Know Your Customer (KYC)
This section covers the Know Your Customer (KYC) domain of the IIBF AML/KYC examination. The paper tests practical application of the RBI Master Direction on KYC (2016, as amended), the Prevention of Money Laundering Act (PMLA) record rules and FATF customer due diligence standards: who must be identified, how identity and beneficial ownership are verified, how customers are risk-rated, and when enhanced due diligence (EDD) is mandatory.
Core rules
- A board-approved KYC policy rests on four pillars: customer acceptance policy, customer identification procedure, transaction monitoring and risk management.
- Customer due diligence (CDD) must be completed before a relationship begins. It covers identification, verification through an officially valid document (OVD), beneficial ownership, purpose and intended nature of the relationship, and ongoing due diligence.
- OVDs include passport, driving licence, voter ID, NREGA job card and Aadhaar (with masked Aadhaar number). Aadhaar alone is not a universal substitute for all CDD.
- For legal persons, identify the entity and its beneficial owners. Under the PMLA rules the threshold is 25% shareholding or voting rights for a company and 15% for a partnership firm; for trusts, the trustees, beneficiaries and author are relevant. If no beneficial owner is identifiable, the senior managing official is treated as the beneficial owner.
- Risk categories are low, medium and high. Politically exposed persons (PEPs) are high risk: EDD, senior management approval and source of funds/wealth are required.
- Periodic updation under the RBI direction is at least every two years for high-risk, eight years for medium-risk and ten years for low-risk customers.
Worked example
A private limited company applies to open a current account. The reasoning is: verify the certificate of incorporation, board resolution and authorised signatory; map shareholders to identify every beneficial owner at or above 25%; screen the entity, signatories and beneficial owners against sanctions and PEP lists; assign a risk rating; and if one beneficial owner is a foreign PEP, apply EDD and obtain senior management approval before onboarding. If beneficial ownership cannot be established, the account should not be opened on standard CDD.
Traps
CKYC registry records do not replace CDD. Do not treat a company as low risk merely because it is incorporated. Do not accept a declaration of beneficial ownership without verification. Do not skip ongoing monitoring after onboarding. Third-party reliance does not transfer responsibility for the CDD records.