Do You Need KYC / AML & Fit-and-Proper Compliance Advisory? A Practical Starting Point
Every entity regulated by the Reserve Bank of India — NBFCs, banks, payment system operators, money changers, Account Aggregators — must run a Board-approved Know Your Customer (KYC) and Anti-Money Laundering (AML) programme under the RBI Master Direction on KYC and the Prevention of Money-Laundering Act, 2002, and every director and key managerial person of such an entity must independently satisfy 'fit and proper' criteria that RBI can and does scrutinise at licensing, at every subsequent director appointment, and on an ongoing annual basis. Getting either wrong does not produce a late fee — it produces licence-threatening supervisory action, personal disqualification of directors, and reputational damage that outlasts the compliance gap itself. At PNPC Global, we have advised regulated and about-to-be-regulated financial entities across India and the UAE since 1986.
What You're Really Buying
KYC/AML & Fit-and-Proper Compliance Advisory is a structured advisory engagement covering two distinct but interlinked regulatory obligations that apply to every RBI-regulated entity — NBFCs (including microfinance and housing finance companies), banks, payment system operators, Full-Fledged Money Changers, Account Aggregators, and P2P lending platforms. The first obligation is customer-facing: a Board-approved KYC policy and AML programme, built around the RBI Master Direction – Know Your Customer (KYC) Direction, 2016 (as amended from time to time) and the Prevention of Money-Laundering Act, 2002 (PMLA) read with the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005. This policy must address customer acceptance, customer identification (including Aadhaar-based e-KYC and Video-based Customer Identification Process — V-CIP — where permitted for the entity's category), risk categorisation of customers into low, medium, and high risk, ongoing due diligence and periodic KYC updation at RBI-prescribed intervals tied to risk category, enhanced due diligence for politically exposed persons (PEPs) and non-face-to-face customers, monitoring of transactions for suspicious patterns, and the maintenance of records for the periods PMLA prescribes.
For the full scope, current process and what PNPC includes, see the dedicated KYC / AML & Fit-and-Proper Compliance Advisory service page.
When You'd Need This
- You are applying for, or have recently received, an RBI Certificate of Registration as an NBFC, Payment System Operator, Account Aggregator, or FFMC and need a Board-approved KYC/AML policy in place before commencing customer-facing operations
- Your existing KYC/AML policy has not been reviewed since the last RBI Master Direction amendment and you are not confident it reflects current risk-categorisation, periodic updation, and V-CIP requirements
- You are appointing a new director, CEO, or significant shareholder and need a defensible fit-and-proper assessment completed and documented before the appointment is finalised or reported to RBI
- Your annual Board process for obtaining fit-and-proper self-certification from existing directors is informal, undocumented, or inconsistently applied across directors
When It Isn't the Right Fit
- You have not yet decided whether to seek an NBFC Certificate of Registration at all — start with our NBFC Registration, Annual Compliance & Takeover Advisory service, which covers the full licensing decision and process, of which KYC/AML policy design is one downstream component
- You need only the mechanical filing of a specific FC-GPR or FC-TRS transaction with no KYC/AML or fit-and-proper element — our FC-GPR/FC-TRS Filing service is the narrower, correctly scoped engagement
- Your business has no customer-facing financial activity and is not an RBI reporting entity under PMLA — a KYC/AML programme is not applicable to your entity type
Quick Answers
What exactly does 'KYC/AML compliance' mean for an RBI-regulated entity, in plain terms?
It means your entity has a Board-approved written policy for how you identify who your customers are, assess how risky each customer relationship is, verify their identity documents, watch their transactions for suspicious patterns, and report specific transaction types to the Financial Intelligence Unit-India. It is governed primarily by the RBI Master Direction on KYC and the Prevention of Money-Laundering Act, 2002. It is not a one-time document — it is a living operational process that your compliance team follows every day and that RBI inspects periodically.
What does 'fit and proper' mean for a director of an NBFC or other RBI-regulated entity?
It is RBI's assessment of a director's integrity, reputation, financial soundness, and track record — whether they have any conviction, pending criminal proceeding, history of default with a bank or NBFC, or other disqualifying factor that would make their continued directorship a risk to the entity or its stakeholders. For NBFCs it arises specifically under Section 45-IA of the RBI Act, 1934 read with the applicable NBFC Master Direction, and it is assessed both at initial registration and on an ongoing annual basis.
Which RBI-regulated entities actually need a formal KYC/AML programme?
Any entity that is a 'reporting entity' under PMLA and its Rules — this includes NBFCs of every category (asset finance, investment/credit companies, microfinance institutions, housing finance companies), banks, Payment System Operators, Account Aggregators, Full-Fledged Money Changers, and P2P lending platforms. If your entity onboards customers, holds or moves customer funds, or facilitates financial transactions under an RBI authorisation, a KYC/AML programme applies to you.
Where PNPC Fits In
Speak directly with a PNPC Chartered Accountant who has advised RBI-regulated entities on KYC/AML governance and director fit-and-proper compliance since 1986 — not a compliance portal that hands you a template and disappears after the invoice. We build the policy your Board can defend at inspection, and we stay engaged through every director appointment, every regulatory amendment, and every regulator query after that.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full FEMA & RBI practice for related services, or go straight to the KYC / AML & Fit-and-Proper Compliance Advisory page for specifics.
Rates, thresholds and filing dates are set by the relevant authority and revised periodically. Treat anything numeric here as "ask PNPC for the current figure," not as a quoted fact.