KYC/AML & Fit-and-Proper Advisory: Who Needs It and Who Does Not
Whether KYC/AML & Fit-and-Proper Advisory applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the KYC/AML & Fit-and-Proper Advisory page.
What exactly does 'KYC/AML compliance' mean for an RBI-regulated entity, in plain terms?
It means your entity has a Board-approved written policy for how you identify who your customers are, assess how risky each customer relationship is, verify their identity documents, watch their transactions for suspicious patterns, and report specific transaction types to the Financial Intelligence Unit-India. It is governed primarily by the Know Your Customer Directions that the RBI issued for each category of regulated entity on 28 November 2025 (replacing the 2016 Master Direction on KYC) and the Prevention of Money-Laundering Act, 2002 with the PML Rules; confirm which set of Directions applies to your entity type. It is not a one-time document — it is a living operational process that your compliance team follows every day and that RBI inspects periodically.
In practice: The single most common gap we find is a KYC/AML policy that was well-drafted at licensing and never touched again. RBI revises its KYC directions from time to time — a policy frozen at the licensing date is likely to fall out of step with current requirements, and the November 2025 consolidation is a reminder to re-check it.
What is a Principal Officer and who should hold that role?
The Principal Officer is the senior individual within a reporting entity responsible for ensuring compliance with PMLA obligations — reviewing flagged transactions, deciding whether a Suspicious Transaction Report should be filed, liaising with FIU-IND, and overseeing the KYC/AML programme's operation. RBI and FIU-IND expect this person to hold sufficient seniority and independence from purely commercial or sales functions to make these judgment calls without undue business pressure.
In practice: We advise against appointing someone from the sales or business development function as Principal Officer, even if convenient. The independence expectation is real, and RBI inspection specifically probes whether the Principal Officer has genuine authority or is a title without teeth.
How often must customer KYC information be updated?
The periodic KYC updation interval depends on the customer's risk category as assessed under your entity's own risk-categorisation framework — high-risk customers require more frequent updation than low-risk customers, in line with the intervals set out in the RBI KYC Directions applicable to your entity. The exact interval your entity applies should be documented in your Board-approved policy and consistently followed, not decided case by case.
In practice: A defensible risk-categorisation matrix with a clear rationale for each tier is what RBI inspection actually tests — not just whether an interval number exists in your policy document.
Does a Politically Exposed Person (PEP) require different KYC treatment?
Yes. Customers who are or have been entrusted with prominent public functions — domestically or in a foreign country — along with their family members and close associates, require enhanced due diligence under the RBI KYC Directions applicable to your entity, including senior management approval for establishing the relationship and more frequent ongoing monitoring than a standard customer.
In practice: Many entities have a PEP clause in their policy document but no actual operational screening process to identify a PEP at onboarding. We build the screening step into the workflow, not just the policy language.
What is beneficial ownership identification and why does it matter for KYC?
Beneficial ownership identification means looking through a corporate or legal-entity customer's registered ownership structure to identify the natural person(s) who ultimately own or control it, above a threshold set out in the PML Rules. This prevents a customer from using layered corporate structures to obscure who is actually behind a transaction or account relationship — a core anti-money-laundering safeguard.
In practice: Beneficial ownership checks are frequently the weakest link in an otherwise well-documented KYC file, particularly for corporate and trust customers with multi-layer ownership. We test this specifically during gap assessments.
What is the difference between AML and CFT, and does our entity need to address both?
Anti-Money Laundering (AML) addresses the concealment of the origin of illegally obtained funds; Combating the Financing of Terrorism (CFT) addresses the movement of funds — which may themselves be legitimately sourced — toward terrorist activity. RBI's KYC Directions and PMLA's framework require reporting entities to address both within the same policy and monitoring framework, since the customer due diligence and transaction monitoring mechanisms largely overlap.
In practice: We draft a combined AML/CFT policy rather than two separate documents — the operational controls (customer due diligence, transaction monitoring, reporting) are largely the same mechanism serving both purposes, and RBI expects to see them addressed together.
Does a change in ultimate beneficial ownership of our NBFC require RBI approval before it happens?
A change in shareholding pattern or control of an NBFC — particularly one crossing thresholds defined in the applicable RBI directions — typically requires prior RBI approval or, at minimum, timely intimation, and triggers a fresh fit-and-proper assessment of the incoming significant shareholder or director. The precise threshold and approval requirement depends on the entity's specific NBFC category and the current RBI directions governing it.
In practice: We flag this early to clients considering a change in ownership — attempting the change first and seeking RBI's view afterward is a common and avoidable misstep. The fit-and-proper and approval process should run before the transaction closes, not after.
How does periodic KYC updation work for a dormant or low-activity customer account?
Even a dormant or low-transaction-volume customer account remains within the periodic KYC updation cycle applicable to its assigned risk category — inactivity does not exempt an account from updation, though it may influence the risk categorisation applied. The entity's policy should specify how dormant accounts are handled within the broader KYC updation and monitoring framework.
In practice: Dormant accounts are an easy category to overlook operationally because nobody is actively transacting on them, but they still need to appear in the periodic updation tracking — we specifically test this category during gap assessments.
What is the realistic cost range for building a KYC/AML policy and completing fit-and-proper documentation for a small NBFC?
Cost depends materially on the entity's complexity — number of directors requiring fit-and-proper assessment, whether an existing policy needs revision or a fresh build is required, and whether FIU-IND registration and Principal Officer setup are also in scope. PNPC provides a written, fixed-fee quote after the initial scoping call rather than a generic published rate, since a one-director NBFC-ICC and a multi-branch NBFC-MFI require materially different effort.
In practice: We avoid quoting a headline number without first understanding the entity's actual complexity — a quote given before scoping is usually wrong in one direction or the other, and we would rather give an accurate written quote after a short call than a misleading one upfront.
Where this sits in the wider engagement
KYC/AML & Fit-and-Proper Advisory rarely arrives on its own. The statutory basis and the current requirements are set out on the KYC/AML & Fit-and-Proper Advisory service page, and the related services are grouped under Fema Rbi.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On KYC/AML & Fit-and-Proper Advisory we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.