IIBF AML/KYC cheat sheet

KYC is the identification and verification of a customer's identity plus ongoing risk-based monitoring of the relationship, not a one-time onboarding formality.

Three core KYC elements: Customer Acceptance Policy (who is refused), Customer Identification Procedure (what documents and how verified), and Risk Management/Monitoring (periodic review and transaction scrutiny).

Customer Due Diligence (CDD) triggers: new relationship, beneficial owner identification, occasional transactions above the prescribed threshold, suspicion of ML/TF, and doubts about previously obtained data.

Enhanced Due Diligence (EDD) applies to high-risk categories: PEPs, non-resident customers, correspondent relationships, cash-intensive businesses, complex/offshore structures, and clients from high-risk jurisdictions.

Beneficial owner definition: natural person who ultimately owns or controls the account - typically 10-25% ownership threshold (India: 10% for non-listed, 15% for listed companies) plus control by other means.

Simplified Due Diligence is permitted only for demonstrably low-risk customers and cannot be applied where ML/TF suspicion exists or to high-risk or PEP relationships.

Periodic KYC updation is risk-tiered: high risk at least every 2 years, medium at least every 8 years, low at least every 10 years (India), with full KYC on any renewal or change of status.

Politically Exposed Persons are individuals entrusted with prominent public functions, their family members and close associates; PEP status requires senior management approval, source of funds/wealth checks and ongoing monitoring.

Record retention: identity and transaction records must be kept at least 5 years after the relationship ends or the transaction is executed (FATF standard; India: 5 years from cessation).

Money laundering stages: Placement (introducing illicit cash into the financial system), Layering (obscuring the trail through transfers and structures), and Integration (reintroducing funds as legitimate assets).

AML legal framework rests on the FATF 40 Recommendations; the Vienna Convention (1988) and Palermo Convention (2000) are the key international instruments criminalising laundering.

Three lines of defence: business units own the risk, the compliance/AML function sets and monitors controls, and internal audit provides independent assurance.

Suspicious Transaction Report (STR) is filed on suspicion, not on proof; the tipping-off prohibition bars disclosing the report to the customer or third parties.

Threshold-based reporting is distinct from suspicion reporting: cash transaction reports and cross-border wire reports are value-triggered, while STRs are judgement-triggered.

Red flags: structuring below thresholds, rapid in-and-out movement, unusual cash intensity, mismatched customer profile, third-party funding, and reluctance to provide beneficial ownership data.

Correspondent banking risk: shell banks are prohibited; nested and payable-through accounts require EDD and documented understanding of the respondent's AML programme.

AML programme pillars: internal policies and procedures, designated compliance officer, employee training, independent testing, and a customer due diligence programme.

Sanctions screening is separate from AML risk rating: a confirmed sanctions match is ordinarily blocked or rejected regardless of the customer's risk category.

Terrorist financing can be funded from legitimate sources, so transaction size and source-of-wealth checks alone do not detect it; purpose and destination matter more than amount.

Key CFT instruments: UN Security Council Resolution 1373 (2001), the Terrorist Financing Convention (1999), FATF Special Recommendation VIII (now integrated as Recommendation 6) on targeted financial sanctions.

Targeted financial sanctions require freezing funds of designated persons/entities without delay and without prior notice, and prohibiting making funds available to them.

UNSCR 1267 and 1988 sanctions lists, and the national designated list, must be screened at onboarding and on every list update; screening must include name variations and transliterations.

CFT red flags: charity or NPO accounts with no clear charitable purpose, funds routed to conflict zones, multiple small remittances to a high-risk region, and use of informal value transfer systems (hawala).

Non-profit organisations are high-risk for TF abuse; due diligence should verify governance, beneficiary selection, and that funds reach intended beneficiaries.

Freezing obligations override customer confidentiality; a freeze must be reported to the competent authority, and no tipping-off is permitted.

Wire transfer rules (FATF Recommendation 16): originator and beneficiary information must accompany transfers, and cross-border transfers require full originator data.