Chapter 5: IFSCA (Anti Money Laundering, Counter Terrorist Financing and Know Your Customer) Guidelines, 2022

The establishment of the International Financial Services Centres Authority (IFSCA) in April 2020 under the International Financial Services Centres Authority Act, 2019, marked a transformative milestone in Indian financial governance. Prior to the enactment of the IFSCA Act, financial entities operating in the Gujarat International Finance Tec-City (GIFT) Special Economic Zone were subject to fragmented supervision by multiple domestic regulators:

• Banking units were supervised by the Reserve Bank of India (RBI).
• Stock exchanges, brokers, alternative investment funds (AIFs), and clearing corporations were supervised by the Securities and Exchange Board of India (SEBI).
• Insurance offices and insurance intermediaries were regulated by the Insurance Regulatory and Development Authority of India (IRDAI).
• Pension funds were regulated by the Pension Fund Regulatory and Development Authority (PFRDA).

Under Section 12 and Section 13 of the IFSCA Act, 2019, the regulatory, developmental, and supervisory powers previously exercised by RBI, SEBI, IRDAI, and PFRDA within the IFSC were consolidated and vested exclusively in the IFSCA as a unified financial regulator.

                           CONSOLIDATION OF POWERS UNDER IFSCA
                                            │
        ┌───────────────────┬───────────────┴───────────────┬───────────────────┐
        ▼                   ▼                               ▼                   ▼
    [ RBI ]             [ SEBI ]                        [ IRDAI ]           [ PFRDA ]
  Banking Units      Capital Markets & AIFs         Insurance Offices      Pension Funds
        │                   │                               │                   │
        └───────────────────┼───────────────────────────────┴───────────────────┘
                            ▼
           [ Unified Authority: IFSCA Act, 2019 ]
                            │
                            ▼
     [ IFSCA (AML, CFT and KYC) Guidelines, 2022 ]
   (Comprehensive framework across 12 distinct chapters)

Architecture of the IFSCA (AML, CFT and KYC) Guidelines, 2022

To create an internationally competitive yet robust anti-money laundering and counter-terrorist financing ecosystem compliant with the Financial Action Task Force (FATF) 40 Recommendations, the Authority notified the IFSCA (Anti Money Laundering, Counter Terrorist Financing and Know Your Customer) Guidelines, 2022 (abbreviated as IFSCA AML/CFT Guidelines).

These Guidelines are structured into 12 Comprehensive Chapters:

1. Chapter I - Applicability, Definitions and Responsibilities: Outlines jurisdictional boundaries, scope of Regulated Entities (REs), and fiduciary duties of Senior Management.
2. Chapter II - Risk-Based Approach (RBA): Mandates proportionality in applying controls based on verified risk levels.
3. Chapter III - Business Risk Assessment (BRA): Directs institutional enterprise-wide threat and vulnerability evaluations.
4. Chapter IV - Customer Risk Assessment: Establishes mandatory 3-tier risk categorisation (Low, Medium, High).
5. Chapter V - Customer Due Diligence (CDD): Details identification, verification, Beneficial Ownership discovery, EDD, and SDD protocols.
6. Chapter VI - Third Party Reliance: Conditions under which an RE can rely on foreign intermediaries for customer identification.
7. Chapter VII - Correspondent Banking and Wire Transfer: Safeguards against shell banks, payable-through accounts, and cross-border originator information.
8. Chapter VIII - Internal Policies, Compliance, Audit and Training: Prescribes the appointment and responsibilities of the Money Laundering Reporting Officer (MLRO) / Principal Officer and independent AML audits.
9. Chapter IX - Record Keeping: Five-year mandatory preservation rule post business relationship termination.
10. Chapter X - Process of Identification and Reporting of Suspicious Transactions: FIU-IND interface, STR timelines, and non-tipping off mandates.
11. Chapter XI - Compliance Obligations under International Agreements and Domestic Laws: United Nations Security Council Resolutions (UNSCR) 1267, 1373, and Weapons of Mass Destruction (WMD) Act enforcement.
12. Chapter XII - Groups, Branches and Subsidiaries: Harmonisation of higher AML standards across overseas holding structures.

Statutory Definition and Duties of a Regulated Entity (RE)

Under Clause 1.2 of the Guidelines, a Regulated Entity (RE) is defined as any financial institution, intermediary, or unit which has been granted a licence, registration, recognition, or authorisation by the IFSCA to operate within the IFSC. This includes:

• International Banking Units (IBUs)
• Finance Companies and Global Treasury Centres
• Stock and Commodity Exchanges, Clearing Corporations, and Depositories
• Registered Intermediaries (Brokers, Portfolio Managers, Investment Advisors)
• Alternative Investment Funds (AIFs), Fund Management Entities (FMEs), and Family Offices
• Insurance and Reinsurance Entities (IIOs, Corporate Agents, Brokers)
• Bullion Depository and Exchange Intermediaries
• Aircraft and Ship Leasing Entities
• FinTech entities operating in the IFSCA Regulatory Sandbox.

Mandatory Senior Management Governance Obligations

Under Clause 1.3 of the Guidelines:

1. Every Regulated Entity must formulate a comprehensive AML-CFT Policy, which must be formally approved by its Governing Body (Board of Directors) or a designated Committee of Directors.
2. Every RE must develop an integrated KYC Policy, which forms an inseparable schedule of its overarching AML-CFT policy.
3. Collective Senior Management Responsibility: Every member of the RE's Senior Management is personally and collectively responsible for ensuring compliance. The Senior Management must exercise due skill, care, and diligence in executing controls, monitoring risk appetites, and ensuring adequate budgetary and technological allocation for AML compliance.

A cornerstone of the IFSCA AML/CFT Guidelines is the abandonment of mechanical, "tick-the-box" compliance in favour of a dynamic Risk-Based Approach (RBA). Under RBA, an entity allocates its compliance resources, investigative scrutiny, and verification measures in direct proportion to the specific money laundering, terrorist financing, and proliferation financing risks it actually confronts.

                  ENTERPRISE-WIDE RISK DYNAMICS IN GIFT IFSC
                                      │
           ┌──────────────────────────┴──────────────────────────┐
           ▼                                                     ▼
[ Business Risk Assessment (BRA) ]             [ Customer Risk Assessment (CRA) ]
(Macro / Institutional Level)                  (Micro / Transactional Level)
- Evaluates total firm vulnerability           - Evaluates individual customer risk
- Reviewed annually or upon triggers           - Done prior to account onboarding
- Examines 4 core risk vectors:                - Profiles customer into:
  1. Customer Demographics                       • High Risk (Mandatory EDD)
  2. Products & Services Complexity              • Medium Risk (Standard CDD)
  3. Delivery Channels (Digital/Faceless)        • Low Risk (Simplified CDD)
  4. Geographic Jurisdictions

1. Business Risk Assessment (BRA) Requirements (Chapter III)

Every Regulated Entity operating in the IFSC must conduct an enterprise-wide Business Risk Assessment (BRA) to identify and assess the ML/TF/PF risks to which its overall business is exposed.

The BRA must systematically evaluate four core risk pillars:

1. Customer Risk Profile: The proportion of high-net-worth individuals, Politically Exposed Persons (PEPs), complex cross-border trusts, offshore corporate vehicles, fund-of-funds structures, and foreign shell-like entities seeking services.
2. Product and Service Vulnerabilities: High-speed algorithmic trading, cross-border multi-currency wire transfers, private wealth management, discretionary portfolio management, structured financial derivatives, and asset-backed financing (aircraft/ship leasing) that can be abused for layering.
3. Delivery Channel Hazards: The prevalence of non-face-to-face onboarding, reliance on automated API feeds, cross-border digital onboarding without physical presence, and intermediation through foreign introducers or fintech platforms.
4. Geographic and Country Risks: Exposure to customers, beneficial owners, or counterparty banks located in countries on the FATF Grey List, countries subject to UN or OFAC sanctions, jurisdictions with weak tax transparency (e.g., offshore secrecy havens), or regions known for terrorist funding networks.

The BRA must be:

• Formally documented in writing;
• Reviewed and updated at least annually, or whenever there is a material change in the firm's business model, regulatory environment, new product launch, or organizational restructuring;
• Formally approved by the Governing Body; and
• Made available immediately upon request to the IFSCA and FIU-IND inspectors.

2. Customer Risk Assessment and 3-Tier Categorisation (Chapter IV)

Prior to establishing any business relationship or onboarding a client, the RE must execute a Customer Risk Assessment (CRA) to assign an individualized risk rating:

Crucial Confidentiality Rule: Clause 4.1 mandates that the risk categorization of a customer and the underlying algorithmic scoring or analytical rationale must remain strictly confidential. The RE and its employees are prohibited from disclosing the assigned risk rating to the customer to prevent tipping off.

Effective anti-money laundering compliance requires robust institutional infrastructure, clear operational lines of responsibility, and independent oversight. The IFSCA AML/CFT Guidelines mandate specific structural roles to ensure that compliance functions independently of commercial business pressures.

                      IFSCA AML INSTITUTIONAL GOVERNANCE
                                       │
                      [ Governing Body / Board ]
                                       │
                ┌──────────────────────┴──────────────────────┐
                ▼                                             ▼
     [ Senior Management ]                        [ Independent AML Audit ]
                │                                 (Annual internal/external
                │                                  verification of controls)
                ▼
  [ MLRO / Principal Officer ]
  - Direct access to Board
  - Absolute operational independence
  - Unimpeded access to all records
                │
                ├─────────────────────────────────────────────┐
                ▼                                             ▼
    [ Internal Transaction Alerts ]               [ External Regulatory Gate ]
    (Staff suspicion reports / AI alerts)       (FINnet 2.0 / FIU-IND Portal)
                │                                             │
                ▼                                             ▼
     [ Evaluation & Analysis ]                     [ STR / CTR / CBWTR Filing ]

Appointment and Statutory Status of the MLRO / Principal Officer

Under Chapter VIII of the Guidelines, every Regulated Entity must designate a suitably qualified, experienced, and sufficiently senior individual as the Money Laundering Reporting Officer (MLRO), who also functions as the Principal Officer under the PMLA framework:

1. Seniority and Authority: The MLRO must be at management level and report directly to the Governing Body or its audit/compliance committee. The MLRO must not be subordinate to front-office business acquisition or revenue-generating heads.
2. Operational Independence: The MLRO must be empowered to act independently, exercise unbiased judgment, and access all operational files, client accounts, transaction logs, and internal communications without requiring management pre-approval.
3. Statutory Liaison: The MLRO serves as the sole, dedicated interface between the Regulated Entity, the Financial Intelligence Unit - India (FIU-IND), and the IFSCA for all AML/CFT inquiries, notices, and filings.
4. Deputy MLRO: The RE must appoint a Deputy MLRO possessing commensurate qualifications to perform compliance duties during the absence of the primary MLRO.

Mandatory Compliance Mechanisms and Audits

• Independent AML Audit: The RE must maintain an independent audit function (which may be conducted by internal audit teams or an external chartered accounting firm) to test the adequacy, effectiveness, and operational robustness of the AML/CFT policies, internal controls, and IT systems. The audit findings must be placed directly before the Governing Body at least once every financial year.
• Employee Screening and Vetting: Under Clause 8.4, the RE must implement rigorous 'Know Your Employee' (KYE) screening procedures to verify the background, integrity, and creditworthiness of candidates prior to hiring, especially for sensitive positions in operations, fund transfers, and compliance.
• Ongoing Staff Training: The RE must administer continuous, customized AML/CFT training programmes for all board members, officers, and operational staff, covering emerging typology trends, sanctions lists, red flags, and transaction reporting requirements.

Process of Reporting Suspicious Transactions (Chapter X)

Regulated Entities in the IFSC are legally bound under Section 12 of the PMLA and Chapter X of the Guidelines to report all suspicious transactions to FIU-IND:

• Registration on FINnet 2.0: Every licensed RE must complete registration and obtain institutional credentials on the FIU-IND portal (FINGate / FINnet 2.0).
• Zero Monetary Floor for STRs: Unlike Cash Transaction Reports (CTR) which have a ₹10 Lakh statutory floor, a Suspicious Transaction Report (STR) must be filed regardless of the monetary value involved. Even an attempted transaction that was aborted or rejected by the RE must be reported if suspicion is aroused.
• Statutory Timeline: An STR must be filed with FIU-IND within 7 working days of the MLRO arriving at a conclusion that a transaction or series of transactions is suspicious.
• Absolute Prohibition on Tipping Off: Under Section 12 of PMLA and Chapter X of the Guidelines, the RE, its directors, officers, and employees are statutorily prohibited from disclosing to the client or any third party that an STR has been filed, or that an AML inquiry is underway. Tipping off constitutes a punishable offence.