Comprehensive Study Notes: IFSCA Guidelines for KYC Norms (Chapter 6 — Part 1)

This study guide provides highly structured, authoritative, and exam-focused notes for Chapter 6: IFSCA Guidelines for KYC Norms from the NISM-IFSCA-01 Certification Workbook. It is meticulously designed for compliance professionals, financial intermediaries, and students preparing for the certification exam.

To facilitate progressive, high-retention learning, this extensive chapter is broken down into four comprehensive parts. This document represents Part 1, focusing entirely on Section 6.1: IFSCA Guidelines for KYC Norms and Customer Risk Assessment.

1. Introduction to IFSCA KYC Norms & Customer Risk Management

The provisions of the IFSCA (Anti Money Laundering, Counter Terrorist-Financing and Know Your Customer) Guidelines, 2022 apply strictly to every Regulated Entity (RE) falling under the administrative and regulatory purview of the International Financial Services Centres Authority (IFSCA). These guidelines establish a unified, internationally aligned framework for market integrity and financial system security within the GIFT IFSC ecosystem.

1.1 Scope and Extent of Applicability

• Regulated Entities (REs): Applies to any financial unit, branch, or institution that has been granted a license, recognition, registration, or formal authorisation by the IFSCA to operate within the International Financial Services Centre (IFSC).
• Financial Group Applicability: The provisions of these guidelines do not work in isolation; they also extend, to a specified and legally defined extent, to the broader Financial Group of the Regulated Entity.

Key Legal Definition: Financial Group

Financial Group refers to an organizational structure that consists of a parent company (or any other type of legal person) that exercises active control and coordinating functions over the rest of the group, together with the various branches and/or subsidiaries that are subject to consolidated AML/CFT policies and procedures at the group level.

2. Customer Risk Management Framework

Under Chapter IV (Customer Risk Management) of the IFSCA Guidelines, Regulated Entities are mandated to implement a robust, structured process to identify, assess, and manage the money laundering (ML) and terrorist financing (TF) risks posed by prospective and existing clients.

2.1 The Strategic Link to Business Risk Assessment

The customer risk assessment process is not isolated. A Regulated Entity must ensure that the specific risks and vulnerabilities identified during its comprehensive Business Risk Assessment (BRA) (the enterprise-wide risk analysis) are actively used to design and run the individual Customer Risk Assessment.

2.2 Core Mandates of Customer Risk Assessment

1. Prior Completion: The customer risk assessment must be fully completed prior to undertaking any Customer Due Diligence (CDD) measures for new customers.
2. Dynamic Application: The assessment must also be run for existing customers whenever the Regulated Entity deems it necessary (e.g., upon a material change in circumstances or risk profile).
3. Proportional Risk Rating: The ultimate outcome of the assessment must result in assigning a clear Risk Rating (categorised as Low, Medium, or High) to the customer, which is directly proportionate to the assessed ML/TF risks.
4. Strict Confidentiality (The Anti-Tipping-Off Rule):
   • The risk categorization of any customer, along with the specific reasons, parameters, and indicators that led to that categorization, must be kept strictly confidential.
   • This information shall never be revealed to the customer under any circumstances, ensuring absolute prevention of "tipping off".

3. Essential Evaluation Parameters for Risk Assessment

When undertaking a risk-based assessment of a customer, a Regulated Entity is legally required to obtain, analyze, and consider a diverse set of risk parameters. These parameters are structured to provide a multi-dimensional view of the client's risk profile.

4. Risk Factor Analysis: Identifying High-Risk Scenarios

A Regulated Entity must maintain active compliance systems to detect factors that indicate a High Risk of Money Laundering or Terrorist Financing (ML/TF). When assessing high-risk situations, the RE must evaluate three core categories: Customer Risk, Country/Geographic Risk, and Product/Service/Delivery Channel Risk.

4.1 Customer Risk Factors

The physical nature, operational behavior, or organizational layout of the client may present heightened risks. High-risk indicators include:

• High-Risk Sectors: Customers operating within, or generating wealth from, businesses, activities, or sectors identified as high-risk by the RE or global standards.
• Complex Corporate Structures: Legal entities or legal arrangements whose ownership or control structure appears unusual or excessively complex relative to the actual nature of their business operations.
• Unusual Geographic Distance: Business relationships conducted under abnormal circumstances, such as significant and unexplained geographical separation between the Regulated Entity’s offices in the IFSC and the customer's physical location.
• Nominee & Bearer Shares: Companies that utilize nominee shareholders or have capital structures containing shares in bearer form (which obscure actual ownership transitions).
• Personal Asset Holding Vehicles: Legal persons or legal arrangements that exist primarily as personal asset holding vehicles rather than active commercial businesses.

4.2 Country or Geographic Risk Factors

Geographic risks focus on the legal, regulatory, and criminal landscapes of jurisdictions linked to the client. High-risk indicators include:

• Inadequate AML/CFT Regimes: Countries or jurisdictions to which the RE is exposed (via its own branch/subsidiary operations, customer domiciles, or correspondent banking networks) that suffer from high levels of corruption, organized crime, or inadequate AML/CFT measures as officially identified by the Financial Action Task Force (FATF).
• Credible Deficiencies: Jurisdictions flagged by credible international bodies (e.g., through mutual evaluation reports, detailed assessment reports, or published follow-up papers) as having inadequate AML/CFT systems or failing to implement measures consistent with FATF Recommendations.
• Sanctioned Jurisdictions: Countries or territories subject to active sanctions, embargoes, or restrictive financial measures issued by International Organisations (such as the United Nations) or domestic authorities in India.
• State Support of Terrorism: Jurisdictions known to fund, support, or facilitate terrorist activities, or those harboring organizations designated as terrorist groups by India, other countries, or International Organisations.

4.3 Product, Service, Transaction, or Delivery Channel Risk Factors

The inherent design, delivery mechanism, or transactional options of a product can facilitate illicit flows. High-risk indicators include:

• Private Banking: The provision of bespoke, high-value private banking services.
• Anonymity-Enhancing Features: Products, services, or specific transaction types designed or structured in a way that favours anonymity.
• Non-Face-to-Face Channels: Business relationships or transactions initiated and maintained through non-face-to-face channels without adequate and robust security safeguards.
• Unassociated Third-Party Payments: Situations where incoming payments or settlements are received from unknown, unassociated, or unrelated third parties.
• Nominee & Corporate Formation Services: Professional services offered in relation to providing nominee directors, nominee shareholders, or facilitating the rapid formation of legal entities in foreign jurisdictions.
• Frequent Anonymous Inflows: Transactions characterized by anonymous processing or frequent, unstructured payments coming from unknown third-party sources.

Crucial Analytical Principle: The presence of a single high-risk factor does not automatically force a high-risk rating in every scenario. The Regulated Entity must actively examine the overall risk of the situation, keeping in mind that risk factors are interconnected and must be evaluated holistically.

5. Risk Factor Analysis: Identifying Low-Risk Scenarios

In contrast to high-risk indicators, the IFSCA framework allows Regulated Entities to identify scenarios exhibiting a Low Risk of Money Laundering or Terrorist Financing. Identifying these factors allows the RE to apply Simplified Customer Due Diligence (SCDD), subject to regulatory approvals.

5.1 Customer Risk Factors

Certain institutional, public, or highly regulated clients are deemed inherently low-risk due to their public transparency and supervision. Low-risk indicators include:

• Government Entities: Departments, ministries, or agencies of sovereign governments.
• Listed Public Companies: Publicly traded corporations listed on recognized stock exchanges that are subject to strict regulatory disclosure requirements (either by exchange rules, domestic law, or other enforceable means) that guarantee transparency of beneficial ownership.
• Regulated Financial Institutions: Financial institutions incorporated or established outside India that are subject to, and actively supervised for compliance with, AML/CFT requirements that are consistent with the standards set by the FATF.
• Regulated Subsidiaries: Subsidiaries of the regulated financial institutions mentioned above, provided that the parent entity's governing law ensures the subsidiary strictly observes the identical AML/CFT standards as its parent.
• Public Bodies: Public bodies, statutory boards, or publicly owned enterprises.
• Low-Risk Residency: Individual or corporate residents established, registered, or domiciled in a geographical territory classified as low-risk.

5.2 Product, Service, Transaction, or Delivery Channel Risk Factors

Specific products with low transactional velocity, restricted transferability, or non-investment characteristics present low vulnerabilities. Low-risk indicators include:

• Non-Life Insurance: General contracts of insurance that do not contain investment options (non-life insurance).
• Pure Life Insurance: Life insurance policies that contain no investment return, no redemption value, and no surrender value (pure term insurance).
• Restricted Pension Policies: Insurance policies linked to pension schemes that strictly prohibit early surrender options and cannot be used as collateral for loans or credit.
• Ceded Reinsurance: Reinsurance contracts ceded to an IFSC unit by an insurer that is a highly regulated financial institution.
• Regulated Employee Benefit Schemes: Pension, superannuation, or employee retirement benefit schemes, provided they satisfy the following criteria:
  1. The scheme is designed exclusively to provide retirement benefits to employees.
  2. Contributions to the scheme are executed directly via mandatory deductions from wages.
  3. The formal rules of the scheme strictly prohibit the assignment of any member’s interest to another party.
• Risk-Managed Products: Products where the risk of ML/TF is managed through other controls, such as strict transaction limits or complete transparency of ownership.
• Financial Inclusion Products: Specialized financial products or services designed to provide strictly defined and limited services to specific customer segments for financial inclusion purposes.

Crucial Analytical Principle: Similar to high-risk indicators, the presence of a single low-risk factor does not automatically qualify a relationship for a low-risk rating. The Regulated Entity must perform a holistic evaluation of the overall risk.

6. Prohibited Business Relationships (Absolute Red Lines)

To safeguard the integrity of the IFSC, the IFSCA KYC Guidelines establish absolute boundaries. A Regulated Entity is strictly prohibited from establishing or continuing a business relationship with a customer in any of the following cases:

1. Obstructed Beneficial Ownership Identification: Where the ownership or control arrangements of a customer (such as excessively complex holding layers or opaque structures) prevent the Regulated Entity from identifying one or more of the customer's ultimate Beneficial Owners.
2. Anonymous, Fictitious, or Nominee Accounts: Where the request involves opening or maintaining anonymous accounts, accounts in fictitious or dummy names, or a nominee account which is formally held in the name of one person but is controlled by or held for the active benefit of another person whose identity has not been fully disclosed to the RE.
3. Shell Financial Institutions: Where the prospective client is a Shell Financial Institution (defined as a bank or financial entity incorporated in a jurisdiction where it has no physical presence and is unaffiliated with any regulated financial group).

7. Practice Exam Questions (Topic-Specific)

MCQs — Customer Risk Assessment & Risk Categorization

Q1. Under Chapter IV of the IFSCA (AML, CFT and KYC) Guidelines, 2022, when must a Regulated Entity complete the Customer Risk Assessment for a prospective client?

A) Within 30 days of opening the account.
B) Prior to undertaking Customer Due Diligence (CDD) measures.
C) Immediately after the first financial transaction is processed.
D) During the first annual compliance audit.

Answer: B

Q2. Which of the following is an absolute regulatory “red line” where an IFSCA Regulated Entity is strictly prohibited from establishing a business relationship?

A) The customer is a resident of a high-risk country.
B) The customer is a newly formed personal asset holding vehicle.
C) The customer is a Shell Financial Institution.
D) The customer requests a non-face-to-face account opening.

Answer: C

Q3. To prevent “tipping off”, what are the compliance requirements regarding a customer's assigned risk rating?

A) The rating must be displayed transparently in the customer's portal.
B) The rating and specific reasons for categorization must be kept strictly confidential.
C) The rating must be shared only with the customer's legal counsel.
D) The rating must be updated publicly on the FINGate portal.

Answer: B

Q4. Which of the following customer profiles is categorized as a low-risk indicator under the IFSCA KYC Guidelines?

A) A private banking customer residing in a non-FATF compliant jurisdiction.
B) A public company listed on a stock exchange subject to regulatory transparency of beneficial ownership.
C) A company with nominee shareholders and bearer shares.
D) A foreign trust whose beneficial ownership structure cannot be verified.

Answer: B

8. Key Terminology for Quick Recall

• Regulated Entity (RE): A unit or business granted a license, recognition, registration, or formal authorisation by the International Financial Services Centres Authority (IFSCA).
• Financial Group: A parent company exercising coordinating and control functions, together with its branches and subsidiaries subject to group-level AML/CFT policies.
• Business Risk Assessment (BRA): An enterprise-wide assessment of the exposure to money laundering and terrorist financing risks, which serves as the foundation for individual customer risk profiles.
• Tipping Off: The unauthorized disclosure of AML/CFT investigations or risk assessments to the customer, which could compromise regulatory actions.
• Shell Financial Institution: A financial institution with no physical presence in the country where it is incorporated, and which is unaffiliated with a regulated financial group.