Complete Study Notes on PML (Maintenance of Records) Rules, 2005: Part 3 - KYC Documentation, Small Accounts, and Digital Verification Processes
Chapter 3 of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005 (PMLR) provides the detailed operational guidelines for verifying client identities. It defines the exact documents required, establishes alternative onboarding frameworks (such as Small Accounts), and outlines the digital verification processes—including Digital KYC and Video-based Customer Identification Process (V-CIP)—that reporting entities must use to ensure compliance with the Prevention of Money-laundering Act, 2002 (PMLA).
1. Officially Valid Documents (OVDs) & Address Verification Framework
For individual clients, identity and address verification under Rule 9(4) must be conducted using Officially Valid Documents (OVDs).
Core Individual Identification Requirements
To open an account-based relationship, an individual client must submit:
- Aadhaar Number: Required when the client wants to receive benefits or subsidies under schemes notified under Section 7 of the Aadhaar Act, 2016, or when they decide to submit it voluntarily to a banking company or a notified reporting entity.
- Officially Valid Document (OVD): If Aadhaar is not submitted, or where offline verification cannot be carried out, the client must produce any OVD or its equivalent e-document containing details of their identity and address.
- Tax Identifiers: The client's Permanent Account Number (PAN), an equivalent e-document, or Form No. 60 (as defined in the Income-tax Rules, 1962).
- Business Details: Other documents regarding the client's business nature and financial status, as required by the reporting entity.
Table: Deemed Officially Valid Documents for Address Proof (Rule 9(18))
If the OVD furnished by a client does not contain their updated address, the PMLR allows the use of specific substitute documents. These are treated as deemed OVDs for the limited purpose of proof of address:
| Substitute Document Category | Mandatory Conditions & Validity | Statutory Grace Period for OVD Submission |
|---|---|---|
| Utility Bills | Must not be more than two months old. Covers electricity, telephone, post-paid mobile phone, piped gas, and water bills. | The client must submit an updated OVD (or its equivalent e-document) containing their current address within three months of submitting the deemed OVD. |
| Tax Receipts | Property tax or Municipal tax receipts. | The client must submit an updated OVD (or its equivalent e-document) containing their current address within three months of submitting the deemed OVD. |
| Pension Payment Orders (PPOs) | Pension or family pension payment orders issued to retired employees by Government Departments or Public Sector Undertakings (PSUs), provided they contain the current address. | The client must submit an updated OVD (or its equivalent e-document) containing their current address within three months of submitting the deemed OVD. |
| Employer Allotment Letters | Letters of accommodation allotment issued by Central or State Government Departments, statutory or regulatory bodies, PSUs, scheduled commercial banks, financial institutions, or listed companies. | The client must submit an updated OVD (or its equivalent e-document) containing their current address within three months of submitting the deemed OVD. |
| Leave & License Agreements | Agreements executed with the aforementioned employers for official accommodation. | The client must submit an updated OVD (or its equivalent e-document) containing their current address within three months of submitting the deemed OVD. |
Special Provisions
- Aadhaar Address Declaration (Rule 9(19)): If a client uses their Aadhaar number for identification and wants to provide a current address that differs from the address in the Central Identities Data Repository (CIDR), the reporting entity can accept a self-declaration to that effect.
- Aadhaar Redaction Rule (Rule 9(16)): When a client submits a physical copy of their Aadhaar card, and e-KYC authentication is not required, the reporting entity must ensure the client redacts or blacks out their Aadhaar number to protect their data privacy.
- Non-Submission of PAN/Form 60 (Rule 9(17)): If an existing client fails to submit their PAN or Form 60 by the date notified by the Central Government, the account will temporarily cease to be operational.
- Notice Requirement: Before suspending transactions, the reporting entity must provide the client with an accessible notice and a reasonable opportunity to be heard.
- Closure Request: If the client states in writing that they do not wish to submit their PAN or Form 60, the account must be closed and all outstanding obligations settled after verifying the client's identity.
2. Regulatory Framework for Small Accounts (Rule 9(5))
To promote financial inclusion, Rule 9(5) provides an alternative onboarding framework that allows individuals who lack standard OVDs to open a Small Account with a banking company.
| No. | Safeguard | Requirement / Condition |
|---|---|---|
| 1 | 📸 Photo & Signature | Obtain a self-attested photograph, along with the customer's signature or thumb impression, affixed in the presence of an authorised bank official. |
| 2 | 💻 System Restrictions | Small accounts may be opened only at CBS-linked branches, where prescribed transaction and balance limits can be monitored. |
| 3 | 🌐 Remittance Barriers | Foreign remittances cannot be credited to a small account unless standard KYC requirements have been completed. |
| 4 | 🚨 Suspicion Triggers | If there is suspicion of money laundering or terrorist financing (ML/TF), standard identity verification/KYC procedures are triggered. |
Opening Procedure & Official Certification
- Onboarding Documents: A small account can be opened using only a self-attested photograph and by signing or affixing a thumbprint to the account opening form.
- Designated Officer’s Duty: The designated officer of the bank must certify under their signature that the customer signed or affixed their thumbprint in their presence.
- Prisoner Accounts: If the individual is a prisoner in a jail, they must sign or affix their thumbprint in the presence of the officer in-charge of the jail. The jail officer must certify the signature under their hand. The account can then remain operational based on the annual submission of a proof of address certificate issued by the jail in-charge.
Operational Constraints and Manual Monitoring
- CBS Mandate: Small accounts can only be opened at Core Banking Solution (CBS) linked branches, or branches equipped to manually monitor transaction limits and balances before any transaction is executed.
- Stipulated Limits: The bank must ensure that the stipulated limits on monthly and annual transaction aggregates, as well as the maximum account balance, are not breached.
- Foreign Remittance Ban: Under no circumstances can foreign remittances be credited to a small account unless the client’s identity is fully verified using standard OVDs under Rule 9(4).
- Suspicion Escalation: If there is any suspicion of money laundering, terrorist financing, or other high-risk activity, the relaxation rules are suspended, and the bank must verify the client's identity using standard OVDs.
Validity and Extension Timeline
- Initial Period: A small account remains operational for an initial period of twelve months.
- Extension: The account can be extended for an additional twelve months if the holder provides official evidence showing they applied for an OVD within the first twelve months of opening the account.
- The 24-Month Review: The entire relaxation arrangement for the account must be reviewed after twenty-four months.
- Note on COVID-19 Relief: Under Rule 9(5)(iv), small accounts were permitted to remain operational between 1st April 2020 and 30th June 2020, along with other extension periods notified by the Central Government.
3. Non-Profit Organisations (NPOs) & NITI Aayog DARPAN Portal (Rule 9(9A))
Non-Profit Organisations (NPOs) are recognized globally as highly vulnerable to being misused for terrorist financing. To mitigate this risk, the PMLR establishes strict registration requirements.
The DARPAN Registration Mandate
Under Rule 9(9A), every banking company, financial institution, and intermediary must register the details of any client that is a Non-Profit Organisation on the DARPAN Portal of NITI Aayog, if the NPO is not already registered.
| Step | Action | Requirement |
|---|---|---|
| 1 | 🏦 Reporting Entity Checks NPO Status | Bank / Financial Institution / Intermediary verifies the NPO's registration status. |
| 2A | ✅ Already Registered on DARPAN | Obtain and verify the NPO's DARPAN registration records. |
| 2B | ❌ Not Registered on DARPAN | The NPO must register on the DARPAN Portal as required. |
| 3 | 🗂️ Maintain Records | Maintain the relevant registration records for 5 years after the business relationship ends or the account is closed. |
Record-Keeping Timeline
The reporting entity must maintain the NPO's DARPAN registration records for a minimum of five years after the business relationship has ended or the account has been closed, whichever is later.
4. Verification Methodologies: e-KYC, Offline, and e-Documents
Rule 9(15) outlines the various methods reporting entities can use to verify a client's identity depending on the type of document submitted.
A. Aadhaar e-KYC Authentication (Rule 9(15)(a))
- Application: Triggered when the client voluntarily submits their Aadhaar number to a banking company or a notified reporting entity under Section 11A of the PMLA.
- Procedure: The entity must perform e-KYC authentication directly through the Unique Identification Authority of India (UIDAI) system.
B. Offline Aadhaar Verification (Rule 9(15)(b))
- Application: Used when the client provides proof of possession of Aadhaar where offline verification is possible.
- Procedure: The reporting entity must carry out offline verification using the secure, cryptographic XML or QR data provided by UIDAI.
C. Equivalent e-Document Verification (Rule 9(15)(c))
- Application: Used when the client submits an electronic equivalent of an OVD issued by an official authority.
- Procedure: The reporting entity must:
- Verify the digital signature of the issuing authority as per the provisions of the Information Technology Act, 2000.
- Capture a live photo of the customer in the manner prescribed by the regulator.
5. Digital KYC Process (Rule 9(15)(d))
If offline verification is not possible and the client does not undergo biometric e-KYC, the reporting entity must verify their identity using the Digital KYC process.
Definition of Digital KYC
Digital KYC is the process of capturing a live photo of the client along with their original OVD (or proof of possession of Aadhaar), and recording the latitude, longitude (GPS coordinates), and time stamp of the location where the photo was taken by an authorised officer of the reporting entity.
Step-by-Step Digital KYC Workflow
| Step | Stage | Key Requirement / Action |
|---|---|---|
| 1 | 🔐 Secure App Access | The process must be performed only through the reporting entity's official, access-controlled Digital KYC application. |
| 2 | 👤 In-Person Presence | The client must be physically present before the authorised official and produce the original physical OVD. |
| 3 | 📸 Live Photo Capture | The official captures the client's live photograph against a plain white background. Printed or video-recorded photos are not permitted. |
| 4 | 🏷️ Embedded Watermarking | The application automatically adds a readable watermark containing CAF number, GPS coordinates, official's name, employee code, date and time. |
| 5 | 🪪 Original OVD Capture | The original OVD is positioned horizontally and photographed vertically from above, without tilt or skew. |
| 6 | 🔳 QR Code Data Capture | Where the OVD contains a QR code, the application scans it to auto-populate information such as name, gender, DOB and address. |
| 7 | 📲 Validation & OTP Signature | The client reviews the completed Customer Application Form (CAF). An OTP is sent to the registered mobile number; successful validation serves as the client's digital signature. |
| 8 | 👨💼 Officer Declaration | The authorised officer submits an on-screen declaration, verifies it through an OTP, and captures their own live photograph to complete the verification. |
| 9 | ✍️ Digital Signing & Upload | After successful verification, the CAF is digitally signed by the reporting entity's representative. A printed copy is physically signed by the customer, scanned and uploaded. The original OVD is returned. |
6. Video-based Customer Identification Process (V-CIP)
For Indian nationals, the Video-based Customer Identification Process (V-CIP) serves as a secure, consent-based, remote alternative that is treated on par with in-person identification.
Core Requirements of V-CIP
- Interactive Session: A secure, live, audio-visual interaction conducted by an authorised official of the Regulated Entity (RE) with the customer.
- Facial Recognition: Utilises facial recognition technology to compare the customer’s live video face with the photo on their OVD.
- Audit Trail: The entire video interaction must be recorded, creating a comprehensive, secure, and time-stamped audit trail of the session.
- Onboarding Scope: V-CIP can be used for onboarding new individual customers, sole proprietors, authorised signatories, and Ultimate Beneficial Owners (UBOs) of non-natural persons. It can also be used for periodic KYC updates.
7. Key Terms and Definitions Reference
- Officially Valid Document (OVD): Passport, driving licence, proof of possession of Aadhaar number, Voter's Identity Card, job card issued by NREGA signed by an officer of the State Government, and letter issued by the National Population Register containing details of name and address.
- Deemed OVD: Specified temporary substitute documents (such as utility bills under two months old) that are acceptable solely for verifying a client's address, provided an updated OVD is submitted within three months.
- Digital KYC: A verification process where an authorised official captures a live photo of a client and their OVD, embedding GPS coordinates, CAF number, employee code, and date-time stamps.
- Small Account: A basic savings account opened with minimal documentation (a self-attested photo and signature/thumbprint) at a CBS-enabled branch, subject to strict transaction and balance limits and a complete ban on foreign remittances.
- DARPAN Portal: A centralized registration portal managed by NITI Aayog used to track and monitor the registration records of Non-Profit Organisations.
8. Exam-Focused Practice Questions
Question 1
If an individual client submits a deemed Officially Valid Document (such as a water bill not more than two months old) for address proof, what is the statutory timeframe within which they must submit an updated OVD with their current address?
- A) 30 days
- B) 3 months
- C) 6 months
- D) 12 months
Answer: B Explanation: Under Rule 9(18), when a client submits a deemed OVD for address proof, they must submit an updated OVD (or its equivalent e-document) with their current address within a period of three months.
Question 2
Under Rule 9(5), a "Small Account" opened with a banking company remains operational initially for a period of:
- A) 6 months
- B) 12 months
- C) 24 months
- D) 5 years
Answer: B Explanation: Rule 9(5)(iii) states that a small account shall remain operational initially for a period of twelve months, and can be extended for a further twelve months if the holder provides evidence of having applied for an OVD.
Question 3
Under Rule 9(9A), registration details of a client that is a Non-Profit Organisation (NPO) must be maintained on the NITI Aayog DARPAN Portal for how long after the relationship has ended?
- A) 2 years
- B) 3 years
- C) 5 years
- D) 10 years
Answer: C Explanation: Rule 9(9A) states that the registration records on the DARPAN Portal must be maintained for a period of five years after the business relationship between a client and a reporting entity has ended or the account has been closed, whichever is later.