Prevention of Money Laundering Act, 2002

What this chapter covers

This chapter carries 7 per cent of the III-A examination.

LEARNING OBJECTIVES: After studying this chapter, you should know about: Some key provisions of the PMLA, 2002 · Policies and procedures to be put in place by intermediaries to prevent money laundering · Key features of SEBI (Foreign Portfolio Investors) Regulations, 2014

9.1 Introduction

The Prevention of Money Laundering Act, 2002 (PMLA) forms the core of the legal framework put in place by India to combat money laundering. The provisions of PMLA came into force on July 1 2005.

Its objective: to prevent money-laundering and to provide for confiscation of property derived from, or involved in, money-laundering and for matters connected therewith or incidental thereto.

9.2 Highlights of the Act

Section 3 — the offence

Whosoever directly or indirectly attempts to indulge or knowingly assists or knowingly is a party or is actually involved in any process or activity connected with the proceeds of crime including its concealment, possession, acquisition or use and projecting or claiming it as untainted property shall be guilty of the offence of money laundering.

Six connected activities: (a) concealment; or (b) possession; or (c) acquisition; or (d) use; or (e) projecting as untainted property; or (f) claiming as untainted property, in any manner whatsoever.

And the offence does not end when the act ends: the process or activity connected with proceeds of crime is a continuing activity and continues till such time a person is directly or indirectly enjoying the proceeds of crime by its concealment or possession or acquisition or use or projecting it as untainted property or claiming it as untainted property in any manner whatsoever.

A continuing offence — it lasts as long as the enjoyment lasts.

Section 4 — punishment

Whoever commits the offence of money-laundering shall be punishable with rigorous imprisonment for a term which shall not be less than 3 years but which may extend to 7 years and shall also be liable to fine. In cases where the proceeds of crime involved in money-laundering relate to any offence as specified in Paragraph 2 of Part A of the Schedule to the PMLA, 2002, the term of imprisonment shall not be less than 3 years but which may extend to 10 years.

Three to seven years normally; three to ten for Paragraph 2 of Part A offences.

Section 5 — attachment

Attachment needs two beliefs, held by the Director, or any other officer not below the rank of Deputy Director, authorized by the Director. He must have reason to believe on the basis of the material in his possession:

• that any person is in possession of any proceeds of crime; and
• that such proceeds of crime are likely to be concealed, transferred or dealt with in any manner which may result in frustrating any proceedings relating to the confiscation.

He then may order to attach such property for a period not exceeding 180 days from the date of such order.

Not below Deputy Director; 180 days.

Adjudication

The Central Government shall appoint an Adjudicating Authority. It acts on a complaint. It must have reason to believe that a person has committed an offence under section 3 or holds proceeds of crime. It then may serve a notice of not less than 30 days on such person calling upon him to indicate the sources of his income, earnings or assets, out of which or by means of which he has acquired the property which has been attached, or, seized or frozen, the evidence on which he relies and other relevant information and particulars, and to show cause why all or any of such properties should not be declared to be the properties involved in money-laundering and confiscated by the Central Government.

Not less than 30 days, and the person must explain his sources.

Section 12 — obligations of reporting entities

Every reporting entity shall:

(a) maintain a record of all transactions, including information relating to transactions covered under clause (b), in such manner as to enable it to reconstruct individual transactions.

(b) furnish to the Director within such time as may be prescribed, information relating to such transactions, whether attempted or executed, the nature and value of which may be prescribed.

Note "whether attempted or executed" — an abandoned transaction is reportable.

(c) maintain record of documents evidencing identity of its clients and beneficial owners as well as account files and business correspondence relating to its clients.

Confidentiality: every information maintained, furnished or verified... shall be kept confidential.

Two five-year periods:

The records referred to in clause (a)... shall be maintained for a period of five years from the date of transaction between a client and the reporting entity.

The records [of identity]... shall be maintained for a period of five years after the business relationship between a client and the reporting entity has ended or the account has been closed, whichever is later.

Transaction records run from the transaction; identity records run from the end of the relationship.

And exemption is possible: the Central Government may, by notification, exempt any reporting entity or class of reporting entities from any obligation under this Chapter.

What the Rules require by way of value: every reporting entity shall maintain the record of all transactions including the record of all cash transactions of the value of more than ten lakhs rupees or its equivalent in foreign currency.

The first review question tests that figure — Rs. 10 lakh.

Section 12AA — enhanced due diligence

Every reporting entity shall, prior to the commencement of each specified transaction:

(a) verify the identity of the clients undertaking such specified transaction by authentication under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. There is an alternative process where verification requires authentication of a person who is not entitled to obtain an Aadhaar number.

(b) take additional steps to examine the ownership and financial position, including sources of funds of the client.

(c) take additional steps as may be prescribed to record the purpose behind conducting the specified transaction and the intended nature of the relationship between the transaction parties.

And a hard stop: where the client fails to fulfil the conditions laid down under sub-section (1), the reporting entity shall not allow the specified transaction to be carried out.

Where suspicion arises: the entity shall increase the future monitoring of the business relationship with the client, including greater scrutiny or transactions.

Retention: the information obtained while applying the enhanced due diligence measures... shall be maintained for a period of five years from the date of transaction.

"Specified transaction" means:

• (a) any withdrawal or deposit in cash, exceeding specified amount.
• (b) any transaction in foreign exchange, exceeding specified amount.
• (c) any transaction in any high value imports or remittances.
• (d) such other transaction or class of transactions, in the interest of revenue or where there is a high risk or money-laundering or terrorist financing, as may be prescribed.

Sections 12A and 13 — the Director's powers

Section 12A — the Director may call for from any reporting entity any of the records and any additional information as he considers necessary; every reporting entity shall furnish to the Director such information as may be required by him... within such time and in such manner as he may specify; and the information shall be kept confidential.

Section 13 — the Director may either of his own motion or on an application made by any authority, officer or person, make such inquiry or cause such inquiry to be made with regard to a reporting entity's obligations.

And he may order an audit: where having regard to the nature and complexity of the case, [he] is of the opinion that it is necessary to do so, he may direct the concerned reporting entity to get its records, as may be specified, audited by an accountant from amongst a panel of accountants maintained by the Central Government — the expenses being borne by the Central Government.

"Accountant" means a Chartered accountant within the meaning of the Chartered Accountants Act, 1949.

Where a failure is found, without prejudice to other action, he may:

• (a) issue a warning in writing.
• (b) direct such reporting entity or its designated director on the Board or any of its employees to comply with specific instructions.
• (c) direct... to send reports as such interval as may be prescribed.
• (d) by an order impose a monetary penalty... which shall not be less than ten thousand rupees but may extend to one lakh rupees for each failure.

Ten thousand to one lakh, for each failure.

And the order is circulated: the Director shall forward a copy of the order so passed to every banking company, financial institution or intermediary or person who is a party to the proceedings.

Appeals: any person aggrieved by the order passed by the Director or the Adjudicating Officer under the PMLA, 2002 may prefer to appeal to the Appellate Tribunal.

Two officers

The intermediaries are required to appoint a Principal Officer... responsible to discharge the legal obligations to report suspicious transactions to authorities. The Principal Officer is responsible for reviewing the alerts received from regulators/exchanges.

Designated Director is defined as a person designated by the reporting entity to ensure overall compliance with the obligations imposed under the Act and Rules.

And both must be notified: every reporting entity shall communicate to FIU Delhi/Regulator on name, designation and address of Designated Director and Principal Officer.

9.3 SEBI's AML and CFT master circular

A 'Principal Officer' needs to be designated who shall be responsible for ensuring compliance of the provisions of the PMLA. SEBI's circulars cover Know Your Client (KYC) norms, Anti-Money Laundering (AML), Client Due Diligence (CDD), and these directives lay down minimum requirements — intermediaries may, according to their requirements specify additional disclosures.

Each intermediary shall consider carefully the specific nature of its business, organizational structure, type of client and transaction, etc. to satisfy itself that the measures taken by it are adequate and appropriate.

Cross-border rule: in case there is a variance in Client Due Diligence (CDD) / Anti Money Laundering (AML) standards specified by SEBI and the regulators of the host country, branches/overseas subsidiaries of registered intermediaries are required to adopt the more stringent requirements of the two.

The stricter standard always wins. And if the host country does not permit the proper implementation of AML/CFT measures consistent with the home country requirements, financial groups shall be required to apply appropriate additional measures to manage the ML/TF risks, and inform SEBI.

On terrorist financing, there is a Government order of February 02, 2021 under the Unlawful Activities (Prevention) Act, 1967 (UAPA). It covers nine areas. They include:

• Appointment and communication details of the UAPA Nodal officers.
• Communication of list of designated individuals/entities.
• Treatment of bank accounts, stocks or insurance policies, and of immovable property.
• Real estate agents, dealers or precious metals /stones and other designated non-financial business and profession.
• Requests received from foreign countries under a resolution passed by the UN Security Council, and exemptions under UNSCR.
• The procedure for unfreezing of funds... of individuals/entities inadvertently affected by the freezing mechanism.
• Prevention of entry into or transit through India.

9.3.1 Obligation to establish policies

Senior management of a registered intermediary should be fully committed to establishing appropriate policies and procedures. Intermediaries should:

a) Issue a statement of policies and procedures on a group basis where applicable.

b) Ensure that the content of these directives is understood by all staff members.

c) Regularly review the policies and procedures... Further to ensure effectiveness of policies and procedures, the person who reviews should be different from the person framing the policies and procedures.

A separation of reviewer from author — the same principle that keeps an investigator from judging his own case.

d) Adopt client acceptance policies and procedures that are sensitive to the risk of Money Laundering (ML) and Terrorism Financing (TF).

e) Undertake Client Due Diligence (CDD) measures to an extent that is sensitive to the risk.

f) Have a system in place for identifying, monitoring and reporting suspected money laundering to the law enforcement authorities.

g) Develop staff members' awareness and vigilance to guard against ML and TF.

9.3.2 What the policies must cover

The policies must cover six things:

• Communication of group policies... to all management and relevant staff that handle account information, securities transactions, money and client records etc. whether in branches, departments or subsidiaries.
• Client acceptance policy and due diligence measures, including requirements for proper identification.
• Maintenance of records.
• Compliance with relevant statutory and regulatory requirements.
• Cooperation with the relevant law enforcement authorities, including timely disclosure of information.
• The role of internal audit or compliance function. This includes testing of the system for detecting suspected money laundering transactions evaluating and checking the adequacy of exception reports generated on large and/or irregular transactions, the quality of reporting of suspicious transactions and the level of awareness of front line staff.

And the audit function must be real: the internal audit function shall be independent, adequately resourced and commensurate with the size of the business and operations, organization structure, number of clients and other such factors.

9.3.3 Written procedures

Each registered intermediary should adopt written procedures... Such procedures should include the following three specific parameters which are related to the CDD process: (a) Policy for acceptance of clients (b) Procedure for identifying the clients (c) Risk Management (d) Monitoring of Transactions.

The fourth review question asks what need not be included — none of the listed items can be omitted. Client acceptance, client identification and transaction monitoring with suspicious transaction reporting are all required, so the answer is none of the above.

9.3.4 Client Due Diligence

The CDD measures comprise:

(a) Obtaining sufficient information in order to identify persons who beneficially own or control securities account. The beneficial owner is the natural person or persons who ultimately own, control or influence a client and/or person on whose behalf a transaction is being conducted. It also incorporates those persons who exercise ultimate effective control over a legal person or arrangement.

(b) Identify the clients, verify their identity using reliable and independent sources of identification, obtain information on the purpose and intended nature of the business relationship.

(c) Verify the client's identity using reliable, independent source documents, data or information — and where he acts for another, verify that any person purporting to act on behalf of such client is so authorized and verify the identity of that person. For a trust, the reporting entity should ensure that trustees disclose their status at the time of commencement of an account-based relationship.

(d) Identify beneficial ownership and control. (e) Verify the identity of the beneficial owner. (f) Understand the ownership and control structure of the client.

(g) Conduct ongoing due diligence and scrutiny... to ensure that the transactions being conducted are consistent with the registered intermediary's knowledge of the customer, its business and risk profile, taking into account, where necessary, the customer's source of funds.

(h) Review the measures when there are suspicions of money laundering or financing of the activities relating to terrorism or where there are doubts about the adequacy or veracity of previously obtained client identification data.

(i) periodically update all documents, data or information of all clients and beneficial owners... particularly for high risk clients.

(j) Register a non-profit organisation client on the DARPAN Portal of NITI Aayog. Keep those records for a period of five years after the business relationship... has ended or the account has been closed, whichever is later.

(k) Where CDD would tip-off the client, the intermediary should not pursue the CDD process, and instead file a STR with FIU-IND.

(l) No transaction or account-based relationship should be undertaken without following the CDD procedure.

Client acceptance safeguards

No account should be opened anonymous or in a fictitious name or on behalf of other persons whose identity has not been disclosed or cannot be verified.

Risk classification: factors having regard to clients' location, nature of the business activity, trading turnover etc. and manner of making payment, enabling the classification of clients into low, medium and high risk.

Clients of Special Category (CSC) come in eight illustrative types:

**The list is only illustrative and the intermediary shall exercise independent judgment to ascertain whether any other set of clients shall be classified as CSC or not.

Where CDD cannot be applied: it should be ensured that an account is not opened where the intermediary is unable to apply appropriate CDD measures — where identity cannot be ascertained, the information is suspected to be non-genuine, or there is perceived non-co-operation. The intermediary should not continue to do business with such a person and file a suspicious activity report, and should be cautious to ensure that it does not return securities or money that may be from suspicious trades.

Where a client acts for another, the circumstances should be clearly laid down, including transaction limits, additional authority required for transactions exceeding a specified quantity / value, and the rights and responsibilities of both the persons.

And a screening check: necessary checks and balances should be put into place before opening an account so as to ensure that the identity of the client does not match with any person having known criminal background or is not banned in any other manner, whether in terms of criminal or civil proceedings by any enforcement agency worldwide.

9.3.5 Client Identification Procedure and PEPs

The 'Know your Client' (KYC) policy should clearly spell out the Client Identification Procedure (CIP) to be carried out at different stages i.e. while establishing the intermediary–client relationship, while carrying out transactions for the client or when the intermediary has doubts regarding the veracity or the adequacy of previously obtained client identification data.

On Politically Exposed Persons:

All registered intermediaries shall proactively put in place appropriate risk management systems to determine whether their client or potential client or the beneficial owner of such client is a Politically Exposed Person (PEP), including seeking relevant information from the client, referring to publicly available information or accessing the commercial electronic databases of PEPs.

All registered intermediaries are required to obtain senior management approval for establishing business relationships with Politically Exposed Persons (PEPs). Where a client has been accepted and the client or beneficial owner is subsequently found to be, or subsequently becomes a PEP, registered intermediaries shall obtain senior management approval to continue the business relationship.

Approval both at entry and on later discovery.

And: registered intermediaries should also take reasonable measures to verify the sources of funds as well as wealth of clients and beneficial owners identified as PEP.

Other CIP requirements:

• The client must be identified by using reliable sources including documents / information.
• The information must satisfy competent authorities (regulatory / enforcement authorities) in future that due diligence was observed.
• Each original document should be seen prior to acceptance of a copy.
• Failure by prospective clients to provide satisfactory evidence of identity shall be noted and reported to the higher authority within the intermediary.

No thresholds, no exemptions: irrespective of the amount of investment made by clients, no minimum threshold or exemption is available to registered intermediaries (brokers, depository participants, AMCs etc.) from obtaining the minimum information/documents... Further no exemption from carrying out CDD exists in respect of any category of clients... non-compliance shall attract appropriate sanctions.

9.3.6 and 9.3.7 Records

Records must be sufficient to permit reconstruction of individual transactions (including the amounts and types of currencies involved, if any) so as to provide, if necessary, evidence for prosecution of criminal behaviour.

For a satisfactory audit trail, retain:

• (a) the beneficial owner of the account.
• (b) the volume of the funds flowing through the account.
• (c) for selected transactions: the origin of the funds; the form in which the funds were offered or withdrawn, e.g., cash, cheques, etc.; the identity of the person undertaking the transaction; the destination of the funds; the form of instruction and authority.

Retention periods:

One open-ended case: in situations where the records relate to ongoing investigations or transactions which have been the subject of a suspicious transaction reporting, they shall be retained until it is confirmed that the case has been closed.

9.3.8 Monitoring of transactions

Regular monitoring of transactions is vital... This is possible only if the intermediary has an understanding of the normal activity of the client so that it can identify deviations.

The intermediary has to pay special attention to all complex, unusually large transactions / patterns which appear to have no economic purpose, may specify internal threshold limits for each class of client accounts, and must examine the background carefully and findings be recorded in writing — those findings being made available to auditors and also to SEBI/stock exchanges/FIU-IND/other relevant authorities.

CDD applies to existing clients too, on the basis of materiality and risk, and the extent of monitoring shall be aligned with the risk category of the client.

And the compliance cell shall randomly examine a selection of transactions undertaken by clients to comment on their nature.

9.3.9 Suspicious transactions

Seven illustrative circumstances can signal a suspicious transaction:

1. Clients whose identity verification seems difficult or clients that appear not to cooperate.
2. Asset management services for clients where the source of the funds is not clear or not in keeping with the client's apparent standing /business activity.
3. Clients based in high-risk jurisdictions.
4. Substantial increases in business without apparent cause.
5. Clients transferring large sums of money to or from overseas locations with instructions for payment in cash.
6. Attempted transfer of investment proceeds to apparently unrelated third parties.
7. Unusual transactions by CSCs and businesses undertaken by offshore banks/ financial services, businesses reported to be in the nature of export/ import of small items.

Any suspicious transaction shall be immediately notified to the Designated/Principal Officer within the intermediary, by a detailed report with specific reference to the clients, transactions and the nature/ reason of suspicion.

And then the crucial instruction: it shall be ensured that there is continuity in dealing with the client as normal until told otherwise and the client shall not be told of the report/suspicion.

Attempted transactions count: the intermediary shall report all such attempted transactions in STRs, even if not completed by clients, irrespective of the amount of the transaction.

High-risk country clients are CSC and shall also be subject to appropriate counter measures, including further enhanced scrutiny of transactions, enhanced relevant reporting mechanisms or systematic reporting of financial transactions.

9.3.10 Reporting to FIU-IND

a) The Cash Transaction Report (CTR) (wherever applicable) for each month shall be submitted to FIU-IND by 15th of the succeeding month.

The second review question — 15th.

b) The Suspicious Transaction Report (STR) shall be submitted within 7 days of arriving at a conclusion that any transaction, whether cash or non-cash or a series of transactions integrally connected are of suspicious nature. The Principal Officer shall record his reasons for treating any transaction or a series of transactions as suspicious. It shall be ensured that there is no undue delay in arriving at such a conclusion.

The third review question — 7 days.

c) The Non-Profit Organization Transaction Reports (NTRs) for each month shall be submitted to FIU-IND by 15th of the succeeding month.

d) The Principal Officer will be responsible for timely submission of CTR, STR and NTR to FIU-IND.

e) Utmost confidentiality shall be maintained.

f) No nil reporting needs to be made to FIU-IND in case there are no cash/ suspicious/ non-profit organization transactions to be reported.

Two further rules. Intermediaries shall not put any restrictions on operations in the accounts where an STR has been made.

And the tipping-off ban: intermediaries and their directors, officers and employees (permanent and temporary) should be prohibited from disclosing ("tipping off") the fact that an STR or related information is being reported or provided to the FIU-IND. This prohibition on tipping off extends not only to the filing of the STR and/ or related information but even before, during and after the submission of an STR.

Before, during and after — and it shall be ensured that there is no tipping off to the client at any level.

And no threshold applies: registered intermediaries, irrespective of the amount of transaction and/or the threshold limit envisaged for predicate offences specified in part B of Schedule of PMLA, 2002, shall file STR if they have reasonable grounds to believe that the transactions involve proceeds of crime.

The two officers

Appointment of a Principal Officer: an officer designated by a registered intermediary who should be an officer at the management level. The Principal Officer would act as a central reference point in facilitating onward reporting of suspicious transactions.

Appointment of a Designated Director: a person designated by the reporting entity to ensure overall compliance with the obligations imposed under chapter IV of the PMLA Act and the Rules.

The cases

Case 9.1 — Marfatia Stock Broking. SEBI inspected whether an AML Policy was in place within 30 days of its 2006 circular. Marfatia had adopted a policy only in 2009, but argued that though a separate AML Policy was not documented, but the requirements of PMLA were duly incorporated in the relevant policies itself like KYC policy and RMS policy. SEBI accepted that although there was no separate documented policy within the prescribed timeline, the various requirements were adopted in other policies, and the allegation of not complying with the provisions of the circular does not stand established.

On the Principal Officer, a 2006 letter to the FIU was produced late and with only the proof of despatch... in the form of a courier slip... and there is no proof of delivery — but since there is nothing on record to suggest the contrary, the officer accepted the appointment had been made and notified.

The order: the observations were procedural in nature and all of these were complied with after being pointed out, with no serious observations... where the investors' interests would have been adversely affected. No penalty; the show cause notice was disposed of.

Case 9.2 — Shreepati Holdings. Three failures were found. The AML policy was updated on November 23, 2014, which resulted in a delay of 8 months, and the argument that no fixed timeline was prescribed failed because SHF cannot absolve it from the mandatory obligation of immediate compliance.

Second, alerts were ignored. SHF had received 83 alerts from BSE and 54 alerts from NSE and closed all the alerts received from the exchanges without assigning any reason for the same and did not maintain any record, either electronic or written, of the reasons for closing those alerts. No additional information was sought from clients.

Third, no monitoring system existed — SHF did not have any system/ mechanism to monitor transactions with respect to client transactions vis-à-vis the declared client financials.

Aggravating factors: SHF took corrective steps only after issuance of Show Cause Notice, a delay of more than two years, and had the inspection been not carried out... SHF would have remained non-compliant. SEBI observed that any lapse in non-compliance of the same by an Intermediary poses a serious threat to the national economy and national interest.

Penalty: Rs. 3,00,000 under Section 15HB.

Case 9.3 — FIU v PayPal. FIU imposed Rs 96 lakh penalty... for alleged contravention of the anti-money laundering law, holding the company guilty on three counts, the fundamental being its failure to register itself as a "reporting entity".

PayPal's defence was that it operates only as an Online Payment Gateway Service Provider (OPGSP) or a payment intermediary and is not covered within the definition of a payment system operator or financial institution.

FIU rejected it: the business model offered by PayPal clearly indicated that it not only acts as an intermediary but actively undertakes money transfer operations... By virtue of enabling payment system for its users by way of credit card, debit card, money transfer operations, PayPal is functioning as a payment system operator and is therefore deemed to be a reporting entity.

And it noted the group's own practice elsewhere — its parent company in the US - PayPal Inc. - reports suspicious transactions to the American FIU and also to similar agencies in Australia and the UK.

The order required payment within 45 days, registration as a reporting entity, and appointment of a principal officer and director for communication within a fortnight.

The consequence FIU feared: if the contention were accepted, the objective of the law would be redundant and other entities will find some reason to technically escape being categorised as one (reporting entity).

On appeal, the Delhi High Court stayed the December 17, 2020 order... subject to the payment gateway maintaining records of all its transactions in a secure server and depositing within two weeks in the high court a bank guarantee of Rs 96 lakh, and directed a committee to decide should providers of payment gateway services be classified as payment system operators?

The chapter's review questions confirm that records must include cash transactions of the value of more than Rs. 10 lakh; that the CTR goes to FIU-IND by 15th of the succeeding month; that an STR must be filed within 7 days of concluding a transaction is suspicious; and that written AML procedures must include all of client acceptance, client identification and transaction monitoring with STR — none of the above may be omitted.