I85PREP
⌘ K
IIBF NBFC study materials
IIBF NBFC study resources

IIBF NBFC: NBFC Compliance, Audit, AML/CFT and Governance

IIBF NBFC · Work through your exam, one topic at a time.

All guide sections

NBFC Compliance, Audit, AML/CFT and Governance

What this domain tests

The control environment: compliance officer and policy, internal and statutory audit, board composition, and AML/CFT reporting obligations that carry criminal liability.

Audit and compliance

  • Board-approved compliance policy and an independent compliance function headed by a Chief Compliance Officer in larger NBFCs (Upper Layer and Middle Layer above the prescribed asset threshold), reporting to the board or audit committee.
  • Internal audit: risk-based plan, independent reporting line to the audit committee, plus concurrent audit where volumes justify it.
  • Statutory auditors of NBFCs with assets of Rs 1,000 crore and above need RBI's prior approval; continuous audit-firm tenure is capped at three years with a cooling-off period, and the auditor certifies prudential returns.

Governance

  • Board with independent directors, audit committee, nomination and remuneration committee and risk committee as applicable; fit-and-proper declarations; prior RBI approval for MD/CEO appointments in deposit-taking and Upper Layer NBFCs.
  • Conflicts of interest, related-party transactions and a whistle-blower policy are standard board agenda items.

AML/CFT

  • NBFCs are "reporting entities" under the PMLA, 2002: a board-level Designated Director and a Principal Officer are mandatory.
  • Customer due diligence and risk categorisation per the KYC Master Direction; periodic KYC updation by risk - high risk every 2 years, medium 8 years, low 10 years; enhanced due diligence for PEPs.
  • Records for 5 years; STR to FIU-IND within 7 days of establishing suspicion (no monetary threshold); CTR for cash aggregating Rs 10 lakh or more per customer per month, filed by the 15th of the following month; no tipping off.
  • Frauds of Rs 1 lakh and above are reported to RBI in FMR-1 within three weeks of detection.

Worked example

A customer pays Rs 6 lakh cash on the 3rd and Rs 5 lakh on the 20th - Rs 11 lakh in the month, so a CTR is due by the 15th of the next month. If staff notice the splitting was designed to stay below reporting thresholds, that structuring is itself suspicious and an STR follows within 7 days.

Traps

Assuming STRs have a monetary threshold; aggregating CTRs per branch instead of per customer; treating KYC updation as a one-time exercise; assuming auditors can be appointed without RBI approval.