Presentation-on-KYC-basics.pdf
- 1. Understanding KYC - K A N A K P R A B H A J E T H A N I V I N O D K O T H A R I C O N S U L T A N T S P . L T D .
- 2. Coverage •Meaning and genesis of KYC •Need of KYC •Anti-Money Laundering Framework in India •Introduction of KYC Directions •Flow of a typical credit sanction process •Modes of undertaking KYC and intricacies in each of the modes •Major compliance requirements under the KYC Directions and Prevention of Money Laundering Act and Rules.
- 3. What is KYC? KYC stands for Know Your Customer It is a process of establishing a person’s identity Essentially, it means verifying the details of the person and confirming the same from a trusted source
- 4. Why is KYC needed? •Risk of money laundering in every financial transaction •For lending institutions, there is an additional risk of financing terrorism •Risk of impersonation •Risk of frauds
- 5. Anti-Money Laundering Framework in India Guidelines Regulatory Authorities To monitor customers' transactions and report on suspicious financial activities Prevention of Money Laundering Act, 2002 RBI Master Direction - Know Your Customer (KYC) Direction, 2016 SEBI Know Your Client (KYC) Requirements
- 7. Important Terminology OVD- means : - the passport - the driving license - proof of possession of Aadhaar number - the Voter's Identity Card issued by the Election Commission of India - job card issued by NREGA duly signed by an officer of the State Government - letter issued by National Population Register with details of name and address. Equivalent e-documents- means an electronic equivalent of a document, issued by the issuing authority of such document with its valid digital signature including documents issued to the digital locker account of the customer as per rule 9 of the Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016. Regulated Entity (RE)- means all banks, AIFIs, NBFCs, Payment System Providers/ System Participants and Prepaid Payment Instrument Issuers and all authorised persons regulated by the RBI. Customer Due Diligence (CDD)- means identifying and verifying the customer and the beneficial owner.
- 8. Credit Sanction Process Flow Receipt of Application + PAN + OVDs Checking whether the name of the applicant falls in the UNSC lists/lists of willful defaulters/other lists of terrorist organisation Verifying the authenticity of the OVDs submitted from authentic sources Matching the details of the OVDs with that of the customer Credit Check Additional Due Diligence, where required Lending/Account opening decision
- 9. Modes of conducting CDD Physical • Customer submits a copy of OVDs, photograph and PAN with loan application • RE matches the copy with the original OVD shown by the customer • Signatures of the customer obtained in wet ink V-CIP • Customer submits an equivalent e-document of OVDs/aadhaar XML/QR code/KYC Identifier with loan application and PAN • The OVDs submitted by applicant are verified using various means • RE does a video call with the applicant, where he/she displays original OVD on call • Loan agreement is executed digitally Digital KYC • Extension of physical KYC • Rather than obtaining a physical copy of OVD, the RE captures image of original OVD in an application • Live photograph of the applicant is also captured • The rest of the process is same OTP based eKYC • Manner of authentication of Aadhaar • Aadhaar can be authenticated by sending an OTP to the customers registered mobile no. • Only for banks • Usually used for digital lending • Temporary mode- valid for 1 year CKYCR • Customer submits his/her KYC identifier • RE downloads KYC records from the CKYCR and matches the details with that provided by the applicant • Loan documents are executed digitally/physically
- 10. CDD for Entities Sole Proprietorship Undertake CDD of proprietor Any 2 of following additional documents to be obtained: -Registration certificate -Certificate/licence under Shop and Establishment Act. -Sales and income tax returns. -GST certificate (provisional/final). -Certificate by Tax authorities. -IEC (Importer Exporter Code) - Complete Income Tax Return - Utility bills Partnership Firm Undertake CDD of BO/Manager, officers or employees holding power of attorney to act of behalf of firm BO- Person entitled to more than 15% per cent of capital or profits Any 2 of following additional documents to be obtained: -Registration certificate -Partnership deed -PAN of the partnership firm and Company Undertake CDD of BO/Manager, officers or employees holding power of attorney to act of behalf of company BO- Person having Controlling Interest i.e. 25% of the shares or capital or profits Any 2 of following additional documents to be obtained: -Certificate of incorporation -Memorandum and Articles of Association - PAN of the company - A resolution and power of attorney granted to person transact on its behalf
- 11. Intricacies in modes of carrying out KYC
- 12. Physical Mode Aadhaar number can be obtained only by banks Authentication using e-KYC authentication facility provided by UIDAI REs other than banks can obtain proof of possession of Aadhaar only If provided by customer, ensure the same is redacted Authentication using offline verification Copies of other OVDs may also be obtained Usually self-attested by customer
- 13. Digital KYC Extension of Physical KYC Application to be developed for digital KYC process Access of the Application shall be controlled by the REs Customer shall visit the location of the authorized official of the RE or vice-versa Ensure customer has original OVD Same shall be captured along with live photo of customer and location tagging Banks may use the services of Business Correspondent (BC) for this process
- 14. V-CIP Can be used for CDD of individuals, proprietors of proprietorship firm, authorised signatories and Beneficial Owners (BOs) of Legal Entities In case of other than individuals, additional documents to be obtained May also be used for conversion of existing OTP based accounts to full KYC accounts and periodic updation of KYC Application to be operated only by officials of RE This mode of carrying out KYC verification cannot be outsourced Can obtain equivalent e-document including documents issued through Digilocker Verification of documents using- OTP based authentication/ Offline verification of Aadhaar/KYC records downloaded from CKYCR/verification of equivalent e-document from the database of issuing authority PAN to be verified from the database of the issuing authority Account shall be operational only after concurrent audit- Ensure no tampering Details of KYC and person performing V-CIP to be maintained
- 15. V-CIP Infrastructure Comply with RBI guidelines on minimum baseline cyber security and resilience framework for banks Technology infrastructure to be housed in own premises V-CIP connection and interaction to necessarily originate from RE’s own secured network domain Technology related outsourcing may be done, in accordance with RBI guidelines Customer consent to be recorded in an auditable and alteration proof manner. Infrastructure to be capable of preventing connection from IP addresses outside India or from spoofed IP addresses. Recordings to contain the live GPS co-ordinates and date-time stamp of customer. Quality of video to be adequate to allow identification of the customer beyond doubt. Tests such as Vulnerability Assessment, Penetration testing and a Security Audit
- 16. OTP based eKYC Can be undertaken by banks only Specific consent of customer to be obtained Limits on account: aggregate balance of the deposit account shall not exceed Rs. 1 lakh aggregate of all credits in a financial year, in all the deposit account taken together, shall not exceed Rs. 2 lakhs only term loans shall be sanctioned aggregate amount of term loans sanctioned shall not exceed rupees Rs. 60,000 in a year. account shall not be allowed for more than one year unless complete KYC is done Otherwise, the account shall be closed immediately. Declaration to be obtained that no other account has been opened nor will be opened using OTP based KYC Clearly indicate in CKYCR records
- 17. CKYCR If customer submits KYC identifier, take declaration that there has been no change in the KYC information submitted Ensure data on CKCYR is updated In case obtaining KYC documents from customer for the first time- upload on CKYCR within 10 days Communicate KYC Identifier to customer Is this mode a valid mode of KYC?
- 19. Major provisions of KYC Directions (1/3) REs to have a KYC Policy in place • Policy should usually include: • Procedure for identification and acceptance of customer • Broad contours of the KYC process to be followed • Guidance for secrecy and maintenance of information • Governance Framework for KYC • Manner of ongoing due diligence and periodic updation Outsourcing • Outsourcing of KYC function may be done to the extent it does not outsource decision making power • Only the function of collecting and processing information can be outsourced • Information security guidelines must not be breached • Records or the information to be obtained within two days from the service provider • Responsibility of RE shall not cease MLTF risk • Financial institutions are more prone to the risk of ML an dTF • Carry out assessment- geography, type, customer seg • Place before BOD • Must form part of policy
- 20. Major provisions of KYC Directions (2/3) Designated Director and Principal Officer • Designated Director (DD) ensures overall compliance with the obligations imposed under Chapter IV of the PML Act and the Rules • Principal Officer (PO) - responsible for ensuring compliance, monitoring transactions, and sharing and reporting information • PO and DD not to be the same person • Details of PO and DD to be communicated to the FIU- IND. Customer Acceptance • CDD to be done at UCIC level • CDD to be done for all joint account holders • Ensure the name of customer does not appear in UNSC/ RBI sanctions list/willful defaulters list etc. • PAN to be verified only from verification facility • In case of e-documents, digital signature to be verified as per IT Act, 2000 Risk Management • Customers to be divided in 3 categories: • High • Medium • Low • Parameters for categorization • customer’s identity, social/financial status • nature of business, location etc.
- 21. Major provisions of KYC Directions (3/3) Periodic Updation • Risk based approach • If no change in KYC information- obtain self- declaration for the same • If change in address- • In case of individual- self- declaration of the new address + verification within 2 months • In case of other than individual- conduct CDD • Change in other KYC information- conduct CDD Record Management • Records of transactions to be maintained for 5 years from date of transaction • Records of identity to be preserved for 5 years after relationship ends Secrecy Obligations • KYC information is personal information • Not to be divulged to any person without prior consent of the customer • Exceptions: • Compulsion of law • Duty to disclose • Required by RBI/courts
- 22. Prevention of Money Laundering Act and Rules
- 23. Major provisions Maintenance of Records Reporting • Maintain records of all transactions • Specifically: • cash transactions of Rs. 10 lakhs or more- individual or series • cash transactions where forged or counterfeit notes have been used • suspicious transactions • all cross border wire transfers of more than Rs. 5 lakhs • purchase./sale of immovable property of Rs. 50 lakhs or more • Upon occurrence of any suspicious transactions, report to FIU within 7 working days • Purchase/sale of immovable property of Rs. 50 lakhs or above- to be reported by 15th of succeeding quarter • Other specified transactions to be reported by 15th of next month
- 24. Thank you