What changed
RBI has expanded existing KYC/AML requirements by mandating a structured, documented risk assessment for money laundering and terror financing across all customer segments, geographies, products, services, and delivery channels. Banks must now have board-approved policies, controls, and procedures to manage and mitigate these risks using a risk-based approach, with enhanced due diligence for medium or high-risk categories.
What it means for you
Banks can no longer rely solely on customer-level risk profiling; they must now assess and document ML/TF risk at the portfolio level, including country and product risks. This will require significant upgrades to risk management frameworks, transaction monitoring systems, and board-level oversight. Non-compliance invites penalties under the Banking Regulation Act, 1949.
What you must do
- Conduct a comprehensive ML/TF risk assessment covering customers, geographies, products, services, and delivery channels.
- Develop and get board approval for policies, controls, and procedures to manage and mitigate identified risks.
- Implement enhanced due diligence measures for all medium and high-risk categories identified in the assessment.
- Use IBA's guidance on risk-based transaction monitoring as a reference for your own risk assessment framework.
- Ensure compliance with Section 35A of the Banking Regulation Act, 1949 and PMLA rules, with documented evidence of risk assessment.
Who it affects
All Scheduled Commercial Banks (excluding RRBs), All India Financial Institutions, Local Area Banks, Board of Directors and senior management of these entities, Compliance and AML/KYC teams
What is the key change from the earlier Master Circular?
Earlier, banks only needed to prepare risk profiles of individual customers. Now, they must also assess and document ML/TF risk at the entity level, including country, product, and delivery channel risks, with board-approved policies.
What happens if we don't comply with this circular?
Non-compliance is a contravention of the Banking Regulation Act, 1949 and PMLA rules, and will attract penalties under the B R Act, 1949.
Can we use the IBA guidance as our risk assessment framework?
Yes, RBI explicitly states that banks may use the IBA's Report on Parameters for Risk Based Transaction Monitoring as guidance, but the final risk assessment and policies must be approved by your board.