Know Your Customer (KYC) norms/Anti-Money Laundering (AML) standards
Different norms/ guidelines regarding "Know your customer (KYC) norms Anti-Money Laundering (AML) standards as given by RBIare as under :
1.. Definition of Customer
For the purpose of KYC policy, a ‘Customer’ is defined as :
# a person who receives occasional/ regular cross border inward remittances under MTSS;
# one on whose behalf a cross border inward remittance under MTSS is received (i.e. the beneficial owner).
2. Guidelines
2.1 General
Banks should keep in mind that the information collected from the customer while making payment of cross border inward remittances is to be treated as confidential and details thereof are not to be divulged for cross selling or any other like purposes. Banks should, therefore, ensure that information sought from the customer is relevant to the perceived risk, is not intrusive, and is in conformity with the guidelines issued in this regard. Any other information from the customer, wherever necessary, should be sought separately with his/her consent.
2.2 KYC Policy
Banks should frame their KYC policies incorporating the following four key elements:
a) Customer Acceptance Policy;
b) Customer Identification Procedures;
c) Monitoring of Transactions; and
d) Risk Management.
2.3 Customer Acceptance Policy (CAP)
a) Every Bank should develop a clear Customer Acceptance Policy laying down explicit criteria for acceptance of customers. The Customer Acceptance Policy must ensure that explicit guidelines are in place on the following aspects of customer relationship with the Banks.
i) No remittance is received in anonymous or fictitious/benami name(s).
ii) Parameters of risk perception are clearly defined in terms of the nature of business activity, location of customer and his clients, mode of payments, volume of turnover, social and financial status, etc. to enable categorisation of customers into low, medium and high risk (APs may choose any suitable nomenclature viz. level I, level II and level III). Customers requiring very high level of monitoring, e.g. Politically Exposed Persons (PEPs) may, if considered necessary, be categorised even higher.
iii) Documentation requirements and other information to be collected in respect of different categories of customers depending on perceived risk and keeping in mind the requirements of Prevention of Money Laundering Act, (PMLA), 2002, as amended by Prevention of Money Laundering (Amendment) Act, 2009, Prevention of Money-Laundering (Maintenance of Records of the Nature and Value of Transactions, the Procedure and Manner of Maintaining and Time for Furnishing Information and Verification and Maintenance of Records of the Identity of the Clients of the Banking Companies, Financial Institutions and Intermediaries) Rules, 2005, as amended from time to time, as well as instructions / guidelines issued by the Reserve Bank, from time to time.
iv) Not to make payment of any remittance where the bank is unable to apply appropriate customer due diligence measures i.e. Bank is unable to verify the identity and /or obtain documents required as per the risk categorisation due to non-cooperation of the customer or non reliability of the data/information furnished to the Bank . It is, however, necessary to have suitable built in safeguards to avoid harassment of the customer.
v) Circumstances, in which a customer is permitted to act on behalf of another person/entity, should be clearly spelt out, the beneficial owner should be identified and all reasonable steps should be taken to verify his identity.
b) Banks should prepare a profile for each new customer, where regular cross-border inward remittances are/ expected to be received, based on risk categorisation. The customer profile may contain information relating to customer’s identity, social / financial status, etc. The nature and extent of due diligence will depend on the risk perceived by the AP (Indian Agent). However, while preparing customer profile, Banks should take care to seek only such information from the customer, which is relevant to the risk category and is not intrusive. The customer profile is a confidential document and details contained therein should not be divulged for cross selling or any other purposes.
c) For the purpose of risk categorisation, individuals (other than High Net Worth) and entities whose identities and sources of wealth can be easily identified and transactions by whom by and large conform to the known profile, may be
categorised as low risk. Customers that are likely to pose a higher than average risk should be categorised as medium or high risk depending on customer's background, nature and location of activity, country of origin, sources of funds
and his client profile, etc. APs should apply enhanced due diligence measures based on the risk assessment, thereby requiring intensive ‘due diligence’ for higher risk customers, especially those for whom the sources of funds are not
clear.
Examples of customers requiring enhanced due diligence include
(a) non-resident customers;
(b) customers from countries that do not or insufficiently apply the FATF standards;
(c) high net worth individuals;
(d) politically exposed persons (PEPs);
(e) non-face to face customers; and
(f) those with dubious reputation as per public information available, etc.
d) It is important to bear in mind that the adoption of customer acceptance policy
and its implementation should not become too restrictive and must not result in
denial of cross border inward remittance facilities to general public.
2.4 Customer Identification Procedure (CIP)
a) The policy approved by the Board of Banks should clearly spell out the Customer Identification Procedure while making payment to a beneficiary or when the AP has a doubt about the authenticity/veracity or the adequacy of the previously obtained customer identification data. Customer identification means identifying the customer and verifying his/her identity by using reliable, independent source documents, data or information.Banks need to obtain sufficient information necessary to establish, to their satisfaction, the identity of each new customer, whether regular or occasional. Being satisfied means that the Bank must be able to satisfy the competent authorities that due diligence was observed based on the risk profile of the customer in compliance with the extant guidelines in place. Such risk based approach is considered necessary to avoid disproportionate cost to Banks and a burdensome regime for the customers. The Banks should obtain sufficient identification data to verify the identity of the customer and his address/location. For customers that are natural persons, the banks should obtain sufficient identification document /s to verify the identity of the customer and his address/location.
For customers that are legal persons, the bank should :
(i) verify the legal status of the legal person through proper and relevant documents;
(ii) verify that any person purporting to act on behalf of the legal person is so authorised and identify and verify the identity of that person; and
(iii) understand the ownership and control structure of the customer and determine who are the natural persons who ultimately control the legal person.
Customer identification requirements in respect of a few typical cases, especially, legal persons requiring an extra element of caution as given in Annexture-I . Banks may, however, frame their own internal guidelines based on their experience of dealing with such persons, their normal prudence and the legal requirements as per established practices. If the Bank decides to undertake such transactions in terms of the Customer Acceptance Policy, the Bank should take reasonable measures to identify the beneficial owner(s) and
take all reasonable steps to verify his identity.
b) Some close relatives, e.g. wife, son, daughter and parents, etc. who live with their husband, father / mother and son / daughter, as the case may be, may find it difficult to undertake transactions with Banks as the utility bills
required for address verification are not in their name. It is clarified, that in such cases, Banks can obtain an identity document and a utility bill of the relative with whom the prospective customer is living along with a declaration
from the relative that the said person (prospective customer) wanting to undertake a transaction is a relative and is staying with him/her. Banks can use any supplementary evidence such as a letter received through post for further verification of the address. While issuing operational instructions to the branches on the subject, Banks should keep in mind the spirit of instructions issued by the Reserve Bank and avoid undue hardships to individuals who are, otherwise, classified as low risk customers.
c) Banks should introduce a system of periodical updation of customer identification data, if there is a continuing relationship.
2
.5 Customer Identification Requirements – Transactions by Politically
Exposed Persons (PEPs)- Indicative Guidelines
Politically exposed persons are individuals who are or have been entrusted with prominent public functions in a foreign country, e.g., Heads of States or of Governments, senior politicians, senior government/judicial/military officers, senior executives of state-owned corporations, important political party officials, etc. Banks should gather sufficient information on any person/customer of this category intending to undertake a transaction and check all the information available on the person in the public domain.Banks should verify the identity of the person and seek information about the source /s of wealth and source /s of funds before accepting the PEP as a customer. The decision to undertake a transaction with a PEP should be taken at a senior level which should be clearly spelt out in Customer Acceptance Policy.
Banks should also subject such transactions to enhanced monitoring on an ongoing basis. The above norms may also be applied to transactions with the family members or close relatives of PEPs. The above norms may also be applied to customers who become PEPs subsequent to establishment of the business relationship.
2.6 Monitoring of Transactions
Ongoing monitoring is an essential element of effective KYC procedures. Banks can effectively control and reduce their risk only if they have an understanding of the normal and reasonable receipt of remittances of the beneficiary so that they have the means of identifying receipts that fall outside the regular pattern of activity. However, the extent of monitoring will depend on the risk sensitivity of the remittance. Banks should pay special attention to all complex, unusually large receipts and all unusual patterns which have no apparent economic or visible lawful purpose. Banks may prescribe threshold limits for a particular category of receipts and pay particular attention to the receipts which exceed these limits. High-risk receipts have to be subjected to intense monitoring. Every Bank should set key indicators for such
receipts, taking note of the background of the customer, such as the country of origin, sources of funds, the type of transactions involved and other risk factors. Banks should put in place a system of periodical review of risk categorization of customers and the need for applying enhanced due diligence measures. Such review of risk categorisation of customers should be carried out periodically.
2.7 Attempted transactions
Where the Bank is unable to apply appropriate KYC measures due to non-furnishing of information and /or non-cooperation by the customer, the AP should not undertake the transaction. Under these circumstances, Banks should make a suspicious transactions report to FIU-IND in relation to the customer, even if the transaction is not put through.
2.8 Risk Management
a) The Board of Directors of the Bank should ensure that an effective KYC programme is put in place by establishing appropriate procedures and ensuring effective implementation. It should cover proper management oversight, systems and controls, segregation of duties, training and other related matters. Responsibility should be explicitly allocated within the bank for ensuring that the APs’ policies and procedures are implemented effectively. Banks should, in consultation with their Boards, devise procedures for creating risk profiles of their existing and new customers and apply various
anti money laundering measures keeping in view the risks involved in a transaction.
b) Banks internal audit and compliance functions have an important role in evaluating and ensuring adherence to the KYC policies and procedures. As a general rule, the compliance function should provide an independent evaluation of the Banks own policies and procedures, including legal and regulatory requirements. Banks should ensure that their audit machinery is staffed adequately with individuals who are wellversed in such policies and procedures. The concurrent auditors should check all cross border inward remittance transactions under MTSS to verify that they have
been undertaken in compliance with the anti-money laundering guidelines and have been reported whenever required to the concerned authorities. Compliance on the lapses, if any, recorded by the concurrent auditors should be put up to the
Board. A certificate from the Statutory Auditors on the compliance with KYC / AML / CFT guidelines should be obtained at the time of preparation of the Annual Report and kept on record.
|
