HomeCirculars › RBI/2011-12/466

NBFCs Must Now Assess ML/TF Risk for Customers, Products, Geographies

Current · Source: Reserve Bank of India · RBI/2011-12/466 · issued 21 Mar 2012 · ~2 min read
Quick answerRBI directs NBFCs to identify and assess money laundering/terror financing risks for customers, countries, products, services, and delivery channels. Boards must approve policies to manage these risks, with enhanced due diligence for medium or high-risk categories. IBA guidance can be used as reference.
The rule, in the simplest words
How it plays out — a real example

Priya, a compliance officer at a small NBFC in Pune, is updating her company's risk checklist. She now adds a new section for 'gold loan products' because the RBI rule says she must assess if that product could be used for money laundering. She also notes that customers from a certain high-risk country need extra documents. She presents her updated policy to the board for approval, and they agree to it at the next meeting.

What changed

Previously, NBFCs were required to prepare customer risk profiles and apply enhanced due diligence on higher-risk customers. Now, they must also assess ML/TF risk for countries, geographical areas, products, services, and delivery channels. Boards must approve policies to manage and mitigate these risks using a risk-based approach.

What it means for you

NBFCs need to broaden their AML/CFT framework beyond customer risk profiling to include product, service, and geographic risk assessments. This requires board-approved policies and enhanced measures for medium or high-risk categories. The IBA's risk-based transaction monitoring report can serve as a practical guide. Non-compliance may attract penalties under the RBI Act.

What you must do

Who it affects

All Non-Banking Financial Companies (NBFCs), Residuary Non-Banking Companies (RNBCs), Compliance and risk management teams at NBFCs, Boards of NBFCs

❓ Common questions

What is the key new requirement for NBFCs under this circular?

NBFCs must now assess ML/TF risk not only for customers but also for countries, geographical areas, products, services, and delivery channels, with board-approved policies.

Can NBFCs use the IBA's guidance on risk-based transaction monitoring?

Yes, the circular explicitly states that NBFCs may use the IBA's report on parameters for risk-based transaction monitoring as guidance in their own risk assessment.

What happens if an NBFC fails to comply with these guidelines?

Non-compliance or contravention may attract penalties under the relevant provisions of the RBI Act, 1934, as the guidelines are issued under Sections 45K and 45L.

📜 Read the original circular — full text as issued by RBI
RBI/2011-12/466 DNBS(PD).CC. No 264/03.10.42/2011-12 March 21, 2012 All Non Banking Financial Companies / Residuary Non Banking Companies Dear Sir, Know Your Customer (KYC) norms/Anti-Money Laundering (AML) standards/Combating of Financing of Terrorism (CFT)/Obligation of banks under Prevention of Money Laundering Act (PMLA), 2002- Assessment and Monitoring of Risk Please refer to our Master Circular DNBC(PD)CC No 231/03.10.42/2011 -12 dated July 01, 2011 on Know Your Customer (KYC) norms /Anti-Money Laundering (AML) standards/Combating of Financing of Terrorism (CFT)/Obligation of banks under PMLA, 2002. 2. In terms of paragraph 2 of Annex vi of the aforesaid Master Circular, NBFCs are required to prepare a risk profile of each customer and apply enhanced due diligence measures on higher risk customers. Some illustrative examples of customers requiring higher due diligence have also been provided in the paragraph under reference. Further, paragraph 5 of Annex vi  of the Master Circular requires NBFCs to put in place policies, systems and procedures for risk management keeping in view the risks involved in a transaction, account or banking/business relationship. 3. The Government of India had constituted a National Money Laundering/Financing of Terror Risk Assessment Committee to assess money laundering and terror financing risks, a national AML/CFT strategy and institutional framework for AML/CFT in India. Assessment of risk of Money Laundering /Financing of Terrorism helps both the competent authorities and the regulated entities in taking necessary steps for combating ML/FT adopting a risk-based approach. This helps in judicious and efficient allocation of resources and makes the AML/CFT regime more robust. The Committee has made recommendations regarding adoption of a risk-based approach, assessment of risk and putting in place a system which would use that assessment to take steps to effectively counter ML/FT. The recommendations of the Committee have since been accepted by the Government of India and needs to be implemented. 4. Accordingly, NBFCs  should take steps to identify and assess their ML/FT risk for customers, countries and geographical areas as also for products/ services/ transactions/delivery channels, in addition to what has been prescribed in our Master Circular dated July 1, 2011, referred to in paragraph 2 above. NBFCs should have policies, controls and procedures, duly approved by their boards, in place to effectively manage and mitigate their risk adopting a risk-based approach as discussed above. As a corollary, NBFCs would be required to adopt enhanced measures for products, services and customers with a medium or high risk rating. 5. In this regard, Indian Banks' Association (IBA) has taken initiative in assessment of ML/FT risk in the banking sector. This has circulated to its member banks on May 18, 2011 and  a copy of their Report on Parameters for Risk Based Transaction Monitoring (RBTM) as a supplement to their guidance note on Know Your Customer (KYC) norms / Anti-Money Laundering (AML) standards issued in July 2009, is available on the IBA website. The IBA guidance also provides an indicative list of high risk customers, products, services and geographies. NBFCs  may use the same as guidance in their own risk assessment. 6. These guidelines are issued under Section 45K and 45L of the RBI Act, 1934 read with Rule 7 of Prevention of Money-laundering (Maintenance of Records of the Nature and Value of Transactions, the Procedure and Manner of Maintaining and Time for Furnishing Information and Verification and Maintenance of Records of the Identity of the Clients of the Banking Companies, Financial Institutions and Intermediaries) Rules, 2005. Any contravention thereof or non-compliance shall attract penalties under the relevant provisions of RBI Act, 1934. Please acknowledge receipt. Yours faithfully, (Uma Subramaniam) Chief General Manager-in-Charge
Reproduced for reference with acknowledgment — Source: Reserve Bank of India · RBI/2011-12/466 · issued 21 Mar 2012. The plain-English explanation above is BankPulse’s own independent summary.
🧰 Tools — save, print, templates & related
Worked example & action-note template

Example: if you are a Compliance officer at a bank this circular applies to (All Non-Banking Financial Companies (NBFCs), Residuary Non-Banking Companies (RNBCs), Compliance and risk management teams at NBFCs, Boards of NBFCs), your first concrete step on “NBFCs Must Now Assess ML/TF Risk for Customers, Products, Geographies” is: “Identify and assess ML/TF risks for customers, countries, products, services, and delivery channels.” (RBI issued this 21 Mar 2012).

  1. Circular: RBI/2011-12/466 -- NBFCs Must Now Assess ML/TF Risk for Customers, Products, Geographies
  2. Issued: 21 Mar 2012
  3. Action required: Identify and assess ML/TF risks for customers, countries, products, services, and delivery channels.
  4. Action required: Get board approval for policies, controls, and procedures to manage and mitigate these risks.
  5. Action required: Adopt enhanced due diligence measures for medium or high-risk customers, products, and services.
  6. Action required: Refer to IBA's guidance on risk-based transaction monitoring for practical implementation.
  7. Owner: ____________ Target date: ____________
  8. Board/committee approval needed? Y / N
  9. Evidence filed in compliance register on: ____________
Built only from this circular’s own published fields — not legal advice; always confirm against the official RBI source.

💬 Banker Discussion

Discuss this circular with fellow bankers — reply, upvote what helps, report what doesn’t belong. Be professional; no client data. Views are the commenter’s own, not BankPulse’s.

Loading comments…
BankPulse Compliance Evidence Pack — generated 03 Aug 2026 · status cross-checked against RBI’s official withdrawal register (refreshed weekly).
Official RBI source: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=7085&Mode=0 — Plain-English summary by BankPulse (bankpulse.ai), reviewed by our expert reviewer, CA Amit Jain. Independent platform, not affiliated with the Reserve Bank of India; is our own plain-English paraphrase, not RBI’s original wording.
Public beta — plain-English informational summaries. Always verify against the official RBI source (circular number cited on every page) before making compliance, credit, treasury, audit, or operational decisions. · Join our WhatsApp channel ↗