereof, as defined in Income-tax Rules, 1962; and
(c) Business and finances	such other documents including in respect of the nature of business and financial status of the customer.

And the IFSC definition of an e-document adds a phrase: an electronic equivalent of a document, issued by the issuing authority of such document with its valid Digital Signature, including documents issued to the digital locker account of the customer... or its equivalent in other jurisdictions, as may be recognised by the Authority.

"Or its equivalent in other jurisdictions" — the IFSC version recognises foreign equivalents.

6.3.4 Persons acting on behalf of a customer

The Regulated Entity shall identify each natural person who acts or is appointed to act on behalf of such natural or legal person or legal arrangement by obtaining the same identification information as for a customer. In case of a trust, the Regulated Entity shall ensure that trustees disclose their status at the time of commencement of a business relationship.

Verification of authority: the appropriate documentary evidence authorising the appointment of such natural person by the customer to act on his or its behalf which may include power of attorney, resolution passed by Governing Body or authorisation granted to transact on its behalf.

And a practical concession: where there is a long list of natural persons appointed to act on behalf of the customer (e.g., a list comprising more than 10 authorized signatories), the Regulated Entity shall verify those natural persons who will deal directly with the Regulated Entity.

6.3.5 Beneficial owners

Where there is one or more Beneficial Owners in relation to a customer, the Regulated Entity shall identify the Beneficial Owners and take reasonable measures to verify their identities using the relevant information or data obtained from reliable, independent sources.

Legal persons: the identity of the natural person(s) (whether acting alone or together) exercising control over the legal person through ownership or who ultimately owns the legal person; and to the extent that there is doubt... or where no natural persons ultimately own the legal person, identify the natural person(s) (if any) who ultimately control the legal person or have ultimate effective control.

Legal arrangements: for a trust, identification of the author of the trust, the trustee, the beneficiaries with fifteen per cent. or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership. In all other types of legal arrangements, the Regulated Entity shall identify persons in equivalent or similar positions.

6.3.6 The parameters

Company: the natural person(s), who... has/have a controlling ownership interest or who exercise control through other means. "Controlling ownership interest" means ownership of or entitlement to more than ten per cent. of the shares or capital or profits of the company; "Control" shall include the right to appoint majority of the directors or to control the management or policy decisions including by virtue of their shareholding or management rights or shareholders agreements or voting agreements.

Partnership firm: more than ten per cent of capital or profits of the partnership or who exercises control through other means, control meaning the right to control the management or policy decision.

Unincorporated association or body of individuals: more than fifteen per cent. of the property or capital or profits. And a footnote: the term 'body of individuals' includes societies. Where no natural person is identified under (a) to (c) above, the beneficial owner is the relevant natural person who holds the position of senior managing official.

Trust: identification of the author of the trust, the trustee, the beneficiaries with ten per cent or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership.

A discrepancy worth noting. The workbook states both figures. Clause 6.3.5(b)(i) gives the trust beneficiary threshold as fifteen per cent. or more. Clause 6.3.6(d) — the parameters clause, which matches rule 9(3)(e) of the PML Rules — gives ten per cent or more. Follow the ten per cent figure, which is the one in the Rules and in the parameters clause, unless a question reproduces the other wording.

The listed-entity exemption. A listed company already discloses its owners, so its shareholders need not be traced. But doubt or suspicion cancels the exemption. The exact words: unless the Regulated Entity has doubts about the veracity of the CDD information, or suspects that customer may be connected with ML/TF, it shall not be required to identify and verify the identity of any shareholder or beneficial owner where the client or the owner of the controlling interest is an entity listed on the stock exchange in India, or it is an entity resident in jurisdictions notified by the Central Government and listed on stock exchanges in such jurisdictions... or it is a subsidiary of such listed entities.

Note the condition at the front — doubts or suspicion switch the exemption off.

And the notified-jurisdiction rule for depository receipts or equity shares: the determination, identification and verification of such beneficial owner, shall be as per the norms of such jurisdiction.

6.3.7 Beneficiaries of a life insurance policy

For life or other investment-related insurance business, Regulated Entity shall, in addition to the CDD measures required for the customer and the beneficial owner, conduct the following CDD measures on the beneficiary(ies)... as soon as the beneficiary(ies) are identified/designated:

Beneficiary	Measure
(i) Named	for a specifically named natural person, legal person or legal arrangement, obtain the full name, including any aliases, of such beneficiary;
(ii) By class	for beneficiaries designated by characteristics or by class (e.g., spouse or children at the time that the insured event occurs) or by other means (e.g., under a will), obtain sufficient information concerning the beneficiary(ies) to satisfy itself that it will be able to establish the identity of the beneficiary(ies) at the time of the payout.
(iii) PEP check	take reasonable measures to determine whether the beneficiaries and/or, where required, the beneficial owner of the beneficiary, are PEPs. This should occur, at the latest, at the time of the payout. Where higher risks are identified, financial institutions should be required to inform Senior Management before the payout of the policy proceeds, to conduct enhanced scrutiny on the whole business relationship with the policyholder, and to consider making a Suspicious Transaction Report.

The PEP check on a beneficiary can wait, but not past the payout.

6.3.8 Purpose and intended nature

A Regulated Entity shall, while establishing business relationship, understand and as appropriate, obtain information from the customer as to the purpose and intended nature of business relations, and the measures taken... should be commensurate with the risk profile and complexity of the customer's business.

6.4 Politically Exposed Persons

The entity must have systems that can tell whether a PEP is involved anywhere in the relationship. The exact words: A Regulated Entity shall implement appropriate internal risk management systems, policies and procedures to determine if a customer or any natural person appointed to act on behalf of the customer, or any beneficial owner of the customer is a politically exposed person (PEP) or in case of a life insurance or other similar policy, if a beneficiary of the policy, or a Beneficial Owner of a beneficiary, is a PEP.

Four possible PEP positions — the customer, his authorised person, his beneficial owner, and an insurance beneficiary or that beneficiary's beneficial owner.

Six additional measures:

	Measure
i.	Collect by appropriate and reasonable means, adequate information including information about the source of wealth and income of family members, any beneficial owner and close relatives;
ii.	Verify the identity before accepting the PEP as a customer;
iii.	Obtain approval from its Senior Management before opening an account of a PEP or making any payout under the life insurance or other similar policy to the PEP;
iv.	In the event of an existing customer or the beneficial owner of an existing account subsequently becoming a PEP, obtain the Senior Management's approval to continue the business relationship;
v.	Increase the degree and nature of ongoing monitoring of the business relationship, to determine whether the customer's transactions or activities appear unusual or suspicious.
vi.	Carry out the additional Customer Due Diligence for circumstances specified in sub-clauses (i) to (v) above, before making any payout under the life insurance or other similar policy.

Note measure (iv) — a customer who becomes a PEP after onboarding needs fresh Senior Management approval to continue.

And a risk-based approach applies to the extended categories:

i. PEP, their family members and close associates;
ii. International Organisation PEP, their family members, and close associates;
iii. PEP who has stepped down from their prominent public functions, taking into consideration the level of influence such persons may continue to exercise after stepping down, their family members and close associates, except in cases where their business relations or transactions with the Regulated Entity present a high risk for ML/TF.

A former PEP does not automatically cease to matter. Influence may survive office.

6.5 Enhanced Due Diligence

Where the risks of ML/TF are high, a Regulated Entity shall conduct enhanced CDD measures, consistent with the risks identified. The enhanced CDD measures are as follows:

	Enhanced measure
i.	Obtaining additional information on the customer (e.g., occupation, volume of assets, information available through public databases, internet, etc.), and updating more regularly the identification data of customer and beneficial owner.
ii.	Obtaining information and taking additional steps to examine the ownership and financial position, including source of wealth and source of funds of the customer or, if applicable, of the Beneficial Owner.
iii.	Obtaining information and taking additional steps to record the purpose behind conducting the specified transaction and the intended nature of the relationship between the transaction parties.
iv.	Obtaining the approval of Senior Management to commence or continue the business relationship.
v.	Conducting enhanced monitoring of the business relationship, by increasing the number and timing of controls applied, and selecting patterns of transactions that need further examination; and,
vi.	Requiring the first payment to be carried out through an account in the customer's name with a bank subject to similar CDD standards.

In plain words: know more, dig into where the money came from, get senior approval, watch more closely, and make the first payment come from the customer's own bank account.

Measure (iv) is the answer to Chapter 5's fourth sample question — Senior Management approval to commence or continue is an Enhanced Due Diligence measure.

The first-payment rule in detail. Where applicable, the first payment made by a customer in order to open an account with a Regulated Entity shall be carried out through a bank account in the customer's name with:

i. a Bank;
ii. a regulated financial institution whose entire operations are subject to regulation and supervision, including AML/CFT regulation and supervision, in a jurisdiction where its regulations on AML/CFT are equivalent to the standards set out in the FATF recommendations; or
iii. a subsidiary of a regulated financial institution referred to in (ii), if the law that applies to the Parent entity ensures that the subsidiary also observes the same AML/CFT standards as its Parent entity.

And FATF-called-for countries: the Regulated Entities shall specifically apply enhanced due diligence measures, proportionate to the risks, to business relationships and transactions with natural and legal persons (including financial institutions) from countries for which this is called for by the FATF.

The third sample question offers PEPs, high ML/TF risk and stepped-down PEPs, and answers All of the above.

6.6 Simplified Customer Due Diligence

Where the risks of ML/TF are low, a Regulated Entity may conduct simplified CDD measures, which should be commensurate with the low risk factors. Examples of possible measures are:

	Simplified measure
i.	Verifying the identity of the customer and the beneficial owner after the establishment of the business relationship
ii.	Reducing the frequency of customer identification updates.
iii.	Reducing the degree of on-going monitoring and scrutinizing transactions, based on a reasonable monetary threshold.
iv.	Not collecting specific information or carrying out specific measures to understand the purpose and intended nature of the business relationship but inferring the purpose and nature from the type of transactions or business relationship established.

Note the word "may" — simplified CDD is permitted, not required.

And the hard limit: Simplified CDD (SCDD) measures shall not be conducted where there is a suspicion of ML/TF.

6.7 Ongoing customer due diligence

	Duty
i.	The Regulated Entity shall monitor its business relations with the customer on an ongoing basis.
ii.	it shall observe the conduct of the customer's account and scrutinize transactions undertaken throughout the course of business relations, to ensure that the transactions are consistent with Regulated Entity's knowledge of the customer, its business and risk profile and where appropriate, may seek the source of wealth and source of funds.
iii.	it shall pay particular attention to any complex, unusually large or unusual patterns of transactions undertaken throughout the course of business relations, that have no apparent or visible economic or legitimate purpose.
iv.	it shall make further enquiries into the background and purpose of the transaction specified in sub-clause (iii) above and document its findings so that this information is made available to the relevant authorities, should the need arise.
v.	it shall periodically review each customer to ensure that the risk rating assigned... is commensurate with the ML/TF risks posed by the customer.
vi.	where there are indications that the risks associated with an existing business relation with the customer may have increased, the Regulated Entity shall request additional information and conduct a review of the customer's risk profile.
vii.	it shall ensure that CDD data in respect of customers, natural persons appointed to act on behalf of the customers, related parties of the customers and beneficial owners of the customers, are relevant and kept up-to-date... particularly for customers with high-risk rating.

In short: keep watching. If a transaction looks odd, ask why and write down the answer. If the risk seems to have grown, review the customer.

6.8 Ongoing sanctions screening

A Regulated Entity shall review its customers, their business and transactions against United Nations Security Council sanctions lists and also against any other relevant sanctions list.

Screening is continuous, not a one-time onboarding check. A customer who was clean at onboarding may be listed later.

6.9 Failure to complete CDD

In cases where a Regulated Entity is unable to conduct or complete the requisite Customer Due Diligence for a customer... it, to the extent relevant, shall:

	Action
i.	not open an account or otherwise provide a service;
ii.	not carry out a transaction with or for the customer;
iii.	not otherwise establish a business relationship;
iv.	terminate or suspend any existing business relationship with the customer;
v.	return any monies or assets received from the customer; and,
vi.	consider whether the failure to conduct or complete Customer Due Diligence necessitates the filing of a Suspicious Transaction Report (STR).

Note item (vi). Failure to complete CDD is itself a reason to consider an STR.

A protection for persons with disabilities: no application for onboarding or periodic updation of KYC shall be rejected, in case of Persons with Disabilities (PwDs), without application of mind. Reason(s) of rejection shall be duly recorded by the officer concerned.

And an exception: a Regulated Entity is not bound to comply with sub-clauses (a) (i) to (v) above, if it amounts to "tipping off" of the customer, or FIU-IND directs the Regulated Entity to act otherwise.

So the anti-tipping-off principle can override the duty to refuse or terminate. Abrupt termination may itself alert the customer.

6.10 Periodic updation

A Regulated Entity shall adopt a risk-based approach for periodic updation of CDD. The periodicity of updation from the date of opening of the account / last CDD updation for different categories of customers is as follows:

i. Annually- for high-risk customers;
ii. once in three years- for medium risk customer; and,
iii. once in every five years- for low-risk customers.

One, three, five.

But a different cycle applies to one category: the periodicity of such updation in case of resident Indian customer having an existing client relationship with the Financial Group in India, shall be as follows:

Rating	Periodicity
(a) High risk	once in every two years - for high-risk customers
(b) Medium risk	once in every eight years - for medium risk customers
(c) Low risk	once in every ten years - for low-risk customers

Two, eight, ten — for a resident Indian customer already known to the Financial Group in India.

And where the group disagrees: where the risk categorization made by the Financial Group entity differs from the risk categorization made by the Regulated Entity, the stricter of the two periodicity shall apply.

The stricter always wins.

Policy in this regard shall be documented as part of Regulated Entity's internal KYC policy, which is duly approved by the Governing Body of the Regulated Entity.

Individual customers

No change in CDD information: a self-declaration from the customer in this regard may be obtained through mobile number registered with the Regulated Entity or through digital channels (such as online banking / internet banking, e-mail or mobile application of Regulated Entity).

Change in address: a self-declaration of the new address may be obtained through the registered email, registered mobile or digital channels, and the declared address shall be verified through positive confirmation within two months, by means such as address verification letter, contact point verification, deliverables etc.

Two months for positive confirmation.

Further, a Regulated Entity shall obtain a copy of OVD or the equivalent e-documents thereof for the purpose of proof of address declared by the customer at the time of periodic updation. Such requirement, however, shall be clearly specified by the Regulated Entity in its internal KYC policy, duly approved by its Governing Body.

Customers other than natural persons

No change: a self-declaration through email id registered with the Regulated Entity, digital channels..., a letter duly signed by authorised official and requisite resolutions in this regard shall be obtained from the customer. Further, a Regulated Entity shall ensure that Beneficial Ownership (BO) information available with them is accurate and up to-date.

Change in CDD information: Regulated Entity shall undertake fresh CDD process as is applicable for on boarding a new customer which is a non-natural person.

Additional measures

	Measure
i.	documents must meet current CDD standards — this is applicable even if there is no change in customer information but the documents available with the Regulated Entity are not as per the current CDD standards, and where their validity... has expired at the time of periodic updation, a fresh CDD process equivalent to that applicable for on boarding a new customer is required.
ii.	for an Indian National, the PAN details, if available... is verified from the database of the issuing authority at the time of periodic updation.
iii.	acknowledgment is provided to the customer mentioning the date of receipt of the relevant document(s), and afterwards an intimation, mentioning the date of updation of CDD details, is provided to the customer.
iv.	the entity may consider making available the facility of periodic updation of CDD at any of its branch, per its internal KYC policy.
v.	any additional and exceptional measures — such as requirement of obtaining recent photograph, requirement of physical presence of the customer... a more frequent periodicity of CDD updation than the minimum specified periodicity — shall be clearly specified in its approved internal KYC policy.
vi.	its internal KYC policy and processes on updation / periodic updation of CDD are transparent and adverse actions against the customers should be avoided, unless warranted by specific regulatory requirements.
vii.	where documents are updated, customers shall submit to the Regulated Entity the update of such documents... within 30 days of the update.

And the closing thought: with effective implementation of IFSCA guidelines for KYC norms in International Financial Service Centres by Regulated Entities, IFSCA's crucial role in maintaining market integrity, investor confidence, and the orderly functioning of India's International Financial Markets can be duly and efficiently achieved.

6.11 IFSCA compared with other Indian regulators

IFSCA Guidelines	Other Indian Regulators
IFSCA guidelines are tailored to the unique global nature of IFSC operations	The fundamental goals of Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) are shared across all Indian regulators (like RBI, SEBI, IRDAI, PFRDA)
IFSCA acts as a single point of regulation for diverse financial activities within IFSC	Other Indian regulators focus on specific sectors like banking, securities, insurance, or pensions
Given the international focus of IFSCA, its AML/CFT guidelines align closely with the recommendations of the Financial Action Task Force (FATF), the global standard-setter for combating illicit financial flows	The AML/CFT guidelines of Indian Regulators are more aligned with Indian Financial Environment
IFSC entities primarily deal with international clients and cross-border transactions, requiring a strong emphasis on global KYC, CDD, and sanctions screening procedures aligned with international practices	The Indian Regulators primarily deal with domestic clients, requiring a strong alignment with Indian laws, rules and regulations
IFSCA aims to provide a world-class regulatory environment with ease of doing business, which may lead to streamlined KYC procedures potentially differing from those for domestic entities	The KYC/CDD process being followed by other Indian Regulators have been carved out in such a manner so as to suit the Indian business requirements

The fourth sample question asks which statement is true of the IFSCA guidelines — tailored to the unique global nature of IFSC operations. The three distractors all describe the other regulators' column.

Think of it like this

Thirty days to suspend, one hundred and twenty to terminate

A shop may let a trusted customer take goods before the paperwork is finished — but not indefinitely. The Guidelines set two hard dates.

A Regulated Entity may establish a business relationship with a customer before completing the verification... subject to fulfilling the following conditions.

Four conditions, all required. The deferral must be essential in order not to interrupt the normal conduct of a business relationship; there is low risk of occurrence of ML/TF activity and any such risks identified can be effectively managed; for a bank account, adequate safeguards must ensure that the account is not closed, and transactions are not carried out by or on behalf of the account holder (including any payment from the account to the account holder) before verification has been completed; and verification must be completed as soon as reasonably practicable and, in any event, it should not exceed 30 business days after the establishment of business relationship.

Note that condition (ii) restricts this to low-risk cases — deferral is not available for a high-risk customer.

If the deadline will be missed, the entity must act prior to the end of the 30-day period: document the reason for its non-compliance; complete the verification as soon as possible; and record the non-compliance event for reporting to its Governing Body.

Then the two consequences.

At 30 days: suspension. The Regulated Entity shall suspend business relationship with the customer and refrain from carrying out further transactions (except to return funds to their sources, to the extent that is possible) if such verification remains uncompleted for 30 days after the establishment of business relationship.

Note the exception — returning funds to their sources is permitted, because leaving money in a suspended relationship helps nobody.

At 120 days: termination. The Regulated Entity shall terminate business relations with the customer if such verification remains uncompleted for 120 days after the establishment of business relationship.

And the policy must anticipate all of it: the AML/CFT systems and controls must include internal risk management policies and procedures concerning the conditions under which such business relationships may be established with a customer before completing verification and should also factor the above time limitation.

The PML Rules permit the same deferral more briefly — the Regulator may allow verification as soon as reasonably practicable following the establishment of the relationship where risks are effectively managed and interruption would be avoided. The IFSCA Guidelines put dates on it.

Two periodic updation cycles, and the stricter one wins

A car needs servicing more often the harder it is driven. KYC updation works the same way — and there are two schedules.

The general cycle: i. Annually- for high-risk customers; ii. once in three years- for medium risk customer; and, iii. once in every five years- for low-risk customers.

One, three, five — measured from the date of opening of the account / last CDD updation.

The special cycle applies to resident Indian customer having an existing client relationship with the Financial Group in India: (a) once in every two years - for high-risk customers, (b) once in every eight years - for medium risk customers and (c) once in every ten years - for low-risk customers.

Two, eight, ten. The relaxation exists because the group already knows the customer in India.

And where the two parts of the group disagree about risk: where the risk categorization made by the Financial Group entity differs from the risk categorization made by the Regulated Entity, the stricter of the two periodicity shall apply.

The stricter always wins — a useful principle to carry into any question that sets up a conflict.

What updation requires depends on what has changed. For an individual with no change in CDD information, a self-declaration from the customer... may be obtained through mobile number registered with the Regulated Entity or through digital channels. For a change in address, a self-declaration through registered channels, with the declared address... verified through positive confirmation within two months, by means such as address verification letter, contact point verification, deliverables etc.

For a non-natural person with no change, a self-declaration by registered email or digital channel, a letter duly signed by authorised official and requisite resolutions; and the entity shall ensure that Beneficial Ownership (BO) information available with them is accurate and up to-date.

With a change, the whole process starts again: Regulated Entity shall undertake fresh CDD process as is applicable for on boarding a new customer which is a non-natural person.

And even without change, stale documents force a fresh CDD — the requirement applies even if there is no change in customer information but the documents available with the Regulated Entity are not as per the current CDD standards.

**The whole policy must be duly approved by the Governing Body of the Regulated Entity.

The three doors that must stay shut

Most KYC rules ask how much diligence is enough. Three situations ask nothing — the answer is simply no.

The Regulated Entity shall not establish the business relationship with the customer, which is a legal person or legal arrangement, in the following cases:

(a) where the ownership or control arrangements of the customer prevent the Regulated Entity from identifying one or more of the customer's Beneficial Owners;

(b) where there are anonymous accounts, accounts in fictitious names, or a nominee account which is held in the name of one person, but is controlled by or held for the benefit of another person whose identity has not been disclosed to the Regulated Entity; or

(c) a Shell Financial Institution.

The second sample question tests limb (a), and the answer is TRUE.

Note what limb (a) really says. It is not that the beneficial owner is hard to find, but that the structure itself prevents identification. Where the search is merely difficult, the fallback in the parameters applies: where no natural person is identified under (a) to (c) above, the beneficial owner is the relevant natural person who holds the position of senior managing official.

Limb (b) mirrors rule 9(11) of the PML Rules — no reporting entity shall allow the opening of or keep any anonymous account or account in fictitious names or account on behalf of other persons whose identity has not been disclosed or cannot be verified — and adds the undisclosed nominee arrangement expressly.

Limb (c) matches the correspondent banking prohibition in Chapter 5: correspondent relationship shall not be entered into with a bank which is a Shell Financial Institution.

A related but different rule governs failure of CDD. Where an entity is unable to conduct or complete the requisite Customer Due Diligence, it shall not open an account or otherwise provide a service, not carry out a transaction, not otherwise establish a business relationship, terminate or suspend any existing business relationship, return any monies or assets received from the customer, and consider whether the failure... necessitates the filing of a Suspicious Transaction Report (STR).

With one important qualification: the entity is not bound to comply with sub-clauses (a) (i) to (v) above, if it amounts to "tipping off" of the customer, or FIU-IND directs the Regulated Entity to act otherwise.

So abrupt refusal can itself be the wrong answer where it would alert the customer to an investigation.

And a fairness safeguard applies throughout: no application for onboarding or periodic updation of KYC shall be rejected, in case of Persons with Disabilities (PwDs), without application of mind. Reason(s) of rejection shall be duly recorded by the officer concerned.

Why the IFSC rulebook looks outward

A domestic bank in Pune and a fund manager in GIFT City face the same crime but a different customer base. The Guidelines say so directly.

IFSCA guidelines are tailored to the unique global nature of IFSC operations — while the fundamental goals of Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) are shared across all Indian regulators (like RBI, SEBI, IRDAI, PFRDA).

The fourth sample question asks which statement is true of the IFSCA guidelines, and this is it. The three distractors — more aligned with Indian Financial Environment, carved out... so as to suit the Indian business requirements, and deal with domestic clients — all belong to the other regulators' column.

Single regulator versus sectoral ones: IFSCA acts as a single point of regulation for diverse financial activities within IFSC, whereas other Indian regulators focus on specific sectors like banking, securities, insurance, or pensions. Chapter 1 explains why — the regulatory powers of four financial services regulators in India... have been vested in IFSCA.

International standard-setting: given the international focus of IFSCA, its AML/CFT guidelines align closely with the recommendations of the Financial Action Task Force (FATF), the global standard-setter for combating illicit financial flows.

Which is why FATF appears throughout this chapter — high-risk countries as identified by the FATF; low-risk customers including a regulated financial institution incorporated or established outside India that is subject to and supervised for compliance with AML/CFT requirements consistent with standards set by the FATF; the first-payment rule naming a jurisdiction where its regulations on AML/CFT are equivalent to the standards set out in the FATF recommendations; and the direction to apply enhanced measures to business relationships and transactions with natural and legal persons (including financial institutions) from countries for which this is called for by the FATF.

The client base explains the emphasis: IFSC entities primarily deal with international clients and cross-border transactions, requiring a strong emphasis on global KYC, CDD, and sanctions screening procedures aligned with international practices, while the Indian Regulators primarily deal with domestic clients.

And ease of doing business is an express aim: IFSCA aims to provide a world-class regulatory environment with ease of doing business, which may lead to streamlined KYC procedures potentially differing from those for domestic entities.

That is the balance Chapter 1 described — committed to ensuring financial stability and protection of the interests of investors. At the same time, it allows enough space for financial innovations with adequate risk management measures in place.

Key terms in this chapter

Beneficial owner parameters: A company or partnership firm — a natural person with more than ten per cent of shares, capital or profits, or who exercises control through other means; an unincorporated association or body of individuals, including societies — more than fifteen per cent; a trust — the author, trustee, beneficiaries with ten per cent or more interest, and anyone with ultimate effective control. Where none is identified, the senior managing official.
Cases where no business relationship may be established: Where the ownership or control arrangements prevent identification of one or more beneficial owners; where there are anonymous accounts, fictitious-name accounts, or a nominee account held for an undisclosed person; or where the customer is a shell financial institution.
Customer risk assessment: A risk-based assessment of every customer, completed before customer due diligence for new customers, using risks identified in the business risk assessment, and producing a rating of high, medium or low proportionate to the ML/TF risks. The rating and its reasons must be kept confidential from the customer to avoid tipping off.
Deferred verification: Establishing a relationship before verification is complete — permitted only where deferral is essential to avoid interrupting normal business, risk of ML/TF is low and manageable, bank-account safeguards exist, and verification does not exceed 30 business days. Suspension follows at 30 days and termination at 120 days.
Enhanced Due Diligence: Applied where ML/TF risks are high, in addition to ordinary CDD — additional customer information and more regular updating; examination of ownership, financial position, source of wealth and source of funds; recording the purpose of the transaction; Senior Management approval to commence or continue; enhanced monitoring; and requiring the first payment through an account in the customer's name at a bank subject to similar CDD standards.
Failure to complete CDD: The entity must not open an account, carry out a transaction or establish a relationship; must terminate or suspend an existing relationship; must return monies or assets received; and must consider whether the failure necessitates an STR — unless doing so would amount to tipping off, or FIU-IND directs otherwise.
Financial Group: A group consisting of a parent company or other legal person exercising control and coordinating functions over the rest of the group, together with branches and subsidiaries subject to AML/CFT policies and procedures at group level.
High-risk customer indicators: High-risk businesses or sectors; unusual or excessively complex ownership structures; relations conducted under unusual circumstances such as unexplained geographic distance; nominee shareholders or bearer shares; personal asset holding vehicles; and corporate structures unusual for the nature of the business.
Identification of a legal person: At least full name and any trading name, unique identification number such as a tax or incorporation number, registered or business address and principal place of business if different, date of establishment or incorporation, and place of incorporation — plus the legal form, constitution and powers binding it, and identification and screening of connected parties.
Identification of a natural person: At least full name including aliases, unique identification number, date of birth, nationality, legal domicile, current residential address other than a post office box, and contact telephone details.
Life insurance beneficiary CDD: For a specifically named beneficiary, obtain the full name including aliases as soon as designated; for beneficiaries designated by class or characteristics, obtain enough information to establish identity at payout; and take reasonable measures to determine whether beneficiaries or their beneficial owners are PEPs, at the latest at payout — informing Senior Management before payout where higher risks are identified.
Listed-entity exemption: A regulated entity need not identify or verify shareholders or beneficial owners where the customer or the owner of the controlling interest is listed in India or in a notified jurisdiction, or is a subsidiary of such an entity — unless it has doubts about the veracity of the CDD information or suspects a connection with ML/TF.
Low-risk customer indicators: Government entities; listed public companies subject to beneficial ownership transparency requirements; regulated financial institutions outside India supervised consistently with FATF standards; subsidiaries of such institutions where the parent's law ensures the same standards; public bodies or publicly owned enterprises; and residents of low-risk geographical areas.
PEP measures: Six additional measures — collecting information on source of wealth and income of family members, beneficial owners and close relatives; verifying identity before acceptance; Senior Management approval before opening an account or making an insurance payout; Senior Management approval to continue where an existing customer becomes a PEP; increased ongoing monitoring; and completing the additional CDD before any insurance payout.
Periodic updation cycles: Generally annually for high-risk, once in three years for medium and once in five years for low-risk customers. For a resident Indian customer with an existing Financial Group relationship in India: two, eight and ten years respectively. Where the Financial Group's risk categorisation differs, the stricter periodicity applies.
Simplified Customer Due Diligence: Permitted where risks are low — verifying identity after the relationship is established, reducing the frequency of identification updates, reducing ongoing monitoring based on a reasonable monetary threshold, and inferring purpose and nature from the type of transactions. It shall not be conducted where there is a suspicion of ML/TF.
The four CDD measures: Identifying and verifying the customer using reliable independent sources; identifying the beneficial owner and taking reasonable measures to verify identity, understanding ownership and control structure for legal persons; understanding and obtaining information on the purpose and intended nature of the relationship; and conducting ongoing due diligence and scrutiny of transactions, including source of funds where necessary.
V-CIP: Video based Customer Identification Process — an alternate method of customer identification with facial recognition and due diligence by an authorised official through seamless, secure, live, informed and consent-based audio-visual interaction, with independent verification and an audit trail. It is treated on par with face-to-face identification.

Check you have understood it

The L1 test for this chapter has 6 questions. Score 60% to unlock L2 Application (worked numericals and scenarios) and then L3 Exam-Ready (NISM-style traps, timed, with this paper's real marking). Tests, the higher levels and full mock exams need a free account so we can track your progress.

Create a free account

Original explanatory writing based on the official NISM workbook for Series IFSCA-01, which is published and copyrighted by NISM. Check figures against the current edition at nism.ac.in.

Something look wrong? Report it