I85PREP
⌘ K
IIBF SFB study materials
IIBF SFB study resources

IIBF SFB: KYC/AML/CFT and Fraud Risk Management

IIBF SFB · Work through your exam, one topic at a time.

All guide sections

KYC/AML/CFT and Fraud Risk Management

What the exam tests

KYC/AML obligations on an SFB as a reporting entity under the PMLA, 2002, and the fraud classification and reporting framework, including digital-channel fraud.

Core rules

  • Governance: appoint a Principal Officer reporting to the board and a Designated Director; maintain a board-approved KYC/AML policy, staff training and records for five years from the transaction.
  • CDD: identify the customer and beneficial owner through officially valid documents, verify PAN/Aadhaar, and complete KYC before establishing an account-based relationship.
  • Risk categorisation drives periodic updation - high risk every 2 years, medium every 8 years, low every 10 years - with enhanced due diligence for PEPs, non-face-to-face relationships and high-risk jurisdictions.
  • Reporting to FIU-IND: Suspicious Transaction Reports within 7 days of forming the suspicion, regardless of amount; Cash Transaction Reports for cash above Rs 10 lakh, monthly by the 15th. No tipping off.
  • Fraud: board-approved fraud risk management policy, fraud register, early-warning signals and red-flagged accounts before credit sanction, staff accountability, and reporting frauds of Rs 1 lakh and above to RBI within the timeline prescribed in the RBI (Frauds - Classification and Reporting) Directions, 2024; smaller frauds go to the police.

Worked example

A savings account shows 40 UPI debits of Rs 4,000-5,000 in a single day to newly added beneficiaries across three states, with salary credits inconsistent with the profile. Low value plus high velocity points to structuring through a mule account, not ordinary retail behaviour. Action: place the account under monitoring, complete the investigation, file an STR with FIU-IND within 7 days of the suspicion, and review onboarding and mule-account controls - without telling the customer that an STR was filed.

Marks-losing traps

Believing STRs have a monetary threshold; swapping the 7-day STR timeline with the 15th-of-month CTR timeline; applying one periodic-updation cycle to all customers; reporting a fraud only to the police and not to RBI.