Ongoing due diligence
Also written Ongoing customer due diligence · Ongoing CDD
The continuing duty to scrutinise a customer's transactions against what is known of the customer, its business and risk profile, and to keep CDD data current, for the whole life of the relationship.
In plain language
Customer due diligence at onboarding tells a regulated entity who a customer was on the day the account opened. Ongoing due diligence is the obligation to notice when that picture stops being true.
It is the fourth of the four CDD measures in the IFSCA Guidelines and the first clause of Rule 9(12) of the PML Rules, and it is where most enforcement actually lands. Onboarding failures are rare; failures to watch what an account does afterwards are common.
In the workbook's case chapter, Paytm Payments Bank was penalised for this failure twice over — once for its payout service and once for 34 beneficiary accounts.
How it works
The two sources.
| PML Rules, Rule 9(12) | IFSCA Guidelines, section 6.7 |
|---|---|
| (i) Exercise ongoing due diligence and closely examine transactions for consistency with knowledge of the client, his business and risk profile and, where necessary, source of funds | Monitor the relationship on an ongoing basis; observe the conduct of the account and scrutinise transactions for consistency with the customer's business and risk profile, and where appropriate seek source of wealth and source of funds |
| (ii) Where there are suspicions, or doubts about the adequacy or veracity of earlier identification data, review due diligence — including verifying identity again | Pay particular attention to complex, unusually large or unusual patterns with no apparent economic or legitimate purpose; make further enquiries and document findings for the relevant authorities |
| (iii) Apply CDD to existing clients on the basis of materiality and risk | Periodically review each customer's risk rating; where risk may have increased, request additional information and review the risk profile; keep CDD data on customers, their representatives, related parties and beneficial owners up to date, particularly for high-risk customers |
Re-doing CDD. Under section 6.2.2(b) CDD is undertaken again whenever the entity doubts the veracity or adequacy of CDD information, suspects ML/TF, or the customer's risk rating changes or a material change in circumstances warrants it.
Sanctions screening. Section 6.8 requires customers, their business and transactions to be reviewed against the UNSC sanctions lists and any other relevant sanctions list as part of ongoing due diligence.
Tools and timing. Robust software must throw alerts when transactions are inconsistent with risk categorisation and updated profile. Periodic updation runs annually for high-risk, once in three years for medium and once in five years for low-risk customers, and customers must submit updates to their documents within 30 days of the update.
A worked example
The Paytm facts are from Chapter 7; the IFSC scenario is illustrative.
The workbook case. FIU-IND found that Paytm Payments Bank had failed to exercise ongoing due diligence in respect of its payout service and the accounts of the entities involved, and in respect of 34 beneficiary accounts that received proceeds from those payout accounts — both charged under section 12(1) of the PMLA read with Rule 9(12). With the other charges, the order of 15 March 2024 imposed Rs 5,49,00,000.
In the IFSC. Kaveri Global Bank (IFSC Banking Unit) onboarded a Singapore commodity trader in 2023 as medium risk, expecting USD 2–3 million a month in receipts from buyers.
| Month | Inflows | Pattern |
|---|---|---|
| Jan | USD 2.6m | From 11 known buyers |
| Feb | USD 2.4m | From 10 known buyers |
| Mar | USD 9.8m | 64 payments from 40 new, unrelated remitters; outflows same day to three shell-like companies |
What ongoing due diligence requires in March. The alert on the inconsistency is examined; the bank makes further enquiries into background and purpose and documents its findings; screens the new counterparties against the UNSC lists; seeks source of funds; reviews the risk rating — which triggers CDD again under section 6.2.2(b)(iii); and, if suspicion forms, the Principal Officer files an STR promptly. What it may not do is let the medium-risk label it assigned in 2023 decide what March 2025 means.
Why NISM asks about it
Chapter 6 (IFSCA Guidelines for KYC Norms), sections 6.3.1(d), 6.2.2, 6.7 and 6.8, carry the IFSCA duty; Chapter 3 carries Rule 9(12); and Chapter 7 applies it in the Paytm Payments Bank order. Expect a question on what ongoing due diligence consists of, the triggers for re-doing CDD, and the Paytm charges, which are the workbook's clearest example of the obligation failing.
Common exam traps
- It runs for the life of the relationship, not only after an alert.
- A change in risk rating is itself a trigger to undertake CDD again.
- Complex or unusual transactions require documented findings — enquiry that is not written down does not satisfy section 6.7.
- Sanctions screening is part of ongoing due diligence under section 6.8, not only an onboarding check.
- Existing customers are covered on the basis of materiality and risk.
- Two retention periods appear in the workbook. The IFSCA Guidelines require records, including internal findings, to be kept at least six years from the end of the relationship or completion of the transaction; section 12 of the PMLA in Chapter 2 prescribes five years. For an IFSC regulated entity the Guidelines' six years is the longer obligation and the one to apply.
Check yourself
1.What is the position on Central KYC Records Registry filing for an IFSC entity's client who is a foreign national?
- a)No receiving, storing, safeguarding or retrieving of records is required in an IFSC for a client who is a foreign national — though client due diligence still applies
- b)Filing is required within ten days as for any other client
- c)Filing is required, but within thirty days
- d)Neither filing nor client due diligence applies
Show the answer
Answer: (a) No receiving, storing, safeguarding or retrieving of records is required in an IFSC for a client who is a foreign national — though client due diligence still applies
However in an International Financial Services Centre, no such receiving, storing, safeguarding and retrieving of records shall be required for a client who is a foreign national.
Two conditions must both hold — the entity is in an International Financial Services Centre, and the client is a foreign national. An Indian-national client of an IFSC entity is not covered.
Option D goes too far. The carve-out removes only the Registry requirement. Rule 9 continues to apply in full: the entity must identify its clients, verify their identity using reliable and independent sources of identification, obtain information on the purpose and intended nature of the business relationship, take reasonable steps to understand the nature of the customer's business, and its ownership and control, and determine whether a client is acting on behalf of a beneficial owner.
And ongoing obligations continue — every reporting entity shall exercise ongoing due diligence with respect to the business relationship with every client and closely examine the transactions in order to ensure that they are consistent with the knowledge of the client, his business and risk profile.
Options B and C state the general rule, which the carve-out displaces. For other clients, every reporting entity shall within ten days after the commencement of an account-based relationship with a client, file the electronic copy of the client's KYC records with the Central KYC Records Registry — ten days, not thirty. (Thirty days belongs elsewhere: the client must submit any document update within 30 days of such updation.)
Where the carve-out sits. It appears in Rule 9A(1), immediately after the requirement that the Central Government shall within a period of one hundred and eighty days... set-up a Central KYC Records Registry.
And the Registry is recognised in the IFSC guidelines too: as per IFSCA AML, CFT and KYC Guidelines, the Central KYC Records Registry is authorised to receive, store, safeguard and retrieve the KYC records of a customer in digital form.
2.Which of the following statements about the actions of an intermediary is TRUE?
- a)It should have a system to identify clients as a potential PEP (Politically Exposed Person)
- b)It should not classify clients into High, Medium and Low risk
- c)It may close STRs without giving appropriate reasons
- d)It may monitor transactions without considering AML and CFT provisions
Show the answer
Answer: (a) It should have a system to identify clients as a potential PEP (Politically Exposed Person)
Only the first states a genuine duty; the other three describe failures.
**The IFSCA Guidelines require that systems and controls enable the Regulated Entity to determine: whether a customer or a Beneficial Owner is a Politically Exposed Person (PEP); and whether a beneficiary of the policy, or a Beneficial Owner of such beneficiary is a PEP, (in the cases where it is providing life insurance or other similar policies).
And more fully: a Regulated Entity shall implement appropriate internal risk management systems, policies and procedures to determine if a customer or any natural person appointed to act on behalf of the customer, or any beneficial owner of the customer is a politically exposed person (PEP).
Option B inverts a core requirement. The result of the risk assessment shall be used to classify the ML/TF risks as low, medium, and high, and the entity must assign the customer a risk rating proportionate to the ML/TF risks.
Option C contradicts the reporting rule. The Principal Officer shall record his reasons for treating any transaction or relating to suspicious, and records must include internal findings and analysis... whether or not it results in a Suspicious Transactions Report.
Option D describes the Way2Wealth failure exactly — the firm did not consider adverse orders of SEBI from the perspective of AML transactional monitoring and reporting obligations.
Monitoring must be AML-aware, continuous and risk-linked: every reporting entity shall exercise ongoing due diligence with respect to the business relationship with every client and closely examine the transactions in order to ensure that they are consistent with the knowledge of the client, his business and risk profile.
Paytm was charged with the opposite — failure of the bank to exercise ongoing due diligence with respect to its Payout service and accounts of entities in question... in violation of Section 12(1) of PMLA read with Rule 9(12).
3.Which of the following is NOT true about the Customer Due Diligence process?
- a)Not obtaining information on the purpose and intended nature of the business relationship
- b)Identifying the customer and verifying that customer's identity
- c)Conducting ongoing due diligence on the business relationship and scrutiny of transactions
- d)Knowing the customer's business and risk profile, including, where necessary, the source of funds
Show the answer
Answer: (a) Not obtaining information on the purpose and intended nature of the business relationship
Option A states the opposite of a core CDD requirement — obtaining that information is precisely what is required, so the statement is not true of CDD.
**Rule 9 of the PML Rules requires an entity to identify its clients, verify their identity using reliable and independent sources of identification, obtain information on the purpose and intended nature of the business relationship, where applicable.
Purpose and intended nature are expressly part of the process — and they are asked again where doubt arises: on suspicion or where there are doubts about the adequacy or veracity of previously obtained client identification data, the reporting entity shall review the due diligence measures including verifying again the identity of the client and obtaining information on the purpose and intended nature of the business relationship.
Option B is the first limb of CDD — identify its clients, verify their identity using reliable and independent sources of identification.
Option C is the ongoing limb — every reporting entity shall exercise ongoing due diligence with respect to the business relationship with every client and closely examine the transactions in order to ensure that they are consistent with the knowledge of the client, his business and risk profile.
Option D restates the rest of that sentence — consistent with the knowledge of the client, his business and risk profile and where necessary, the source of funds.
The Guidelines make source of funds explicit for higher risk too: entities must follow robust KYC (Know Your Customer) procedures, including enhanced diligence for high-risk clients, identification of beneficial owners, source of funds, and ongoing monitoring.
CDD is Chapter V of the Guidelines, with Chapter-IV Customer Risk Assessment before it and Chapter-VI Third Party Reliance after — all taken up in the next chapter of this workbook.
And the classification principle governs its intensity: enhanced measures in case of high-risk customers and simplified measures in case of low-risk customers.
Where this is taught
Free preparation for NISM Series IFSCA-01Related terms
- Customer risk assessmentThe IFSCA requirement to assess every customer and give it a high, medium or low ML/TF risk rating before CDD begins — the rating that decides simplified, standard or enhanced due diligence.
- Enhanced Due DiligenceThe additional customer due diligence a Regulated Entity must perform where ML/TF risk is high — including source of wealth, Senior Management approval and enhanced ongoing monitoring.
- Simplified Customer Due DiligenceThe lighter version of CDD an IFSC regulated entity may apply to a customer rated low risk — never where there is a suspicion of money laundering or terrorist financing.
- Suspicious transactionAny transaction or attempt, cash or not, that to a person acting in good faith suggests proceeds of crime or terrorist financing, or looks unjustifiably complex or without economic rationale.
- UNSC sanctions listsThe UN Security Council's ISIL (Da'esh) & Al-Qaida Sanctions List and 1988 Sanctions List — no IFSC regulated entity may hold an account in a listed name, and resembling accounts go to FIU-IND and MHA.
- Suspicious Transaction ReportA report a SEBI intermediary must file with FIU-IND within 7 days of concluding that a transaction or connected series of transactions is suspicious — and must never disclose to the client.
- Deferred verificationOpening a business relationship before verification of the customer or beneficial owner is complete — allowed in the IFSC only on four conditions, with suspension at 30 days and termination at 120.
- Financial GroupA parent company, or other legal person exercising control and coordinating functions, together with the branches and subsidiaries that are subject to AML/CFT policies and procedures at group level.
- KYC IdentifierThe unique number or code the Central KYC Records Registry assigns to a client after de-duplicating its KYC records — the key a reporting entity uses to fetch those records instead of asking for them again.