Deferred verification

Ordinarily, a regulated entity verifies a customer's identity and then does business. Sometimes that order would stall a perfectly ordinary transaction — a document is in transit, a registry is slow, a signatory is abroad.

The IFSCA Guidelines allow the order to be reversed, but only inside a tight frame. The relationship may start first if the delay is essential to avoid interrupting business, if the ML/TF risk is low and manageable, if bank accounts cannot be used in the meantime, and if verification is completed quickly.

Then a clock runs, and it has two alarms: at 30 days the relationship is suspended, and at 120 days it is terminated.

The four conditions (Chapter 6, section 6.2.3(a)). A regulated entity may establish a business relationship before completing verification only if:

1. deferral of verification of the customer or beneficial owner is essential in order not to interrupt the normal conduct of a business relationship;
2. there is low risk of ML/TF and any risks identified can be effectively managed;
3. for bank account opening, adequate safeguards ensure the account is not closed and no transactions are carried out by or on behalf of the holder — including any payment to the holder — before verification is complete; and
4. verification is completed as soon as reasonably practicable and in any event within 30 business days of establishing the relationship.

If the 30-day requirement cannot be met — before the end of the period the entity shall document the reason, complete verification as soon as possible, and record the non-compliance event for reporting to its Governing Body.

Suspension at 30 days. If verification remains uncompleted 30 days after establishment, the entity shall suspend the relationship and refrain from further transactions — except to return funds to their sources, to the extent possible.

Termination at 120 days. If verification remains uncompleted 120 days after establishment, the entity shall terminate business relations.

Policies. The entity's AML/CFT systems and controls must include internal risk management policies on the conditions for such relationships and must factor in these time limits.

The statutory root. Rule 9(1) of the PML Rules lets the regulator permit verification to be completed as soon as reasonably practicable after the relationship is established, where ML/TF risks are effectively managed and this is essential not to interrupt normal business. Verifying identity after establishment is also the first example of simplified CDD.

Illustrative dates, ignoring holidays.

Tapti Capital Markets (IFSC), a broker-dealer, onboards Halden Partners LP, a low-risk rated fund, on Monday 2 June 2025. The fund's limited partner register has been certified but the apostilled copy is still with a courier; the fund needs to settle a USD 900,000 trade that week.

Conditions check. Deferral is essential to avoid interrupting normal business; the customer is rated low risk; this is not a bank account; verification is expected within days. The relationship is established.

The clocks.

Scenario A. The documents arrive and verification completes on 18 June. Nothing further is needed.

Scenario B. By late June the courier has lost the documents. Before the 30-day period ends, Tapti documents the reason, pushes for replacement copies, and records the non-compliance event for its Governing Body. On 2 July verification is still open, so the relationship is suspended — no new trades; a USD 40,000 cash balance may only be returned to its source. If verification is still incomplete on 30 September, the relationship is terminated.

Chapter 6 (IFSCA Guidelines for KYC Norms), section 6.2.3, "Establishing business relationship before verification", carries the four conditions and the 30- and 120-day consequences; Chapter 3 carries the Rule 9(1) proviso; and section 6.6 lists deferred verification among simplified CDD measures. Expect the two numbers, the bank-account safeguard, and what may still be done during suspension (returning funds to source).

• All four conditions are required, including low ML/TF risk. A high-risk customer cannot be onboarded ahead of verification.
• 30 days: suspend. 120 days: terminate. Do not swap them.
• During suspension, funds may only go back to their source.
• Bank accounts: no transactions by or for the holder — not even a payment to the holder — until verification is complete.
• The workbook counts the 30 days two ways. Section 6.2.3(a)(iv) says verification should not exceed 30 business days; clauses (b) and (c) speak of the 30-day requirement and suspension if verification remains uncompleted for 30 days. In an exam, "30 days" is the number; if both options appear, the suspension trigger is worded as 30 days.
• Missing the deadline must be documented and reported to the Governing Body before the period ends.