Chapter 6: IFSCA Guidelines for KYC Norms

Customer Due Diligence (CDD) represents the operational bedrock of KYC compliance within the GIFT International Financial Services Centre. Because the IFSC functions as an offshore financial gateway welcoming international investors, multinational corporations, global funds, and non-resident individuals, the CDD regime combines international FATF benchmarks with India's domestic legal architecture.

Under Chapter V of the IFSCA (AML, CFT and KYC) Guidelines, 2022, a Customer or Client is defined as any person engaged in a financial transaction or activity with an RE, and includes any person on whose behalf the transaction is being executed.

                         THE 4 CORE PILLARS OF CDD IN GIFT IFSC
                                            │
        ┌───────────────────┬───────────────┴───────────────┬───────────────────┐
        ▼                   ▼                               ▼                   ▼
[ Identification & ]    [ Beneficial Ownership ]      [ Purpose & Nature ]  [ Ongoing Transaction ]
[ Verification ]        [ Discovery ]                 [ of Relationship ]   [ Monitoring ]
- Natural Persons       - Natural persons behind      - Understand economic - Scrutinize turnover
  (Passport, OVD, V-CIP)  corporate veils               rationale             against declared profile
- Legal Persons         - Threshold: > 10% for Cos/   - Profile expected    - Real-time screening
  (Constitutional Docs)   Trusts; > 15% for Unincorp    volume & frequency    against sanctions

The 4 Mandatory Pillars of Customer Due Diligence

1. Identification and Independent Verification:
   • Identifying the customer (whether natural person, corporate body, partnership, or trust) using reliable, independent source documents, data, or electronic equivalents.
   • Verifying the customer's permanent and operational identity and legal existence before opening an account or executing financial business.
2. Identification of Beneficial Ownership (BO):
   • Peeling back corporate structures to identify the natural person(s) who ultimately own, control, or exercise effective dominant influence over the customer.
3. Understanding the Purpose and Intended Nature of the Business Relationship:
   • Ascertaining the economic rationale of the account, anticipated transactional turnover, investment objectives, and operational sources of wealth.
4. Conducting Ongoing Due Diligence and Transaction Scrutiny:
   • Monitoring ongoing transactions throughout the course of the relationship to ensure consistency with the customer’s known commercial profile, source of wealth, and risk rating.

Detailed Verification Requirements by Entity Type

The 30-Day Conditional Verification Exception (Clause 5.3)

While the default statutory rule mandates that verification must be fully completed prior to establishing a business relationship, Clause 5.3 allows a limited deferral under strictly governed circumstances:

• Conditions: Deferral is permissible only if it is essential to avoid interrupting the normal conduct of business; the ML/TF risk is objectively verified as low; and safeguards ensure that funds cannot be paid out or transferred to third parties before verification is complete.
• Strict 30-Business-Day Cap: The pending verification must be completed within 30 business days of establishing the relationship.
• Mandatory Actions on Default: If verification remains uncompleted upon the expiry of 30 business days, the RE must immediately suspend the business relationship, freeze all transaction capabilities (except returning funds to their original source, to the extent legally permissible), and report the non-compliance incident to its Governing Body.

Where a customer, transaction, or jurisdiction presents a heightened vulnerability to financial crime, standard due diligence measures are statutorily insufficient. In such cases, Regulated Entities must apply Enhanced Due Diligence (EDD) under Chapter V of the IFSCA Guidelines.

                          ENHANCED DUE DILIGENCE (EDD) TRIGGER MATRIX
                                                │
         ┌──────────────────────────────┬───────┴──────────────────────┬──────────────────────────────┐
         ▼                              ▼                              ▼                              ▼
  [ High-Risk Jurisdictions ]       [ PEPs & Associates ]     [ Complex Offshore Vehicles ]  [ Shell Bank / Anonymity ]
  - FATF Black/Grey Lists           - Foreign heads of state   - Bearer shares / Nominees     - Anonymous accounts
  - Sanctioned nations              - Senior military / judiciary- Multi-tier trusts           - Fictitious names
  - Mandatory EDD & countermeasures - Prior approval needed    - Unexplained opacity          - STRICTLY PROHIBITED

Mandatory EDD Protocols (Clause 5.6)

Whenever a customer is categorised as High Risk, the RE must execute the following enhanced controls:

1. Senior Management Approval: Obtaining explicit written approval from Senior Management (or the Governing Body) before establishing a business relationship, or prior to continuing an existing relationship when an existing customer is escalated to high risk.
2. Ascertaining Source of Funds and Source of Wealth:
   • Source of Funds: Establishing the specific origin and monetary trail of the funds used in the immediate transaction (e.g., bank statement tracing sales proceeds, dividends, or debt facility).
   • Source of Wealth: Investigating the broader economic activities, cumulative business undertakings, inheritances, or commercial ventures that generated the customer's total net worth over time.
3. Enhanced Transaction Monitoring: Subjecting the account to intensified monitoring, adjusting automated transaction monitoring rules to lower threshold triggers, and reviewing transaction patterns on a weekly or daily basis.
4. Shortened KYC Refresh Frequency: Requiring complete re-verification and updating of KYC documents at least annually (compared to 8 years for low-risk and 3 years for medium-risk customers).

Statutory Rules Governing Politically Exposed Persons (PEPs)

Under the PMLA and IFSCA Guidelines, Politically Exposed Persons (PEPs) are individuals who are or have been entrusted with prominent public functions by a foreign government, such as:

• Heads of State or Governments
• Senior politicians and political party executives
• Senior government, judicial, or military officials
• Senior executives of state-owned corporations and central banks
• Important political party officials.

The definition explicitly extends to Family Members (spouses, children, parents, siblings) and Close Associates (business partners, individuals with shared beneficial ownership in entities) of such persons.

For any prospective or existing customer identified as a PEP:

• Senior Management approval is mandatory prior to onboarding.
• Independent verification of the PEP's declared source of wealth and source of funds is legally compulsory.
• If an existing client subsequently becomes a PEP, the relationship must be escalated immediately to Senior Management for formal approval to continue banking or investment operations.

Beneficial Ownership (BO) Discovery in Complex Offshore Structures

To comply with FATF standards and Section 2(1)(fa) of the PMLA, the IFSCA has harmonised Beneficial Ownership discovery thresholds across corporate and institutional forms:

                      BENEFICIAL OWNERSHIP (BO) THRESHOLD FORMULA
                                           │
         ┌─────────────────────────────────┼─────────────────────────────────┐
         ▼                                 ▼                                 ▼
   [ Companies ]                 [ Partnership / AOP ]                 [ Trusts ]
- Natural person(s) owning     - Natural person(s) owning       - Author / Settlor, Trustees
  > 10% shareholding, capital,   > 10% capital or profits       - Beneficiaries with ≥ 10%
  or profits                   - Unincorporated Association:      interest
- Or exercising control via      > 15%                          - Any natural person with
  management agreements                                           ultimate effective control

• Senior Managing Official Fallback: Where no natural person is identified as a beneficial owner under the ownership or control tests after exhausting all reasonable investigative measures, the RE must identify the Senior Managing Official (CEO, Managing Director, or Chief Operating Officer) as the Beneficial Owner.
• Absolute Prohibition on Anonymous Accounts & Shell Entities: Under Clause 5.2 of the Guidelines, an RE is statutorily prohibited from opening or maintaining anonymous accounts, accounts in fictitious names, or relationships with Shell Banks (banks that have no physical presence in any country and are not affiliated with a regulated financial group).

The risk-based philosophy of the IFSCA guidelines ensures that low-risk financial transactions and institutions are not subjected to disproportionate administrative burdens. At the same time, the offshore, multi-currency environment of GIFT IFSC requires continuous vigilance through ongoing due diligence, real-time sanctions screening, and regulatory harmonization.

Simplified Due Diligence (SDD) Framework (Clause 5.7)

Where a Regulated Entity determines through an objective Customer Risk Assessment that a customer presents a Low Risk of money laundering, terrorist financing, and proliferation financing, it may adopt Simplified Due Diligence (SDD) measures.

Permissible Reductions under SDD:

1. Verifying the customer's identity and that of the beneficial owner after the establishment of the business relationship, provided low-risk conditions are maintained.
2. Reducing the frequency of routine customer identification updates (extended up to an 8-year interval, subject to event-driven triggers).
3. Reducing the intensity of ongoing monitoring and scrutinizing transactions only when they cross higher aggregate thresholds.
4. Inferring the purpose and intended nature of the business relationship from the type of transactions or business established, without demanding ancillary evidentiary documents.

Eligible Low-Risk Customers:

• Central and State Government departments, statutory bodies, and sovereign wealth funds.
• Regulated financial institutions incorporated in FATF-compliant jurisdictions subject to equivalent AML oversight.
• Publicly listed companies whose shares are traded on recognised stock exchanges with comprehensive disclosure requirements.
• Pension, provident, or superannuation schemes where contributions are made via direct salary deductions and rules forbid assignment of benefits.

Crucial Invalidation Rule: SDD is strictly prohibited whenever there is a suspicion of money laundering or terrorist financing, or where high-risk indicators or adverse media emerge. Standard CDD or EDD must be deployed immediately.

Real-Time Sanctions Screening and UN Obligations (Chapter XI)

Regulated Entities in the IFSC must maintain automated, real-time screening mechanisms to screen all customers, authorized signatories, beneficial owners, and cross-border payment counterparties against international sanctions lists:

1. UNSCR 1267 / 1989 / 2253 Sanctions Committee: Targeted financial sanctions against ISIL (Da'esh), Al-Qaida, and affiliated terrorist individuals and entities.
2. UNSCR 1373 (2001): Freezing of assets of individuals and entities committing or facilitating terrorist acts, notified by the Ministry of External Affairs (MEA) and Ministry of Home Affairs (MHA).
3. Weapons of Mass Destruction Act, 2005 (WMD Act): The 2022 Amendment prohibits the financing of any activity in relation to weapons of mass destruction and empowers the Central Government to freeze, seize, or attach financial assets of designated persons.
4. Real-Time Screening Trigger: If a customer's name matches an entry on the designated terrorist list, the RE must immediately freeze the funds, refuse the transaction without tipping off the client, and report the match to the Central Sanctions Nodal Officer and FIU-IND within 24 hours.

Regulatory Comparison: IFSCA vs Domestic Regulators (RBI & SEBI)

Because the IFSC operates as a de-facto offshore financial center within India's political territory, its AML/KYC provisions exhibit notable distinctions when compared to domestic Indian guidelines: