The Prevention of Money-laundering (Maintenance of Records) Rules, 2005

Why an Act needs Rules

Chapter 3 carries 8 marks out of 50 — 16% of the paper.

Learning Objective- After studying this chapter, you should know about: Definition, objective and process of implementation of PML (Maintenance of Records) Rules, 2005 · Detailed explanation of verifying the identity of the client/ true beneficial owner of the assets under Client Due Diligence rules.

An act is a law or the statute which has been passed by the legislature and approved by the President of India. Rules, on the other hand, help in governing laws. Rules are created after an act to define how the act will be implemented and performed. Rules are secondary to the act, and are created to provide flexibility in implementation.

The workbook's sample question asks why rules are made — all three: to define how the Act will be implemented, to state how it will be performed, and to provide flexibility.

Where these Rules come from. The PMLA itself gave the power to make them. The workbook puts it this way: in exercise of the powers conferred by section 73 of the Prevention of Money-Laundering Act, 2002 (15 of 2003), the Central Government in consultation with the Reserve Bank of India, hereby made the following rules.

They cover four things:

• Maintenance of records of the nature and value of transactions.
• The procedure and manner of maintaining information.
• Time for furnishing of information.
• Verification of records of the identity of the clients of the banking companies, financial institutions and intermediaries.

Section 73 is the rule-making power — and note that the Central Government acted in consultation with the Reserve Bank of India.

And they have been updated: vide Gazette Notification dated 7th March, 2023, the above mentioned rules were amended and to be called as the Prevention of Money-laundering (Maintenance of Records) Amendment Rules, 2023.

What the rules require entities to do, in four lines:

• Develop internal controls: Create policies, procedures, systems, and controls to prevent financial crimes.
• Conduct customer due diligence: Follow a process before onboarding customers or executing transactions.
• Report suspicious activity: Report suspicious transactions and other specified activities.

Maintain client identity records: a reporting entity shall keep records of the client identity in the manner as may be specified by its Regulator from time to time.

The third of these is the workbook's second sample question — reporting suspicious transactions, not ignoring or delaying them.

And the purpose: by mandating robust customer verification, due diligence and reporting practices, SEBI and RBI aim to create a secure environment within the financial sector to prevent illicit financial activities.

Rule 3 — records of transactions

Rule 3 of PMLR, 2005 is important because it outlines the responsibilities of reporting entities, their officers, and employees in maintaining information.

Every reporting entity shall maintain the record of all transactions including, the record of -

• (A) all cash transactions of the value of more than ten lakhs rupees or its equivalent in foreign currency.
• (B) all series of cash transactions integrally connected to each other which have been individually valued below rupees ten lakhs or its equivalent in foreign currency where such series of transactions have taken place within a month and the monthly aggregate exceeds an amount of ten lakh rupees or its equivalent in foreign currency.
• (BA) all transactions involving receipts by non-profit organisations of value more than rupees ten lakh, or its equivalent in foreign currency.
• (C) all cash transactions where forged or counterfeit currency notes or bank notes have been used as genuine or where any forgery of a valuable security or a document has taken place facilitating the transactions.
• (D) all suspicious transactions whether or not made in cash.
• (E) all cross-border wire transfers of the value of more than five lakh rupees or its equivalent in foreign currency where either the origin or destination of fund is in India.
• (F) all purchase and sale by any person of immovable property valued at fifty lakh rupees or more that is registered by the reporting entity.

The sample question asks the cash threshold — ten lakh rupees.

The reach of clause (D)

Clause (D) is drafted very widely. Suspicious transactions are caught by way of -

(i) deposits and credits, withdrawals into or from any accounts in any currency maintained by cheques including third party cheques, pay orders, demand drafts, cashiers cheques or any other instrument of payment of money including electronic receipts or credits and electronic payments or debits, travelers cheques, transfer from one account within the same banking company, financial institution and intermediary... including from or to Nostro and Vostro accounts, or any other mode in whatsoever name it is referred to

(ii) credits or debits into or from any non-monetary accounts such as d-mat account, security account in any currency.

Demat and securities accounts are expressly named — this is the limb that matters most to a securities market intermediary.

(iii) money transfer or remittances in favour of own clients or non-clients from India or abroad and to third party beneficiaries in India or abroad including transactions on its own account in any currency — by any mode. The workbook lists payment orders, cashiers, cheques, demand drafts, telegraphic or wire transfers, electronic remittances or transfers, internet transfers, Automated Clearing House remittances, lock box driven transfers or remittances, remittances for credit or loading to electronic cards or any other mode of money transfer. In short, every way of sending money counts.

(iv) loans and advances including credit or loan substitutes, investments and contingent liability. This covers:

• Subscription to debt instruments such as commercial paper, certificate of deposits, preferential shares, debentures, securitised participation, interbank participation or any other investments in securities.
• Purchase and negotiation of bills, cheques and other instruments.
• Foreign exchange contracts, currency, interest rate and commodity and any other derivative instrument.
• Letters of credit, standby letters of credit, guarantees, comfort letters, solvency certificates and any other instrument for settlement and/or credit support.

(v) collection services in any currency by way of collection of bills, cheques, instruments or any other mode of collection.

Note the repeated formula — "or any other mode in whatsoever name it is referred to". The list is illustrative, not exhaustive.

Rule 3A — group-wide programmes

(1) Every reporting entity, which is part of a group, shall implement group-wide programmes against money laundering and terror financing, including group-wide policies for sharing information required for the purposes of client due diligence and money laundering and terror finance risk management and such programmes shall include adequate safeguards on the confidentiality and use of information exchanged, including safeguards to prevent tipping-off.

In plain words: a group must fight money laundering as one group. Its companies share the information needed for due diligence. But that information must stay confidential, and the client must not be tipped off.

(2) Groups are required to implement group-wide policies for the purpose of discharging obligations under the provisions of the Prevention of Money Laundering Act, 2002.

"Tipping-off" is the danger the safeguards address — sharing information within a group must not result in the client learning that he is under scrutiny.

Rule 4 — what the records must contain

The records referred to in rule 3 shall contain all necessary information specified by the regulator to permit reconstruction of individual transaction including the following information: -

• (a) the nature of the transactions.
• (b) the amount of the transaction and the currency in which it was denominated.
• (c) the date on which the transaction was conducted; and
• (d) the parties to the transaction.

Four elements — nature, amount and currency, date, parties — and the standard is reconstruction of individual transaction, matching section 12(1)(a) of the Act.

Rule 5 — the manner of maintaining information

(1) Every reporting entity shall maintain information in respect of transactions with its client referred to in rule 3 in accordance with the procedure and manner as may be specified by its regulator from time to time.

(2) Every reporting entity shall evolve an internal mechanism for maintaining such information in such form and manner and at such intervals as may be specified by its regulator from time to time.

(3) It shall be the duty of every reporting entity, its designated director, officers and employees to observe the procedure and the manner of maintaining information as specified by its regulator.

Note who bears the duty in sub-rule (3) — the entity, its designated director, officers and employees, personally as well as institutionally.

Rule 7 — the manner of furnishing information

(1) Every reporting entity shall communicate to the Director the name, designation and address of the Designated Director and the Principal Officer.

Note that Rule 7 requires both names to be communicated — not only the Principal Officer's.

(2) The Principal Officer shall furnish the information referred to in clauses (A), (B), (BA), (C), (D), (E) and (F) of sub-rule (1) of rule 3 to the Director on the basis of information available with the reporting entity. A copy of such information shall be retained by the Principal Officer for the purposes of official record.

(3) Every reporting entity shall evolve an internal mechanism having regard to any guidelines issued by the Director in consultation with, its regulator, for detecting the transactions referred to in clauses (A), (B), (BA), (C), (D), (E) and (F)... and for furnishing information about such transactions in such form as may be directed by the Director in consultation with, its Regulator.

(4) It shall be the duty of every reporting entity, its designated director, officers and employees to observe the procedure and the manner of furnishing information.

Detection, not just reporting — sub-rule (3) obliges the entity to build systems that find the transactions in the first place.

Rule 8 — when information must be furnished

(1) The Principal Officer of a reporting entity shall furnish the information in respect of transactions referred to in clauses (A), (B), (BA), (C) and (E) of sub-rule (1) of rule 3 every month to the Director by the 15th day of the succeeding month.

(2) The Principal Officer of a reporting entity shall furnish the information promptly in writing or by fax or by electronic mail to the Director in respect of transactions referred to in clause (D)... not later than seven working days on being satisfied that the transaction is suspicious.

(3) The Principal Officer of a reporting entity shall furnish, the information in respect of transactions referred to in clause (F)... every quarter to the Director by the 15th day of the month succeeding the quarter.

So: monthly by the 15th for A, B, BA, C and E; within seven working days for D; quarterly by the 15th for F.

And delay is expensive: (4) For the purpose of this rule, delay of each day in not reporting a transaction or delay of each day in rectifying a mis-reported transaction beyond the time limit as specified in this rule shall constitute a separate violation.

Each day is a separate violation — and mis-reporting counts as well as non-reporting.

Sub-rule (5) is a COVID-era relaxation: information for the months of March 2020, April 2020 and May 2020, and for the quarter January-March 2020, could be furnished by the 30th June, 2020.

(6) Every reporting entity, its Directors, officers, and all employees shall ensure that the fact of maintenance of records referred to in rule 3 and furnishing of information to the Director is kept confidential.

With one carve-out: nothing in this rule shall inhibit sharing of information under rule 3A of any analysis of transactions and activities which appear unusual.

Rule 9 — Client Due Diligence

The trigger

Due diligence is triggered at three points. Every reporting entity shall act:

• At the time of commencement of an account-based relationship.
• While carrying out occasional transaction of an amount equal to or exceeding rupees fifty thousand, whether conducted as a single transaction or several transactions that appear to be connected.
• For any international money transfer operations.

The Rs. 50,000 figure applies only to occasional transactions, and connected transactions are added together. International money transfers trigger due diligence regardless of value. At each trigger point, the entity must:

(a) identify its clients, verify their identity using reliable and independent sources of identification, obtain information on the purpose and intended nature of the business relationship, where applicable;

(b) take reasonable steps to understand the nature of the customer's business, and its ownership and control; and

(c) determine whether a client is acting on behalf of a beneficial owner, and identify the beneficial owner and take all steps to verify the identity of the beneficial owner, using reliable and independent sources of identification.

Two provisos. Where the Regulator considers risks effectively managed and where this is essential not to interrupt the normal conduct of business, it may permit the reporting entity to complete the verification as soon as reasonably practicable following the establishment of the relationship. And where a client deals in depository receipts or equity shares listed in jurisdictions notified by the Central Government of a company incorporated in India on behalf of a beneficial owner resident there, the beneficial owner enquiry follows the norms of such jurisdiction.

The Central KYC Records Registry

(1A) Subject to the provisions of sub-rule (1) of Rule 9, every reporting entity shall within ten days after the commencement of an account-based relationship with a client, file the electronic copy of the client's KYC records with the Central KYC Records Registry.

(1B) The Central KYC Records Registry shall process the KYC records received from a reporting entity for de-duplicating and issue a KYC Identifier for each client to the reporting entity, which shall communicate the KYC Identifier in writing to their client.

(1C) For verification of identity or ongoing due diligence, the entity shall seek the KYC Identifier from the client or retrieve the KYC Identifier, if available, from the Central KYC Records Registry and proceed to obtain KYC records online by using such KYC Identifier and shall not require a client to submit the same KYC records or information or any other additional identification documents or details, unless—

(a) there is a change in the information of the client as existing in the records of Central KYC Records Registry; (b) the KYC record or information retrieved is incomplete or is not as per the current applicable KYC norms prescribed by the respective regulator; or (c) the validity period of the downloaded documents has lapsed; or (d) the reporting entity considers it necessary in order to verify the identity or address (including current address)... or to perform enhanced due diligence or to build an appropriate risk profile of the client.

The client is not asked twice for the same papers, save in those four cases.

(1D) On obtaining additional or updated information, the entity shall within seven days or within such period as may be notified by the Central Government furnish the updated information to the Central KYC Records Registry, which updates the record and shall thereafter inform electronically all reporting entities who have dealt with the concerned client.

(1E) The reporting entity which performed the last KYC verification or sent updated information in respect of a client shall be responsible for verifying the authenticity of the identity or address of the client.

(1F) A reporting entity shall not use the KYC records of a client obtained from the Central KYC Records Registry for purposes other than verifying the identity or address of the client and shall not transfer KYC records or any information contained therein to any third party unless authorised to do so by the client or by the Regulator or by the Director.

(1G) The regulator shall issue guidelines to ensure that the Central KYC records are accessible to the reporting entities in real time.

(1H) On being informed of an update, the entity shall retrieve the updated KYC records from the Central KYC Records Registry and update the KYC record maintained by the reporting entity.

Ten days to file; seven days to update; real-time access.

Reliance on a third party — sub-rule (2)

A reporting entity may rely on a third party subject to the conditions that-

• (a) the reporting entity, immediately, obtains from the third party or from the Central KYC Records Registry records or the information of client due diligence carried out by the third party.
• (b) the reporting entity takes adequate steps to satisfy itself that copies of identification data and other relevant documentation... will be made available from the third party upon request without delay.
• (c) the reporting entity is satisfied that such third party is regulated, supervised or monitored for, and has measures in place for compliance with client due diligence and record-keeping requirements in line with the requirements and obligations under the Act.
• (d) the third party is not based in a country or jurisdiction assessed as high risk.

(e) the reporting entity is ultimately responsible for client due diligence and undertaking enhanced due diligence measures, as applicable; and

(f) where a reporting entity relies on a third party that is part of the same financial group, the Regulator may issue guidelines to consider any relaxation in the conditions (a) to (d).

Condition (e) is the one that matters — reliance transfers the work, never the responsibility.

Who is the beneficial owner — sub-rule (3)

(a) where the client is a company, the beneficial owner is the natural person(s), who, whether acting alone or together, or through one or more juridical person, has a controlling ownership interest or who exercises control through other means.

• "Controlling ownership interest" means ownership of or entitlement to more than ten per cent of shares or capital or profits of the company.
• "Control" shall include the right to appoint majority of the directors or to control the management or policy decisions including by virtue of their shareholding or management rights or shareholders agreements or voting agreements.

So there are two routes to being the beneficial owner of a company: owning more than 10%, or controlling it in some other way.

(b) where the client is a partnership firm, the natural person with ownership of/entitlement to more than ten percent of capital or profits of the partnership or who exercises control through other means — where "control" shall include the right to control the management or policy decision.

(c) where the client is an unincorporated association or body of individuals, the natural person(s) with ownership of or entitlement to more than fifteen percent of the property or capital or profits.

(d) where no natural person is identified under (a), (b) or (c), the beneficial owner is the relevant natural person who holds the position of senior managing official.

(e) where the client is a trust, identification shall include identification of the author of the trust, the trustee, the beneficiaries with 10 percent or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership.

(f) where the client or the owner of the controlling interest is an entity listed on a stock exchange in India, or a listed entity in a notified jurisdiction, or a subsidiary of such listed entities, it is not necessary to identify and verify the identity of any shareholder or beneficial owner of such entities.

Ten percent for a company, a partnership and a trust beneficiary; fifteen percent for an unincorporated association; the senior managing official as the fallback.

Documents by type of client

An individual — sub-rule (4):

(a) the Aadhaar number where (i) he is desirous of receiving any benefit or subsidy under any scheme notified under section 7 of the Aadhaar (Targeted Delivery of Financial and Other subsidies, Benefits and Services) Act, 2016; or (ii) he decides to submit his Aadhaar number voluntarily to a banking company or any reporting entity notified under first proviso to sub-section (1) of section 11A of the Act; or

(aa) the proof of possession of Aadhaar number where offline verification can be carried out; or

(ab) the proof of possession of Aadhaar number where offline verification cannot be carried out or any officially valid document or the equivalent e-document thereof containing the details of his identity and address; and

(b) the Permanent Account Number or the equivalent e-document thereof or Form No. 60 as defined in Income-tax Rules, 1962; and

(c) such other documents including in respect of the nature of business and financial status of the client... as may be required by the reporting entity.

A small account — sub-rule (5) may be opened in a banking company on production of a self-attested photograph and affixation of signature or thumb print, subject to certification by the designated officer. The conditions:

• Opened only at Core Banking Solution linked banking company branches, or where manual monitoring is possible.
• Operated initially for a period of twelve months, extendable by a further twelve on evidence of having applied for an officially valid document.
• Reviewed after twenty-four months, and monitored for suspicion.
• Foreign remittance shall not be allowed to be credited into a small account unless the identity of the client is fully established.

A company — sub-rule (6) submits:

• Certificate of incorporation.
• Memorandum and Articles of Association.
• Permanent Account Number of the company.
• A resolution from the Board of Directors, power of attorney granted to its managers, officers or employees... to transact on its behalf.
• Such documents as are required for an individual under sub-rule (4) relating to beneficial owner, managers, officers or employees... holding an attorney to transact on the company's behalf.
• The names of the relevant persons holding senior management position; and
• The registered office and the principal place of its business, if it is different.

A partnership firm — sub-rule (7) submits:

• Registration certificate.
• Partnership deed.
• Permanent Account Number of the partnership firm.
• [individual documents] relating to beneficial owner, managers, officers or employees... holding an attorney.
• The names of all the partners and address of the registered office, and the principal place of its business.

A trust — sub-rule (8) submits:

• Registration certificate.
• Trust deed.
• Permanent Account Number or Form No.60 of the trust.
• [individual documents].
• The names of the beneficiaries, trustees, settlor or and authors of the trust and the address of the registered office.
• List of trustees and documents as are required for individuals under sub-rule (4) for those discharging roles as trustee and authorised to transact.

An unincorporated association or body of individuals — sub-rule (9) submits:

• Resolution of the managing body.
• Power of attorney granted to him to transact on its behalf.
• Permanent account number or Form No.60.
• [individual documents].
• Such information as may be required by the reporting entity to collectively establish the existence of such association or body of individuals.

A non-profit organisation client — sub-rule (9A). Two duties apply. Every reporting entity shall register the details of a client, in case of client being a non-profit organisation, on the DARPAN Portal of NITI Aayog, if not already registered. It must also maintain such registration records for a period of five years after the business relationship between a client and a reporting entity has ended or the account has been closed, whichever is later.

Updates — sub-rule (9B): where documents have been submitted, the client shall submit to the reporting entity any update of such documents... within 30 days of such updation.

Authorisation, anonymity and ongoing diligence

(10) Where the client purports to act on behalf of juridical person or individual or trust, the reporting entity shall verify that any person purporting to act on behalf of such client is so authorized and verify the identity of that person. And in case of a trust, the reporting entity shall ensure that trustees disclose their status.

(11) No reporting entity shall allow the opening of or keep any anonymous account or account in fictitious names or account on behalf of other persons whose identity has not been disclosed or cannot be verified.

(12) Three clauses:

(i) Every reporting entity shall exercise ongoing due diligence with respect to the business relationship with every client and closely examine the transactions in order to ensure that they are consistent with the knowledge of the client, his business and risk profile and where necessary, the source of funds.

(ii) When there are suspicions of money laundering or financing of the activities relating to terrorism or where there are doubts about the adequacy or veracity of previously obtained client identification data, the reporting entity shall review the due diligence measures including verifying again the identity of the client and obtaining information on the purpose and intended nature of the business relationship.

Put simply: suspicion or doubt means doing the KYC again. The entity re-verifies who the client is and why the relationship exists.

(iii) The reporting entity shall apply client due diligence measures also to existing clients on the basis of materiality and risk, and conduct due diligence on such existing relationships at appropriate times.

Risk assessment — sub-rule (13)

Every reporting entity shall - (i) carry out risk assessment to identify, assess and take effective measures to mitigate its money laundering and terrorist financing risk across four areas:

• Clients.
• Countries or geographic areas.
• Products, services, transactions or delivery channels.

The assessment must be consistent with any national risk assessment conducted by a body or authority duly notified by the Central Government.

(ii) the risk assessment... shall (a) be documented (b) consider all the relevant risk factors before determining the level of overall risk and the appropriate level and type of mitigation to be applied (c) be kept up to date; and (d) be available to competent authorities and self-regulating bodies.

Four risk dimensions: clients, countries or geographic areas, and products, services, transactions or delivery channels.

Guidelines and the CDD Programme — sub-rule (14)

The regulator shall issue guidelines and may prescribe enhanced or simplified measures to verify the client's identity taking into consideration the type of client, business relationship, nature and value of transactions based on the overall money laundering and terrorist financing risks involved.

But simplified measures have a limit: simplified measures are not acceptable whenever there is a suspicion of money laundering or terrorist financing, or where specific higher-risk scenarios apply or where the risk identified is not consistent with the national risk assessment.

The guidelines must also provide for those who cannot comply through no fault of their own — exemptions, limitations and conditions and alternate and viable means of identification, to provide account based services to clients who are unable to undergo biometric authentication, relaxation for continued operation of accounts for clients who are unable to provide Permanent Account Number or Form No. 60, and similar relief for those unable to undergo Aadhaar authentication — owing to injury, illness or infirmity on account of old age or otherwise.

And every entity must have a programme: every reporting entity shall formulate and implement a Client Due Diligence Programme. It shall include policies, controls and procedures, approved by the senior management. Their purpose is to enable the reporting entity to manage and mitigate the risk that have been identified either by the reporting entity or through national risk assessment.

Verification methods — sub-rule (15)

(a) Aadhaar number submitted under clause (a): carry out authentication of the client's Aadhaar number using e-KYC authentication facility provided by the Unique Identification Authority of India

(b) proof of possession where offline verification is possible: carry out offline verification

(c) an equivalent e-document: verify the digital signature as per the provisions of the Information Technology Act, 2000... and take a live photo in the manner specified by the regulator

(d) an officially valid document or Aadhaar proof where offline verification cannot be carried out: carry out verification through digital KYC — with a transitional alternative of a certified copy where an e-document is not submitted.

Obtaining a certified copy means comparing the copy... with the original and recording the same on the copy by the authorised officer of the reporting entity.

And a privacy safeguard — sub-rule (16): where a client submits proof of possession containing the Aadhaar number, the entity shall ensure such client redacts or blacks out his Aadhaar number through appropriate means where the authentication of Aadhaar number is not required.

PAN and address — sub-rules (17) to (19)

(17)(i) An existing client must submit his Permanent Account Number or the equivalent e-documents thereof or Form No.60, on such date as may be notified by the Central Government, failing which the account shall temporarily cease to be operational. There is a safeguard. Before temporarily ceasing operations for an account, the reporting entity shall give the client an accessible notice and a reasonable opportunity to be heard.

"Temporary ceasing of operations"... means the temporary suspension of all transactions or activities in relation to that account by the reporting entity till such time the client complies.

(ii) If the client says in writing that he will not submit PAN or Form No. 60, the client's account with the reporting entity shall be closed and all obligations due in relation to the account shall be appropriately settled after establishing the identity of the client.

(18) Where the officially valid document lacks a current address, four documents are deemed to be officially valid documents for the limited purpose of proof of address:

• (a) utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill).
• (b) property or Municipal tax receipt.
• (c) pension or family pension payment orders (PPOs) issued to retired employees by Government Departments or Public Sector Undertakings, if they contain the address.
• (d) letter of allotment of accommodation from employer issued by State Government or Central Government Departments, statutory or regulatory bodies, public sector undertakings, scheduled commercial banks, financial institutions and listed companies and leave and license agreements with such employers.

And the relief is temporary: the client shall submit updated officially valid document... with current address within a period of three months.

(19) Where Aadhaar was given and the current address differs from that in the Central Identities Data Repository, the client may give a self-declaration to that effect.

Rule 9A — the Central KYC Records Registry

(1) The Central Government shall within a period of one hundred and eighty days from the date of coming into force of the Prevention of Money-laundering (Maintenance of Records) Amendment Rules, 2015 set-up a Central KYC Records Registry having its own seal for the purpose of receiving, storing, safeguarding and retrieving electronic copies of KYC records obtained by the reporting entities from their clients.

One hundred and eighty days — the workbook's fourth sample question. Note that the question text says "Amendment Rules, 2005"; the rule itself refers to the Amendment Rules, 2015. The answer being tested is 180 days.

With an IFSC carve-out: in an International Financial Services Centre, no such receiving, storing, safeguarding and retrieving of records shall be required for a client who is a foreign national.

(2) The functions and obligations:

• (a) shall follow any operating instructions issued by the Regulator.
• (b) shall be responsible for storing, safeguarding and retrieving the KYC records and making such records available online to reporting entities or Director.
• (c) shall take all precautions necessary to ensure that the electronic copies of KYC records are not lost, destroyed or tampered with and that sufficient back up of electronic records are available at all times at an alternative safe and secure place.
• (d) shall cause an annual audit of its controls, systems, procedures and safeguards and shall undertake corrective actions for deficiencies, if any.
• (e) shall provide information only to the reporting entities which are registered with it on payment of fees as specified by the regulator.

(f) shall appoint a compliance officer who shall be responsible for monitoring the compliance of the Act, the rules made and the notifications issued thereunder and also the guidelines and instructions issued by the Central Government and the Regulator and for redressal of client's grievances. The compliance officer shall immediately and independently report to the Central Government any noncompliance observed by him.

(g) the Regulator in consultation with the Central Government and the Central KYC Records Registry may issue guidelines to be followed by the reporting entities for filing the KYC records.

(h) the Central Government may direct that rule 9 or 9A shall not apply to a class or classes of regulated entities or shall apply... with exceptions, modifications and adaptations.

3.3 Digital KYC — the thirteen steps

A. The reporting entities shall develop an application for digital KYC process which shall be made available at customer touch points... and the KYC process shall be undertaken only through this authenticated Application of the Reporting Entities.

B. The access of the Application shall be controlled by the Reporting Entities and it should be ensured that the same is not used by unauthorized persons. The Application shall be accessed only through login-id and password or Live OTP or Time OTP controlled mechanism.

C. The client, for the purpose of KYC, shall visit the location of the authorized official of the Reporting Entity or vice-versa. The original Officially Valid Document (OVD) shall be in possession of the client.

Someone must physically travel — either the client to the official or the official to the client.

D. The Reporting Entity must ensure that the Live photograph of the client is taken by the authorized officer and the same photograph is embedded in the Customer Application Form (CAF). And the application shall put a water-mark in readable form having CAF number, GPS coordinates, authorized official's name, unique employee Code... and Date (DD:MM: YYYY) and time stamp (HH:MM: SS) on the captured live photograph.

Five items in the watermark: CAF number, GPS coordinates, official's name, employee code, and date and time.

E. The application shall ensure that only live photograph of the client is captured and no printed or video-graphed photograph of the client is captured. The background behind the client while capturing live photograph should be of white colour and no other person shall come into the frame.

F. The live photograph of the original document (placed horizontally), shall be captured vertically from above and water-marking in readable form as mentioned above shall be done. No skew or tilt in the mobile device shall be there.

G. The live photograph of the client and his original documents shall be captured in proper light so that they are clearly readable and identifiable.

H. All CAF entries are filled from the documents and information furnished; where a Quick Response (QR) code is available, such details can be auto-populated by scanning the QR code — for example name, gender, date of birth and address from an Aadhaar or e-Aadhaar.

I. An OTP containing the text 'Please verify the details filled in form before sharing OTP' is sent to client's own mobile number. Upon successful validation of the OTP, it will be treated as client signature on CAF. If the client has no mobile number, mobile number of his/her family/relatives/known persons may be used and stated in the CAF — but in any case, the mobile number of authorized officers registered with the Reporting Entity shall not be used for client signature.

J. The authorised officer gives a declaration about the capture, verified by One Time Password (OTP) which will be sent to his mobile number registered with the Reporting Entity — and the live photograph of the authorized official shall also be captured in this authorized officer's declaration.

K. The application confirms completion, submits the activation request, and generate[s] the transaction-id/reference-id number of the process, which the officer shall intimate... to client for future reference.

L. The authorised officer shall check and verify that: i. information available in the picture of document is matching with the information entered by authorized officer in CAF. ii. live photograph of the client matches with the photo available in the document.; and iii. all of the necessary details in CAF including mandatory field are filled properly.

M. On Successful verification, the CAF shall be digitally signed by authorized representative of the Reporting Entity who will take a print of CAF, get signatures/thumb-impression of customer at appropriate place, then scan and upload the same in system. Original hard copy may be returned to the customer.