NISM Series XXIV · Chapter 5: Anti Money Laundering (AML), Combating the Financing of Terrorism (CFT) and Proliferation Financing (PF) Guidelines

L1 · Foundation

AML, CFT and Proliferation Financing Guidelines

The three statutes the guidelines summarise — PMLA, UAPA and the WMD Act; the Central Government's powers under section 51A of the UAPA and its power to list terrorist organisations under section 35; section 12 of the WMD Act; who a Service Provider is in the virtual digital asset space; the purpose and scope of the guidelines and their effective date; and the FATF black and grey lists.

15 min read · Worth 10% of the paper · Written from pages 69–73 of the official NISM workbook · Updated 18 September 2026

What this chapter covers

Chapter 5 carries 5 marks out of 50 — 10% of the paper.

Learning Objective- After studying this chapter, you should know about: Background, purpose and scope of CFT and PF Guidelines along with General Obligations of Financial Service Providers (SPs).

5.1 Where the guidelines come from

The Prevention of Money-Laundering Act, 2002 ('PMLA') forms the core of the legal framework put in place by India to combat Money Laundering activities. PMLA envisages certain guidelines for record-keeping and reporting obligations for financial institutions and persons carrying on designated business or profession. These guidelines shall be called AML & CFT Guidelines for Reporting Entities.

In short: the PMLA is the law, and these guidelines explain how firms keep records and make reports under it.

Who they reach: persons carrying on designated business or profession are defined in Clause (s) of sub-section (1) of Section 2 of the PMLA. And crucially, sub-clause (vi) of the said clause includes within the ambit of 'person carrying on designated business or profession' such persons who carry on activities as the Central Government may, by notification, designate from time-to-time.

That open-ended sub-clause is how virtual digital asset businesses were brought in.

the Prevention of Money Laundering Act, 2002 (hereinafter referred to as the "PMLA").
the Unlawful Activities (Prevention) Act, 1967 (hereinafter referred to as the "UAPA").
The Weapons of Mass Destruction and Delivery Systems (Prohibition of Unlawful Activities) Act, 2005 (hereinafter referred to as the "WMDA") and rules there under.

Three statutes, three targets — the PMLA for money laundering, the UAPA for terrorist financing, and the WMDA for proliferation financing.

5.2.1 Section 51A of the UAPA, 1967

Under Section 51A of Unlawful Activities (Prevention) Act 1967 and orders issued thereunder, it has been specified that the Central Government shall have power to:

freeze, seize or attach funds and other financial assets or economic resources held by, on behalf of or at the direction of the individuals or entities listed in the Schedule to the Order, or any other person engaged in or suspected to be engaged in terrorism.
prohibit any individual or entity from making any funds, financial assets or economic resources or related services available for the benefit of the individuals or entities listed in the Schedule to the Order or any other person engaged in or suspected to be engaged in terrorism.
prevent the entry into or the transit through India of individuals listed in the Schedule to the Order or any other person engaged in or suspected to be engaged in terrorism.

Three powers: freeze the money, stop anyone else from supplying money, and keep the person out of the country.

Note the reach of each. They apply not only to listed persons but to any other person engaged in or suspected to be engaged in terrorism — and to funds held by, on behalf of or at the direction of them.

5.2.2 Section 35 of the UAPA, 1967

Under Section 35 of the Act, the Central government may, by notification, in the Official Gazette, —

(a) add an organisation to the First Schedule.
(b) add also an organisation to the First Schedule, which is identified as a terrorist organisation in a resolution adopted by the Security Council under Chapter VII of the Charter of the United Nations, to combat international terrorism.
(c) remove an organisation from the First Schedule.
(d) amend the First Schedule in some other way.

With a condition on the power: the central government shall exercise its power in respect of an organisation only if it believes that it is involved in terrorism.

And a wider power over the other schedules: the central government may, by notification in the Official Gazette, add to or remove or amend the Second Schedule or Third Schedule.

Note limb (b) — the UN Security Council's own terrorist designations under Chapter VII of the Charter of the United Nations can be brought straight into the Indian First Schedule.

5.2.3 Section 12 of the WMD Act, 2005

Under Section 12 of The Weapons of Mass Destruction and Delivery Systems (Prohibition of Unlawful Activities) Act, 2005, no person who is a resident in India shall, for a consideration under the terms of an actual or implied contract, knowingly facilitate the execution of any transaction which is prohibited or regulated under this Act.

Four elements to the offence: a person who is a resident in India, acting for a consideration under the terms of an actual or implied contract, who knowingly facilitates the execution of a transaction that is prohibited or regulated under the Act.

And a proviso protecting the innocent carrier: a mere carriage, without knowledge, of persons, goods or technology, or provision of services, including by a public or private carrier of goods, courier, tele-communication, postal service provider or financial service provider, shall not be an offence for the purposes of this section.

"Without knowledge" is the key — a financial service provider that unknowingly carries a payment is not caught; one that knowingly facilitates a prohibited transaction is.

Service Providers and virtual digital assets

Further, the AML/CFT/PF guidelines also provide their applicability and implications for the providers of services related to Virtual Digital Assets hereinafter referred to as Service Providers (SPs) and their role in applying Anti-Money Laundering, Countering the Financing of Terrorism and Combating Proliferation Financing (AML/CFT/CPF) obligations.

Put simply, the guidelines also tell crypto businesses — called Service Providers — what their AML duties are.

These guidelines are intended to set out the steps that a SP shall implement to discourage and to identify any money laundering, terrorist financing or proliferation financing activities. It prescribes the procedures and obligations to be followed by the reporting entities to ensure compliance with AML/CFT/CPF guidelines.

The three-part strategy: the strategy would be to use deterrence (implementation of effective KYC, CDD and EDD measures), detection (e.g., monitoring and suspicious transaction reporting), and record-keeping so as to facilitate investigations by the appropriate authorities wherever required.

Deterrence, detection, record-keeping — and note that KYC, CDD and EDD are grouped under deterrence, while monitoring and STR reporting fall under detection.

Who is a Service Provider

The term Service Provider (SP) means a person carrying out the following activities for another natural or legal person in the course of business:

exchange between virtual digital assets and fiat currencies;
exchange between one or more forms of virtual digital assets;
transfer of virtual digital assets;
safekeeping or administration of virtual digital assets or instruments enabling control over virtual digital assets; and
participation in and provision of financial services related to an issuer's offer and sale of a virtual digital asset.

Five activities, and the workbook's first sample question asks which agency provides exchange between virtual digital assets and fiat currencies — the Service Provider.

Note two qualifiers in the definition. The activity must be carried out for another natural or legal person — so trading on one's own account is not covered — and in the course of business.

And the fourth limb reaches beyond the assets themselves — instruments enabling control over virtual digital assets, which covers private keys and similar control mechanisms.

5.2.4 Purpose and scope

The purpose of these guidelines is to:

Understand and apply the risk-based approach and indicate best practices in the design and implementation of an effective risk-based approach.
Identify the entities that conduct activities or operations relating to VDAs i.e., SPs.
Establish an efficient reporting mechanism to prevent money laundering, terrorist financing and proliferation financing.
To assist entities engaged in or seeking to engage in VDA activities or operations to better understand their AML/CFT/CPF obligations and how they can effectively comply with the AML/CFT/CPF requirements as notified under PMLA/PMLR.

Note what is absent from that list — any purpose of stopping VDA activity. The workbook's second sample question asks which is NOT a purpose, and the answer is preventing entities from engaging in VDA activities. The guidelines exist to regulate the activity, not to prohibit it.

The Scope of these guidelines is vast and:

The guidelines apply to SPs and explain how they should implement the AML/CFT/CPF obligations effectively.
Further, the guidelines focus on VDAs that are convertible to other funds or value, including both VDAs that are convertible to other VDAs and VDAs that are convertible to fiat or that intersect with the fiat financial system.
Central Bank issued Digital Currencies (CBDCs) are outside the scope of this guidance since they are digital representation of fiat currencies (government issued currency that is not backed by a precious metal).

CBDCs are excluded because they are simply fiat in digital form — the risk the guidelines address is convertibility outside the regulated system, which a central bank currency does not present.

These guidelines became effective from 10th March 2023.

The FATF lists

The Financial Action Task Force (FATF) which leads global action to tackle money laundering, terrorist and proliferation financing activities, identifies jurisdictions with weak measures to combat money laundering and terrorist financing (AML/CFT) in two FATF public documents/statements that are issued three times a year.

Two documents, three times a year.

The FATF's process to publicly list countries with weak AML/CFT regimes has proved effective.

The black list

This statement, (previously called "Public Statement"), identifies countries or jurisdictions with serious strategic deficiencies to counter money laundering, terrorist financing, and financing of proliferation. This list is often externally referred to as the Black list.

And the consequences are severe. For all countries identified as high-risk, the FATF calls on all members and urges all jurisdictions to apply enhanced due diligence. In the most serious cases, countries are called upon to apply counter-measures to protect the international financial system from the ongoing money laundering, terrorist financing, and proliferation financing risks emanating from the country.

Two levels of response — enhanced due diligence for all high-risk countries, and counter-measures in the most serious cases.

The grey list

Further, this statement identifies countries that are actively working with the FATF to address strategic deficiencies in their regimes to counter money laundering, terrorist financing, and proliferation financing.

When the FATF places a jurisdiction under increased monitoring, it means the country has committed to resolve swiftly the identified strategic deficiencies within agreed timeframes and is subject to increased monitoring. This list is often externally referred to as the grey list.

The workbook's third sample question asks which list contains countries subject to increased monitoring — the grey list.

The distinction in one line. The black list names countries with serious strategic deficiencies; the grey list names countries actively working with the FATF to address strategic deficiencies, having committed to resolve swiftly the identified strategic deficiencies within agreed timeframes.

Deficiency in both cases — cooperation is what separates them.

And this connects back to the PML Rules. Rule 9(2)(d) permits reliance on a third party only where the third party is not based in a country or jurisdiction assessed as high risk, and Rule 9(13) requires a risk assessment covering clients, countries or geographic areas, and products, services, transactions or delivery channels.

The FATF lists are how a jurisdiction gets assessed as high risk.

The practical applicability of AML/CFT and PF guidelines have been dealt in detail in the next chapter.

Think of it like this

Three statutes, three financing crimes

A hospital treats different diseases with different medicines. India's framework addresses three related but distinct crimes with three separate Acts, and the guidelines summarise all three together.

The AML & CFT Guidelines for reporting entities providing services related to Virtual Digital Assets (VDA) aim to provide a summary of the provisions of the applicable anti money laundering, counter-terrorism financing and proliferation financing legislations in India, viz. the Prevention of Money Laundering Act, 2002 (hereinafter referred to as the "PMLA"), the Unlawful Activities (Prevention) Act, 1967 (hereinafter referred to as the "UAPA"), The Weapons of Mass Destruction and Delivery Systems (Prohibition of Unlawful Activities) Act, 2005 (hereinafter referred to as the "WMDA") and rules there under.

Money laundering — the PMLA. It forms the core of the legal framework put in place by India to combat Money Laundering activities and envisages certain guidelines for record-keeping and reporting obligations.

Terrorist financing — the UAPA. Section 51A gives the Central Government power to freeze, seize or attach funds and other financial assets or economic resources, to prohibit any individual or entity from making any funds, financial assets or economic resources or related services available, and to prevent the entry into or the transit through India of listed persons. Section 35 lets it add an organisation to the First Schedule, including one identified as a terrorist organisation in a resolution adopted by the Security Council under Chapter VII of the Charter of the United Nations.

Proliferation financing — the WMDA. Section 12 provides that no person who is a resident in India shall, for a consideration under the terms of an actual or implied contract, knowingly facilitate the execution of any transaction which is prohibited or regulated under this Act.

Each Act protects a different thing. The PMLA protects the integrity of the financial system; the UAPA protects against terrorism; the WMDA protects against the spread of weapons of mass destruction.

But the entity's duty is the same in all three cases — deterrence (implementation of effective KYC, CDD and EDD measures), detection (e.g., monitoring and suspicious transaction reporting), and record-keeping so as to facilitate investigations by the appropriate authorities wherever required.

Which is why the suspicious transaction definition names two of the three: a transaction is suspicious if it gives rise to a reasonable ground of suspicion that it may involve the proceeds of crime or that it may involve financing of activities relating to terrorism.

A Service Provider is defined by what it does with virtual assets, for someone else

A moneychanger is defined by the act of changing money for customers, not by owning currency. The definition of a virtual digital asset Service Provider works the same way.

The term Service Provider (SP) means a person carrying out the following activities for another natural or legal person in the course of business — exchange between virtual digital assets and fiat currencies · exchange between one or more forms of virtual digital assets · transfer of virtual digital assets · safekeeping or administration of virtual digital assets or instruments enabling control over virtual digital assets and · participation in and provision of financial services related to an issuer's offer and sale of a virtual digital asset.

Two qualifiers narrow it. The activity must be for another natural or legal person — so someone trading his own holdings is not an SP — and it must be in the course of business, so an isolated favour is not caught either.

The five activities cover the whole life of a virtual asset. Converting it to money, converting it to another asset, moving it, holding it, and helping issue it.

The fourth limb is broader than it first appears: safekeeping or administration of virtual digital assets or instruments enabling control over virtual digital assets. Holding a customer's private key is holding an instrument enabling control, even if the assets themselves sit elsewhere.

How they were brought within the PMLA. Persons carrying on designated business or profession are defined in Clause (s) of sub-section (1) of Section 2 of the PMLA. Sub-clause (vi) of the said clause includes within the ambit of 'person carrying on designated business or profession' such persons who carry on activities as the Central Government may, by notification, designate from time-to-time.

That open sub-clause is the doorway — and a person carrying on a designated business or profession is a reporting entity under the Act, with all that follows: verify identity, maintain records, furnish information.

What the guidelines ask of them: these guidelines are intended to set out the steps that a SP shall implement to discourage and to identify any money laundering, terrorist financing or proliferation financing activities.

Two words there — discourage and identify — matching the strategy of deterrence and detection.

And the scope is limited to convertible assets. The guidelines focus on VDAs that are convertible to other funds or value, including both VDAs that are convertible to other VDAs and VDAs that are convertible to fiat or that intersect with the fiat financial system.

Black list and grey list: both have deficiencies, only one is cooperating

A school may put one student on report for failing and another on probation for failing but attending remedial classes. Both are failing; the difference is what they are doing about it.

FATF publishes two documents, three times a year. It identifies jurisdictions with weak measures to combat money laundering and terrorist financing (AML/CFT) in two FATF public documents/statements that are issued three times a year.

The black list — serious deficiencies, no adequate response. This statement, (previously called "Public Statement"), identifies countries or jurisdictions with serious strategic deficiencies to counter money laundering, terrorist financing, and financing of proliferation. This list is often externally referred to as the Black list.

The consequences escalate in two stages. For all countries identified as high-risk, the FATF calls on all members and urges all jurisdictions to apply enhanced due diligence, and in the most serious cases, countries are called upon to apply counter-measures to protect the international financial system.

Enhanced due diligence for all; counter-measures for the worst.

The grey list — deficiencies, but active cooperation. It identifies countries that are actively working with the FATF to address strategic deficiencies in their regimes.

"Increased monitoring" is the phrase to remember — it is the formal name of what the grey list represents.

Why an intermediary cares. The PML Rules make jurisdiction a live question in two places. Reliance on a third party requires that the third party is not based in a country or jurisdiction assessed as high risk. And the risk assessment must cover clients, countries or geographic areas, and products, services, transactions or delivery channels.

Chapter 1 explained how FATF acquired this influence: these standards began to have more relevance in 2000 and 2001, after FATF began a process to publicly identify countries that were deficient in their anti-money laundering laws and international cooperation — and the FATF's process to publicly list countries with weak AML/CFT regimes has proved effective.

India, a member since 2010, is on neither list and participates in the evaluation of others through FATF and its regional bodies, the Asia Pacific Group (APG) and the Eurasian Group.

The guidelines regulate virtual assets; they do not ban them — and central bank currencies are outside

A traffic code exists to make driving safe, not to stop people driving. The AML/CFT/PF guidelines take the same approach to virtual digital assets.

Read the four stated purposes and notice what is missing. They are: understand and apply the risk-based approach and indicate best practices in the design and implementation of an effective risk-based approach · identify the entities that conduct activities or operations relating to VDAs i.e., SPs · establish an efficient reporting mechanism to prevent money laundering, terrorist financing and proliferation financing · and to assist entities engaged in or seeking to engage in VDA activities or operations to better understand their AML/CFT/CPF obligations and how they can effectively comply with the AML/CFT/CPF requirements as notified under PMLA/PMLR.

Nothing about prevention of the activity itself. The fourth purpose expressly contemplates entities seeking to engage in VDA activities and sets out to help them.

That is what the workbook's second sample question tests — preventing entities from engaging in VDA activities is not a purpose of the guidelines.

The scope tells the same story. The guidelines apply to SPs and explain how they should implement the AML/CFT/CPF obligations effectively, focusing on VDAs that are convertible to other funds or value, including both VDAs that are convertible to other VDAs and VDAs that are convertible to fiat or that intersect with the fiat financial system.

Convertibility is the risk factor — an asset that can become money, or another asset that can become money, can carry value out of the regulated system.

Which explains the one express exclusion. Central Bank issued Digital Currencies (CBDCs) are outside the scope of this guidance since they are digital representation of fiat currencies (government issued currency that is not backed by a precious metal).

A CBDC is fiat money in another form, already inside the regulated system, so the convertibility risk does not arise.

And the framework rests on risk, not prohibition. The first stated purpose is to understand and apply the risk-based approach — the same approach Rule 9(13) requires of every reporting entity, and the same one that lets the regulator prescribe enhanced or simplified measures... based on the overall money laundering and terrorist financing risks involved.

The guidelines became effective from 10th March 2023.

Key terms in this chapter

AML & CFT Guidelines for Reporting Entities: Guidelines envisaged by the PMLA for record-keeping and reporting obligations of financial institutions and persons carrying on designated business or profession, summarising the PMLA, the UAPA and the Weapons of Mass Destruction Act and the rules under them.
Central Bank Digital Currency (CBDC): A digital representation of fiat currency — government issued currency not backed by a precious metal — expressly excluded from the scope of the AML/CFT/PF guidance for virtual digital assets.
FATF black list: The statement, previously called the Public Statement, identifying countries or jurisdictions with serious strategic deficiencies in countering money laundering, terrorist financing and proliferation financing — for which FATF urges all jurisdictions to apply enhanced due diligence and, in the most serious cases, counter-measures.
FATF grey list: The list of countries actively working with the FATF to address strategic deficiencies, placed under increased monitoring, having committed to resolve the identified deficiencies swiftly within agreed timeframes. Both lists are issued in two FATF public statements three times a year.
Purpose of the guidelines: To understand and apply the risk-based approach and indicate best practices; to identify the entities conducting VDA activities, that is SPs; to establish an efficient reporting mechanism to prevent money laundering, terrorist financing and proliferation financing; and to assist entities engaged in or seeking to engage in VDA activities to understand and comply with their AML/CFT/CPF obligations.
Scope of the guidelines: They apply to Service Providers and focus on virtual digital assets convertible to other funds or value — whether to other VDAs or to fiat, or intersecting with the fiat financial system. Central Bank issued Digital Currencies are outside the scope, being digital representations of fiat currency. The guidelines became effective from 10 March 2023.
Section 12, WMD Act, 2005: Prohibits any person resident in India from knowingly facilitating, for consideration under an actual or implied contract, the execution of a transaction prohibited or regulated under the Act — with a proviso that mere carriage without knowledge, including by a carrier, courier, telecommunication, postal or financial service provider, is not an offence.
Section 35, UAPA: Empowers the Central Government by notification in the Official Gazette to add an organisation to the First Schedule — including one designated by a UN Security Council resolution under Chapter VII of the Charter — to remove one, or otherwise amend the Schedule, exercising the power only where it believes the organisation is involved in terrorism; and separately to amend the Second or Third Schedule.
Section 51A, UAPA: Gives the Central Government power to freeze, seize or attach funds and other financial assets or economic resources held by, on behalf of or at the direction of listed persons or anyone engaged in or suspected of terrorism; to prohibit anyone from making funds, assets, resources or related services available for their benefit; and to prevent their entry into or transit through India.
Service Provider (SP): A person carrying out, for another natural or legal person and in the course of business, exchange between virtual digital assets and fiat currencies, exchange between forms of virtual digital assets, transfer of virtual digital assets, safekeeping or administration of virtual digital assets or instruments enabling control over them, or participation in and provision of financial services related to an issuer's offer and sale of a virtual digital asset.
Sub-clause (vi) of clause (s): The provision in section 2(1) of the PMLA that brings within "person carrying on designated business or profession" such persons as the Central Government may by notification designate from time to time — the doorway through which virtual digital asset service providers became reporting entities.
The three-part strategy: Deterrence through effective KYC, CDD and EDD measures; detection through monitoring and suspicious transaction reporting; and record-keeping so as to facilitate investigations by the appropriate authorities wherever required.

Check you have understood it

The L1 test for this chapter has 6 questions. Score 60% to unlock L2 Application (worked numericals and scenarios) and then L3 Exam-Ready (NISM-style traps, timed, with this paper's real marking). Tests, the higher levels and full mock exams need a free account so we can track your progress.

Create a free account

Original explanatory writing based on the official NISM workbook for Series XXIV, which is published and copyrighted by NISM. Check figures against the current edition at nism.ac.in.

Something look wrong? Report it