pvtltd.co

Compliance & HR

AML / KYC Compliance for NBFCs and Reporting Entities

AML/KYC compliance design, policy review, and periodic monitoring for regulated and reporting entities. PMLA, KYC directions, customer due diligence, sanctions screening, and reporting obligations.

Reviewed by CA Harun Raaj, ICAI Reg. No. 238303·Last reviewed:
Starting from Discuss with usTypical timelineAML / KYC

We review your KYC policy against the PMLA 2002, the PML Rules 2005 and the RBI KYC Master Direction, set up customer due diligence and risk categorisation, and build the reporting calendar for FIU-IND filings (CTR, STR) through the FINnet portal.

What is included
  • • Reporting entity status mapping
  • • KYC policy gap review
  • • Customer due diligence and risk categorisation design
  • • CTR / STR reporting calendar and FINnet filing support
  • • Team training on CDD and suspicion escalation
  • • Periodic compliance review and inspection readiness
Documents required
  • • Entity registration details and licence
  • • Existing KYC / AML policy and customer forms
  • • Customer onboarding and monitoring workflow
  • • Records of past reports or regulator correspondence
Government fees

See the fee table below for the statutory filing charge and common delay logic.

Legal basis
  • • Section 2(1)(wa) of the PMLA 2002
  • • Section 12 of the PMLA 2002
  • • Section 13 of the PMLA 2002
  • • Rule 3 of the PML Rules 2005
  • • Rule 8 of the PML Rules 2005
  • • Rule 9 of the PML Rules 2005
  • • RBI Master Direction - Know Your Customer
Start filingExplore more services

Process

How the service works

The workflow is built to be predictable: document collection, legal review, filing, and post-filing follow-through.

Step 1Status

Map your reporting entity status

We confirm whether your NBFC or institution is a reporting entity under s.2(1)(wa) read with s.12 of the PMLA 2002, and which regulator's KYC directions apply.

Step 2Review

Review the KYC policy

We compare your customer due diligence, risk categorisation and record-keeping practices against Rule 9 of the PML Rules 2005 and the applicable KYC Master Direction.

Step 3Reporting

Set up monitoring and reporting

We wire transaction monitoring to the reporting calendar — CTR under Rule 3 within 15 days and STR under Rule 8 within 7 working days, filed with FIU-IND on the FINnet portal.

Step 4Training

Train the team

Your staff get a plain-language walkthrough of customer due diligence steps, enhanced due diligence triggers, and how to escalate a suspicious transaction internally.

Step 5Maintain

Certify and maintain

We document the compliance file, schedule periodic reviews, and keep the register ready for FIU or regulator inspection under s.13 of the PMLA 2002.

AEO summary

AML/KYC compliance is what the PMLA 2002 requires of a reporting entity — banks, NBFCs and other financial institutions must verify customer identity, maintain records and report to FIU-IND under s.12(1). Client due diligence follows Rule 9 of the PML Rules 2005, with cash transaction reports filed within 15 days and suspicious transaction reports within 7 working days.

What the PMLA requires of a reporting entity

Section 12(1) of the PMLA 2002 puts four duties on a reporting entity: maintain records of transactions, verify the identity of its clients, furnish information to the Director (FIU-IND), and maintain the specified record of all transactions.

The detailed mechanics — how identity is verified, which transactions are reported, and within what time — are set out in the PML Rules 2005 and the sector KYC directions issued by the regulator (the RBI Master Direction for NBFCs and banks).

  • • Scope of entity — s.2(1)(wa) PMLA 2002 (banking company, financial institution, intermediary)
  • • Core duties — s.12(1) PMLA 2002 (records, identity verification, reporting to FIU-IND)
  • • Client due diligence — Rule 9 PML Rules 2005 (verify identity before/within the prescribed time)
  • • Sector overlay — RBI Master Direction on KYC for NBFCs

The reporting calendar

The two reports that drive the calendar are the CTR and the STR, both filed electronically with FIU-IND through the FINnet portal. The deadlines are short, so the reporting workflow has to be wired into transaction monitoring rather than done at year end.

Missing a CTR or STR deadline exposes the entity to s.13 penalty exposure even when the underlying transactions were lawful.

  • • CTR — within 15 days of the transaction (Rule 3 PML Rules 2005)
  • • STR — within 7 working days of forming the suspicion (Rule 8 PML Rules 2005)
  • • Both filed with FIU-IND on the FINnet portal
  • • Record maintenance — 5 years after the business relationship ends (s.12(4) PMLA 2002)

What failure costs

Non-compliance with the s.12 obligations is priced by s.13 of the PMLA 2002: a monetary penalty for each contravention, and a further penalty if the failure continues after the Director directs compliance.

Beyond the statutory penalty, a weak KYC file is the first thing a regulator inspection or FIU query examines — and it surfaces in due diligence when the entity seeks funding or a licence renewal.

  • • Penalty per contravention — ₹10,000 to ₹1,00,000 (s.13(2) PMLA 2002)
  • • Continuing failure — additional penalty under s.13(4) PMLA 2002
  • • Direction to comply — s.13(3) PMLA 2002

Government fees

Fee breakdown

ItemFeeNotes
Registration or renewalAs per state / portal scheduleState and local rules decide the actual filing fee.
Professional supportDiscuss with usThe fee depends on the number of branches, employees, or locations.

Timeline

Typical turnaround

Typical timeline usually means a monthly turnaround, assuming documents are complete and any board or shareholder approvals are already in place.

Pricing note

Portal fees and state charges vary by registration route and the number of establishments, employees, or locations involved.

Related services

Keep the company moving

Digital Signatures

Class 3 DSC procurement and renewal for individuals and organisations — MCA21, DGFT, Income Tax, and GST portal DSC.

PF & ESIC

Provident Fund and ESIC registration, monthly ECR filings, and advisory on threshold applicability and contractor compliance.

Labour Law

Labour law compliance — applicability review, registration, monthly compliance calendar, wage audit, and annual returns.

POSH Compliance

POSH compliance under the POSH Act 2013 — Internal Committee constitution, policy drafting, training and annual report.

FAQ

Frequently asked questions

Which companies are reporting entities under the PMLA?
A reporting entity under s.2(1)(wa) of the PMLA 2002 includes a banking company, financial institution, intermediary and any person carrying on a designated business or profession. NBFCs registered with the RBI, including digital lending platforms, fall in scope and owe the s.12 obligations.
What is the penalty for failing KYC compliance under the PMLA?
Section 13(2) of the PMLA 2002 allows a monetary penalty of not less than ₹10,000 and up to ₹1,00,000 for each contravention of the s.12 obligations. A continuing failure after a direction to comply attracts further penalty under s.13(4), and the Director can direct remedial measures.
What is the deadline for filing a suspicious transaction report (STR)?
Rule 8 of the PML Rules 2005 requires a reporting entity to file an STR within 7 working days of forming the suspicion, through the FINnet portal of FIU-IND. The report covers the transaction and the grounds of suspicion, without tipping off the customer.
What is the deadline for filing a cash transaction report (CTR)?
Rule 3 of the PML Rules 2005 requires a CTR within 15 days from the date of the transaction, covering cash transactions of ₹10 lakh or more and the other specified categories. It is filed with FIU-IND on the FINnet portal.
Does customer due diligence apply to every customer or only high-risk ones?
Rule 9 of the PML Rules 2005 applies client due diligence to every customer, with the depth scaled by risk. Standard customers get identity verification; politically exposed persons and higher-risk customers get enhanced due diligence, including source-of-funds review.
How long does an AML/KYC compliance setup take?
A policy review and reporting-calendar build typically completes in 2–4 weeks, depending on how many customer segments and branches are involved. The monitoring and reporting obligations are then ongoing — CTR and STR deadlines recur every month.

Canonical reference: https://www.pvtltd.co/services/aml-kyc-compliance

Get started

Ready to move this filing forward?

We can help with the filing, the legal mapping, and the follow-up work that keeps the company compliant after submission.

Start filingSee pricing