KYC/AML & Fit-and-Proper Advisory: The Process, Start to Finish
The mechanics of KYC/AML & Fit-and-Proper Advisory are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the KYC/AML & Fit-and-Proper Advisory page.
What is the Financial Intelligence Unit-India (FIU-IND) and why does our entity need to register with it?
FIU-IND is the central national agency under the Department of Revenue, Ministry of Finance, responsible for receiving, analysing, and disseminating information on suspicious financial transactions. An NBFC or other reporting entity under the Prevention of Money-laundering Act, 2002 (PMLA) must register with FIU-IND on its FINGate 2.0 portal, designate a Designated Director and a Principal Officer, and file the reports PMLA requires (Cash Transaction Reports, Suspicious Transaction Reports, and others applicable to the entity's business). This is a separate registration and reporting obligation from your RBI Certificate of Registration.
In practice: Entities frequently treat the RBI licence as the finish line and forget FIU-IND registration is a distinct, mandatory second step. We check this explicitly during our engagement scoping call.
What is Video-based Customer Identification Process (V-CIP) and can our entity use it?
V-CIP is a digital, non-face-to-face customer identification method — a live video interaction combined with document verification — that RBI has permitted as an alternative to in-person or physical KYC verification for eligible entity categories and customer types, subject to conditions set out in RBI's KYC Directions applicable to the entity's category (the Master Direction - KYC, 2016 was replaced on 28 November 2025 by entity-specific KYC Directions, 2025). Whether your entity can use V-CIP, and for which customer segments, depends on your specific regulatory category and the conditions RBI has prescribed for that category.
In practice: V-CIP eligibility and the specific technical/process conditions attached to it are refined periodically by RBI. We confirm current eligibility for the client's specific entity category before recommending it be built into the onboarding flow, rather than assuming blanket applicability.
What happens if RBI finds our KYC/AML programme deficient during an inspection?
Outcomes range depending on severity — from a formal observation requiring a written remediation plan within a specified timeline, to restrictions on new customer onboarding, to monetary penalty, and in serious or repeated cases, action affecting the entity's Certificate of Registration itself. RBI's supervisory approach is generally proportionate to severity and repeat-offence pattern, but a credible, well-documented remediation response materially affects how the finding is resolved.
In practice: The single biggest factor in how an inspection finding resolves is the quality and credibility of the entity's remediation response. A vague promise to 'do better' reads very differently to RBI than a documented action plan with named owners and dates.
Can a director with a past loan default serve on the Board of an NBFC?
It depends on the nature, amount, and recency of the default, and how it is disclosed and assessed under the fit-and-proper framework — a past default is not automatically disqualifying in every case, but it is a factor RBI's fit-and-proper requirements expect the Board (and RBI, at registration or on query) to specifically assess. Non-disclosure of a known default is a materially more serious issue than the default itself.
In practice: We tell clients plainly: disclose fully and let the fit-and-proper assessment run its course. An undisclosed default discovered later is a far more serious issue than a disclosed default that was properly assessed and documented at the time.
How is a KYC/AML policy different from an internal audit or compliance function?
The KYC/AML policy is the Board-approved document defining what your entity must do — customer acceptance criteria, risk categorisation, monitoring, and reporting rules. The compliance function (led by the Principal Officer) is the team that operationalises the policy day to day. Internal audit is a separate, independent function that periodically tests whether the policy is actually being followed in practice. All three are distinct and RBI expects to see evidence of each functioning independently.
In practice: Smaller NBFCs sometimes conflate the compliance function and internal audit into one person or team. RBI inspection specifically checks for independence between the two — we advise on a structure appropriate to the entity's size that still preserves this separation in substance.
Do foreign or NRI directors of an NBFC go through the same fit-and-proper process as resident directors?
Yes — fit-and-proper assessment applies to every director regardless of residency status, though the supporting documentation differs. Foreign or NRI directors typically need apostilled or notarised identity and address proof, and declarations covering any regulatory or criminal proceedings in their country of residence in addition to India, since RBI's assessment is not limited to India-based history.
In practice: PNPC's Dubai office can coordinate document collection and notarisation for UAE-based directors of Indian NBFCs and payment entities, so the India-side fit-and-proper file is complete without the director needing to manage cross-border paperwork alone.
What records must be maintained under PMLA, and for how long?
The Prevention of Money-Laundering (Maintenance of Records) Rules, 2005 prescribe the categories of records reporting entities must maintain — customer identification records, transaction records, and records supporting any Suspicious Transaction Report filed — for the periods specified in the Rules, which can extend well beyond the closure of the customer relationship. The exact retention period should be confirmed against the current Rules at the time of policy drafting, as retention requirements are a specific area regulators periodically revisit.
In practice: We build record retention into the policy with explicit reference to the current PML Rules provision rather than a rounded estimate — this is one of the areas where a stale policy quietly falls out of compliance without anyone noticing until an inspection asks for a record that was already purged.
What is a Suspicious Transaction Report (STR) and when must one be filed?
An STR is a report a reporting entity files with FIU-IND when a transaction — or a pattern of transactions — appears inconsistent with the customer's known profile, lacks an apparent lawful purpose, or otherwise raises a reasonable suspicion of money laundering or terrorist financing, as assessed under the entity's internal monitoring process and the PMLA framework. The Principal Officer is responsible for the internal decision to escalate a flagged transaction into a filed STR.
In practice: A functioning STR process requires clear internal escalation criteria — otherwise front-line staff either over-report trivial transactions or, more dangerously, under-report genuinely suspicious ones because there is no clear threshold to act on.
Our entity has never received foreign investment or dealt with a PEP — do we still need the full KYC/AML framework?
Yes. The KYC/AML and PMLA reporting obligations apply based on your entity's regulatory category and customer-facing activity, not on whether a specific higher-risk scenario (foreign investment, PEP customer) has actually occurred yet. The framework must be built and ready to correctly handle such scenarios if and when they arise — RBI does not accept 'we have not encountered this yet' as a substitute for having the policy provision in place.
In practice: The argument that a scenario has not yet arisen does not hold. The policy needs to cover the full range of scenarios your licence category permits you to encounter, not just the scenarios you have encountered so far.
Where this sits in the wider engagement
KYC/AML & Fit-and-Proper Advisory rarely arrives on its own. The statutory basis and the current requirements are set out on the KYC/AML & Fit-and-Proper Advisory service page, and the related services are grouped under Fema Rbi.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On KYC/AML & Fit-and-Proper Advisory we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.