Chapter 3: The Prevention of Money-laundering (Maintenance of Records) Rules, 2005
3.1 Maintenance of Transaction Records: CTR, STR, CBWTR, and NTR Reporting Thresholds
Statutory Mandate of PML Rules, 2005
While the PMLA Act provides the substantive statutory framework, the operational procedures for reporting entities are codified in The Prevention of Money-laundering (Maintenance of Records) Rules, 2005 (PML Rules). These rules specify the exact categories of transactions that must be recorded, maintained, and reported to the Director, FIU-IND.
+---------------------------------------------------------------------------------------------------+
| MANDATORY TRANSACTION REPORTING MATRIX (PML RULES) |
+-------------------+-----------------------+-----------------------+-------------------------------+
| Report Type | Full Report Name | Monetary Threshold | Statutory Filing Deadline |
+-------------------+-----------------------+-----------------------+-------------------------------+
| CTR | Cash Transaction | All cash transactions | By the **15th day of the |
| | Report | > ₹10 Lakh (or equiv. | succeeding calendar month** |
| | | in foreign currency) | |
+-------------------+-----------------------+-----------------------+-------------------------------+
| Integr. Series | Series of Connected | Monthly aggregate cash| By the **15th day of the |
| Cash Report | Cash Transactions | > ₹10 Lakh | succeeding calendar month** |
+-------------------+-----------------------+-----------------------+-------------------------------+
| STR | Suspicious Transaction| **NO MONETARY LIMIT** | Within **seven (7) working |
| | Report | (Any suspect trade, | days** of arriving at a |
| | | attempted or executed)| conclusion of suspicion |
+-------------------+-----------------------+-----------------------+-------------------------------+
| CBWTR | Cross-Border Wire | All cross-border wire | By the **15th day of the |
| | Transfer Report | transfers > ₹5 Lakh | succeeding calendar month** |
+-------------------+-----------------------+-----------------------+-------------------------------+
| NTR | Non-Profit | Receipts by non-profit| By the **15th day of the |
| | Organization Report | entities > ₹10 Lakh | succeeding calendar month** |
+-------------------+-----------------------+-----------------------+-------------------------------+
Detailed Deconstruction of Reporting Categories
1. Cash Transaction Report (CTR)
Every reporting entity must maintain and report all cash transactions of the value of more than ₹10 Lakh (Ten Lakh Rupees) or its equivalent in foreign currency, including all integrally connected cash transactions that exceed ₹10 Lakh within a single calendar month.
2. Suspicious Transaction Report (STR)
The STR is the single most critical intelligence deliverable under AML law. Crucially, there is NO minimum monetary threshold for filing an STR—even a transaction of ₹5,000 must be reported if it exhibits suspicious characteristics:
- Gives rise to a reasonable ground of suspicion that it may involve proceeds of an offense.
- Appears to have no economic rationale or bona fide lawful purpose.
- Appears to be structured to evade standard transaction reporting thresholds.
- Involves unusual complexity or unexplained third-party pay-ins/pay-outs.
- Relates to terror financing or proliferation financing.
Suspicion Identified by Broker ---> Alert Escalated to Principal Officer ---> Analysis & Document Review
|
If Conclusion of Suspicion Established v
Must file STR on FINnet within 7 WORKING DAYS!
3. Cross-Border Wire Transfer Report (CBWTR)
Reporting entities must furnish monthly reports of all cross-border wire transfers exceeding ₹5 Lakh (or equivalent in foreign currency) where the origin or destination of funds is outside India.
4. Non-Profit Organization Report (NTR)
All transactions involving receipts by non-profit organizations exceeding ₹10 Lakh must be submitted to FIU-IND monthly to detect potential terror financing conduits.
3.2 Client Due Diligence (CDD), Beneficial Ownership (UBO Thresholds), and PEP Protocols
Client Due Diligence (CDD) Principles
Client Due Diligence is the mandatory process through which a reporting entity verifies the identity of its clients, assesses their financial profile, and determines whether they pose money laundering or terrorist financing risks:
- Identification: Obtaining independent source documents (PAN, Aadhaar, Passport, Driving License, Voter ID).
- Verification: Authenticating the identity against issuing government databases (DigiLocker, CKYCR, UIDAI).
- Purpose Understanding: Establishing the nature of the business relationship, source of wealth, and investment rationale.
- Ongoing Monitoring: Continuously scrutinizing transactions throughout the life of the account to ensure alignment with the client's known risk profile.
Identification of Ultimate Beneficial Ownership (UBO)
Money launderers frequently hide behind intricate corporate pyramids, partnerships, and offshore trusts. Under Rule 9 of the PML Rules, 2005, a reporting entity must identify the natural person(s) who ultimately exercise controlling ownership:
+---------------------------------------------------------------------------------------------------+
| BENEFICIAL OWNERSHIP (UBO) STATUTORY IDENTIFICATION THRESHOLDS |
+-----------------------------------+---------------------------------------------------------------+
| Non-Individual Client Entity Type | Statutory UBO Ownership / Controlling Interest Threshold |
+-----------------------------------+---------------------------------------------------------------+
| Company / Corporate Body | Natural person(s) holding **more than 10%** of shares/capital |
| | (amended down from legacy 25% threshold to align with FATF) |
+-----------------------------------+---------------------------------------------------------------+
| Partnership Firm / LLP | Natural person(s) holding **more than 10%** of capital/profits|
| | (amended down from legacy 15% threshold) |
+-----------------------------------+---------------------------------------------------------------+
| Unincorporated Association / Body | Natural person(s) holding **more than 15%** of property/rights|
+-----------------------------------+---------------------------------------------------------------+
| Trust (Charitable / Family / AIF) | - Author of the trust / Settlor |
| | - Trustee(s) |
| | - Beneficiaries with **10% or more interest** in the trust |
| | - Any natural person exercising ultimate effective control |
+-----------------------------------+---------------------------------------------------------------+
If no natural person is identified through the ownership test, the senior managing official (e.g., Managing Director or CEO) is designated as the Beneficial Owner.
Protocols for Politically Exposed Persons (PEPs)
A Politically Exposed Person (PEP) is an individual who is or has been entrusted with prominent public functions by a foreign country (e.g., Heads of State, senior politicians, senior government officials, judicial or military officers, senior executives of state-owned corporations).
- PEPs pose heightened bribery and corruption risks.
- Approval Mandate: Onboarding a foreign PEP requires explicit prior approval from Senior Management.
- Source of Wealth: The reporting entity must verify the legitimate source of funds and wealth.
- Enhanced Monitoring: Accounts belonging to PEPs (and their close family members and known associates) are subject to continuous Enhanced Due Diligence (EDD).
3.3 Digital KYC Procedures, Video In-Person Verification (VIPV), and Aadhaar-Based Verification
The Digital Transformation of KYC in Securities Markets
To facilitate frictionless, paperless investor onboarding while preserving rigorous regulatory safeguards, SEBI, IFSCA, and the Ministry of Finance formalized Digital Know Your Customer (Digital KYC) procedures under the PML Rules.
+---------------------------------------------------------------------------------------------------+
| DIGITAL KYC ONBOARDING MODALITIES |
+-------------------+-----------------------------------+-------------------------------------------+
| Modality | Authentication Engine | Verification Standard & Limits |
+-------------------+-----------------------------------+-------------------------------------------+
| Online e-KYC | UIDAI Aadhaar OTP or Biometric | Complete digital verification; full |
| (Aadhaar based) | Authentication Service | transaction privileges |
+-------------------+-----------------------------------+-------------------------------------------+
| DigiLocker | Ministry of Electronics and IT | Direct fetching of digitally signed, |
| Integration | (MeitY) digital credential portal | tamper-proof OVDs from government sources |
+-------------------+-----------------------------------+-------------------------------------------+
| Video In-Person | Real-time, live interactive video | Replaces physical in-person verification; |
| Verification(VIPV)| stream with AI facial matching | strict geo-tagging and liveness detection |
+-------------------+-----------------------------------+-------------------------------------------+
Video In-Person Verification (VIPV) Architecture
Under regulatory guidelines, an intermediary can complete In-Person Verification (IPV) digitally via a secure Video In-Person Verification (VIPV) application adhering to technical standards:
Step 1: Client initiates live video session on intermediary application
Step 2: AI algorithm performs Liveness Detection & anti-spoofing checks (blinking, smiling, nodding)
Step 3: GPS Geo-Tagging records client latitude/longitude (Must confirm client is within Indian borders)
Step 4: Live facial match compared against photo on Aadhaar/Passport using AI (Facial match >= 80%)
Step 5: Random dynamic One-Time Password (OTP) or visual security question displayed on screen
Step 6: Compliance officer records audio-video interaction; encrypted video stored securely
The Role of Central KYC Registry (CKYCR)
Managed by CERSAI (Central Registry of Securitisation Asset Reconstruction and Security Interest of India), the Central KYC Registry (CKYCR) eliminates repetitive KYC documentation:
- When a client completes KYC with any regulated financial intermediary (bank, broker, insurer, mutual fund), their data is uploaded to CKYCR, generating a unique 14-digit CKYC Identifier Number (KIN).
- Subsequent intermediaries can download the digitized verified records directly from CKYCR using the KIN, preventing unnecessary duplicate verification while ensuring standardized verification nationwide.