AML compliance in India: PMLA, PML Rules and FIU-IND reports

AML compliance in India rests on the Prevention of Money Laundering Act, 2002 (PMLA) and the Prevention of Money-laundering (Maintenance of Records) Rules, 2005. Together they require every reporting entity, which includes banks and NBFCs, to verify its clients, keep records for five years, and file prescribed reports with the Financial Intelligence Unit – India (FIU-IND). A suspicious transaction report is due within seven working days of the entity being satisfied that the transaction is suspicious.

RBI's Know Your Customer directions carry these duties into banking supervision. This explainer covers the law, the reports and their timelines, and the controls a compliance team is expected to run.

The legal framework for Anti Money Laundering (AML)

Three layers apply to an RBI-regulated entity:

• PMLA, 2002. Chapter IV sets the obligations of reporting entities. Section 12 covers maintenance of records and furnishing of information. Section 13 gives the Director, FIU-IND the power to call for records, order audits and impose penalties. Section 14 protects the entity and its staff from civil or criminal proceedings for furnishing information under the Act.
• PML (Maintenance of Records) Rules, 2005. Rule 3 lists the transactions to be recorded, rule 7 the procedure for furnishing information, rule 8 the time limits, and rule 9 the client due diligence requirements.
• RBI's KYC directions. Since November 2025 these are issued entity-wise, for example the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025 and the corresponding directions for NBFCs. They cover the KYC policy, customer due diligence, monitoring of transactions and reporting to FIU-IND.

FIU-IND is the central national agency that receives, analyses and disseminates information on suspect financial transactions. It is not a regulator of banks, but its Director enforces the reporting obligations under the PMLA.

Who is a reporting entity

The PMLA uses the term "reporting entity" for:

• a banking company, including cooperative banks;
• a financial institution, which includes NBFCs, housing finance institutions, chit fund companies, payment system operators, authorised persons and the Department of Posts;
• an intermediary, such as a stock broker, merchant banker or portfolio manager; and
• a person carrying on a designated business or profession notified under the Act.

Every reporting entity registers with FIU-IND on its FINnet portal and files its reports online in the prescribed formats.

FIU-IND reports and their timelines

Rule 3 of the PML Rules defines what must be recorded and reported. Rule 8 sets the due dates.

Two points are often missed. First, the STR has no monetary threshold. Second, the STR clock starts when the principal officer is satisfied that the transaction is suspicious, so the entity must be able to show when that conclusion was reached and how long the alert took to get there.

RBI's KYC directions add that each day of delay in furnishing a report beyond the time limit counts as a separate violation.

What counts as a suspicious transaction

Under the PML Rules, a suspicious transaction is one, including an attempted transaction and whether or not made in cash, which to a person acting in good faith:

• gives rise to a reasonable ground of suspicion that it may involve the proceeds of an offence specified in the Schedule to the Act, regardless of the value involved;
• appears to be made in circumstances of unusual or unjustified complexity;
• appears to have no economic rationale or bona fide purpose; or
• gives rise to a reasonable ground of suspicion that it may involve financing of activities relating to terrorism.

The test is the entity's judgement on the facts it holds. That is why the law places the decision with a named officer and expects the reasoning to be recorded.

Suspicious transaction monitoring expectations

RBI's KYC directions make monitoring of transactions one of the four key elements of the KYC policy. For transaction monitoring they expect a bank to:

• understand the normal and reasonable activity of the customer, so that transactions inconsistent with the customer's profile, business and source of funds can be identified;
• pay special attention to large and complex transactions and unusual patterns that have no apparent economic or lawful purpose, to transactions that exceed prescribed thresholds, to high account turnover inconsistent with the balance maintained, and to deposits by third parties followed by large cash withdrawals;
• put in place robust software that throws alerts when transactions are inconsistent with the customer's risk categorisation and updated profile;
• review the risk categorisation of accounts at least once in six months and apply enhanced monitoring to high-risk accounts;
• carry out a money laundering and terrorist financing risk assessment periodically, and review it at least annually.

Two rules govern conduct after an alert. The fact that an STR has been filed must be kept strictly confidential, and the customer must not be tipped off. And a bank should not restrict operations in an account only because an STR has been filed.

Principal officer, designated director and record keeping

Designated director. A person designated by the reporting entity to ensure overall compliance with the obligations under Chapter IV of the PMLA and the Rules. In a company this is the managing director or a whole-time director authorised by the board.

Principal officer. An officer at management level, nominated by the entity, who is responsible for furnishing information to FIU-IND. Under RBI's directions the principal officer cannot be the same person as the designated director.

The names, designations and addresses of both are communicated to the Director, FIU-IND, and to RBI.

Record keeping. The PMLA requires a reporting entity to:

• maintain records of transactions for five years from the date of the transaction between the client and the entity;
• maintain records of the identity of clients and beneficial owners, account files and business correspondence for five years after the business relationship has ended or the account has been closed, whichever is later;
• keep the records in a form that allows individual transactions to be reconstructed and retrieved quickly when a competent authority asks.

Penalties for non-compliance

Under section 13 of the PMLA, where the Director, FIU-IND finds that a reporting entity, its designated director on the board or any of its employees has failed to comply with the obligations under Chapter IV, the Director may:

• issue a warning in writing;
• direct compliance with specific instructions;
• direct the entity to send reports at prescribed intervals on the measures it is taking; or
• impose a monetary penalty of not less than ₹10,000, which may extend to ₹1 lakh, for each failure.

Because the penalty is per failure, a pattern of unfiled or late reports adds up quickly. An order of the Director can be appealed to the Appellate Tribunal. RBI can separately take supervisory action for breach of its KYC directions.

How RegIntel Nexus helps

RegIntel Nexus does not monitor transactions or screen customers. It helps the compliance team stay on top of the rules those systems must meet. It monitors publications from RBI, FIU-IND and other regulators, classifies them and tracks amendments. It turns each requirement into a clause-level obligation with an owner, a due date, a status and an escalation path, and maps it to the process and application concerned. The research assistant answers questions with the document, clause and page cited, and source references, document versions and approvals are kept as audit evidence.

This article is general information for compliance and risk professionals. It is not legal advice. Regulations are amended often; check the current text published by the regulator before acting.