Regulatory Framework, Compliance, KYC and AML
What this domain tests
The statutory backbone and the operational compliance duties it creates: knowing your customer, monitoring transactions, reporting to FIU-IND and keeping records.
Statutory map
RBI Act, 1934 (banking structure and NBFCs); Banking Regulation Act, 1949 (licensing, supervision); RBI Act Second Schedule (scheduled banks); PSS Act, 2007 (payment systems); PMLA, 2002 (money laundering prevention); Insurance Act, 1938 and IRDAI Act, 1999; SEBI Act, 1992. FIU-IND is the national agency receiving PMLA reports.
KYC and AML duties
Customer due diligence at onboarding and periodically, identification of the beneficial owner, enhanced due diligence for politically exposed persons and high-risk customers, and simplified measures for small accounts. CKYC uploads records to the central registry managed by CERSAI. Records must be retained for the period prescribed under PMLA (five years after the transaction or account closure).
Reporting to FIU-IND: CTR for cash transactions above ₹10 lakh in a month per customer, STR for suspicious activity with no minimum amount, and NTR for counterfeit currency.
Worked example
A customer with annual income of ₹4 lakh deposits ₹4,80,000 in cash as four deposits of ₹1,20,000 over two days. No single deposit crosses the ₹10 lakh CTR threshold, but the pattern is classic structuring to avoid reporting. The correct action is to file an STR, complete enhanced due diligence, and not alert the customer.
Traps
Structuring is reportable even when each transaction is small. Tipping off the customer about an STR is an offence. KYC is not a one-time door check - it is ongoing. Do not confuse a CTR (value-based) with an STR (suspicion-based).