Written Anti Money Laundering Procedures

Written AML procedures are the backbone of a broker‑dealer’s compliance program. SEBI’s (Securities and Exchange Board of India) regulations, particularly the “Know Your Customer” (KYC) and AML guidelines, require every intermediary to have a documented policy that is approved by senior management and reviewed annually.

The policy must outline the steps for customer onboarding, risk categorisation, transaction monitoring, and reporting of suspicious activities. Having a clear, written document ensures consistency across branches, aids internal audits, and demonstrates to regulators that the firm has a proactive defence against money‑laundering risks.

In the NISM exam, questions often present a brief scenario and ask whether the firm’s written procedures satisfy SEBI requirements. Candidates must spot missing elements such as lack of senior‑management sign‑off or absence of a periodic review clause.

• Regulatory compliance – avoids penalties and licence suspension.
• Operational consistency – standardises due‑diligence across all sales personnel.

The policy must start with a clear scope that defines which entities (brokers, sub‑brokers, distributors) and which products (equity derivatives, futures) are covered. This prevents ambiguity during audits.

Next, it should detail the customer due‑diligence (CDD) process: identification documents, verification methods, and risk‑rating criteria. The policy must also describe the enhanced due‑diligence (EDD) steps for high‑risk customers, such as Politically Exposed Persons (PEPs) or entities from high‑risk jurisdictions.

Finally, the document must include monitoring and reporting mechanisms, escalation pathways, record‑keeping timelines, and the authority responsible for policy approval and annual review. Each section should reference the specific SEBI circular or clause to demonstrate regulatory alignment.

Risk assessment is the first quantitative step in AML compliance. Every client is assigned a risk rating—Low, Medium, or High—based on factors such as transaction size, source of funds, and geographic location. The written procedure must specify the scoring methodology and the thresholds that trigger enhanced due‑diligence.

During onboarding, the CDD checklist should capture: full legal name, PAN, Aadhaar, proof of address, and, for corporate clients, directors' details and CIN. The policy must also state the verification sources (e.g., RBI’s KYC database, government portals) and the timeline (usually within 5 business days of account opening).

For exam purposes, remember that a missing step—like not obtaining the PAN for an individual client—makes the written procedure non‑compliant, even if the rest of the policy is robust.

Once customers are onboarded, continuous monitoring must detect unusual patterns such as large cash deposits, rapid turnover of positions, or transactions that deviate from the client’s known profile. The written AML procedure should outline the thresholds that trigger a Suspicious Transaction Report (STR) and the exact timeline for filing—typically within 48 hours of detection.

Reporting channels must be clearly defined: the compliance officer prepares the STR, which is then submitted electronically to the Financial Intelligence Unit‑India (FIU‑India). The policy should also cover internal escalation, preservation of evidence, and cooperation with law‑enforcement agencies.

Exam questions may present a delay in filing an STR. Remember: any breach of the 48‑hour rule is a direct non‑compliance point, even if the STR is eventually filed.

SEBI mandates that all AML‑related records—customer KYC documents, risk‑assessment scores, transaction logs, and STR copies—be retained for a minimum of five years from the date of the transaction. The written policy must specify the storage format (electronic or physical) and the security controls (encryption, access logs) to protect confidentiality.

Records must be readily retrievable for regulatory inspections. The policy should also describe the periodic internal audit schedule (at least annually) to verify that records are complete and correctly indexed.

In the exam, a question may ask which document can be discarded after two years. The correct answer is any *non‑AML* marketing material; all AML documents must stay for five years.