The PML (Maintenance of Records) Rules, 2005

What this chapter covers

Chapter 3 carries 7 marks out of 50 — 14% of the paper.

Learning Objective - After studying this chapter, you should know about: Definition, objective and process of implementation of PML (Maintenance of Records) Rules, 2005 · Detailed explanation of verifying the identity of the client/ true beneficial owner of the assets under Client Due Diligence rules under PMLR, 2005.

3.1 Why rules follow an Act

An act is a law or the statute which has been passed by the legislature and approved by the President of India. Rules, on the other hand, help in governing laws. Rules are created after an act to define how the act will be implemented and performed. Rules are secondary to the act, and are created to provide flexibility in implementation.

Three purposes — define implementation, define performance, provide flexibility. The first sample question offers all three and the answer is All of the above.

Where the power comes from. The Rules were made by the Central Government under section 73 of the Act, after consulting the RBI. The exact words: in exercise of the powers conferred by section 73 of the Prevention of Money-Laundering Act, 2002 (15 of 2003), the Central Government in consultation with the Reserve Bank of India, hereby made the following rules for maintenance of records of the nature and value of transactions, the procedure and manner of maintaining and time for furnishing of information and verification of records of the identity of the clients of the banking companies, financial institutions and intermediaries.

Section 73 is the rule-making power — listed in Chapter 2 as Power to make Rules. Note the consultation with the Reserve Bank of India.

And the current version: vide Gazette Notification dated 7th March, 2023, the above mentioned rules were amended and to be called as the Prevention of Money-laundering (Maintenance of Records) Amendment Rules, 2023.

What the Rules require of entities:

The second sample question tests the third of these — report, not ignore or delay.

And the purpose: by mandating robust customer verification, due diligence and reporting practices, IFSCA, SEBI and RBI aim to create a secure environment within the financial sector to prevent illicit financial activities.

Note that IFSCA is named alongside SEBI and RBI. In the IFSC, it is the regulator whose specifications the Rules refer to.

3.2.1 Rule 3 — records of transactions

Rule 3 of PMLR, 2005 is important because it outlines the responsibilities of reporting entities, their officers, and employees in maintaining information.

Every reporting entity shall maintain the record of all transactions including, the record of -

The third sample question tests clause (A)'s threshold — ten lakh.

Clause (D) lists five channels through which a suspicious transaction may occur:

Note how wide clause (D) is. It covers accounts of every kind, remittances, lending, derivatives, guarantees and collections. The suspicion matters, not the instrument.

Seven clauses: A, B, BA, C, D, E, F. Their letters matter, because Rules 7 and 8 refer to them by letter.

Rule 3A — group programmes

In short, a group must run one AML programme across all its members. It may share information inside the group, but it must keep that information safe. The exact words:

Every reporting entity, which is part of a group, shall implement group-wide programmes against money laundering and terror financing, including group-wide policies for sharing information required for the purposes of client due diligence and money laundering and terror finance risk management and such programmes shall include adequate safeguards on the confidentiality and use of information exchanged, including safeguards to prevent tipping-off.

Two things at once. Share information within the group. But guard it against tipping-off — alerting the client that he has been reported.

Groups are required to implement group-wide policies for the purpose of discharging obligations under the provisions of Chapter IV the Prevention of Money Laundering Act, 2002.

3.2.2 Rule 4 — what the records must contain

The records referred to in rule 3 shall contain all necessary information specified by the regulator to permit reconstruction of individual transaction including the following information:

• (a) the nature of the transactions.
• (b) the amount of the transaction and the currency in which it was denominated.
• (c) the date on which the transaction was conducted; and
• (d) the parties to the transaction.

Four items: nature, amount and currency, date, parties. The governing standard is to permit reconstruction of individual transaction — the same phrase as section 12(1)(a) of the Act.

3.2.3 Rule 5 — procedure and manner of maintaining

Every reporting entity shall maintain information in respect of transactions with its client referred to in rule 3 in accordance with the procedure and manner as may be specified by its regulator from time to time.

Every reporting entity shall evolve an internal mechanism for maintaining such information in such form and manner and at such intervals as may be specified by its regulator from time to time.

And the duty is personal as well as institutional: it shall be the duty of every reporting entity, its designated director, officers and employees to observe the procedure and the manner of maintaining information as specified by its regulator.

3.2.4 Rule 7 — furnishing information

Every reporting entity shall communicate to the Director the name, designation and address of the Designated Director and the Principal Officer.

Both officers, not just one — this is the rule behind FINGate's second registration step.

The Principal Officer shall furnish the information referred to in clauses (A), (B), (BA), (C), (D), (E) and (F) of sub-rule (1) of rule 3 to the Director on the basis of information available with the reporting entity. A copy of such information shall be retained by the Principal Officer for the purposes of official record.

Note the retention duty on the officer himself — a copy for official record.

Every reporting entity shall evolve an internal mechanism having regard to any guidelines issued by the Director in consultation with, its regulator, for detecting the transactions referred to in clauses (A), (B), (BA), (C), (D), (E) and (F)... and for furnishing information about such transactions.

Detection first, then furnishing. The entity must have a way to find reportable transactions. Filing them once found is not enough.

And again the personal duty: it shall be the duty of every reporting entity, its designated director, officers and employees to observe the procedure and the manner of furnishing information.

3.2.5 Rule 8 — the timelines

The Principal Officer of a reporting entity shall furnish the information in respect of transactions referred to in clauses (A), (B), (BA), (C) and (E) of sub-rule (1) of rule 3 every month to the Director by the 15th day of the succeeding month.

The Principal Officer of a reporting entity shall furnish the information promptly in writing or by fax or by electronic mail to the Director in respect of transactions referred to in clause (D) of sub-rule (1) of rule 3 not later than seven working days on being satisfied that the transaction is suspicious.

The Principal Officer of a reporting entity shall furnish, the information in respect of transactions referred to in clause (F) of sub-rule (1) of rule 3, every quarter to the Director by the 15th day of the month succeeding the quarter.

Three timelines, mapped to clause letters:

The penalty rule: delay of each day in not reporting a transaction or delay of each day in rectifying a mis-reported transaction beyond the time limit as specified in this rule shall constitute a separate violation.

Each day is its own violation. A ten-day delay is ten violations, not one. And a mis-reported transaction that is not rectified counts the same way as one never reported.

A one-off COVID relaxation is preserved in the text: information for the months of March 2020, April 2020 and May 2020, and for the quarter January-March 2020, could be furnished by the 30th June, 2020.

Confidentiality: every reporting entity, its Directors, officers, and all employees shall ensure that the fact of maintenance of records referred to in rule 3 and furnishing of information to the Director is kept confidential.

Note what is confidential. It is the fact of reporting itself. That is the anti-tipping-off rule.

With one carve-out: nothing in this rule shall inhibit sharing of information under rule 3A of any analysis of transactions and activities which appear unusual.

3.2.6 Rule 9 — client due diligence

When CDD is triggered. Client due diligence (CDD) means checking who the client really is. It must be done at three moments:

• When an account-based relationship starts.
• For an occasional transaction of an amount equal to or exceeding rupees fifty thousand, whether conducted as a single transaction or several transactions that appear to be connected.
• For any international money transfer operations.

The exact words: every reporting entity shall at the time of commencement of an account-based relationship or while carrying out occasional transaction of an amount equal to or exceeding rupees fifty thousand, whether conducted as a single transaction or several transactions that appear to be connected, or any international money transfer operations:

Three triggers — account opening, an occasional transaction of fifty thousand or more, and any international money transfer operation.

Note that the fifty-thousand threshold does not apply to international money transfers. Those trigger CDD at any value. And connected transactions are added together.

What must be done:

Identify, understand, look behind — the three limbs of CDD.

A timing relaxation: where the Regulator is of the view that money laundering and terrorist financing risks are effectively managed and where this is essential not to interrupt the normal conduct of business, the Regulator may permit the reporting entity to complete the verification as soon as reasonably practicable following the establishment of the relationship.

And a jurisdictional relaxation for depository receipts or equity shares issued or listed in jurisdictions notified by the Central Government, of a company incorporated in India, where the client acts for a beneficial owner resident in that jurisdiction — there the beneficial owner determination follows the norms of such jurisdiction.

The Central KYC Records Registry in Rule 9

Every reporting entity shall within ten days after the commencement of an account-based relationship with a client, file the electronic copy of the client's KYC records with the Central KYC Records Registry.

Ten days from the start of the relationship. The Registry then removes duplicates and gives each client one KYC Identifier.

What the Registry does with them: the Central KYC Records Registry shall process the KYC records received from a reporting entity for de-duplicating and issue a KYC Identifier for each client to the reporting entity, which shall communicate the KYC Identifier in writing to their client.

**A KYC Identifier is the unique number or code assigned to a client/customer by the Central Know Your Customer Records Registry.

And the entity must use it rather than asking again: the reporting entity shall seek the KYC Identifier from the client or retrieve the KYC Identifier, if available, from the Central KYC Records Registry and proceed to obtain KYC records online by using such KYC Identifier and shall not require a client to submit the same KYC records or information or any other additional identification documents or details, unless—

• i. there is a change in the information of the client as existing in the records of Central KYC Records Registry;
• ii. the KYC record or information retrieved is incomplete or is not as per the current applicable KYC norms prescribed by the respective regulator; or
• iii. the reporting entity considers it necessary in order to verify the identity or address (including current address)... or to perform enhanced due diligence or to build an appropriate risk profile of the client.

Three exceptions. The data has changed, it is incomplete, or more is needed. Otherwise, do not ask the client again.

Updating flows back: a reporting entity after obtaining additional or updated information from a client... shall within seven days or within such period as may be notified by the Central Government furnish the updated information to the Central KYC Records Registry which shall update the existing KYC records of the client and the Central KYC Records Registry shall thereafter inform electronically all reporting entities who have dealt with the concerned client.

Seven days upward. Then the Registry informs everyone else.

Who is answerable: the reporting entity which performed the last KYC verification or sent updated information in respect of a client shall be responsible for verifying the authenticity of the identity or address of the client.

And the records are not free to use: a reporting entity shall not use the KYC records of a client obtained from the Central KYC Records Registry for purposes other than verifying the identity or address of the client and shall not transfer KYC records or any information contained therein to any third party unless authorised to do so by the client or by the Regulator or by the Director.

Three possible authorisations — client, Regulator or Director.

Access must be immediate: the regulator shall issue guidelines to ensure that the Central KYC records are accessible to the reporting entities in real time.

And when the Registry notifies an update, the entity must pull it: the reporting entity shall retrieve the updated KYC records from the Central KYC Records Registry and update the KYC record maintained by the reporting entity.

Reliance on a third party — sub-rule (2)

An entity may use due diligence already done by someone else. But six conditions apply.

A reporting entity may rely on a third party subject to the conditions that-

Condition (e) is the one to remember. Reliance never transfers responsibility.

Sub-rule (3) — who is the beneficial owner

The beneficial owner for the purpose of sub-rule (1) in the clause 1.3.3. of the IFSCA AML, CFT and KYC Guidelines is determined as under—

Ten per cent for companies and firms. Fifteen per cent for unincorporated bodies. The beneficial owner is always a natural person.

The fallback: where no natural person is identified under (a) or (b) or (c) above, the beneficial owner is the relevant natural person who holds the position of senior managing official.

Trust: the identification of beneficial owner(s) shall include identification of the author of the trust, the trustee, the beneficiaries with ten percent or more interest in the trust and any other natural person exercising ultimate effective control over the trust through a chain of control or ownership.

Note the trust list is cumulative. It covers the author, the trustee, beneficiaries with ten percent or more, and anyone with ultimate effective control.

Listed entities are excused: where the client or the owner of the controlling interest is an entity listed on a stock exchange in India, or it is an entity resident in jurisdictions notified by the Central Government and listed on stock exchanges in such jurisdictions... or it is a subsidiary of such listed entities, it is not necessary to identify and verify the identity of any shareholder or beneficial owner of such entities.

Documents by client type

Individual — sub-rule (4). An individual gives three things: proof of identity and address, PAN or Form 60, and papers on his business and finances.

**An "equivalent e-document" is an electronic equivalent of a document, issued by the issuing authority of such document with its valid digital signature including documents issued to the digital locker account of the client.

Small accounts — sub-rule (5). A small account lets a person without full documents start banking, under tight limits.

Other clients — sub-rules (6) to (9):

Every type requires the PAN or Form 60 and the individual documents for the beneficial owner.

Non-profit clients — sub-rule (9A): every Banking Company or Financial Institution or intermediary... shall register the details of a client, in case of client being a non-profit organisation, on the DARPAN Portal of NITI Aayog, if not already registered, and maintain such registration records for a period of five years after the business relationship between a client and a reporting entity has ended or the account has been closed, whichever is later.

Updates — sub-rule (9B): the client shall submit to the reporting entity any update of such documents... within 30 days of such updation.

Authorised persons — sub-rule (10): where the client purports to act on behalf of juridical person or individual or trust, the reporting entity shall verify that any person purporting to act on behalf of such client is so authorized and verify the identity of that person. For a trust, the reporting entity shall ensure that trustees disclose their status.

The prohibition — sub-rule (11): no reporting entity shall allow the opening of or keep any anonymous account or account in fictitious names or account on behalf of other persons whose identity has not been disclosed or cannot be verified.

Ongoing due diligence — sub-rule (12)

(i) Every reporting entity shall exercise ongoing due diligence with respect to the business relationship with every client and closely examine the transactions in order to ensure that they are consistent with the knowledge of the client, his business and risk profile and where necessary, the source of funds.

(ii) When there are suspicions of money laundering or financing of the activities relating to terrorism or where there are doubts about the adequacy or veracity of previously obtained client identification data, the reporting entity shall review the due diligence measures including verifying again the identity of the client and obtaining information on the purpose and intended nature of the business relationship.

(iii) The reporting entity shall apply client due diligence measures also to existing clients on the basis of materiality and risk, and conduct due diligence on such existing relationships at appropriate times.

So CDD is not a one-time onboarding event. It continues. It repeats when there is doubt. And it reaches back to existing clients.

Risk assessment — sub-rule (13)

Every reporting entity shall carry out risk assessment to identify, assess and take effective measures to mitigate its money laundering and terrorist financing risk for clients, countries or geographic areas, and products, services, transactions or delivery channels that is consistent with any national risk assessment conducted by a body or authority duly notified by the Central Government.

Four risk dimensions: clients, countries or geographic areas, products and services, and delivery channels.

The assessment shall (a) be documented (b) consider all the relevant risk factors before determining the level of overall risk and the appropriate level and type of mitigation to be applied (c) be kept up to date; and (d) be available to competent authorities and self-regulating bodies.

Guidelines and the CDD Programme — sub-rule (14)

The regulator shall issue guidelines incorporating the requirements of sub-rules (1) to (13), sub-rule (15) and sub-rule (17) and may prescribe enhanced or simplified measures to verify the client's identity taking into consideration the type of client, business relationship, nature and value of transactions based on the overall money laundering and terrorist financing risks involved.

But simplified measures have a limit: simplified measures are not acceptable whenever there is a suspicion of money laundering or terrorist financing, or where specific higher-risk scenarios apply or where the risk identified is not consistent with the national risk assessment.

The guidelines must also provide for those who cannot comply for physical reasons — alternate and viable means of identification, to provide account based services to clients who are unable to undergo biometric authentication, relaxation for continued operation of accounts for clients who are unable to provide Permanent Account Number or Form No. 60, and alternatives for those unable to undergo Aadhaar authentication — owing to injury, illness or infirmity on account of old age or otherwise.

And every entity must have a programme: every reporting entity shall formulate and implement a Client Due Diligence Programme, which shall include policies, controls and procedures, approved by the senior management, to enable the reporting entity to manage and mitigate the risk that have been identified either by the reporting entity or through national risk assessment.

Senior management approval is required.

Verification methods — sub-rule (15)

**Digital KYC is defined as capturing live photo of the client and officially valid document or the proof of possession of Aadhaar, where offline verification cannot be carried out, along with the latitude and longitude of the location where such live photo is being taken by an authorised officer.

Live photo plus GPS coordinates. That is what makes it "digital KYC" rather than a scan.

And for the IFSC: as per IFSCA AML, CFT and KYC Guidelines Digital KYC definition, the word client is replaced with customer and the word reporting entity is replaced with regulated entity.

Redaction — sub-rule (16): where the client submits proof of possession containing the Aadhaar number, the entity must ensure such client redacts or blacks out his Aadhaar number... where the authentication of Aadhaar number is not required.

PAN — sub-rule (17): an existing client must submit his Permanent Account Number or the equivalent e-documents thereof or Form No.60, on such date as may be notified by the Central Government, failing which the account shall temporarily cease to be operational — but before temporarily ceasing operations for an account, the reporting entity shall give the client an accessible notice and a reasonable opportunity to be heard. If the client says in writing he will not submit it, the client's account with the reporting entity shall be closed and all obligations due in relation to the account shall be appropriately settled after establishing the identity of the client.

Address proof — sub-rule (18). Sometimes the OVD does not show the current address. Then these are deemed to be officially valid documents for the limited purpose of proof of address:

• utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, water bill).
• property or Municipal tax receipt.
• pension or family pension payment orders (PPOs)... if they contain the address.
• letter of allotment of accommodation from employer by specified bodies, with leave and licence agreements.

And the relief is temporary: the client shall submit updated officially valid document... with current address within a period of three months.

Self-declaration — sub-rule (19): a client who gave Aadhaar and wants a different current address may give a self-declaration to that effect.

Rule 9A — the Central KYC Records Registry

The Central Government shall within a period of one hundred and eighty days from the date of coming into force of the Prevention of Money-laundering (Maintenance of Records) Amendment Rules, 2015 set-up a Central KYC Records Registry having its own seal for the purpose of receiving, storing, safeguarding and retrieving electronic copies of KYC records obtained by the reporting entities from their clients.

One hundred and eighty days — the fourth sample question. (Note a slip in the workbook: the sample question calls them the Amendment Rules, 2005 while the rule text says 2015. The number tested — 180 days — is the same either way.)

And the IFSC carve-out: however in an International Financial Services Centre, no such receiving, storing, safeguarding and retrieving of records shall be required for a client who is a foreign national.

A foreign national client of an IFSC entity is outside the CKYCR system. That is one of the most examinable IFSC-specific points in the chapter.

The Registry's functions and obligations:

Note that the Registry's compliance officer reports independently to the Central Government. He does not go through the Registry's own management.

And the definition: "Central KYC Records Registry" means a reporting entity, substantially owned and controlled by the Central Government, and authorised by that Government through a notification in the Official Gazette to receive, store, safeguard and retrieve the KYC records in digital form of a client.

As per IFSCA AML, CFT and KYC Guidelines, the Central KYC Records Registry is authorised to receive, store, safeguard and retrieve the KYC records of a customer in digital form.

3.3 The digital KYC procedure

Digital KYC has thirteen steps, lettered A to M. In outline: the entity builds a secure app; the officer and client meet with the original document; live, watermarked photos of both are taken; the form is filled; the client signs by OTP; the officer declares by OTP; and a second officer checks and signs. The exact steps follow.

A. The reporting entities shall develop an application for digital KYC process which shall be made available at customer touch points for undertaking KYC of their customers and the KYC process shall be undertaken only through this authenticated Application of the Reporting Entities.

B. The access of the Application shall be controlled by the Reporting Entities and it should be ensured that the same is not used by unauthorized persons. The Application shall be accessed only through login-id and password or Live OTP or Time OTP controlled mechanism.

C. The client, for the purpose of KYC, shall visit the location of the authorized official of the Reporting Entity or vice-versa. The original Officially Valid Document (OVD) shall be in possession of the client.

Either party may travel, but they must meet, and the original document must be present.

D. The Reporting Entity must ensure that the Live photograph of the client is taken by the authorized officer and the same photograph is embedded in the Customer Application Form (CAF). Further, the system Application... shall put a water-mark in readable form having CAF number, GPS coordinates, authorized official's name, unique employee Code... and Date (DD:MM: YYYY) and time stamp (HH:MM: SS) on the captured live photograph.

Five watermark elements: CAF number, GPS coordinates, official's name, employee code, and date with time stamp.

E. The Application... shall have the feature that only live photograph of the client is captured and no printed or video-graphed photograph of the client is captured. The background behind the client while capturing live photograph should be of white colour and no other person shall come into the frame.

F. Similarly, the live photograph of the original officially valid document... (placed horizontally), shall be captured vertically from above and water-marking in readable form as mentioned above shall be done. No skew or tilt in the mobile device shall be there.

G. The live photograph of the client and his original documents shall be captured in proper light so that they are clearly readable and identifiable.

H. Thereafter, all the entries in the CAF shall be filled as per the documents and information furnished by the client. In those documents where, Quick Response (QR) code is available, such details can be auto-populated by scanning the QR code — for example, from physical Aadhaar/e-Aadhaar downloaded from UIDAI, the details like name, gender, date of birth and address can be auto-populated.

I. Once the above-mentioned process is completed, a One Time Password (OTP) message containing the text that 'Please verify the details filled in form before sharing OTP' shall be sent to client's own mobile number. Upon successful validation of the OTP, it will be treated as client signature on CAF.

**If the client has no mobile number, mobile number of his/her family/relatives/known persons may be used for this purpose and be clearly mentioned in CAF. In any case, the mobile number of authorized officers registered with the Reporting Entity shall not be used for client signature.

That prohibition is the safeguard. The officer cannot sign for the client through his own phone.

J. The authorized officer shall provide a declaration about the capturing of the live photograph of client and the original document. For this purpose, the authorized official shall be verified with One Time Password (OTP) which will be sent to his mobile number registered with the Reporting Entity. Upon successful OTP validation, it shall be treated as authorized officer's signature on the declaration. The live photograph of the authorized official shall also be captured.

Two OTPs and two live photographs — one set for the client, one for the officer.

K. Subsequent to all these activities, the Application shall give information about the completion of the process and submission of activation request to activation officer... and also generate the transaction-id/reference-id number of the process. The authorized officer shall intimate the details regarding transaction-id/reference-id number to client for future reference.

L. The authorized officer... shall check and verify that: i. information available in the picture of document is matching with the information entered by authorized officer in CAF. ii. live photograph of the client matches with the photo available in the document.; and iii. all of the necessary details in CAF including mandatory field are filled properly.

M. On Successful verification, the CAF shall be digitally signed by authorized representative of the Reporting Entity who will take a print of CAF, get signatures/thumb-impression of customer at appropriate place, then scan and upload the same in system. Original hard copy may be returned to the customer.