The Know Your Customer (KYC)Policy
KYC
is the mandatory process of identifying and verifying the client's identity
when opening an account and periodically over time. In other words, banks must ensure that their clients are
genuinely who they claim to be.
A Know Your Customer (KYC) policy is a set of processes that financial institutions and businesses use to verify the identity and suitability of their customers. The goal of KYC is to prevent illegal activities like money laundering, terrorist financing, and corruption.
RBI Master Circular dated Feb 25, 2016 as updated on Jan 04, 2024 is the base for this post.
KYC
Policy Banks/FIs should frame their KYC policies incorporating the following
four key elements: (i) Customer Acceptance Policy (CAP); (ii) Customer
Identification Procedures (CIP); (iii) Monitoring of Transactions; and (iv)
Risk Management. Over the years from 2005 to 2024, the Transaction Monitoring has evolved to two components viz.., Transaction Monitoring and KYC updation. That is Ongoing Due Diligence rather than simple transaction monitoring. The detailed description on each of these four items follows in the same order:
Customer Acceptance Policy
Without
prejudice to the generality of the aspect that Customer Acceptance Policy may
contain, REs shall ensure that:
(a)
No account is opened in anonymous or fictitious/benami name.
(b) No
account is opened where the RE is unable to apply appropriate CDD measures,
either due to non-cooperation of the customer or non-reliability of the
documents/information furnished by the customer. The RE shall consider filing
an STR, if necessary, when it is unable to comply with the relevant CDD
measures in relation to the customer.
(c)
No transaction or account-based relationship is undertaken without following the
CDD procedure.
(d)
The mandatory information to be sought for KYC purpose while opening an account
and during the periodic updation, is specified.
(e)Additional
information, where such information requirement has not been specified in the
internal KYC Policy of the RE, is obtained with the explicit consent of the
customer.
(f)
REs shall apply the CDD procedure at the UCIC level. Thus, if an existing KYC
compliant customer of a RE desires to open another account with the same RE,
there shall be no need for a fresh CDD exercise.
(g)
CDD Procedure is followed for all the joint account holders, while opening a
joint account.
(h) Circumstances in which, a customer is
permitted to act on behalf of another person/entity, is clearly spelt out.
(i) Suitable system is put in place to ensure
that the identity of the customer does not match with any person or entity,
whose name appears in the sanctions lists indicated in Chapter IX of this MD.
(j) Where Permanent Account Number (PAN) is
obtained, the same shall be verified from the verification facility of the
issuing authority.
(k) Where
an equivalent e-document is obtained from the customer, RE shall verify the
digital signature as per the provisions of the Information Technology Act, 2000
(21 of 2000).
(l) Where
Goods and Services Tax (GST) details are available, the GST number shall be
verified from the search/verification facility of the issuing authority.
Customer
Acceptance Policy shall not result in denial of banking/financial facility to
members of the general public, especially those, who are financially or
socially disadvantaged.
Where
RE forms a suspicion of money laundering or terrorist financing, and it
reasonably believes that performing the CDD process will tip-off the customer,
it shall not pursue the CDD process, and instead file an STR with FIU-IND.
Customer Identification Procedure (CIP)
CIP is otherwise known as Customer Due Diligence or Client Due Diligence. It is the process by which the bank or financial institution collecting and verifying information about a customer's identity and financial and business activities as well as assessing how much ML/FT risk is brought in by the account relationship or non-account relationship at the onboarding stage. It also involves ongoing monitoring of the customer's activities to identify any changes or red flags that may indicate an increased risk of illicit activity.
REs shall undertake identification of customers in the following cases:
(a) Commencement of an account-based relationship with the customer.
(b) Carrying out any international money transfer operations for a
person who is not an account holder of the RE.
(c) When there is a doubt about the authenticity or adequacy of the
customer identification data it has obtained.
(d) Selling third party products as agents, selling their own products,
payment of dues of credit cards/sale and reloading of prepaid/travel cards and
any other product for more than rupees fifty thousand.
(e) Carrying out transactions for a non-account-based customer, that is
a walk-in customer, where the amount involved is equal to or exceeds rupees
fifty thousand, whether conducted as a single transaction or several
transactions that appear to be connected.
(f) When a RE has reason to believe that a customer (account- based or walk-in)
is intentionally structuring a transaction into a series of transactions below
the threshold of rupees fifty thousand.
(g) REs shall ensure that introduction is not to be sought while
opening accounts.
For the purpose of verifying the identity of customers at the time of
commencement of an account-based relationship, REs, may rely on customer due
diligence done by a third party, subject to the following conditions:
(a) Records or the information of the customer due diligence carried
out by the third party is obtained immediately from the third party or from the
Central KYC Records Registry.
(b) Adequate steps are taken by REs to satisfy themselves that copies
of identification data and other relevant documentation relating to the
customer due diligence requirements shall be made available from the third
party upon request without delay.
(c) The third party is regulated, supervised or monitored for, and has
measures in place for, compliance with customer due diligence and
record-keeping requirements in line with the requirements and obligations under
the PML Act.
(d) The third party shall not be based in a country or jurisdiction
assessed as high risk.
(e) The ultimate responsibility for customer due diligence and
undertaking enhanced due diligence measures, as applicable, will be with the
RE.
The CDD process is covered in detail in a separate post, the link of which is given at the end of this post.
Ongoing Due Diligence/Monitoring Customer Relationship
A. Monitoring of Transaction
This involves ongoing monitoring that has specific processes for Alert Generation, Alert management , Preparation and Submission of STRs, and other reports to FIU-Ind for which specific links are provided at the end of this post.
REs shall undertake on-going due diligence of customers to ensure that their transactions are consistent with their knowledge about the customers, customers’ business and risk profile, the source of funds / wealth. Without prejudice to the generality of factors that call for close monitoring following types of transactions shall necessarily be monitored:
(a) Large and complex transactions including RTGS
transactions, and those with unusual patterns, inconsistent with the normal and
expected activity of the customer, which have no apparent economic rationale or
legitimate purpose
(b) Transactions which exceed the thresholds prescribed
for specific categories of accounts.
(c) High account turnover inconsistent with the size of
the balance maintained.
(d) Deposit of third-party cheques, drafts, etc. in the
existing and newly opened accounts followed by cash withdrawals for large
amounts.
For ongoing due diligence, REs may consider
adopting appropriate innovations including artificial intelligence and machine
learning (AI & ML) technologies to support effective monitoring. The extent
of monitoring shall be aligned with the risk category of the customer.
Explanation: High risk accounts have to be
subjected to more intensified monitoring.
(a) A system of periodic review of risk
categorisation of accounts, with such periodicity being at least once in six
months, and the need for applying enhanced due diligence measures shall be put
in place.
(b) The transactions in accounts of marketing
firms, especially accounts of Multi-level Marketing (MLM) Companies shall be
closely monitored.
Explanation: Cases where a large number of
cheque books are sought by the company and/or multiple small deposits
(generally in cash) across the country in one bank account and/or where a large
number of cheques are issued bearing similar amounts/dates, shall be immediately
reported to Reserve Bank of India and other appropriate authorities such as
FIU-IND.
B. Updation / Periodic Updation of KYC
REs shall
adopt a risk-based approach for periodic updation of KYC ensuring that the
information or data collected under CDD is kept up-to-date and relevant,
particularly where there is high risk. However, periodic updation shall be
carried out at least once in every two years for high-risk customers, once in
every eight years for medium risk customers and once in every ten years for
low-risk customers from the date of opening of the account / last KYC updation.
Policy in this regard shall be documented as part of REs’ internal KYC policy
duly approved by the Board of Directors of REs or any committee of the Board to
which power has been delegated.
a) Individuals:
i). No change in KYC information: In case of
no change in the KYC information, a self-declaration from the customer in this
regard shall be obtained through customer’s email-id registered with the RE,
customer’s mobile number registered with the RE, ATMs, digital channels (such
as online banking / internet banking, mobile application of RE), letter, etc.
ii. Change in address: In case of a change
only in the address details of the customer, a self-declaration of the new
address shall be obtained from the customer through customer’s email-id
registered with the RE, customer’s mobile number registered with the RE, ATMs,
digital channels (such as online banking / internet banking, mobile application
of RE), letter, etc., and the declared address shall be verified through
positive confirmation within two months, by means such as address verification
letter, contact point verification, deliverables, etc.
Further, REs, at their option, may obtain a
copy of OVD or deemed OVD, as defined in Section 3(a)(xiv), or the equivalent
e-documents thereof, as defined in Section 3(a)(x), for the purpose of proof of
address, declared by the customer at the time of periodic updation. Such
requirement, however, shall be clearly specified by the REs in their internal
KYC policy duly approved by the Board of Directors of REs or any committee of
the Board to which power has been delegated.
iii. Accounts of customers, who were minor at
the time of opening account, on their becoming major: In case of customers for
whom account was opened when they were minor, fresh photographs shall be
obtained on their becoming a major and at that time it shall be ensured that
CDD documents as per the current CDD standards are available with the REs.
Wherever required, REs may carry out fresh KYC of such customers i.e.,
customers for whom account was opened when they were minor, on their becoming a
major.
iv. Aadhaar
OTP based e-KYC in non-face to face mode may be used for periodic updation. To
clarify, conditions stipulated in Section 17 are not applicable in case of
updation / periodic updation of KYC through Aadhaar OTP based e-KYC in non-face
to face mode. Declaration of current address, if the current address is
different from the address in Aadhaar, shall not require positive confirmation
in this case. REs shall ensure that the mobile number for Aadhaar
authentication is same as the one available with them in the customer’s
profile, in order to prevent any fraud.
b) Other than Individuals:
i. No change in KYC information: In case of no change in the KYC information of the LE customer, a self-declaration in this regard shall be obtained from the LE customer through its email id registered with the RE, ATMs, digital channels (such as online banking / internet banking, mobile application of RE), letter from an official authorized by the LE in this regard, board resolution, etc. Further, REs shall ensure during this process that Beneficial Ownership (BO) information available with them is accurate and shall update the same, if required, to keep it as up-to-date as possible.ii. Change in KYC information: In case of change in KYC information, RE shall undertake the KYC process equivalent to that applicable for on[1]boarding a new LE customer
c). Additional measures:
i). The KYC documents of the customer as per the current CDD standards are available with them. This is applicable even if there is no change in customer information but the documents available with the RE are not as per the current CDD standards. Further, in case the validity of the CDD documents available with the RE has expired at the time of periodic updation of KYC, RE shall undertake the KYC process equivalent to that applicable for on-boarding a new customer.
ii). Customer’s PAN details, if available with the RE, is verified from the database of the issuing authority at the time of periodic updation of KYC.
Acknowledgment is provided to the customer mentioning the date of receipt of the relevant document(s), including self-declaration from the customer, for carrying out periodic updation. Further, it shall be ensured that the information / documents obtained from the customers at the time of periodic updation of KYC are promptly updated in the records /database of the REs and an intimation, mentioning the date of updation of KYC details, is provided to the customer.
iii). In order to ensure customer convenience, REs may consider making available the facility of periodic updation of KYC at any branch, in terms of their internal KYC policy duly approved by the Board of Directors of REs or any committee of the Board to which power has been delegated.
In case
of existing customers, RE shall obtain the Permanent Account Number or
equivalent e-document thereof or Form No. 60, by such date as may be notified
by the Central Government, failing which RE shall temporarily cease operations
in the account till the time the Permanent Account Number or equivalent
e-documents thereof or Form No. 60 is submitted by the customer. Provided that
before temporarily ceasing operations for an account, the RE shall give the
customer an accessible notice and a reasonable opportunity to be heard.
Further, RE shall include, in its internal policy, appropriate relaxation(s)
for continued operation of accounts for customers who are unable to provide
Permanent Account Number or equivalent e-document thereof or Form No. 60 owing
to injury, illness or infirmity on account of old age or otherwise, and such
like causes. Such accounts shall, however, be subject to enhanced monitoring.
Provided further that if a customer having an existing account-based
relationship with a RE gives in writing to the RE that he does not want to
submit his Permanent Account Number or equivalent e-document thereof or Form
No.60, RE shall close the account and all obligations due in relation to the
account shall be appropriately settled after establishing the identity of the
customer by obtaining the identification documents as applicable to the
customer.
Risk Management
For Risk Management, REs under RBI, India shall have a risk-based approach which includes the following.
(a) Customers shall be categorised as low,
medium and high-risk category, based on the assessment and risk perception of
the RE.
(b) Broad principles may be laid down by the
REs for risk-categorisation of customers.
(c) Risk categorisation shall be undertaken
based on parameters such as customer’s identity, social/financial status,
nature of business activity, and information about the customer’s business and
their location, geographical risk covering customers as well as transactions,
type of products/services offered, delivery channel used for delivery of
products/services, types of transaction undertaken – cash, cheque/monetary
instruments, wire transfers, forex transactions, etc. While considering
customer’s identity, the ability to confirm identity documents through online
or other services offered by issuing authorities may also be factored in.
(d) The risk categorisation of a customer and
the specific reasons for such categorisation shall be kept confidential and
shall not be revealed to the customer to avoid tipping off the customer.
Provided that various other information collected from different categories of
customers relating to the perceived risk, is non-intrusive and the same is
specified in the KYC policy.
Money Laundering and
Terrorist Financing Risk Assessment by REs:
(a) REs shall carry out ‘Money Laundering (ML) and Terrorist
Financing (TF) Risk Assessment’ exercise periodically to identify, assess and
take effective measures to mitigate its money laundering and terrorist
financing risk for clients, countries or geographic areas, products, services,
transactions or delivery channels, etc.
The assessment process should consider all the relevant risk
factors before determining the level of overall risk and the appropriate level
and type of mitigation to be applied. While preparing the internal risk
assessment, REs shall take cognizance of the overall sector-specific
vulnerabilities, if any, that the regulator/supervisor may share with REs from
time to time.
(b) The risk assessment by the RE shall be properly
documented and be proportionate to the nature, size, geographical presence,
complexity of activities/structure, etc. of the RE. Further, the periodicity of
risk assessment exercise shall be determined by the Board or any committee
of the Board of the RE to which power in this regard has been
delegated, in alignment with the outcome of the risk assessment exercise.
However, it should be reviewed at least annually.
(c) The outcome of the exercise shall be put up to the Board
or any committee of the Board to which power in this regard has been delegated,
and should be available to competent authorities and self-regulating bodies.
Happy Reading,
Those who read this, also read:
1. RBI Guidelines on AML/CFT and PMLA 2002
2. RBI Guidelines on Transaction Analysis
4. The IBA Working Group Report on AML/CFT 2010 - Alert Generation
5. The IBA Working Group Report on AML/CFT 2010 - Alert Management
6. The IBA Working Group Report on AML/CFT 2010-Preparation , Review & Submission of STRs
Comments
Post a Comment