IFSCA (AML, CFT and KYC) Guidelines, 2022

What this chapter covers

Chapter 5 carries 8 marks out of 50 — 16% of the paper, the second largest chapter.

Learning Objective- After studying this chapter, you should know about: The Duties of a Regulated Entity (RE) · The Risk Based Approach to be adopted by the RE · Adoption of the Business Risk Assessment by RE · Aspects of Customer Due Diligence, Reporting of Suspicious Transactions, Record Keeping etc. by RE.

5.1 Introduction

International Financial Services Centres Authority (IFSCA) has implemented several initiatives to combat money laundering, including the IFSCA Anti Money Laundering (AML), Counter Terrorist Financing (CFT) and Know Your Customer (KYC) Guidelines. The abbreviated form of the guidelines is IFSCA (AML, CFT and KYC) Guidelines, 2022.

A note on vocabulary: in the IFSC domain, CFT and CTF are interchangeably used as the abbreviated forms of Counter Terrorist Financing.

What they require: these guidelines mandate regulated entities to establish robust AML frameworks to detect and report suspicious transactions related to money laundering and terrorist financing. Key aspects of these initiatives include customer due diligence, risk assessment, enhanced due diligence for high-risk customers, record-keeping, and reporting of suspicious transactions.

And how compliance is checked: IFSCA conducts both onsite and offsite supervision of regulated entities to ensure compliance with AML/CFT regulations.

The twelve chapters:

Twelve chapters. Chapters IV, V and VI — customer risk, customer due diligence and third-party reliance — are taken up in Chapter 6 of this workbook.

5.2 Duties of a Regulated Entity

A Regulated Entity means a unit/entity which has been granted license, recognition, registration or authorisation by the Authority.

Four routes into the definition — licence, recognition, registration or authorisation.

(a) Every Regulated Entity shall formulate an AML-CFT policy, which shall be duly approved by the Governing Body or by a committee to whom such power has been delegated by the Governing Body. While formulating the AML-CFT policy, every Regulated Entity shall incorporate the key principles or elements of these Guidelines.

(b) Additionally, every Regulated Entity shall develop a KYC Policy which shall be the part of its AML-CFT policy.

The KYC policy sits inside the AML-CFT policy, not alongside it.

(c) Every member of Regulated Entity's Senior Management shall be responsible for the Regulated Entity's compliance under these Guidelines. While carrying out their responsibilities under these Guidelines every member of a Regulated Entity's Senior Management shall exercise due skill, care, and diligence.

Every member of Senior Management — not the compliance officer alone, not the Principal Officer alone, not the Designated Director alone. The first sample question tests exactly this, offering each of those as a distractor.

**And the standard is due skill, care, and diligence.

5.3 The Risk-Based Approach

A footnote sets the tone: the RBA should be an essential foundation in Regulated Entity's AML-CFT compliance culture, and it must trickle down from the level of Senior Management to the rest of the organization.

What the RBA means in plain words. Each entity works out where its money laundering and terrorist financing risks lie. Then it puts the most effort where the risk is highest. The Guidelines' words:

The primary thrust of these guidelines is to enable a Regulated Entity to adopt Risk-Based Approach (RBA) to identify and assess the Money Laundering (ML) and Terrorist Financing (TF) risk to which the Regulated Entity is exposed, depending upon its nature of business and exposure to or involvement with certain types of clients, countries or geographic areas, products, services, transactions, or delivery channels, etc. and document the same.

The three conditions:

• i. The RBA is objective and proportionate to the risks;
• ii. The RBA is based on reasonable grounds; and
• iii. The RBA is reviewed and updated at appropriate intervals.

The second sample question offers all three and the answer is All of the above.

Proportionality: the RBA shall be appropriate to the nature and size of the business. While implementing the RBA, the Regulated Entity shall consider all relevant risk factors before deciding overall risk. Based on the risk assessment, the Regulated Entity shall monitor, manage, and mitigate the risks it is exposed to by applying effective, appropriate and proportionate measures.

Enterprise-wide assessment: in addition to assessing the ML/TF risks presented by an individual customer, a Regulated Entity shall also identify and assess ML/TF risks at an enterprise-wide level, Financial Group-wide level or Group-wide level, wherever applicable. This shall include a consolidated assessment of the Regulated Entity's ML/TF risks perception that exist across all its business units, product lines and delivery channels.

Two levels — the individual customer, and the enterprise as a whole.

What may feed the assessment. Three kinds of outside source can be used:

• FATF Public Statement, the reports and guidance notes on AML/CFT/PF issued by FATF.
• Any country specific information that is circulated by relevant authorities from time to time.
• The updated list of natural and legal persons who are subjected to sanction measures as required under various United Nations' Security Council Resolutions.

Documentation: the outcome of the risk assessment by a Regulated Entity shall be properly documented. The documentation should include: the enterprise-wide AML/CFT risk assessment wherever applicable, details of the implementation of the AML/CFT risk management systems, and controls as guided by the AML/CFT risk assessment.

And it must be producible: a Regulated Entity shall ensure that the ML/TF risk assessment information are made available to the Authority upon request.

Classification: the result of the risk assessment shall be used to classify the ML/TF risks as low, medium, and high. The general principle of this classification is to apply enhanced measures in case of high-risk customers and simplified measures in case of low-risk customers.

Three bands: low, medium, high.

Review: to keep the risk assessments up-to-date, the Regulated Entity shall review its risk assessment at least once every two years or when a material trigger event occurs, whichever is earlier. The outcome of the exercise shall be put up to the Governing Body or such other committee of the Regulated Entity to which power in this regard has been delegated.

Two years, or a material trigger event — whichever is earlier.

5.4 Business Risk Assessment

A regulated entity shall adopt a business risk assessment. It shall take into consideration the nature, size and the complexity of its business activities and take suitable steps to identify its exposure to ML/TF risks.

Six risk factors:

In short: who the customers are, where the business is, what is sold, how much and how complex, and what is new.

And action must follow: based on the assessment and risk identification made as per clauses above, the Regulated Entity shall undertake commensurate mitigation measures.

5.4.1 New products, business practices and technologies

A Regulated Entity shall identify and assess the ML and TF risks that may arise in relation to: i. the development of new products, business practices, including new delivery mechanisms; and ii. the use of new or developing technologies for both new and pre-existing products.

And the timing matters most: the Regulated Entity shall undertake the above risk assessment exercise, prior to the launch or use of such products, practices and technologies and shall take appropriate measures to manage and mitigate the risks.

Before launch, not after. Note that the technology limb covers both new and pre-existing products. A new technology applied to an old product triggers the assessment too.

5.4.2 AML/CFT systems and controls

The nature and extent of AML/CFT systems and controls implemented by a Regulated Entity shall be commensurate with the ML/TF risks identified via the enterprise-wide ML/TF risk assessment, wherever applicable.

The information obtained from the risk assessment shall be used to:

So the risk assessment is not a report that sits on a shelf. It shapes the controls, and the controls must be able to spot a PEP.

Who a PEP is: "Politically Exposed Persons" (PEPs) are individuals who have been entrusted with prominent public functions by a foreign country, including the heads of States or Governments, senior politicians, senior government or judicial or military officers, senior executives of state-owned corporations and important political party officials.

Note "by a foreign country" in this definition. And note that the systems must detect a PEP not only as customer but as Beneficial Owner. In insurance they must also detect one as a beneficiary of the policy, or a Beneficial Owner of such beneficiary.

Approval and monitoring: the AML/CFT policies, procedures and controls shall be approved by Senior Management to enable a Regulated Entity to effectively manage and mitigate the risks either identified by it or notified to it by the Authority or other relevant authorities. Further, the Regulated Entity shall constantly monitor the implementation of the policies, procedures and controls, and improve them, if necessary.

5.5 Suspicious transactions

5.5.1 Identification

As per PML Rules, Registered Intermediaries shall ensure that appropriate steps are taken to enable suspicious transactions to be recognized and have appropriate procedures for reporting suspicious transactions. While determining suspicious transactions, registered intermediaries shall be guided by the definition of a suspicious transaction contained in PML Rules as amended from time to time.

Internal reporting requirements. A regulated entity shall establish and maintain policies, procedures, systems and controls in order to monitor and detect suspicious transactions with respect to potential ML/TF. It shall also

put in place such policies, procedures, systems and controls which ensure that whenever any of its employee, acting in the ordinary course of his employment, either: (i) knows; (ii) suspects; or (iii) has reasonable grounds for knowing or suspecting; that a person is engaged in or attempting ML/TF, that employee promptly notifies the Principal Officer of the Regulated Entity with all relevant details.

Put simply: if any employee knows or suspects money laundering, he must tell the Principal Officer at once.

Three states of mind — knows, suspects, or has reasonable grounds for knowing or suspecting — and the duty is to notify promptly the Principal Officer.

Note the internal route. An employee does not report to FIU-IND; he reports to the Principal Officer, who decides and files.

Indications of suspicious transactions — four steps:

• (a) Detect a suspicious indicator(s);
• (b) Ask the customer questions;
• (c) Review customer's records; and
• (d) Evaluate the above information.

Detect, ask, review, evaluate.

5.5.2 Reporting

A Regulated Entity shall furnish to the Director, Financial Intelligence Unit-India (FIU-IND), the required information referred to in rule-3 of the PML Rules and in accordance with the terms of rule-7 thereof.

The Guidelines then add:

In plain words: use FIU-IND's formats and tools, use software that raises alerts, and remember that each day of delay is a fresh violation.

And four further requirements:

i. The Suspicious Transaction Report (STR) shall be submitted promptly on conclusion that any transaction or a series of transactions that are integrally connected, are of suspicious nature. The Principal Officer shall record his reasons for treating any transaction or relating to suspicious. It shall be ensured that there is no undue delay in arriving at such a conclusion.

Note that last sentence. An entity may not put off its conclusion in order to put off the report.

ii. The Non-Profit Organization Transaction Reports (NTRs) for each month shall be submitted to FIU-IND by 15th of the succeeding month.

iii. The Principal Officer shall be responsible for timely submission of STR and NTR to FIU-IND;

iv. Utmost confidentiality shall be maintained in filing of STR and NTR to FIU-IND.

And: a regulated entity and its employees or agents are required to maintain the confidentiality of the STR in the manner prescribed by IFSCA from time to time.

Gatekeeper professions. Lawyers, notaries, accountants, and entities offering services shall report suspicious transactions when, on behalf of or for a client, they engage in a financial transaction in relation to the following activities:

• i. buying and selling of real estate;
• ii. managing of client money, securities or other assets;
• iii. management of bank, savings or securities accounts;
• iv. organization of contributions for the creation, operation or management of companies;
• v. creation, operation or management of legal persons or arrangements, and buying and selling of business entities.

Five activities.

5.6 Correspondent banking and wire transfers

5.6.1 Correspondent banking

In plain words. One bank (the correspondent) offers services to another bank (the respondent), usually in a foreign market. The Guidelines' description:

Correspondent banking is a banking arrangement where one bank (the correspondent bank) provides services to another bank (the respondent bank), typically to facilitate transactions in a foreign country. These services can include things like wire transfers, currency exchange, and trade finance. Essentially, the correspondent bank acts as an intermediary, enabling the respondent bank to offer services to its customers even if it doesn't have a direct presence in that market.

A Regulated Entity shall have a policy approved by its Governing Body, or by a committee headed by the Chairman/CEO/MD to lay down parameters for approving correspondent banking relationships subject to the following conditions:

Two absolute prohibitions concern shell financial institutions. There can be no relationship with one. And no shell may use the accounts indirectly.

5.6.2 Wire transfers

Wire Transfer means any transaction carried out on behalf of a Wire Transfer Originator through a financial institution by electronic means with a view to making an amount of funds available to a beneficiary person at a Beneficiary Institution, irrespective of whether the originator and the beneficiary are the same person.

Note that last clause. A transfer to oneself is still a wire transfer.

Scope. The rules cover money sent and money received by wire for a customer. They do not cover transfers between two financial institutions acting for themselves. The exact words: the clause applies when it sends funds by wire transfer or when it receives funds (including serial payments and cover payments) by wire transfer on the account of the wire transfer originator or the wire transfer beneficiary, but shall not apply to a transfer and settlement between the bank and another financial institution where the bank and the other financial institution are acting on their own behalf.

And the IFSC rule again: all Financial Institutions shall transact and receive all monetary consideration (i.e., funds/fees/amount) only through an account maintained with a Banking Unit in the IFSC.

Also: the Regulated Entity shall verify the information pertaining to its customer where there is a suspicion of ML/TF.

Screening and sanctions:

In plain words: watch payments to risky places, freeze a confirmed terrorist's money at once, send possible matches to the Principal Officer, and never strip details from a payment message.

That last prohibition is the anti-stripping rule.

Before every wire transfer. The sending bank must know who is sending the money, and must keep enough detail to rebuild the transfer later. The exact words: every bank that is an ordering institution shall identify the wire transfer originator and verify his or its identity; and record adequate details of the wire transfer so as to permit its reconstruction, including but not limited to, the date of the wire transfer, the type and amount of currency transferred and the value date.

The USD 1000 threshold

Below or equal to USD 1000, a cross-border wire must carry:

Four data points — two names and two account numbers.

If the amount to be transferred exceeds USD 1000, the ordering institution must include the information required as above and any of the following:

One more identifying element about the originator, over and above the basic four.

A note on exactly USD 1000. The workbook says both things. Its first list is headed below or equal to USD 1000. It then adds that in a cross-border wire transfer where the amount to be transferred is equal to USD 1000, every bank which is an ordering institution shall also comply with these requirements. So a transfer of exactly USD 1000 must carry the extra originator detail as well.

And the boundary is stated expressly: in a cross-border wire transfer where the amount to be transferred is equal to USD 1000, every bank which is an ordering institution shall also comply with these requirements.

Batch files: where several individual cross-border wire transfers from a single wire transfer originator are bundled in a batch file for transmission to wire transfer beneficiaries, a bank shall ensure that the batch transfer file contains below information which are fully traceable within the beneficiary country: i. the wire transfer originator information required under above Clause, which has been verified; and ii. the wire transfer beneficiary information required under above Clause. And these Guidelines shall apply to all Cross-Border Wire Transfers which are bundled in a batch file.

Note that the originator information in a batch must have been verified.

5.6.3 The intermediary institution

An intermediary bank sits in the middle of a transfer. It must pass on, or keep, the details it receives.

And: the Intermediary Institution shall be required to take all reasonable measures, consistent with straight-through processing, to identify cross-border wire transfers that lack the information required.

5.6.4 Domestic wire transfers

"Domestic Wire Transfer" means a wire transfer where both the ordering institution and beneficiary institution are located in the IFSC and also refers to any chain of wire transfers that takes place entirely within the IFSC.

Note the definition. "Domestic" here means within the IFSC, not within India.

The ordering institution has two options. It can send full details, or it can send just the account number and supply the rest on request.

Three business days for the beneficiary institution or the Authority. Immediately for law enforcement.

(c) All wire transfer originator and beneficiary information collected by the ordering institution shall be documented. Where the ordering institution is unable to comply with the requirements under all of the Clauses above, it shall not execute the wire transfer.

The transfer simply does not go.

5.7 Internal policies, compliance, audit and training

Internal Policies: A Regulated Entity shall develop and implement adequate internal policies, procedures, and controls, taking into consideration its ML/TF risks and the size of business, to help prevent ML/TF, and communicate these to its employees.

And keep them current: it is important that a Regulated Entity updates its policies and procedures in a timely manner, to take into account new operational, legal and regulatory developments and emerging or new ML/TF risks.

5.7.1 Compliance and the Principal Officer

A Regulated Entity shall develop appropriate compliance management, including appointing or designating a Principal Officer at the management level and shall also develop compliance framework. They shall ensure that the Principal Officer, as well as any other persons appointed to assist him, is suitably qualified and, has adequate resources and timely access to all customer records and other relevant information which he may require to discharge his functions. Further a Regulated Entity shall ensure that the Principal Officer has the necessary seniority and authority within the Regulated Entity to effectively perform his responsibilities.

Four supports: qualification, resources, access to records, and seniority with authority.

His eight responsibilities:

In short, he watches, leads, informs, reacts, reports, trains and keeps Senior Management told.

Independence: the business interests of a Regulated Entity should not interfere with the effective discharge of the above-mentioned responsibilities of the Principal Officer and potential conflicts of interest should be avoided.

And structurally: to enable unbiased judgments and facilitate impartial advice to management, the Principal Officer should be distinct from the internal audit and business line functions. Where any conflict between business lines and the responsibilities of the Principal Officer arises, procedures should be in place to ensure that AML/CFT concerns are objectively considered and addressed at the appropriate level of the Regulated Entity's management.

Distinct from both audit and the business lines. He is neither a salesman nor the auditor.

5.7.2 Audit

A Regulated Entity shall maintain an audit function that is adequately resourced and independent, that is able to regularly assess the effectiveness of the Regulated Entity's internal policies, procedures and controls.

A Regulated Entity's AML/CFT framework should be subjected to periodic audits. Such audits should be performed not just on individual business functions but also on a Regulated Entity-wide basis.

Auditors should assess the effectiveness of measures taken to prevent ML/TF. This would inter-alia include ―

• i. Determining the adequacy of the Regulated Entity's AML/CFT policies, procedures and controls, ML/TF risk assessment framework and application of risk-based approach;
• ii. Reviewing the content and frequency of AML/CFT training programmes, and the extent of employee's, officer's and representative's compliance with established AML/CFT policies and procedures; and
• iii. Assessing whether instances of non-compliance are reported to Senior Management on a timely basis.

And proportionality again: the frequency and extent of the audit should be commensurate with the ML/TF risks presented and the size and complexity of the Regulated Entity's business.

5.7.3 Training and awareness

The Regulated Entity shall provide AML/CFT training to all relevant employees, periodically. It shall ensure that its AML/CFT training enables its employees to:

Note item vi. Employees must know who the Principal Officer is, since internal reporting runs to him.

And it must be tailored: the Regulated Entity shall ensure that its AML/CFT training is relevant and tailored to the Regulated Entity's activities, including its products, services, customers, distribution channels, business partners, level and nature of its transactions and identifies and indicates the different levels of ML/TF risk and vulnerabilities.

5.7.4 International agreements

The Regulated Entities shall ensure that in terms of Section 51A of the Unlawful Activities (Prevention) Act, 1967 (UAPA) and amendments thereto, they do not have any account in the name of individuals/entities appearing in the lists of individuals and entities, suspected of having terrorist links, which are approved by and periodically circulated by the United Nations Security Council (UNSC).

The two lists:

• a) The "ISIL (Da'esh) & Al-Qaida Sanctions List", which includes names of individuals and entities associated with the Al-Qaida.
• b) The "1988 Sanctions List", consisting of individuals (Section A of the consolidated list) and entities (Section B) associated with the Taliban.

And what to do on a match: details of accounts resembling any of the individuals/entities mentioned in the above lists, shall be reported to FIU-IND apart from advising Ministry of Home Affairs as required under UAPA Order bearing file no.14014/01/2019/CFT dated February 2, 2021, issued by the CTCR Division of the Ministry of Home Affairs, Government of India.

Two recipients — FIU-IND and the Ministry of Home Affairs. And note the word resembling. A near match must be reported, not only an exact one.

In addition: other UNSC Resolutions circulated by the IFSCA in respect of any other jurisdictions/entities from time to time, shall also be taken note of for necessary compliances.

5.8 Record keeping

A Regulated Entity shall maintain the following records:

Note "whether or not it results in a Suspicious Transactions Report" in item (b). The analysis is kept even where the conclusion was that no report was needed.

The retention period: the Regulated Entity shall preserve all necessary records, for at least six years or for such period as prescribed under the applicable laws, from the date on which business relationship has ended or transaction is completed.

Six years. That is longer than the PMLA's five, so the IFSC standard is the stricter one.

And on demand: the Regulated Entity shall provide to the Authority or any law enforcement agency immediately on request, a copy of a records maintained by it under these Guidelines.

5.8.1 Risk assessment documents

A Regulated Entity shall keep and maintain all risk assessment documents and provide to the Authority immediately on request, all relevant documents and information, including:

• a) the business risk assessment undertaken by them;
• b) how the business risk assessment in (a) was used for the purposes of complying with the guidelines.
• c) the risk assessment of its customer undertaken and,
• d) the determination of risk rating.

Electronic form is allowed: the above records may be kept in electronic format, subject to the condition that such records are readily accessible and promptly made available to the Authority or other law enforcement agency, on demand.

When the relationship ended: where the date on which the business relationship with a customer has ended remains unclear, it may be taken to have ended on the date of the completion of the last transaction.

The system must allow:

Four tests, then: quick retrieval, checkable compliance, identifiable customers, and transactions that can be rebuilt.

Records held outside the IFSC. Three duties apply:

• Take all reasonable steps to ensure that the records are kept in a manner consistent with the Guidelines.
• Ensure that the records are easily accessible to it.
• Ensure that the records are immediately made available for inspection, when so desired by the Authority.

And secrecy laws must be checked: all Regulated Entities shall verify if there are secrecy or data protection laws that would restrict access without delay to the records referred by the Regulated Entities, the Authority or the law enforcement agencies of India; and where such law exists, obtain without delay, the certified copies of the relevant records and keep such copies in a jurisdiction which allows access by those persons referred above.

A foreign secrecy law is not an excuse. Certified copies must be moved to a jurisdiction where they can be reached.