Third-party reliance

The same investor is identified many times over in a lifetime — by a bank, a broker, a fund and an insurer. Doing all that work again from scratch is waste, and the rules accept as much.

So a reporting entity may rely on a third party for the job of identifying a client and verifying who that client is. It takes the other firm's due diligence and uses it.

The permission comes with six conditions, and the last of them is the one that matters most. The relying entity remains ultimately responsible. If the third party did the work badly, the failure belongs to the firm that leaned on it, not to the firm that did it.

That is why this is a favourite of the enforcement orders. Relying on somebody else feels like sharing the risk. In law it is not shared at all.

The permission (Chapter 3, Rule 9(2) of the PML Rules). For the purpose of clause (a) of Rule 9(1) — identifying clients and verifying their identity using reliable and independent sources — a reporting entity may rely on a third party, subject to six conditions:

Note what clause (f) does and does not do. It does not relax anything by itself. It gives the Regulator room to relax conditions (a) to (d) by guidelines — and it says nothing at all about condition (e). Ultimate responsibility is not relaxable.

Two words to read carefully. Immediately, in clause (a), is when the records must be obtained — not eventually. Without delay, in clause (b), is when the underlying documents must be producible later.

Where else it appears. Chapter VI of the IFSCA (AML, CFT and KYC) Guidelines, 2022 is titled Third Party Reliance — one of the Guidelines' 12 chapters. In the FATF Standards, Recommendation 17 is Reliance on third parties, grouped under the heading Reliance, Controls and Financial Groups together with Recommendation 18 on internal controls and foreign branches and subsidiaries.

A different rule with similar words. Rule 9(1F) says a reporting entity shall not transfer KYC records obtained from the Central KYC Records Registry to any third party unless authorised by the client, the Regulator or the Director. That is about handing records out. Rule 9(2) is about taking them in.

The workbook supplies the enforcement case.

FIU-IND v. Paytm Payments Bank Ltd. Among the charges FIU-IND found substantiated was this one, in its own words: failure of the Bank to satisfy the requirements with respect to reliance on third-party KYC by relying on a non-compliant or unregulated entity, in violation of Section 12 of the PMLA read with Rule 9(2)(c) and Rule 9(2)(f).

Read that against the table. Clause (c) is the requirement that the third party be regulated, supervised or monitored — and the entity relied on was not. By order dated 15 March 2024, under Section 13 of the PMLA, the Director FIU-IND imposed a total penalty of Rs 5,49,00,000 on the bank for that charge and four others, including no internal mechanism to detect and report suspicious transactions on its Payout service and no suspicious transaction reports for 34 beneficiary accounts.

Now an IFSC illustration. Illustrative amounts. Sabarmati Global Fund Management (IFSC) onboards 40 investors introduced by a distributor.

For the 22 investors introduced by Meridian, Sabarmati relies on Meridian's work. Eight months later one of those investors is rated high risk on a change of circumstances. Sabarmati, not Meridian, must perform the enhanced due diligence — clause (e) puts it there. And when a regulator asks for the passport copy of investor number 17, Sabarmati must produce it without delay from Meridian under clause (b), which is why the contract it signed says one business day rather than "reasonable endeavours".

Chapter 3 (The Prevention of Money-laundering (Maintenance of Records) Rules, 2005) carries Rule 9(2) and its six conditions; Chapter 5 lists Chapter VI — Third Party Reliance among the 12 chapters of the IFSCA Guidelines; Chapter 7 (Discussion on PMLA related Cases) supplies the Paytm Payments Bank charge citing Rule 9(2)(c) and Rule 9(2)(f); and Chapter 8 lists Recommendation 17, Reliance on third parties.

Expect a which of the following is NOT a condition for relying on a third party question, and a direct question on who remains responsible. The answer to the second is always the relying reporting entity. The Paytm penalty of Rs 5,49,00,000 and the rule numbers cited in that order are recall material.

• Responsibility never transfers. Clause (e) makes the relying entity ultimately responsible for client due diligence and for enhanced due diligence. The third party's failure is the relying entity's breach.
• The third party must be regulated, supervised or monitored. Relying on an unregulated introducer is the exact charge Paytm Payments Bank was penalised on.
• A high-risk jurisdiction rules the third party out, whatever the quality of its files.
• "Immediately" and "without delay" are two different obligations. Records come in immediately at the start; documents must be producible without delay afterwards.
• Clause (f) relaxes nothing on its own. It only permits the Regulator to issue guidelines considering relaxation of conditions (a) to (d) for a third party inside the same Financial Group — and condition (e) is not in that list.
• Reliance is permissive. The Rule says a reporting entity may rely on a third party. Nothing compels it, and nothing stops it doing the work itself.
• Do not confuse Rule 9(2) with Rule 9(1F). One lets you use another firm's records; the other forbids you handing Central KYC Records Registry records to a third party without authority.
• Reliance covers identification and verification, not the whole file. Rule 9(2) is written for clause (a) of Rule 9(1). Understanding the customer's business and finding the beneficial owner sit in clauses (b) and (c), and the relying entity owns them.