IFSCA AML, CFT and KYC Compliance
Reviewed by CA Nikhil Gupta · Last reviewed 12 October 2026
Primary-source-based practical guide · reviewed 12 October 2026
2-minute answer
IFSCA-regulated entities must build AML/CFT/KYC controls around their regulated activity, customer risk and PMLA framework. The practical system should cover onboarding, beneficial ownership, sanctions/PEP screening, monitoring, record retention, reporting and governance—not only collection of identity documents.
Primary legal anchors: IFSCA AML/CFT/KYC Guidelines; PMLA and Rules; sector regulations.
Legal framework and scope
GIFT IFSC activity is regulated through the IFSCA Act, sector regulations, frameworks, circulars and the terms of the entity's registration. A generic 'IFSC benefit' description is unsafe: the permissible activity, legal form, capital/net-worth conditions, governance, AML/KYC, reporting and transaction restrictions differ by regulated activity.
For any transaction, first identify the registered entity category and the latest IFSCA instrument applicable on the transaction date. Then reconcile the licence/registration conditions, board approvals, customer or counterparty due diligence, contract, accounting treatment, regulatory returns and any approval or intimation requirement.
Who should use this
IFSCA-regulated entities, compliance officers and business teams onboarding customers/counterparties in IFSC.
Event-date control
Always confirm amendments, delegated legislation, regulator directions, jurisdiction-specific rules and later binding judgments for the relevant event date before professional reliance.
What the law or regulatory framework requires
- Use the latest IFSCA AML/CFT/KYC guidelines and updates applicable to the regulated entity.
- Risk-rate customers and relationships; enhanced diligence should be triggered by risk factors rather than applied randomly.
- Identify and verify beneficial ownership under the current legal thresholds/rules and document control/ownership analysis.
- Maintain sanctions/PEP/adverse-information screening, transaction monitoring, escalation and statutory reporting channels.
The listed points should be read together. A compliant result normally requires both substantive entitlement or authority and procedural compliance. Where the legal instrument gives discretion to an authority, the file should show the facts placed before that authority and the reasons supporting the decision; where the rule creates a hard prohibition or precondition, internal approval cannot cure non-compliance.
Step-by-step practical workflow
- Define customer/entity type, product, geography and transaction risk.
- Collect and independently verify identity/constitution/beneficial ownership.
- Screen sanctions, PEP and adverse information and set risk rating.
- Approve onboarding at the correct level and set monitoring rules.
- Investigate alerts, file reports where legally required, refresh KYC and retain records.
A useful control is to maintain a one-page chronology with columns for event, legal trigger, required action, due date, responsible person, evidence and status. This avoids the common failure where the legal team, finance team and portal operator each hold only part of the record. For a disputed matter, keep the chronology frozen as at each material decision date so that later changes do not overwrite what was actually known.
Documents and evidence to retain
- KYC/CDD checklist
- constitutional and BO documents
- screening results
- risk-rating rationale
- enhanced due-diligence approval
- transaction-monitoring alerts
- reporting/closure records
- periodic refresh log
Evidence quality matters as much as document presence. Check execution authority, date, version, service or submission proof, digital signature/acknowledgement, consistency with books and systems, and whether the record actually supports the factual proposition for which it is cited. Where a portal submission is involved, retain the final filed PDF/data, acknowledgement and a readable copy of attachments.
Worked example
An IFSC entity onboards a corporate customer with layered ownership in multiple jurisdictions. Compliance traces ownership/control to natural persons, verifies documents independently, screens sanctions/PEPs, records the risk factors and sets enhanced monitoring rather than accepting only the immediate shareholder register.
Decision rule: separate the legal trigger from the evidence that proves it, then test the procedural step and available remedy. Do not jump directly from a commercial outcome to a compliance conclusion.
Common mistakes and legal risks
- Treating KYC as a one-time document collection.
- Failing to identify the natural persons who own/control a customer.
- Ignoring transaction behaviour after onboarding.
- Using an old threshold or guideline without checking IFSCA/PMLA updates.
Another recurring risk is using a correct rule for the wrong period. Finin2min therefore treats currentness as a separate control: statute, rules, notifications/circulars, portal implementation and judicial treatment must be checked independently when any of them can change the answer.
Professional review checklist
| Control | Question to close |
|---|---|
| Authority | Have the exact Act/Rule/regulation and current amendment status been opened? |
| Applicability | Are entity, role, location, period, threshold and transaction facts fixed? |
| Procedure | Are form, portal, notice, hearing, approval and timeline requirements mapped? |
| Evidence | Can every material statement be traced to a document, ledger, filing or order? |
| Consequence | Have tax/fee/penalty/remedy, accounting and disclosure effects been considered? |
| Review | Has a competent reviewer challenged assumptions and stale-source risk? |
Quick Q&A
Is KYC complete once PAN/passport is collected?
No. Customer identification, beneficial ownership, purpose, risk, screening and ongoing monitoring form part of the AML control.
Which source should control?
The current IFSCA AML/CFT/KYC instrument together with PMLA/Rules and the sector-specific framework.
Why preserve screening evidence?
It shows the data and risk basis considered at onboarding and periodic review and supports later alert decisions.
Official primary sources
IFSCA official portal
Current regulations, circulars, frameworks and regulated-entity information
IFSCA New / updated instruments
Recent circulars, guidelines and framework updates
Source review date: 12 October 2026. Educational and professional reference only; not a substitute for fact-specific legal advice. For filing, enforcement or litigation, use the operative government/regulator text and portal for the relevant date.