KYC/AML & Fit-and-Proper Advisory: After Approval: What Continues
KYC/AML & Fit-and-Proper Advisory does not end at approval — a set of obligations continues afterwards. The questions below are the ones raised most often in practice; the full scope of the service is on the KYC/AML & Fit-and-Proper Advisory page.
Can PNPC act as our ongoing Principal Officer or must that role sit within our own organisation?
RBI and FIU-IND expect the Principal Officer to be an internal appointment — a senior individual within the regulated entity with genuine authority over compliance decisions — rather than an outsourced advisory function. PNPC advises on selecting and structuring this role correctly, trains the appointee, and remains available for ongoing guidance, but does not itself hold the Principal Officer designation on the entity's behalf.
In practice: We are occasionally asked whether we can simply be named Principal Officer to save the entity the trouble of an internal appointment. We do not take on that role — it needs to be someone inside the organisation with real day-to-day authority, and we say so plainly during scoping.
What happens if a director fails the fit-and-proper assessment after they are already serving on the Board?
RBI can direct the entity to remove a director found not to meet fit-and-proper criteria, and in serious cases can take supervisory action against the entity for having permitted or continued the appointment. The entity's Board bears responsibility for identifying and acting on a fit-and-proper concern proactively — through its own annual certification and monitoring process — rather than waiting for RBI to identify it.
In practice: This is precisely why the annual re-certification process matters — it gives the Board (and the entity) the opportunity to identify and address a fit-and-proper concern on its own terms, rather than have RBI direct a forced removal, which is a materially worse outcome for the entity's reputation and governance standing.
What role does the Board play beyond approving the initial KYC/AML policy?
The Board's role is ongoing, not a one-time approval — it includes periodic review of the policy's continued adequacy, receiving reports from the Principal Officer or compliance function on the programme's operation (including any STRs filed and any inspection or FIU-IND correspondence), and overseeing the annual fit-and-proper certification of its own members. RBI expects to see this as a standing item in Board or Board-committee minutes, not an occasional discussion.
In practice: We recommend a standing KYC/AML and compliance update as a fixed agenda item at a defined frequency — not something raised only when a problem surfaces. This is precisely the kind of governance discipline RBI inspection specifically looks for evidence of.
Can an NBFC or payment entity outsource its KYC verification process to a third-party vendor?
Yes, in many cases KYC verification steps can be outsourced to a third-party technology or verification vendor, but the regulated entity retains ultimate responsibility for KYC/AML compliance — outsourcing the mechanical verification step does not transfer regulatory accountability. The entity's policy should clearly document the vendor arrangement, the data protection and retention terms, and the entity's own oversight process over the vendor's work.
In practice: We review third-party KYC vendor agreements specifically for this accountability gap — a vendor contract that is silent on data retention periods matching PMLA requirements, or that does not give the entity adequate audit rights over the vendor's process, is a common weakness we flag.
Does PNPC help with the actual RBI application or only the policy documentation?
For entities where the KYC/AML and fit-and-proper engagement is tied to a fresh NBFC, PSO, or other RBI licence application, PNPC coordinates the KYC/AML policy and fit-and-proper documentation as part of the broader registration engagement — our NBFC Registration, Annual Compliance & Takeover Advisory service covers the full application process, with this service providing the specific compliance-framework component RBI expects to see.
In practice: We scope these as a combined engagement whenever the trigger is a fresh licence application, since the KYC/AML policy and the registration application are evaluated by RBI together, not as separate submissions.
Where this sits in the wider engagement
KYC/AML & Fit-and-Proper Advisory rarely arrives on its own. The statutory basis and the current requirements are set out on the KYC/AML & Fit-and-Proper Advisory service page, and the related services are grouped under Fema Rbi.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On KYC/AML & Fit-and-Proper Advisory we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.