RBI’s KYC Directions and the Prevention of Money Laundering Act (PMLA) make financial-crime controls mandatory for every NBFC — including digital lenders. Inspectors don’t just read your policy; they test whether it works. Here’s what the framework must contain.
The legal backbone
- RBI Master Direction on KYC — customer identification, risk categorisation, periodic updation
- PMLA, 2002 — NBFCs are reporting entities: maintain records, report prescribed transactions to FIU-IND
- Your board-approved KYC/AML policy — the document everything else hangs from
The five pillars
1. Customer Acceptance Policy
Who you onboard — and who you don’t. Defined customer types, documentation standards, and escalation for high-risk cases.
2. Customer Identification (CIP)
Verify identity and address through prescribed documents. For digital onboarding, RBI permits modes like video-based customer identification (V-CIP) with safeguards — choose deliberately and document the choice.
3. Risk categorisation & CDD/EDD
- Customer Due Diligence (CDD): standard verification for all customers
- Enhanced Due Diligence (EDD): deeper scrutiny for high-risk customers — PEPs, complex structures, high-risk geographies
- Simplified measures where RBI permits for low-risk customers
4. Transaction monitoring
Ongoing monitoring with defined scenarios, thresholds and alert-handling SOPs. Monitoring must be risk-based, not a flat rule for everyone.
5. Reporting & record-keeping
Suspicious Transaction Reports (STRs) to FIU-IND, cash transaction reporting as prescribed, and records retained per PMLA timelines. Appoint a Principal Officer and Designated Director with documented charters.
What inspectors test
- Sample customer files: is CDD complete and risk-graded correctly?
- Alert handling: were monitoring alerts investigated and escalated on time?
- STR discipline: are suspicious transactions identified and reported, not just filed away?
- Training records: can front-line staff explain the policy?
Frequently asked questions
How often must KYC be updated? Periodically, based on risk categorisation — high, medium and low-risk customers at different intervals prescribed by RBI.
Does PMLA apply to small NBFCs too? Yes. There is no de minimis exemption for reporting entities.
Can we use Aadhaar-based e-KYC? Yes, within the prescribed modes and with customer consent — document your chosen modes in the policy. Our KYC/AML advisory designs the full framework.