NBFCs: Updated FATF List of High-Risk Jurisdictions for AML/CFT
Current · Source: Reserve Bank of India · RBI/2010-11/212 · issued 22 Sep 2010 · ~2 min read
Quick answerRBI directs NBFCs/RNBCs to factor in AML/CFT risks from Iran, DPRK, and Sao Tome and Principe per FATF's June 2010 statement. Iran requires countermeasures; the other two need risk consideration. Compliance officers must acknowledge receipt to their regional DNBS office.
The rule, in the simplest words
NBFCs (companies that lend money but are not banks) must be extra careful with customers from Iran, North Korea (DPRK), and Sao Tome and Principe because these countries have weak rules against money laundering (hiding illegal money) and terrorism funding.
For Iran, NBFCs must use strong countermeasures like checking transactions very closely or even stopping some deals to protect the financial system.
For North Korea and Sao Tome and Principe, NBFCs must think about the risks and take steps to reduce them, like asking more questions about the customer's money source.
The compliance officer (the person in charge of following rules) must send a signed receipt of this rule to the nearest RBI regional office.
How it plays out — a real example
A KYC & compliance officer in Mumbai receives a loan application from a customer who recently moved from Iran. Remembering this rule, she immediately flags the case for enhanced due diligence, asks for extra documents like proof of income source, and restricts the loan amount to a lower LTV (how much loan vs the gold's value) until the risk is fully checked.
What changed
FATF updated its list of strategic AML/CFT deficient jurisdictions in June 2010, dividing them into two groups: Iran (subject to countermeasures) and DPRK and Sao Tome and Principe (deficiencies without committed action plans). RBI now requires NBFCs/RNBCs to account for risks from these countries, replacing the earlier April 2010 circular that included a broader set.
What it means for you
NBFCs must enhance due diligence for transactions or relationships involving Iran, DPRK, or Sao Tome and Principe. Iran demands stricter countermeasures like enhanced monitoring or transaction restrictions. For DPRK and Sao Tome and Principe, lenders need to assess and mitigate elevated ML/FT risks. Non-compliance could invite regulatory scrutiny.
What you must do
Update your AML/CFT risk assessment to include Iran, DPRK, and Sao Tome and Principe as high-risk jurisdictions.
Apply appropriate countermeasures for Iran, such as enhanced due diligence or transaction restrictions.
For DPRK and Sao Tome and Principe, evaluate and document risk mitigation steps.
Ensure your compliance officer submits an acknowledgment of this circular to the concerned DNBS regional office.
Who it affects
All Non-Banking Financial Companies (NBFCs), Residuary Non-Banking Companies (RNBCs), Compliance officers and principal officers of NBFCs/RNBCs
❓ Common questions
Which countries are now flagged by FATF as per this circular?
Iran is subject to countermeasures due to substantial ML/FT risks. Democratic People's Republic of Korea (DPRK) and Sao Tome and Principe have strategic deficiencies without committed action plans as of June 2010.
What actions must NBFCs take for Iran?
NBFCs must apply countermeasures to protect the financial system from ongoing ML/FT risks from Iran, such as enhanced due diligence, transaction monitoring, or restrictions on business relationships.
Do we need to report receipt of this circular?
Yes, the compliance officer or principal officer must submit an acknowledged receipt to the concerned Regional Office of DNBS where the NBFC/RNBC is located.
📜 Read the original circular — full text as issued by RBI
RBI/2010-11/212
DNBS(PD).CC. No 201/03.10.42 /2010-11
September 22, 2010
All Non Banking Financial Companies /
Residuary Non Banking Companies
Dear Sir,
Know Your Customer (KYC) Norms/ Anti- Money Laundering (AML)
Standards/ Combating of Financing of Terrorism (CFT)
Please refer to Company Circular No 172 dated April 30, 2010 on the captioned subject giving details about risk arising from the deficiencies in AML / CFT regime of Iran, Angola, Democratic People's Republic of Korea(DPRK), Ecuador, Ethiopia, Pakistan, Turkmenistan and Sao Tome and Principe.
2. Financial Action Task Force (FATF) has issued a Statement dated June 25, 2010 on the subject ( Copy enclosed ) which divides the strategic AML/CFT deficient jurisdictions into two groups as under:
(i) Jurisdictions subject to FATF call on its members and other jurisdictions to apply countermeasures to protect the international financial system from the ongoing and substantial money laundering and terrorist financing (ML/FT) risks emanating from the jurisdiction: Iran
(ii) Jurisdictions with strategic AML/CFT deficiencies that have not committed to an action plan developed with the FATF to address key deficiencies as of June 2010.The FATF calls on its members to consider the risks arising from the deficiencies associated with each jurisdiction: Democratic People's Republic of Korea(DPRK), Sao Tome and Principe
3. All NBFCs/RNBCs are accordingly advised to take into account risks arising from the deficiencies in AML/CFT regime of these countries.
4. An acknowledged receipt of this circular may be submitted by the Compliance officer/ Principal Officer of the NBFCs to the concerned Regional Office of DNBS in whose jurisdiction the NBFC/RNBC is functioning.
Yours faithfully,
(Uma Subramaniam)
Chief General Manager-in-Charge
Encl: as above
Reproduced for reference with acknowledgment — Source: Reserve Bank of India · RBI/2010-11/212 · issued 22 Sep 2010. The plain-English explanation above is BankPulse’s own independent summary.
Apply appropriate countermeasures for Iran, such as enhanced due diligence or transaction restrictions.
📜 Compliance
Update your AML/CFT risk assessment to include Iran, DPRK, and Sao Tome and Principe as high-risk jurisdictions.
For DPRK and Sao Tome and Principe, evaluate and document risk mitigation steps.
Ensure your compliance officer submits an acknowledgment of this circular to the concerned DNBS regional office.
Grouped from the action items above — a single circular may involve more than one team.
Worked example & action-note template
Example: if you are a Compliance officer at a bank this circular applies to (All Non-Banking Financial Companies (NBFCs), Residuary Non-Banking Companies (RNBCs), Compliance officers and principal officers of NBFCs/RNBCs), your first concrete step on “NBFCs: Updated FATF List of High-Risk Jurisdictions for AML/CFT” is: “Update your AML/CFT risk assessment to include Iran, DPRK, and Sao Tome and Principe as high-risk jurisdictions.” (RBI issued this 22 Sep 2010).
Circular: RBI/2010-11/212 -- NBFCs: Updated FATF List of High-Risk Jurisdictions for AML/CFT
Issued: 22 Sep 2010
Action required: Update your AML/CFT risk assessment to include Iran, DPRK, and Sao Tome and Principe as high-risk jurisdictions.
Action required: Apply appropriate countermeasures for Iran, such as enhanced due diligence or transaction restrictions.
Action required: For DPRK and Sao Tome and Principe, evaluate and document risk mitigation steps.
Action required: Ensure your compliance officer submits an acknowledgment of this circular to the concerned DNBS regional office.
Owner: ____________ Target date: ____________
Board/committee approval needed? Y / N
Evidence filed in compliance register on: ____________
Built only from this circular’s own published fields — not legal advice; always confirm against the official RBI source.
💬 Banker Discussion
Discuss this circular with fellow bankers — reply, upvote what helps, report what doesn’t belong. Be professional; no client data. Views are the commenter’s own, not BankPulse’s.
BankPulse Compliance Evidence Pack — generated 03 Aug 2026 · status cross-checked against RBI’s official withdrawal register (refreshed weekly). Official RBI source: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=6008&Mode=0 — Plain-English summary by BankPulse (bankpulse.ai), reviewed by our expert reviewer, CA Amit Jain. Independent platform, not affiliated with the Reserve Bank of India; is our own plain-English paraphrase, not RBI’s original wording.
Help us keep this accurate
Found an inaccuracy or have an improvement? Tell us. Every report is reviewed by our team before any change is made — nothing goes live unverified.
Public beta — plain-English informational summaries. Always verify against the official RBI source (circular number cited on every page) before making compliance, credit, treasury, audit, or operational decisions. · Join our WhatsApp channel ↗
BANKPULSE · FREE DAILY BRIEF
Get RBI updates for your role
Every important RBI update, decoded in plain English — for your career, exams & financial awareness.
We collect only your email, name and role, used solely to send your brief — never sold or shared. Withdraw anytime via the unsubscribe link in any email. Independent platform, not affiliated with the RBI. Information, not legal advice.
REPORT AN ERROR · BETA
Spotted an error? Earn 500 BankPulse Credits
Help us stay accurate. If your correction is verified true and approved by our founder, you earn 500 BankPulse Credits — redeemable when the platform monetises.
Reviewed by a human before any credit is awarded. We never change the site from crowd input without verification.
WANT A NEW FEATURE · BETA
What would make BankPulse more useful for you?
Tell us what to build next — a tool, a data view, a role page, anything. We read every suggestion.
Thank you — your ideas directly shape what we build.