KYC/AML & Fit-and-Proper Advisory: Where It Goes Wrong
The failures on KYC/AML & Fit-and-Proper Advisory repeat, which means they are avoidable if you know what to watch. The questions below are the ones raised most often in practice; the full scope of the service is on the KYC/AML & Fit-and-Proper Advisory page.
What does 'fit and proper' mean for a director of an NBFC or other RBI-regulated entity?
It is RBI's assessment of a director's integrity, reputation, financial soundness, and track record — whether they have any conviction, pending criminal proceeding, history of default with a bank or NBFC, or other disqualifying factor that would make their continued directorship a risk to the entity or its stakeholders. For NBFCs it arises specifically under Section 45-IA of the RBI Act, 1934 read with the applicable NBFC Master Direction, and it is assessed both at initial registration and on an ongoing annual basis.
In practice: Fit-and-proper is not a one-time box to tick at incorporation. RBI expects an annual re-certification process — a director's circumstances can change, and the Board is expected to know if they have.
Is the KYC/AML policy the same across all NBFC categories, or does it differ by licence type?
The core PMLA and RBI Master Direction on KYC framework applies across categories, but the specific Master Direction governing your entity — NBFC-ICC, NBFC-MFI, NBFC-HFC, Payment System Operator, Account Aggregator, or FFMC — layers additional entity-specific requirements on top. An NBFC-MFI's customer risk profile and documentation norms, for instance, differ from a Payment System Operator's transaction-monitoring emphasis. A generic one-size-fits-all policy template misses these category-specific nuances.
In practice: We have reviewed policies clearly adapted from a bank's KYC template with minimal changes for the NBFC's actual customer base and risk profile. RBI inspection tends to notice this quickly — a policy needs to reflect your actual business, not a generic template.
How does PNPC approach a KYC/AML policy build differently from a generic compliance consultant?
We start from your entity's actual RBI Certificate of Registration and regulatory category — not a generic template — and build the risk-categorisation logic, onboarding workflow references, and reporting process to match how your business actually operates. As a practising CA firm with FEMA and RBI advisory experience since 1986, we also connect the KYC/AML build to adjacent obligations — FEMA reporting where the entity has foreign shareholders, transfer pricing where there is a cross-border group structure, and annual RBI compliance filings — so the policy is not designed in isolation from the entity's broader regulatory footprint.
In practice: A KYC/AML policy built in isolation from the entity's FEMA and corporate compliance position can create internal inconsistencies — for example, a beneficial-ownership disclosure in the KYC file that does not match the shareholding pattern reported to RBI under FEMA. We check for this cross-consistency specifically.
What triggers RBI to review our fit-and-proper compliance outside of the annual cycle?
Common triggers include a new director appointment, a significant shareholding change, an Annual Supervisory inspection, a specific complaint or adverse media report concerning a director, or information RBI receives from another regulator or enforcement agency. RBI can also request fit-and-proper re-certification at any time it considers warranted, independent of the entity's own annual cycle.
In practice: We advise clients to treat any adverse development involving a director — a legal notice, a business dispute becoming public, a regulatory action at another entity where they also serve — as a trigger for an internal fit-and-proper review, rather than waiting for RBI to ask first.
Is a written KYC/AML policy alone sufficient, or does RBI expect evidence of implementation?
A written policy alone is not sufficient. RBI inspection tests operational evidence — actual customer files showing the risk-categorisation and documentation the policy describes, records of staff training, minutes showing Board approval and periodic review, and evidence that flagged transactions were actually escalated and assessed. A policy that reads well but has no supporting operational trail is treated as a significant gap.
In practice: We always build the implementation evidence trail alongside the policy document itself — training attendance records, a sample of properly risk-categorised customer files, and Board minutes — because a policy without evidence of use is, from an inspection standpoint, close to having no policy at all.
Our entity operates as both an NBFC in India and has an affiliate in the UAE. Does the KYC/AML framework need to be coordinated across both?
While the Indian entity's KYC/AML programme is governed by RBI and PMLA and the UAE affiliate's by UAE Central Bank or relevant UAE regulator's AML/CFT framework, beneficial-ownership consistency, group-level risk assessment, and cross-border customer or fund flows between the two entities benefit from coordinated review — inconsistent beneficial-ownership disclosure between the two jurisdictions is a red flag either regulator can independently identify.
In practice: Our Chennai and Dubai teams review India-UAE group structures together specifically to catch this kind of cross-jurisdiction inconsistency before either regulator does. Most single-jurisdiction advisors cannot see the full picture.
Where this sits in the wider engagement
KYC/AML & Fit-and-Proper Advisory rarely arrives on its own. The statutory basis and the current requirements are set out on the KYC/AML & Fit-and-Proper Advisory service page, and the related services are grouped under Fema Rbi.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On KYC/AML & Fit-and-Proper Advisory we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.