Discussion on PMLA related Cases

What this chapter covers

Chapter 7 carries 4 marks out of 50 — 8% of the paper.

Learning Objective: After studying this chapter, you should know about: Practical implementation and coverage of PMLA through case studies.

This Chapter covers different cases based on FIU-IND and IFSCA Adjudicating Orders in the scope of Prevention of Money Laundering Act (PMLA).

Five cases — three from FIU-IND and two from IFSCA. Together they show the two enforcement tracks: FIU-IND acting under section 13 of the PMLA, and IFSCA acting under its own Act and regulations.

7.1 FIU-IND v. Bybit Fintech Limited

A Virtual Digital Asset Service Provider penalised for operating in India without registering at all.

The facts

The Financial Intelligence Unit-India (FIU-IND) in furtherance of the powers conferred upon the Director FIU-IND under Section 13(2)(d) of the Prevention of Money Laundering Act, 2002 (as amended) ("PMLA") has imposed a monetary penalty of Total ₹9,27,00,000 (Nine crore twenty-seven lakh rupees) on Bybit Fintech Limited (Bybit) a Virtual Digital Asset Service Provider (VDA SP) with reference to the violations of its obligations under the PMLA read with the Prevention of Money Laundering (Maintenance of Records) Rules, 2005 ("PML Rules") issued thereunder and applicable guidelines and advisories issued by the Director FIU-IND.

Rs. 9.27 crore — the largest penalty in the chapter.

The findings

As a Virtual Digital Asset Service Provider (VDA SP), Bybit is classified as a 'reporting entity' under Section 2(1)(wa) of the Prevention of Money Laundering Act (PMLA).

The fourth sample question tests exactly this — a VDA SP is a reporting entity.

Recall the definition from Chapter 2: "reporting entity" means a banking company, financial institution, intermediary or a person carrying on a designated business or profession. A virtual digital asset service provider enters through the open sub-clause — person carrying on such other activities as the Central Government may, by notification, so designate, from time-to time.

What went wrong: Bybit kept expanding its services in the Indian market without securing mandatory registration with the FIU-IND. The persistent and continuous non-compliance caused FIU-IND to block their websites to stop operations under the Information Technology Act, 2000 through the Ministry of Electronics and Communication Technology (MEITY).

Two consequences — a penalty and a website block, the latter through a different statute and a different ministry.

And Bybit could not claim ignorance: FIU-IND had previously issued comprehensive Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) Guidelines for Reporting Entities offering Services related to Virtual Digital Assets on March 10, 2023. Furthermore, a detailed circular regarding the registration of Virtual Digital Asset Service Providers as reporting entities was issued on October 17, 2023.

Two dates: guidelines on 10 March 2023, the registration circular on 17 October 2023.

The order

In an order dated January 31st, 2025, and exercising authority under Section 13 of the PMLA, it was unequivocally established that Bybit was in violation of Section 12(1) of the PMLA read with Rule 2(1)(h), Rule 7(2), Rule 8(2) Rule 8(4), Rule 3(1)(D) and Rule 7(3) of PMLR, 2005. Consequently, a total penalty of Rs. 9,27,00,000 was imposed on Bybit.

The rules cited map onto what we have already studied. Rule 3(1)(D) is the suspicious transaction limb; Rule 7(2) is the Principal Officer's duty to furnish information; Rule 7(3) the internal mechanism for detecting reportable transactions; Rule 8(2) the seven-working-day STR deadline; Rule 8(4) the rule that delay of each day... shall constitute a separate violation.

The lesson for an IFSC entity is Chapter 1's: all regulated entities licensed with IFSCA are mandatorily required to register with the Financial Intelligence Unit of India (FIU-IND) by completing the enrolment on the FINGate 2.0 Portal, and non-registration with FIU-IND is treated as non-compliance with the IFSCA (AML, CFT, and KYC) Guidelines.

7.2 IFSCA v. Prowess Insurance Brokers Pvt. Ltd. (PIBPL)

An IFSC branch that carried on business after being told to stop.

The facts

M/s Prowess Insurance Brokers Pvt. Ltd ("PIBPL" or "Noticee") is registered with Insurance Regulatory and Development Authority of India ("IRDAI"), as 'Direct Broker (Life & General)'. IRDAI granted renewal of certificate of registration (CoR) to PIBPL which was valid from September 22, 2018, till September 21, 2021.

The IRDAI in terms of IRDAI (IFSC Insurance Intermediary Offices) Guidelines, 2019... had granted approval/authorization dated August 17, 2020 to PIBPL to open branch in GIFT IFSC and operate as IFSC Insurance Intermediary Office (IIIO).

The linkage that mattered: as per clause 11 of the said IRDAI guidelines, validity of approval/authorization granted to the IIIO by IRDAI was for a period co-terminus with the expiry of the original CoR issued by the IRDAI to PIBPL.

"Co-terminus" — the branch authorisation died with the parent registration, on September 21, 2021.

Then the regulator changed: the IFSCA notified IFSCA (Insurance Intermediary) Regulations, 2021... which superseded the IRDAI IIIO Guidelines, 2019. Under the IIIO Regulations, 2021, PIBPL was expected to seek and obtain renewal of its CoR beyond September 21, 2021 from IRDAI, and subsequently required to file an application with IFSCA for CoR for its Branch office at GIFT-IFSC.

Two steps required — renewal from IRDAI, then a fresh application to IFSCA. This is the transition Chapter 1 describes, where the regulatory powers of four financial services regulators in India... have been vested in IFSCA.

What happened: the Noticee/Branch office of PIBPL in GIFT IFSC had informed the IFSCA on January 6, 2022 that their application for renewal of registration is pending with IRDAI. Consequently, the IFSCA on January 12, 2022, in terms of Reg.9(3) of the IIIO Regulations, 2021 read with Reg.14(2) of IRDAI (Insurance Brokers) Regulations, 2018, had directed the Noticee... not to engage in any fresh insurance business until the renewal of CoR is granted, except for servicing the existing policyholders.

A narrow permission — service existing policyholders, write no new business.

And the breach: the Noticee/Branch office of PIBPL in GIFT IFSC failed to acknowledge receipt of IFSCA email dated January 12, 2022, and continued with its business operation in stark violation of the direction issued by the IFSCA. Therefore, the IFSCA on May 30, 2023 directed the Noticee... to submit certain information about their operations.

The finding and order

The main issue for consideration in the instant matter is that the Noticee has not followed the directions issued by IFSCA and has acted in contravention of the regulatory requirements laid down under the IFSCA (Insurance Intermediary) Regulations, 2021.

In exercise of the powers conferred under Section 12 and Section 13 of the IFSCA Act, 2019, and Regulation 30 of the IIIO Regulations, 2021 r/w Section 33(6)(b) of the Insurance Act, 1938, the validity of approval/authorization granted to PIBPL to operate "Branch office in GIFT IFSC" as IFSC Insurance Intermediary Office (IIIO) was cancelled.

And cancellation did not wipe the slate: irrespective of the cancellation of approval/authorization, the Noticee shall continue to be liable for anything done or omitted to be done as Insurance Intermediary and continue to be responsible for payment of outstanding fees and dues and interest, if any, due to the Authority. The Noticee shall ensure maintenance and preservation of records and other documents required to be maintained under the relevant regulations, if any.

Three things survive cancellation — liability, dues, and the duty to preserve records.

That last point connects to Chapter 5: records must be preserved for at least six years... from the date on which business relationship has ended or transaction is completed. Losing a licence does not end that obligation.

7.3 IFSCA v. NEO Asset Management Private Limited

An IFSC branch found empty on four surprise visits.

The facts

M/s NEO Asset Management Private Limited (IFSC Branch)... was provided registration as a Fund Management Entity, under Registered FME(Non-Retail) category, by the International Financial Services Centres Authority under IFSCA (Fund Management) Regulations, 2022 bearing registration number IFSCA/FME/II/2023-24/084 on November 22, 2023.

In the surprise visits conducted by IFSCA on July 31, 2024, and August 21, 2024, the IFSC Branch of the Noticee was found to have absence of Principal Officer and Key Management Personnel on both the occasions.

An advisory followed: the IFSC Branch of the Noticee was issued an Advisory Letter... by IFSCA vide letter dated September 12, 2024, informing about the status of their office during the first two MI or surprise visits.

What it required: the IFSC Branch of the Noticee was advised to comply with the provisions of the Fund Management Regulations and ensure that the office premises are open with physical presence of manpower including Principal Officer and Key Managerial Personnel who are mandated to be based out of IFSC, to effectively discharge its activities, at the earliest and in any case not later than four weeks from the date of the letter i.e., September 12, 2024.

Four weeks — and note the substantive requirement: the Principal Officer and KMP are mandated to be based out of IFSC. A registration in GIFT City requires people physically there.

The letter also carried a warning: the branch was advised to be cautious in future and ensure strict compliance with the provisions of the Fund Management Regulations, failing which same shall be subject to stringent actions.

And it was ignored: this said Advisory Letter was scanned and sent through an email dated September 12, 2024, to the Principal Officer and the Compliance Officer of IFSC Branch of the Noticee. The IFSC Branch of the Noticee was also advised to collect the physical copy of the Advisory Letter from IFSCA Head office at GIFT IFSC. The IFSC Branch of the Noticee neither collected the physical copy of abovementioned Advisory Letter from IFSCA nor acknowledged/replied to the IFSCA's email dated September 12, 2024.

Then two more visits: post completion of the four-week period on October 12, 2024, IFSCA conducted 3rd and 4th Surprise Visits to the IFSC Branch of the Noticee on October 17, 2024, and October 24, 2024, respectively. The IFSC Branch of the Noticee was again found to be without their manpower including Principal Officer and Key Managerial Personnel on both the above-mentioned visits.

Four visits, four empty offices.

Based on the aforementioned facts as well as findings of the visits, the Competent Authority approved initiation of action against the Noticee for non-compliance with the IFSCA (Fund Management) Regulations, 2022.

The order

The main issue for consideration in the instant matter is whether the IFSC Branch of the Noticee has not followed the directions issued by IFSCA and continued to act in contravention of the regulatory requirements.

In exercise of the powers conferred in terms of Regulation 143 of the IFSCA (Fund Management) Regulations, 2022 read with Sections 12 & 13 of the IFSCA Act, 2019 r/w Section 11B of the SEBI Act, dispose of the present proceedings with a Warning to the Noticee as well as the IFSC Branch of the Noticee, to be careful in future with regard to compliances under Regulation 7(4) and Regulation 10(1) of the IFSCA (Fund Management) Regulations, 2022.

A warning, not a penalty — but a conditional one: repetition of any of these violations shall be treated as a matter of serious concern and will result in initiation of stringent action as deemed appropriate under the provisions of IFSCA Act and applicable regulations etc.

Why an absent Principal Officer matters for AML. Chapter 5 requires that the entity ensure that the Principal Officer, as well as any other persons appointed to assist him, is suitably qualified and, has adequate resources and timely access to all customer records, and that he has the necessary seniority and authority. He is where internal suspicion reports go — an employee who knows; suspects; or has reasonable grounds for knowing or suspecting must promptly notif[y] the Principal Officer. An office without one has no functioning AML reporting line at all.

7.4 FIU-IND v. Way2Wealth Brokers Private Limited

A broker that raised no alert where it should have.

The context

As part of its supervisory functions under Prevention of Money Laundering Act (PMLA), Financial Intelligence Unit-India (FIU-IND) takes up cases where apparent or potential non-compliances of relevant obligations have been observed. They are carried out with a view towards identifying weaknesses in the safeguards implemented by 'reporting entities' and for conducting enforcement activity where non-compliances are found.

In relation to the securities market such actions are taken to ensure that all possible safeguards, as required by law, were effectively implemented by the reporting entities so as to ensure malicious actors do not take advantage of the capital flows therein. In this regard, FIU-IND works closely with various sectoral regulators including, the Securities and Exchange Board of India (SEBI).

The facts

Based on a reference from the SEBI highlighting alleged non-compliance with PMLA guidelines by Way2Wealth Brokers Private Limited, FIU-IND had taken up the case for further analysis in order to examine whether there was any non-compliance by the reporting entity with respect to the obligations under Chapter IV of PMLA.

Note how the case began — a reference from the sectoral regulator. Chapter 2 records that depending on the scheduled offence, agencies like IFSCA, SEBI, CBI, customs, and police may be involved for parallel investigation of predicate (scheduled) offences.

Two breaches were found:

its underlying transactions in December 2021. Failure of the reporting entity to properly raise, investigate alerts, handle the alerts and to file the same as a Suspicious Transaction Report (STR) with FIU-IND;

failure of the reporting entity to properly raise an alert and consider adverse orders of SEBI from the perspective of AML transactional monitoring and reporting obligations.

Four verbs in the first charge — raise, investigate, handle, file. The first sample question asks which activity should not be done by a reporting entity, and the answer is ignore an alert.

And the second charge is subtler. An adverse SEBI order against a client is information the firm already has; it must be fed into AML transactional monitoring and reporting obligations, not treated as a purely regulatory matter.

The order

In view of the facts and due to the deficiencies observed in the mechanism implemented by the reporting entity, it was found appropriate to issue monetary penalty of Rs. 1 Lac under section 13(2)(d) to Way2Wealth Brokers Private Limited along with detailed directions to the reporting entity under section 13(2)(a) and 13(2)(b).

Way2Wealth Brokers Private Limited was further required to return, within a period of 30 days, a certification under signature of its Designated Director and Principal Officer that the directed measures would be implemented within the periods prescribed.

Thirty days, and both officers must sign — the two officers of Chapter 2, the Designated Director who ensures overall compliance with the obligations imposed under chapter IV and the Principal Officer who is a central reference point in facilitating onward reporting of suspicious transactions.

7.5 FIU-IND v. Paytm Payments Bank Limited

A payments bank whose accounts carried the proceeds of online gambling.

The facts

Paytm Payments Bank Ltd. by virtue of operating as a payments bank, is a 'reporting entity' for the purposes of Section 2(1)(wa) and is registered as such with FIU-IND. A show-cause notice (SCN) numbered 9-55/2020/Compl/FIU-IND dated 14.02.2022, was issued to PayTM Payments Bank Ltd.

How it began: the inception of the current proceedings stems from the identification by law enforcement agencies of extensive illegal activity conducted by multiple businesses under the syndicate of individuals connected to a foreign state. The matter first came to light with the lodging of First Information Reports (FIRs) by the Cyber Crime Station of Hyderabad under relevant sections of the Indian Penal Code and the Telangana State Gambling Act in relation to the activities of certain business entities.

The FIRs state that these entities and their network of businesses engaged in a number of illegal acts, such as organizing and assisting online gambling, and that the money obtained from these illegal operations that were proceeds of such criminal activities were routed and channeled through bank accounts maintained by the same entities with the Bank.

There is the predicate offence and the proceeds of crime — the structure Chapter 4 describes, where a scheduled offence... should have been committed and the proceeds of crime should have been generated.

FIU-IND's supervisory practice: as part of its mandate to ensure effective implementation of Chapter IV of the PMLA, FIU-IND regularly examines the compliance levels of 'reporting entities' in the wake of any criminal conduct or fraud being reported to it or otherwise coming to light.

What the investigation showed: certain entities were found to have cheated lakhs of Indians through the offering of fraudulent services including prohibited gambling activities, dating services, and streaming. The proceeds of these fraudulent activities were subsequently remitted abroad. It came to light that several of the involved entities had made use of payment intermediaries to implement their fraudulent designs within the country.

Note the cross-border element — the proceeds... were subsequently remitted abroad, which engages Part C of the Schedule: an offence of cross border implications.

The charges

Payout-related charges:

a) In respect of the failure of the Bank to put in place an internal mechanism to detect and report suspicious transactions in the manner prescribed under the PMLA and PML Rules including with reference to its Payout service and accounts of the entities in question. In violation of Section 12(1) of PMLA read with Rules 3(1)(D) and 7(3).

b) In respect of the failure of the bank to exercise ongoing due diligence with respect to its Payout service and accounts of entities in question relating to the same service in violation of Section 12(1) of PMLA read with Rule 9(12);

c) In respect of failure of the Bank to satisfy the requirements with respect to reliance on third-party KYC by relying on a non-compliant/unregulated entity in violation of Section 12 of PMLA read with Rule 9(2)(c) and Rule 9(2)(f).

Charge (c) is the third-party reliance rule of Chapter 3 — the entity must be satisfied that such third party is regulated, supervised or monitored, and it is ultimately responsible for client due diligence whatever it relies on.

Beneficiary account related charges:

a) In respect of failure to file suspicious transaction reports, in respect of 34 beneficiary accounts, in the manner, and within timelines, prescribed under the PMLA and PML Rules in violation of Section 12(1) of PMLA read with Rules 3(D) and Rule 8 of the PML Rules.

b) In respect of the failure of the bank to exercise ongoing due diligence with reference to the accounts of 34 beneficiaries which received proceeds from the Payout accounts of and entities in question in violation of Section 12(1) of PMLA read with Rule 9(12), PML Rules.

Thirty-four beneficiary accounts, and the same two failures repeated — no STRs, and no ongoing due diligence.

The order

After considering the written and oral submissions of the Bank, Director, FIU-IND, based on the material available on record, found that the charges against Paytm Payments Bank Ltd. were substantiated. Consequently, the Director FIU-IND vide order dated 15 March, 2024 in exercise of his powers under Section 13 PMLA, imposed a total fine of Rs. 5,49,00,000 (Rupees Five Crore Forty-Nine Lakh Only) on the Bank.

What the five cases have in common

Every one turns on a failure of process rather than a finding that the firm laundered money. Bybit failed to register; Prowess ignored a direction; NEO left its office unstaffed; Way2Wealth failed to raise and file alerts; Paytm failed to monitor, to conduct ongoing due diligence, and to report.

The obligations breached are the ones already studied — Section 12(1) record-keeping and reporting; Rule 3(1)(D) suspicious transactions; Rule 7(3) the detection mechanism; Rule 8 timelines; Rule 9(2) third-party reliance; Rule 9(12) ongoing due diligence.

The second sample question gathers the baseline requirements: all intermediaries should have an Anti Money Laundering Policy, apply customer due diligence on risk sensitive basis and appoint a Principal Officer — All of the above.

And the third asks which statement about an intermediary's actions is true — that it should have a system to identify clients as a potential PEP (Politically Exposed Person). The distractors describe the opposite of the duties: not classifying clients into High, Medium and Low risk, closing STRs without giving appropriate reasons, and monitoring transactions without considering AML & CFT provisions.