AML/KYC Findings in a Gold-Loan NBFC

The NBFC is a reporting entity under the Prevention of Money Laundering Act and must comply with RBI's KYC Master Direction and the PMLA reporting regime.

• Designated director and principal officer: every reporting entity must appoint a designated director for AML/CFT and a principal officer. The eight-month vacancy is a direct governance breach.
• Cash Transaction Report: cash transactions above ₹10 lakh must be reported to FIU-IND. The 26 cash repayments of ₹10.5 lakh to ₹22 lakh are reportable; none was reported.
• Customer due diligence: Aadhaar OTP e-KYC is a permitted method, but it does not excuse the need to complete CDD. The absence of PAN or an equivalent tax identifier for 1,840 accounts is a CDD gap, especially where large cash repayments are involved.
• Risk-based re-KYC: high-risk customers must be re-KYC'd at least every two years; medium-risk every eight years; low-risk every ten years. Re-KYC only on branch visits does not meet the periodic requirement.
• Simplified KYC: simplified measures may be applied only where the risk assessment supports it. A blanket statement that 'small gold loans are low risk' is not a risk-based assessment.
• Board oversight: the board must oversee AML/CFT. Recording the audit report as merely 'noted' without an action plan is a governance failure.

The compliance team should recommend a sequenced remediation plan:

1. Appoint the designated director and principal officer immediately. An eight-month gap is not curable retrospectively, but the vacancy should be filled and minuted.
2. File overdue reports. Submit Cash Transaction Reports for the 26 cash repayments. Check whether the transactions show structuring or other suspicious indicators; if so, file Suspicious Transaction Reports as well. Do not wait for perfect data.
3. Risk-rate and re-KYC the 1,840 accounts. Obtain PAN or the applicable equivalent, complete CDD, and prioritise customers with high cash activity or high loan values.
4. Review the branch instructions. Withdraw any oral or written instruction that simplified KYC applies automatically to gold loans. Replace it with a documented risk-based approach.
5. Strengthen monitoring. Add transaction monitoring for cash repayments and branch-level aggregation, and increase AML/CFT staffing.
6. Report to the board and consider self-reporting. The board should approve the remediation plan and timelines. If there has been a reportable failure, the company should consider notifying FIU-IND and RBI rather than waiting to be found out.

The board's response is inadequate. AML/CFT is a board responsibility, not an HR detail.

• 'Noted' is not an action. The minutes should record specific directions, owners, and deadlines: appointment of the designated director, filing of overdue reports, re-KYC of the 1,840 accounts, and a follow-up audit.
• The vacancy is a governance breach. The designated director is a statutory AML/CFT role. The board should have appointed an interim or permanent replacement within a reasonable time, not allowed an eight-month gap.
• Accountability: the board should ask why branch staff believed simplified KYC was sufficient, who communicated that, and whether any accounts should be exited or enhanced.
• Follow-up: internal audit should report progress to the audit committee quarterly. The board should also consider whether the statutory auditor or RBI needs to be informed, especially if the overdue reports reveal suspicious activity.

A board that treats AML/CFT as a low-priority administrative matter is itself creating a compliance risk.