Comprehensive Study Notes: IFSCA Guidelines for KYC Norms (Chapter 6 — Part 2)

This study guide represents Part 2 of the comprehensive series for Chapter 6: IFSCA Guidelines for KYC Norms, focusing on Section 6.2 (Customer Due Diligence Process) and Section 6.3 (Customer Due Diligence Requirements). This document covers the regulatory frameworks governing Customer Due Diligence (CDD), operational deferral rules, mandatory client identification attributes, verification standards, and digital onboarding mechanisms.

1. The Core Customer Due Diligence (CDD) Framework

Customer Due Diligence (CDD) is a foundational regulatory mechanism that ensures Regulated Entities (REs) actively verify the identity of their business partners and monitor transactions to prevent illicit financial activities.

1.1 Legal Definition of a Customer/Client

Under the IFSCA Guidelines, a Customer or Client is defined as:

• Any person who is engaged in a financial transaction or activity with a Regulated Entity.
• Anyone on whose behalf the person engaging in the transaction or activity is actively acting.

1.2 Risk-Proportional Application of CDD

CDD is not a one-size-fits-all process. The intensity and nature of the due diligence measures must be aligned directly with the customer’s assigned risk rating (Low, Medium, or High) as determined during the pre-onboarding Customer Risk Assessment.

1. Standard Customer Due Diligence: Applied as the baseline for all customers, specifically those categorized as medium risk.
2. Enhanced Customer Due Diligence (ECDD): Applied in addition to standard CDD measures for any customer who has been assigned a High Risk rating.
3. Simplified Customer Due Diligence (SCDD): Applied by modifying and simplifying the standard CDD process for customers assigned a Low Risk rating.

2. CDD Timing and Deferral Protocols

Regulated Entities must observe strict timing protocols regarding when due diligence and verification must be completed.

2.1 Standard Timing Rules

An RE is required to undertake CDD measures at the following milestones:

• Initial Onboarding: At the time of establishing the business relationship.
• Triggers for Re-Evaluation: After establishing the relationship, CDD must be conducted if:
  • The RE doubts the veracity or adequacy of previously obtained customer due diligence documents, data, or information.
  • There is any suspicion of money laundering or terrorist financing (ML/TF).
  • There is a formal change in the customer's assigned risk rating, or a material change in the customer's personal or business circumstances.

2.2 The Deferral Framework: Onboarding Prior to Verification

In specific circumstances, an RE may establish a business relationship with a customer before completing the verification of identity. This is a tightly regulated exemption and is subject to the following four concurrent conditions:

1. Conduct Continuity: The deferral of verification is essential so as not to interrupt the normal conduct of the business relationship.
2. Low Risk Control: There is a demonstrated low risk of ML/TF, and any risks identified can be effectively managed by the RE.
3. Account Safeguards (Banking Units): In the case of bank account openings, there are robust safeguards in place to ensure that the account cannot be closed and no transactions are carried out by or on behalf of the holder (including any payouts from the account) until verification is fully completed.
4. Time Limitation: The relevant verification must be completed as soon as reasonably practicable, and in any event, must not exceed 30 business days after establishing the business relationship.

2.3 Regulatory Consequences of Verification Failure

If the customer's identity cannot be verified within the permitted deferral windows, the RE must execute mandatory escalation and restriction procedures.

3. Detailed Customer Identification Requirements

Before initiating verification, the RE must collect a comprehensive set of mandatory identification attributes. The information required differs significantly based on whether the customer is a natural person or a legal entity.

3.1 Identification of Natural Persons

If the customer is an individual, the RE must obtain at least the following details:

• Full Name: Including any known aliases.
• Unique Identification Number: Such as an identity card number or passport number.
• Date of Birth.
• Nationality.
• Legal Domicile.
• Current Residential Address: A physical address must be provided; a post office box address is not acceptable for this purpose.
• Contact Details: Personal, office, or work telephone numbers.

3.2 Identification of Legal Persons or Legal Arrangements

If the customer is a corporate entity, partnership, trust, or other legal arrangement, the RE must collect:

• Corporate Identities: Full official name and any trading names.
• Unique ID: Tax identification number (or equivalent), incorporation number, or business registration number.
• Physical Footprint: Registered or business address, and if different, the principal place of business.
• Establishment Details: Date of establishment, incorporation, or registration.
• Jurisdictional Domicile: Place of incorporation or registration.
• Constitutional Powers: Identify the legal form, constitution, and powers that regulate and bind the legal person or arrangement.

3.3 Related and Connected Party Screening

For legal persons or arrangements, the due diligence process must extend beyond the entity itself. The RE is required to identify and screen the related or connected parties of the customer and remain actively appraised of any changes to these parties.

For every connected party, the RE must obtain:

1. Full Name: Including any aliases.
2. Unique Identification Number: Such as an identity card number or passport number.

4. Customer Identity Verification Standards

Verification involves confirming the collected identification details against reliable, independent source data, documents, or information.

4.1 Documents for Verifying Natural Persons

The most reliable documents are those that are highly secure, government-issued, and difficult to counterfeit. Key acceptable documents include:

• Officially Valid Documents (OVDs): Any OVD containing a photograph of the customer, name, unique identification number, date of birth, and nationality (such as a valid passport or government-issued identity card).
• Proof of Address: Residential address verified through an OVD, or temporarily via a recent utility bill, bank statement, or other specific documents defined as OVD equivalent under the guidelines.

4.2 Documents for Verifying Legal Persons and Arrangements

The proof of existence, legal form, constitution, and binding powers must be verified using:

• Constitutional Verification: Certificate of incorporation, certificate of good standing, partnership deed or agreement, trust deed, or other constitutional documents from a reliable independent source.
• Binding Authority Verification: Constitutional documents, the names of relevant individuals holding Senior Management positions, and a board resolution (or equivalent document) authorising the opening of the account and designating authorized signatories.

4.3 CDD for Authorized Representatives (Power of Attorney Holders)

Where a natural person is appointed to act on behalf of a customer (natural or legal person) to establish business relations, the RE must:

• Identify and verify the identity of the appointed representative using standard natural person due diligence measures.
• Verify the representative's formal authorization by obtaining appropriate documentary evidence, such as a Power of Attorney (POA), a resolution passed by the Governing Body, or other official authorization documents.
• Large Signatory Exemption: If there is an exceptionally long list of appointed representatives (e.g., more than 10 authorized signatories), the RE is permitted to focus verification efforts specifically on those natural persons who will deal directly with the RE.

5. Technology-Driven CDD Processes for Indian Nationals

To enhance operational efficiency and facilitate seamless digital onboarding, the IFSCA Guidelines permit technology-driven verification processes specifically tailored for Indian nationals.

5.1 Video-Based Customer Identification Process (V-CIP)

V-CIP is a secure, consent-based alternate method of customer identification that utilizes facial recognition and live audio-visual interactions conducted by an authorized official of the RE.

Key Characteristics and Regulatory Status

• Face-to-Face Equivalent: A V-CIP process that complies with prescribed standards is legally treated on par with a face-to-face customer identification procedure [368/371].
• Consent-Based and Secure: The interaction must be seamless, secure, live, informed, and consent-based, with a complete audit trail maintained by the RE.

Scope of Applicability for V-CIP

Regulated Entities can deploy V-CIP for the following use cases:

• New Individuals: CDD for onboarding new individual customers.
• Proprietorships: CDD for the sole proprietor in the case of a proprietorship firm.
• Corporate Signatories & BOs: CDD for authorized signatories and Beneficial Owners (BOs) of non-natural persons.
• KYC Updation: Conducting periodic updates of KYC for eligible existing customers.

5.2 Digital KYC Process for Indian Nationals

For digital onboarding of Indian nationals, the RE must obtain and verify specific digital and physical attributes while establishing an account-based relationship or verifying a beneficial owner or POA holder:

1. Aadhaar Pathways:
   • Voluntary Authentication: The customer's Aadhaar number, where they voluntarily decide to submit it to a bank or a notified RE under Section 11A of the PMLA.
   • Offline Verification: Proof of possession of Aadhaar where offline verification can be successfully carried out.
   • Digital KYC/OVD: Proof of possession of Aadhaar where offline verification cannot be carried out, or any other OVD/equivalent e-document.
2. PAN Requirement: The customer's Permanent Account Number (PAN) or the equivalent e-document thereof.
3. Financial/Business Status: Additional documents establishing the nature of the customer's business and financial status.

Regulatory Definition: Equivalent e-Document

Equivalent e-Document refers to an electronic equivalent of a document issued directly by the official issuing authority of that document. It must feature a valid Digital Signature and includes secure documents issued to the customer’s official digital locker account (such as DigiLocker in India) or its equivalent in other recognized jurisdictions [375/378].

6. Practice Exam Questions (Topic-Specific)

MCQs — Deferred Verification, V-CIP & Customer Identification

Q1. If an IFSCA Regulated Entity establishes a business relationship under the deferred verification framework, what is the maximum regulatory timeframe permitted to complete the customer's verification?

A) 15 business days
B) 30 business days
C) 60 calendar days
D) 120 calendar days

Answer: B

Q2. Under the IFSCA Guidelines, what is the immediate consequence if a deferred customer verification is not completed within 30 business days?

A) The account must be permanently closed.
B) A monetary penalty is immediately levied on the customer.
C) The business relationship must be suspended, and the RE must refrain from carrying out further transactions.
D) The case must be referred directly to the Directorate of Enforcement.

Answer: C

Q3. If a deferred verification remains incomplete for 120 days after establishing a business relationship, what action is legally mandated for the Regulated Entity?

A) Seek a 30-day extension from the IFSCA.
B) Transfer the balance to a suspense account.
C) Terminate the business relationship with the customer.
D) File an emergency Suspicious Transaction Report (STR).

Answer: C

Q4. For which of the following use cases is a Regulated Entity permitted to utilize the Video-Based Customer Identification Process (V-CIP)?

A) Only for the onboarding of low-risk individual domestic retail accounts.
B) Only for corporate board members who are foreign nationals.
C) For onboarding new individuals, sole proprietors, corporate authorized signatories, beneficial owners, and conducting periodic KYC updates.
D) Only when physical documentation has been destroyed by a natural disaster.

Answer: C

Q5. When identifying an individual customer, which of the following details must be obtained, and what is the restriction regarding the address?

A) Full name, nationality, and any address including a P.O. Box.
B) Full name, nationality, unique ID, date of birth, and a current residential address (other than a P.O. Box).
C) Trading name, tax identification number, and registered office address.
D) Date of birth, nationality, and a self-declared postal address.

Answer: B

7. Key Terminology for Quick Recall

• Customer/Client: A person engaged in a financial transaction or activity with an RE, or the person on whose behalf the transaction is being conducted.
• Deferred Verification: A risk-based regulatory flexibility allowing the establishment of a business relationship prior to completing identity verification under strict conditions and time bounds.
• Suspension of Account: The temporary halting of all active transaction capabilities on a client's account due to non-compliance with verification timelines (mandated at the 30-business-day milestone).
• Termination of Account: The permanent ending of the business relationship, legally mandated if a deferred verification remains uncompleted for 120 days.
• V-CIP (Video-Based Customer Identification Process): An alternate, secure, consent-based audio-visual interaction method treated on par with face-to-face identification.
• Equivalent e-Document: An electronically signed equivalent of a document issued directly by the official issuing authority, such as documents retrieved from DigiLocker.