IFSCA AML CFT KYC Guidelines, 2022: What Every Regulated Entity Must Have in Place

Financial crime compliance is the one obligation in GIFT IFSC that does not vary by business line. A fund manager, a banking unit, a payment service provider and an insurance office may have nothing else in common, but each is a “Regulated Entity” under the IFSCA (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022, most recently updated on 3 August 2026, and each must build the same architecture.

The Legal Foundation

The Guidelines are built on the Prevention of Money-laundering Act, 2002 and the Prevention of Money-laundering (Maintenance of Records) Rules, 2005, whose definitions the Guidelines adopt. They apply to every regulated entity, and extend to the financial group of a regulated entity to the extent set out in the chapter on groups, branches and subsidiaries.

This matters jurisdictionally. Where the IFSCA Act transfers the powers of the RBI, SEBI, IRDAI and PFRDA within the IFSC (Article 1), the PMLA is not one of the transferred statutes; it applies of its own force. IFSCA’s Guidelines operationalise those obligations for IFSC entities and replace the sectoral KYC norms that would otherwise apply, as the banking and finance company regulations expressly recognise.

Who is Exempt, and What Exemption Means

Clause 1.2.3 exempts four categories from the Guidelines:

• a Global In-house Centre registered under the IFSCA (Global In-house Centres) Regulations, 2020 (the Guidelines’ own reference, which the consolidated text updated as on 3 August 2026 still carries; those Regulations have been replaced by the IFSCA (Global In-house Centres) Regulations, 2025, in force from 29 December 2025, and the reference should be read as a GIC registered under the 2025 Regulations);
• an International Branch Campus or Offshore Education Centre of a foreign university or institution registered under the 2022 Regulations;
• a Financial Crime Compliance Services Provider registered under the IFSCA (Book-keeping, Accounting, Taxation and Financial Crime Compliance Services) Regulations, 2024; and
• a financial institution providing services only to entities in its own financial group located in a country not identified in the FATF public statement as a high-risk jurisdiction subject to a call for action.

Two qualifications follow immediately. A financial institution undertaking transactions through third-party business or service providers in the course of its operations is subject to the requirement to undertake business risk assessment notwithstanding the exemption. And exempt entities must still conduct and document a business risk assessment; where any AML or CTF risk is identified, further obligations follow.

Exemption from the Guidelines is therefore not exemption from thinking about the risk, and it is certainly not exemption from the PMLA.

A separate instrument must also be read. IFSCA’s circular of 18 November 2024 exempting certain entities and activities from the Guidelines was amended on 19 June 2026, with immediate effect. Every financial institution, including one that is exempt, must now route all monetary consideration arising from its business transactions, including funds, fees and other payments, only through an account with an IFSC Banking Unit or a Special Non-Resident Rupee account. The exemptions are otherwise retained.

The Architecture the Guidelines Require

The chapters track the FATF-style sequence, and a compliance programme should be built in the same order.

Risk-based approach and business risk assessment. The entity must assess the money laundering and terrorist financing risks inherent in its own business, its products, delivery channels, customers and geographies, and document that assessment.

Customer risk assessment and customer due diligence. Customers must be risk-rated, and due diligence calibrated accordingly, with simplified due diligence where permitted and enhanced due diligence where required, including for politically exposed persons. The Guidelines address identification and verification, beneficial ownership, officially valid documents, video-based customer identification, and use of the Central KYC Records Registry, with detailed guidance in the annexures.

Beneficial ownership. The Guidelines define beneficial owner and define “control” to include the right to appoint a majority of directors or to control management or policy decisions. Identifying the natural person behind a corporate customer is a substantive obligation, not a documentary formality.

Third party reliance. Where an entity relies on a third party for elements of due diligence, the Guidelines set the conditions. Reliance does not transfer responsibility.

Correspondent banking and wire transfers. Dedicated requirements apply, including the approval role of the Principal Officer in decisions on receipt or release of wire transfers in specified circumstances.

Internal policies, compliance and training. The entity must designate a Principal Officer at management level with the necessary seniority and authority, develop compliance policies and procedures, and manage conflicts between business lines and the Principal Officer’s responsibilities so that unbiased judgment and impartial advice to management are possible. A Designated Director is responsible for overall compliance.

Record keeping. Records must be maintained as specified, consistent with the PML Rules.

Suspicious transactions. The Guidelines set out the process for identifying and reporting suspicious transactions to FIU-IND, together with the prohibition on tipping off the customer, subject to FIU-IND’s directions.

Sanctions and Counter-Proliferation: The Daily Obligations

Chapter XI contains obligations that are often under-implemented because they are operational rather than policy-level.

• Daily list screening. Regulated entities must ensure, in terms of section 51A of the Unlawful Activities (Prevention) Act, 1967, that they hold no account in the name of individuals or entities on the UNSC lists, specifically the ISIL (Da’esh) and Al-Qaida Sanctions List and the 1988 Sanctions List. The Guidelines require these lists to be verified on a daily basis, with additions, deletions and other changes taken into account.
• Reporting matches. Details of accounts resembling listed individuals or entities must be reported to FIU-IND, and the Ministry of Home Affairs advised in accordance with the UAPA order of 2 February 2021 on implementation of section 51A.
• Other UNSC resolutions circulated by IFSCA must also be complied with.
• Countermeasures. An entity must adhere to countermeasures when called upon by an international or intergovernmental organisation of which India is a member, where accepted by the Central Government.
• Weapons of mass destruction. Entities must comply with the procedure for implementation of section 12A of the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005, laid down by the order dated 1 September 2023.
• Asset freezing. The Guidelines address freezing of assets under section 51A of the UAPA.

Practical Implementation Points

• Appoint the right people, not the available people. The Guidelines require seniority and authority for the Principal Officer, and separate responsibility for the Designated Director. Conflicts with business lines must be managed by procedure.
• Automate the sanctions screening. A daily verification obligation against lists that change without notice cannot be met manually at scale.
• Document the business risk assessment even if exempt. The exemption in clause 1.2.3 is conditional and does not remove this step.
• Map group obligations. The Guidelines extend to the financial group to the extent specified, which affects group-wide policies, information sharing and branch and subsidiary supervision.
• Read the Guidelines as amended. The 2022 Guidelines have been updated repeatedly, including by circulars recorded in the footnotes of the consolidated version, and the current text as at 3 August 2026 is the operative one.

Frequently Asked Questions

1. What are the IFSCA AML CFT KYC Guidelines, 2022?

They establish anti-money laundering, counter-terrorist financing and customer due diligence requirements for regulated entities in GIFT IFSC.

2. Who must comply with the Guidelines?

All regulated entities within their scope must comply, subject to specified exemptions and conditions.

3. What are the key compliance requirements?

Key requirements include risk assessment, customer due diligence, beneficial ownership verification, record keeping, suspicious transaction reporting and sanctions screening.

4. Who is responsible for AML compliance?

The Principal Officer oversees key compliance functions, while the Designated Director holds overall responsibility for compliance.

5. Do exempt entities have AML obligations?

Yes. Exempt entities must still conduct and document a business risk assessment, and additional obligations may apply where risks are identified.