Financial Group

A bank in GIFT City is rarely a business on its own. It is usually one arm of a wider house that also has a bank in Mumbai, a broker in Singapore and a fund manager in London.

The IFSCA Guidelines give that house a name. A Financial Group is a parent company — or any other legal person that exercises control and coordinating functions over the rest of the group — together with the branches and subsidiaries that are subject to AML and CFT policies and procedures at the group level.

Notice the last phrase. Being related by shareholding is not enough. What makes the group a Financial Group for this purpose is that one AML rulebook runs across it.

The idea matters in three practical ways. Risk has to be assessed across the whole group, not one unit at a time. A customer the group already knows in India gets a longer gap between KYC refreshes. And a group service provider can be exempted from parts of the rulebook, because the group is already covered.

The definition (Chapter 6, footnote to section 6.1). A Financial Group means a group that consists of a parent company or of any other type of legal person exercising control and coordinating functions over the rest of the group, together with branches and subsidiaries that are subject to AML/CFT policies and procedures at the group level.

How far the Guidelines reach. The IFSCA (AML, CFT and KYC) Guidelines apply to every Regulated Entity under IFSCA's purview, and they also apply to a Financial Group of the Regulated Entity, to a specified extent. Chapter XII of the Guidelines — the twelfth and last of the 12 chapters — is titled Groups, Branches and Subsidiaries.

1. Risk assessment at group level. Under clause 5.3(c), besides assessing the risk of an individual customer, a Regulated Entity shall identify and assess ML/TF risks at an enterprise-wide level, Financial Group-wide level or Group-wide level, wherever applicable. That includes a consolidated assessment of the entity's ML/TF risk perception across all its business units, product lines and delivery channels.

2. Longer periodic updation for a group customer. The general cycle under clause 6.10 is annually for high-risk customers, once in three years for medium and once in every five years for low. But for a resident Indian customer having an existing client relationship with the Financial Group in India, the cycle is:

And there is a tie-breaker. Where the risk categorisation made by the Financial Group entity differs from the categorisation made by the Regulated Entity, the stricter of the two periodicities applies. The policy must be documented in the internal KYC policy, approved by the Governing Body.

3. Exemption for a group service provider. By an IFSCA circular dated 18 November 2024, certain entities and activities are exempt from the Guidelines, including service providers within the same financial group provided they are not in FATF high-risk jurisdictions. The exemption is partial: an exempt entity must still conduct and document a business risk assessment, and if any AML or CFT risk is identified, the ordinary obligations under the PMLA and the Guidelines resume.

4. Relaxation in third-party reliance. Under Rule 9(2)(f) of the PML Rules, where a reporting entity relies on a third party that is part of the same financial group, the Regulator may issue guidelines to consider any relaxation in conditions (a) to (d) of Rule 9(2).

In the FATF Standards. Recommendation 18 — internal controls and foreign branches and subsidiaries — sits under the heading Reliance, Controls and Financial Groups, beside Recommendation 17 on reliance on third parties.

Illustrative. The periodicities and the group rules are the workbook's.

Sabarmati Financial Holdings Ltd is the parent. It runs one AML and CFT rulebook across three units, and all three are subject to it at group level — so the three are a Financial Group.

The customer. Mr Anand Rao, a resident Indian, has banked with Sabarmati Bank in Mumbai since 2015. In April 2025 he opens an account with the IFSC Banking Unit and is rated medium risk.

• Without the group relationship, his KYC would fall due for updation once in three years — April 2028.
• Because he has an existing client relationship with the Financial Group in India, the cycle is once in every eight years — April 2033.

Then the ratings diverge. In June 2025 the Mumbai bank re-rates Mr Rao high risk after a large inward remittance. The IFSC unit still holds him at medium. Two cycles are now in play: 2 years on the group's high-risk rating and 8 years on the unit's medium rating. The stricter of the two applies, so his updation is due in June 2027, not 2033 — six years earlier, because of one re-rating in another entity of the same group.

The group service provider. Sabarmati Holdings also runs a shared technology unit in GIFT IFSC that provides reconciliation services only to the three units, and is not in a FATF high-risk jurisdiction. Under the circular of 18 November 2024 it is exempt from the Guidelines — but it still has to conduct and document a business risk assessment. When that assessment flags that it also holds customer identity data for an unrelated overseas client, an AML risk has been identified, and the full obligations resume.

The consolidated view. For the enterprise-wide assessment, the group does not file three separate risk pictures. It rolls up its exposure across all business units, product lines and delivery channels into one.

Chapter 6 (IFSCA Guidelines for KYC Norms) carries the definition in the footnote to section 6.1, and section 6.10 carries both updation tables and the stricter-periodicity rule. Chapter 5 lists Chapter XII — Groups, Branches and Subsidiaries among the 12 chapters of the Guidelines and carries the group-wide risk assessment at clause 5.3(c). Chapter 2 carries the IFSCA exemption circular of 18 November 2024. Chapter 3 carries Rule 9(2)(f), and Chapter 8 lists Recommendation 18.

Expect the six periodicity numbers as a matching question — 1, 3 and 5 years against 2, 8 and 10 years — and a harder question on which applies when the group and the unit rate the same customer differently. The answer is the stricter periodicity.

• The longer cycle needs two things together: a resident Indian customer and an existing client relationship with the Financial Group in India. A foreign customer of the same group gets the ordinary 1, 3 and 5 years.
• Stricter wins, not the group's. Where the two ratings differ, take the shorter periodicity, whichever entity produced it.
• Group relationship is defined by a shared AML rulebook, not just shareholding. The definition requires branches and subsidiaries subject to AML/CFT policies and procedures at the group level.
• A parent company is not the only possibility. Any other type of legal person exercising control and coordinating functions over the rest of the group qualifies.
• The exemption is not a holiday. An exempt group service provider still owes a documented business risk assessment, and the exemption falls away the moment an AML or CFT risk is identified. It also fails if the provider is in a FATF high-risk jurisdiction.
• Rule 9(2)(f) relaxes nothing by itself. It lets the Regulator issue guidelines to consider relaxing conditions (a) to (d) of the third-party reliance test — and condition (e), ultimate responsibility, is not among them.
• Group-wide assessment is in addition to the customer assessment, not instead of it. Clause 5.3(c) begins "in addition to assessing the ML/TF risks presented by an individual customer".
• Financial Group is IFSCA's defined term. Do not answer it with a company-law group definition or with a promoter group.