Complete Study Notes on PML (Maintenance of Records) Rules, 2005: Part 2 - Client Due Diligence & Beneficial Ownership Framework
The Prevention of Money-laundering (Maintenance of Records) Rules, 2005 (PMLR) establish a rigorous regulatory mechanism for identifying, verifying, and monitoring clients. Rule 9 of the PMLR forms the bedrock of the Client Due Diligence (CDD) architecture. It mandates that financial intermediaries systematically authenticate the identities of their clients, understand their business relationships, and uncover the true human controllers—the Ultimate Beneficial Owners (UBOs)—behind legal entities and arrangements.
This section covers the core requirements of Rule 9, including CDD trigger events, verification timelines, the Central KYC Records Registry (CKYCR), rules for third-party reliance, and the specific ownership thresholds used to identify beneficial owners.
1. Trigger Events and Statutory Timing for Customer Due Diligence (CDD)
Under Rule 9(1), Customer Due Diligence is not a one-time onboarding check; it is a statutory gateway triggered by specific operational events. Reporting entities must identify and verify their clients using reliable, independent source documents.
| No. | Trigger | When CDD Is Required |
|---|---|---|
| 1 | 🏦 Account Relationship | When initiating any account-based relationship with a client. |
| 2 | 💸 Occasional Transaction | When carrying out a single or connected occasional transaction valued at ≥ ₹50,000. |
| 3 | 🌐 Wire Transfers | When executing international money transfer / wire transfer operations. |
Trigger Events Under Rule 9(1)
- Commencement of an Account-Based Relationship: Triggered when a customer opens a depository, securities, or banking account.
- Occasional High-Value Transactions: Applies to walk-in or one-off transactions valued at Rs. 50,000 or more. This includes multiple transactions that appear to be connected.
- International Money Transfers: Mandatory for any international remittance or money transfer operation, regardless of the transaction value.
Core CDD Actions Required
- Identify and Verify: Confirm the client’s identity using reliable, independent, and official sources.
- Establish Purpose: Document the business purpose and the intended nature of the financial relationship.
- Understand the Business: Take reasonable steps to understand the client's industry, business operations, and ultimate ownership or control structure.
- Identify Beneficial Owners: Determine whether the client is acting on behalf of another person, and identify and verify that beneficial owner.
Statutory Provisos for Verification Flexibility
- The Postponed Verification Clause: If a regulator determines that money laundering and terrorist financing risks are effectively managed, and that immediate verification would disrupt normal business, the regulator may permit the reporting entity to complete identity verification as soon as reasonably practicable after establishing the relationship.
- The Foreign Listed Subsidiary Clause: If a client is subscribing to or dealing with depository receipts or equity shares of an Indian company listed in notified foreign jurisdictions, and the client is acting on behalf of a beneficial owner resident in that jurisdiction, the due diligence, identification, and verification of that beneficial owner will be governed strictly by the norms of that foreign jurisdiction. In these cases, the standard domestic verification procedures under sub-rules (3) to (9) of Rule 9 do not apply.
2. The Central KYC Records Registry (CKYCR) & KYC Identifier
The Central KYC Records Registry (CKYCR) is a central government-owned and controlled entity authorized to receive, store, safeguard, and retrieve KYC records in digital form. This system allows reporting entities to share verified customer records, reducing compliance costs across the industry.
Key Operating Timelines and Procedures
- The 10-Day Electronic Filing Mandate (Rule 9(1A)): Reporting entities must submit an electronic copy of a client’s KYC records to the CKYCR within ten days of establishing an account-based relationship.
- The KYC Identifier (Rule 9(1B)): The CKYCR processes the uploaded KYC records, runs deduplication checks, and issues a unique KYC Identifier (a unique number or code assigned to the client). The reporting entity must then communicate this Identifier in writing to the client.
- Online Retrieval and the "No Fresh Documents" Rule (Rule 9(1C)): During subsequent identity verifications or ongoing reviews, the reporting entity must retrieve the client's KYC records online from the CKYCR using their KYC Identifier. The entity cannot require the client to submit the same KYC records or additional identification documents unless:
- The client's information has changed compared to the records stored in the CKYCR.
- The retrieved KYC records are incomplete or do not comply with the current KYC norms prescribed by the sectoral regulator.
- The reporting entity requires additional address verification, enhanced due diligence (EDD), or needs to build a more accurate risk profile.
Managing KYC Updates (Rule 9(1D))
When a client submits updated information, the reporting entity must upload the updated records to the CKYCR within seven days (or a period notified by the Central Government). The CKYCR will then update the client's master record and electronically notify all other reporting entities that have previously retrieved that client's KYC data.
Allocation of Accountability and Data Privacy
- Verifying Authenticity (Rule 9(1E)): The reporting entity that performed the last KYC verification or uploaded the latest update is legally responsible for verifying the authenticity of the client's identity and address.
- Strict Use Constraints (Rule 9(1F)): Reporting entities are prohibited from using retrieved KYC records for any purpose other than verifying a client's identity or address. They cannot transfer KYC records to any third party unless explicitly authorized by the client, the regulator, or the Director of FIU-IND.
- Foreign National Exemption in the IFSC: For entities operating within an International Financial Services Centre (IFSC), CKYCR filing, storage, and retrieval are not required for clients who are foreign nationals.
3. Statutory Conditions for Third-Party Reliance
Under Rule 9(2), reporting entities are permitted to rely on Customer Due Diligence (CDD) carried out by a third party to onboard clients. However, to prevent compliance gaps, this reliance is subject to strict statutory conditions:
| No. | Condition | Requirement |
|---|---|---|
| 1 | 📥 Immediate Data Retrieval | Obtain CDD records from the third party or CKYCR immediately upon onboarding. |
| 2 | 📄 Documentation on Demand | Ensure the third party can provide copies of identity data and supporting documents without delay when requested. |
| 3 | 🏛️ Regulatory Supervision | Verify that the third party is regulated and supervised and maintains compliant CDD and record-keeping systems. |
| 4 | 🌍 Geographic Restriction | Confirm that the third party is not based in a country assessed as high-risk. |
| 5 | ⚖️ Ultimate Liability & Retention | The reporting entity remains ultimately responsible for CDD and any required Enhanced Due Diligence (EDD) and must retain the relevant information. |
- Relaxation for Financial Groups: If the third party is part of the same financial group, the regulator may issue guidelines to relax the requirements for immediate data retrieval, document delivery, regulatory supervision, and geographic restrictions.
4. Thresholds and Parameters for Determining Beneficial Ownership
To prevent money launderers from hiding behind complex corporate structures, reporting entities must identify the Ultimate Beneficial Owner (UBO)—the natural persons who ultimately own, control, or direct a client entity.
Under Rule 9(3), beneficial ownership is determined using specific statutory thresholds based on the client's legal structure:
Table: Beneficial Ownership Identification Thresholds
| Client Legal Structure | Primary Beneficial Ownership Threshold | Statutory Definition of Control / Key Roles |
|---|---|---|
| Company | Natural person(s) owning or entitled to more than 10% of the shares, capital, or profits. | Control: The right to appoint the majority of directors or control management and policy decisions through shareholding, management agreements, or voting agreements. |
| Partnership Firm | Natural person(s) owning or entitled to more than 10% of the capital or profits of the partnership. | The right to control and direct management or policy decisions of the firm. |
| Unincorporated Association or Body of Individuals | Natural person(s) owning or entitled to more than 15% of the property, capital, or profits. | Applies to associations, societies, and other unincorporated organizations. |
| Trust | No percentage threshold for key roles; 10% or more interest for beneficiaries. | Must identify: (1) the author/settlor, (2) the trustee(s), (3) beneficiaries with 10% or more interest, and (4) any natural person exercising ultimate effective control over the trust. |
Fallback Rule for Corporate/Unincorporated Clients
If no natural person can be identified using the ownership or control thresholds for a company, partnership, or unincorporated association, the beneficial owner is designated as the natural person holding the position of Senior Managing Official (SMO).
Statutory Exemptions from Beneficial Owner Verification
- The Listed Entity Exemption (Rule 9(3)(f)): If the client (or the owner of the controlling interest) is an entity listed on a stock exchange in India, or is listed on a stock exchange in a notified foreign jurisdiction, or is a subsidiary of such a listed entity, the reporting entity is not required to identify or verify the individual shareholders or beneficial owners.
- Condition: This exemption does not apply if the reporting entity has doubts about the veracity of previously obtained CDD information, or suspects links to money laundering or terrorist financing.
5. Key Terms and Definitions Reference
- Client Due Diligence (CDD): The process of identifying and verifying the identity of a customer, understanding the nature of their business, and identifying any beneficial owners.
- Central KYC Records Registry (CKYCR): A centralized digital repository substantially owned and controlled by the Central Government to receive, store, safeguard, and retrieve electronic copies of client KYC records.
- KYC Identifier: A unique number or code assigned to a client by the CKYCR upon successful upload and de-duplication of their KYC records.
- Controlling Ownership Interest: The specific threshold of ownership (more than 10% for companies and partnerships; more than 15% for unincorporated associations) that triggers beneficial owner identification.
- Senior Managing Official (SMO): The natural person who holds a senior executive position within a client entity, used as a fallback identification target when no natural person meets the controlling ownership thresholds.
6. Exam-Focused Practice Questions
Question 1
Under Rule 9(1A) of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005, a reporting entity must file an electronic copy of a client's KYC records with the Central KYC Records Registry (CKYCR) within:
- A) 7 days of commencing the relationship
- B) 10 days of commencing the relationship
- C) 15 days of the succeeding month
- D) 30 days of establishing the account
Answer: B Explanation: Rule 9(1A) states that every reporting entity shall, within ten days after the commencement of an account-based relationship with a client, file an electronic copy of the client's KYC records with the Central KYC Records Registry.
Question 2
What is the statutory threshold of ownership or entitlement to shares, capital, or profits required to identify a natural person as a beneficial owner of a Company client under the PMLR?
- A) Exceeding 25%
- B) More than 15%
- C) More than 10%
- D) Equal to or exceeding 5%
Answer: C Explanation: Under Rule 9(3)(a), for a company client, the controlling ownership interest threshold that defines a beneficial owner is ownership of or entitlement to more than ten per cent of the shares, capital, or profits of the company.
Question 3
Under what circumstance is a reporting entity permitted to bypass the requirement to identify and verify the beneficial owners or shareholders of a client?
- A) If the client is a non-profit organization registered on the DARPAN portal
- B) If the client is an entity listed on a stock exchange in India, or is a subsidiary of such a listed entity
- C) If the transaction is an occasional international wire transfer under Rs. 50,000
- D) If the client undergoes video-based customer identification (V-CIP)
Answer: B Explanation: Under Rule 9(3)(f), if the client or the owner of the controlling interest is an entity listed on a stock exchange in India (or in notified foreign jurisdictions), or is a subsidiary of such a listed entity, it is not necessary to identify and verify the identity of any shareholder or beneficial owner.