Reporting entity

The PMLA does not impose its record-keeping and reporting duties on everybody. It imposes them on a defined class, and Section 2(1)(wa) draws the line: a banking company, a financial institution, an intermediary, or a person carrying on a designated business or profession.

If you are inside that definition, Chapter IV of the Act applies to you: verify who your clients are, keep the records, and tell FIU-IND about the transactions the Rules specify. If you are outside it, none of it applies.

Most of the enforcement in this paper is simply the consequence of an entity being inside the definition and behaving as though it were not.

Section 12 of the PMLA states the core obligations. Every reporting entity shall maintain a record of all transactions in such manner as to enable it to reconstruct individual transactions; furnish prescribed information to the Director, FIU-IND; and maintain records of the documents evidencing the identity of its clients and beneficial owners, together with account files and business correspondence.

The two retention clocks are different and are examined as a pair:

• Transaction records: five years from the date of the transaction.
• Client identity records: five years after the business relationship has ended or the account has been closed, whichever is later.

Everything maintained, furnished or verified is to be kept confidential, and the Central Government may exempt a reporting entity or a class of them from any obligation under the Chapter.

Under Rule 7 the entity must communicate the name, designation and address of its Designated Director and Principal Officer to the Director, FIU-IND, and register itself with FIU-IND to file at all. For a unit licensed by IFSCA that registration runs through the FINGate 2.0 portal, and non-registration is itself treated as non-compliance with the IFSCA Guidelines.

Bybit Fintech Limited, a Virtual Digital Asset Service Provider, is a reporting entity under Section 2(1)(wa) — VDA SPs having been brought in by notification, with FIU-IND's AML/CFT guidelines for VDA service providers issued on 10 March 2023 and a registration circular on 17 October 2023.

Bybit kept expanding its services in the Indian market without securing the mandatory registration with FIU-IND. The non-compliance was persistent enough that FIU-IND had its websites blocked, through MeitY, under the Information Technology Act, 2000.

By order dated 31 January 2025, exercising powers under Section 13 of the PMLA, the Director FIU-IND found Bybit in violation of Section 12(1) read with Rules 2(1)(h), 3(1)(D), 7(2), 7(3), 8(2) and 8(4) of the PML Rules, and imposed a penalty of Rs 9,27,00,000 — nine crore twenty-seven lakh rupees.

Compare Paytm Payments Bank Ltd, which was registered as a reporting entity and still paid Rs 5,49,00,000 by order dated 15 March 2024, for failing to detect and report suspicious transactions on its Payout service, failing ongoing due diligence under Rule 9(12), relying on a non-compliant third party for KYC under Rules 9(2)(c) and 9(2)(f), and failing to file STRs for 34 beneficiary accounts.

One was fined for never registering; one for registering and then not doing the work.

Chapter 2 sets out Section 2(1)(wa) and Section 12; Chapter 7's sample question asks directly what a VDA SP is classified as under the PMLA, and the answer is Reporting Entity — with "Regulated Entity" sitting right beneath it as the distractor. Expect the five-year retention pair as a computation-style question, and the case penalties as recall.

• Reporting entity (PMLA) is not Regulated Entity (IFSCA Guidelines). The Chapter 7 sample question is built on exactly this confusion.
• The two five-year clocks run from different events. Transactions: from the date of the transaction. Identity records: from the end of the relationship or account closure, whichever is later.
• Under the IFSCA Guidelines the record-keeping period is at least six years, not five — the Guidelines are stricter than the Act, and both numbers are examinable.
• A person carrying on a designated business or profession is a reporting entity too — casinos, notified real estate agents, dealers in precious metals and stones, and anyone the Central Government designates by notification.
• Registration is an obligation in itself. Bybit was penalised for never registering, not merely for failing to report.
• Beneficial owner records are expressly part of Section 12(1)(c); keeping only the client's own documents is not compliance.