What changed
The Prevention of Money Laundering (Amendment) Act, 2009, effective June 1, 2009, mandates a 10-year preservation period for transaction records from the transaction date and for customer identification records from cessation of business relationship. RBI modified its July 1, 2009 master circular to reflect this, replacing earlier shorter retention periods. Additionally, banks must now obtain senior management approval to continue relationships with customers who become PEPs and apply enhanced CDD measures.
What it means for you
Banks must overhaul record-keeping systems to retain transaction data for a full decade from each transaction, not just from account closure. This increases storage and compliance costs but strengthens anti-money laundering defenses. For PEPs, the new approval requirement adds a layer of scrutiny, potentially slowing onboarding or relationship continuation. Principal Officers now need direct access to customer data and independence to report to senior management or the board.
What you must do
- Update record retention policies to keep transaction records for at least 10 years from transaction date and customer ID records for 10 years after account closure.
- Implement systems to flag existing customers who become PEPs and require senior management approval to continue the relationship.
- Ensure Principal Officers have timely access to all customer identification and transaction data and can report independently to senior management or the board.
- Train compliance teams on the new 10-year retention timelines and PEP monitoring requirements.
Who it affects
All scheduled commercial banks (excluding RRBs), Financial institutions, Local area banks, Compliance and AML teams, Principal Officers, Senior management and board members
What is the new record retention period for transaction records?
Transaction records must be preserved for at least 10 years from the date of each transaction, as per the PMLA 2009 amendment.
How should banks handle a customer who becomes a Politically Exposed Person (PEP)?
Banks must obtain senior management approval to continue the business relationship and apply enhanced customer due diligence measures, including ongoing monitoring.
What access should the Principal Officer have?
The Principal Officer and appropriate staff must have timely access to customer identification data, CDD information, transaction records, and other relevant information to discharge their responsibilities.