NBFCs Must Now Assess ML/TF Risk for Customers, Products, Geographies
Current · Source: Reserve Bank of India · RBI/2011-12/466 · issued 21 Mar 2012 · ~2 min read
Quick answerRBI directs NBFCs to identify and assess money laundering/terror financing risks for customers, countries, products, services, and delivery channels. Boards must approve policies to manage these risks, with enhanced due diligence for medium or high-risk categories. IBA guidance can be used as reference.
The rule, in the simplest words
NBFCs (companies that lend money but are not banks) must check if a customer, a country, a product, or a way of delivering service could be used for money laundering (hiding dirty money) or terror financing (funding bad guys).
The board (top bosses) of the NBFC must say 'yes' to a plan that explains how to handle these risks.
If a customer, product, or service is medium or high risk, the NBFC must do extra checks (like asking more questions or getting more proof).
NBFCs can use a guide from IBA (Indian Banks' Association) to help them do these checks.
How it plays out — a real example
Priya, a compliance officer at a small NBFC in Pune, is updating her company's risk checklist. She now adds a new section for 'gold loan products' because the RBI rule says she must assess if that product could be used for money laundering. She also notes that customers from a certain high-risk country need extra documents. She presents her updated policy to the board for approval, and they agree to it at the next meeting.
What changed
Previously, NBFCs were required to prepare customer risk profiles and apply enhanced due diligence on higher-risk customers. Now, they must also assess ML/TF risk for countries, geographical areas, products, services, and delivery channels. Boards must approve policies to manage and mitigate these risks using a risk-based approach.
What it means for you
NBFCs need to broaden their AML/CFT framework beyond customer risk profiling to include product, service, and geographic risk assessments. This requires board-approved policies and enhanced measures for medium or high-risk categories. The IBA's risk-based transaction monitoring report can serve as a practical guide. Non-compliance may attract penalties under the RBI Act.
What you must do
Identify and assess ML/TF risks for customers, countries, products, services, and delivery channels.
Get board approval for policies, controls, and procedures to manage and mitigate these risks.
Adopt enhanced due diligence measures for medium or high-risk customers, products, and services.
Refer to IBA's guidance on risk-based transaction monitoring for practical implementation.
Who it affects
All Non-Banking Financial Companies (NBFCs), Residuary Non-Banking Companies (RNBCs), Compliance and risk management teams at NBFCs, Boards of NBFCs
❓ Common questions
What is the key new requirement for NBFCs under this circular?
NBFCs must now assess ML/TF risk not only for customers but also for countries, geographical areas, products, services, and delivery channels, with board-approved policies.
Can NBFCs use the IBA's guidance on risk-based transaction monitoring?
Yes, the circular explicitly states that NBFCs may use the IBA's report on parameters for risk-based transaction monitoring as guidance in their own risk assessment.
What happens if an NBFC fails to comply with these guidelines?
Non-compliance or contravention may attract penalties under the relevant provisions of the RBI Act, 1934, as the guidelines are issued under Sections 45K and 45L.
📜 Read the original circular — full text as issued by RBI
RBI/2011-12/466
DNBS(PD).CC. No 264/03.10.42/2011-12
March 21, 2012
All Non Banking Financial Companies /
Residuary Non Banking Companies
Dear Sir,
Know Your Customer (KYC) norms/Anti-Money Laundering (AML) standards/Combating of Financing of Terrorism (CFT)/Obligation of banks under Prevention of Money Laundering Act (PMLA), 2002- Assessment and Monitoring of Risk
Please refer to our Master Circular DNBC(PD)CC No 231/03.10.42/2011 -12 dated July 01, 2011 on Know Your Customer (KYC) norms /Anti-Money Laundering (AML) standards/Combating of Financing of Terrorism (CFT)/Obligation of banks under PMLA, 2002.
2. In terms of paragraph 2 of Annex vi of the aforesaid Master Circular, NBFCs are required to prepare a risk profile of each customer and apply enhanced due diligence measures on higher risk customers. Some illustrative examples of customers requiring higher due diligence have also been provided in the paragraph under reference. Further, paragraph 5 of Annex vi of the Master Circular requires NBFCs to put in place policies, systems and procedures for risk management keeping in view the risks involved in a transaction, account or banking/business relationship.
3. The Government of India had constituted a National Money Laundering/Financing of Terror Risk Assessment Committee to assess money laundering and terror financing risks, a national AML/CFT strategy and institutional framework for AML/CFT in India. Assessment of risk of Money Laundering /Financing of Terrorism helps both the competent authorities and the regulated entities in taking necessary steps for combating ML/FT adopting a risk-based approach. This helps in judicious and efficient allocation of resources and makes the AML/CFT regime more robust. The Committee has made recommendations regarding adoption of a risk-based approach, assessment of risk and putting in place a system which would use that assessment to take steps to effectively counter ML/FT. The recommendations of the Committee have since been accepted by the Government of India and needs to be implemented.
4. Accordingly, NBFCs should take steps to identify and assess their ML/FT risk for customers, countries and geographical areas as also for products/ services/ transactions/delivery channels, in addition to what has been prescribed in our Master Circular dated July 1, 2011, referred to in paragraph 2 above. NBFCs should have policies, controls and procedures, duly approved by their boards, in place to effectively manage and mitigate their risk adopting a risk-based approach as discussed above. As a corollary, NBFCs would be required to adopt enhanced measures for products, services and customers with a medium or high risk rating.
5. In this regard, Indian Banks' Association (IBA) has taken initiative in assessment of ML/FT risk in the banking sector. This has circulated to its member banks on May 18, 2011 and a copy of their Report on Parameters for Risk Based Transaction Monitoring (RBTM) as a supplement to their guidance note on Know Your Customer (KYC) norms / Anti-Money Laundering (AML) standards issued in July 2009, is available on the IBA website. The IBA guidance also provides an indicative list of high risk customers, products, services and geographies. NBFCs may use the same as guidance in their own risk assessment.
6. These guidelines are issued under Section 45K and 45L of the RBI Act, 1934 read with Rule 7 of Prevention of Money-laundering (Maintenance of Records of the Nature and Value of Transactions, the Procedure and Manner of Maintaining and Time for Furnishing Information and Verification and Maintenance of Records of the Identity of the Clients of the Banking Companies, Financial Institutions and Intermediaries) Rules, 2005. Any contravention thereof or non-compliance shall attract penalties under the relevant provisions of RBI Act, 1934.
Please acknowledge receipt.
Yours faithfully,
(Uma Subramaniam)
Chief General Manager-in-Charge
Reproduced for reference with acknowledgment — Source: Reserve Bank of India · RBI/2011-12/466 · issued 21 Mar 2012. The plain-English explanation above is BankPulse’s own independent summary.
Example: if you are a Compliance officer at a bank this circular applies to (All Non-Banking Financial Companies (NBFCs), Residuary Non-Banking Companies (RNBCs), Compliance and risk management teams at NBFCs, Boards of NBFCs), your first concrete step on “NBFCs Must Now Assess ML/TF Risk for Customers, Products, Geographies” is: “Identify and assess ML/TF risks for customers, countries, products, services, and delivery channels.” (RBI issued this 21 Mar 2012).
Circular: RBI/2011-12/466 -- NBFCs Must Now Assess ML/TF Risk for Customers, Products, Geographies
Issued: 21 Mar 2012
Action required: Identify and assess ML/TF risks for customers, countries, products, services, and delivery channels.
Action required: Get board approval for policies, controls, and procedures to manage and mitigate these risks.
Action required: Adopt enhanced due diligence measures for medium or high-risk customers, products, and services.
Action required: Refer to IBA's guidance on risk-based transaction monitoring for practical implementation.
Owner: ____________ Target date: ____________
Board/committee approval needed? Y / N
Evidence filed in compliance register on: ____________
Built only from this circular’s own published fields — not legal advice; always confirm against the official RBI source.
💬 Banker Discussion
Discuss this circular with fellow bankers — reply, upvote what helps, report what doesn’t belong. Be professional; no client data. Views are the commenter’s own, not BankPulse’s.
BankPulse Compliance Evidence Pack — generated 03 Aug 2026 · status cross-checked against RBI’s official withdrawal register (refreshed weekly). Official RBI source: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=7085&Mode=0 — Plain-English summary by BankPulse (bankpulse.ai), reviewed by our expert reviewer, CA Amit Jain. Independent platform, not affiliated with the Reserve Bank of India; is our own plain-English paraphrase, not RBI’s original wording.
Help us keep this accurate
Found an inaccuracy or have an improvement? Tell us. Every report is reviewed by our team before any change is made — nothing goes live unverified.
Public beta — plain-English informational summaries. Always verify against the official RBI source (circular number cited on every page) before making compliance, credit, treasury, audit, or operational decisions. · Join our WhatsApp channel ↗
BANKPULSE · FREE DAILY BRIEF
Get RBI updates for your role
Every important RBI update, decoded in plain English — for your career, exams & financial awareness.
We collect only your email, name and role, used solely to send your brief — never sold or shared. Withdraw anytime via the unsubscribe link in any email. Independent platform, not affiliated with the RBI. Information, not legal advice.
REPORT AN ERROR · BETA
Spotted an error? Earn 500 BankPulse Credits
Help us stay accurate. If your correction is verified true and approved by our founder, you earn 500 BankPulse Credits — redeemable when the platform monetises.
Reviewed by a human before any credit is awarded. We never change the site from crowd input without verification.
WANT A NEW FEATURE · BETA
What would make BankPulse more useful for you?
Tell us what to build next — a tool, a data view, a role page, anything. We read every suggestion.
Thank you — your ideas directly shape what we build.