Risk Based Approach

An intermediary cannot examine every client with the same intensity, and should not try. A retired teacher with a Rs 2 lakh portfolio and an offshore trust routing Rs 40 crore a year do not warrant the same effort, and treating them alike wastes the effort on the wrong one.

The risk based approach is the instruction to spend diligence where the risk is. SEBI requires registered intermediaries to apply each of the client due diligence measures on a risk sensitive basis, under policies approved by their senior management, and to monitor the implementation of those controls and enhance them where necessary.

The approach has one hard limit, and it is the most examined sentence in the section: low risk provisions shall not apply when there are suspicions of money laundering or terrorist financing, or when other factors give rise to a belief that the customer does not in fact pose a low risk.

Classification. Risk factors for assessing and monitoring must be clearly defined, considering the client's location — registered office, correspondence address and any other relevant address — nature of business, trading turnover, and mode of payment. These parameters classify clients as low, medium or high risk. Clients of special category may be placed higher still.

Consequence of classification. The basic principle is that an enhanced client due diligence process applies to higher risk categories and a simplified process may be adopted for lower risk categories. The type and amount of identification information and documents obtained therefore depends on the client's risk category — as does the extent of transaction monitoring, which must be aligned with the risk category of the client.

Risk assessment underneath it. Rule 9(13) and the SEBI guidelines require the intermediary to carry out a risk assessment covering clients, countries or geographical areas, nature and volume of transactions, payment methods and delivery channels, consistent with any national risk assessment. That assessment must be documented, consider all relevant risk factors before determining overall risk, be kept up to date, and be available to competent authorities and self-regulating bodies. It must also take account of country-specific information circulated by the Government of India and SEBI, and the updated list of individuals and entities subject to sanction measures under United Nations Security Council Resolutions.

New products. The exchanges and intermediaries must identify and assess the ML and TF risks arising from new products, new business practices, new delivery mechanisms and new or developing technologies, and must undertake that assessment before launch or use.

Girnar Stock Broking Ltd rebuilds its client risk model and documents the parameters.

What differs. The low-risk client gets the standard document set and periodic monitoring. The jewellery trader gets enhanced due diligence, documented source of funds, an internal alert threshold set at Rs 25 lakh a month, and a KYC refresh every year. Monitoring intensity is set by category, exactly as the guidelines require.

The limit in action. Six months later the low-risk salaried investor starts receiving inward transfers of Rs 40 lakh from three unrelated parties. The relationship manager argues the client is categorised low risk and the simplified documentation stands. That is wrong: low risk provisions shall not apply where there are suspicions of ML or TF, or where other factors suggest the client is not in fact low risk. The category has to be revisited and, if suspicion crystallises, an STR filed.

What a missing model costs. In the SKSE Securities matter SEBI found the broker had not categorised clients into high, medium and low at all, and so was exercising no additional due diligence on higher-risk clients; the AML policy required within one month of the January 2006 circular was still not implemented in 2010. Penalty: Rs 2,00,000 under section 15HB. In the Raima Equities matter, the categorisation existed but had no documented basis, which the Adjudicating Officer held to be arbitrary — again Rs 2,00,000.

Chapter 6 (SEBI Guidelines for AML, CFT and PF), sections 6.2.4 (Risk Management — Risk Based Approach) and 6.2.5 (Risk Assessment), with the statutory hook in Rule 9(13) from Chapter 3. Expect a question on when simplified measures may not be used, one on the four attributes of a documented risk assessment, and case questions from Chapter 8 where the absence or arbitrariness of risk categorisation was the violation.

• Simplified due diligence is never available where there is suspicion, where a higher-risk scenario applies, or where the identified risk is inconsistent with the national risk assessment. This is the trap the paper sets most often.
• A risk category is a live judgement, not a permanent label. Behaviour that contradicts the category overrides it.
• Risk assessment must be documented and available to competent authorities. An assessment that exists only in the compliance officer's head fails on the face of Rule 9(13).
• Categorisation needs a written basis. Raima Equities had categories but no documented rationale, and that was held arbitrary — the penalty was the same as for having no system at all.
• New products must be risk-assessed before launch, not after the first complaint.
• RBA never reduces the reporting obligation. STR reporting has no threshold and no exempt risk category; a low-risk client's attempted transaction of any size is still reportable.