Who the Guidelines apply to
The Guidelines were notified in October 2022 and IFSCA keeps a consolidated text on its website; the version we refer to is updated as on 2 January 2026. Under clause 1.2.1, they apply to every regulated entity that IFSCA has licensed, recognised, registered or authorised. They also apply to the entity's financial group to the extent set out in Chapter XII.
Clause 1.2.3 exempts four categories: Global In-House Centres; International Branch Campuses and Offshore Education Centres; Financial Crime Compliance Services Providers registered under the BATF Regulations, 2024; and a financial institution serving only its own group entities in countries not on the FATF list of high-risk jurisdictions subject to a call for action. Even an exempt entity must carry out and document a business risk assessment, and must comply in full if that assessment shows AML/CTF risk.
Governance: policy, Designated Director and Principal Officer
- Policy: an AML-CFT policy, including a KYC policy, approved by the governing body or a delegated committee (clause 1.5). Every member of senior management is responsible for compliance.
- Designated Director: the person designated to ensure overall compliance with Chapter IV of the PMLA, the Rules and the Guidelines (clause 1.3.12).
- Principal Officer: responsible for furnishing information under rule 8 of the Rules (clause 1.3.33). The Principal Officer must be at management level, suitably qualified and resourced, with timely access to customer records, and distinct from internal audit and the business lines (clause 8.2).
- Notification: the names, designations and addresses of both officers must be communicated to FIU-IND and IFSCA (clause 10.3).
- Certification: by IFSCA's circular of 17 November 2025, every Designated Director and Principal Officer must complete the NISM-IFSCA-01 certification course on AML and CFT in the IFSC, and must hold that certification at all times while in the role.
The firm's booklets note that IFSC entities register with FIU-IND on its FINGate portal before they begin reporting.
Risk assessment and customer due diligence
The Guidelines take a risk-based approach. An entity must assess money-laundering and terrorist-financing risk at enterprise-wide (and, where relevant, group-wide) level, document it, use it to classify customers as low, medium or high risk, and review it at least once every two years or on a material trigger, whichever is earlier (clause 2.1). New products, practices and technologies must be risk-assessed before launch (clause 3.2).
Beneficial ownership is set at more than ten per cent of shares, capital or profits for companies and partnerships, more than fifteen per cent for unincorporated associations, and, for trusts, the settlor, the trustees, beneficiaries with ten per cent or more, and anyone with ultimate effective control (clause 1.3.3). Politically exposed persons attract enhanced measures, including information on source of wealth (clause 5.5). Customer due diligence must be refreshed annually for high-risk customers, every three years for medium-risk and every five years for low-risk customers, with longer cycles for resident Indian customers of a group already known in India (clause 5.11).
Sanctions screening
Under Chapter XI, an entity must not hold accounts for persons on the UN Security Council lists, must check those lists daily for changes, must report matches to FIU-IND and the Ministry of Home Affairs, and must follow the freezing procedure under section 51A of the Unlawful Activities (Prevention) Act, 1967 and the procedure under section 12A of the Weapons of Mass Destruction Act, 2005. FATF statements on high-risk jurisdictions must be built into risk assessment, with written findings on the background to transactions with those jurisdictions.
US, EU and UK sanctions are not part of the IFSCA Guidelines, but they matter in practice. As the firm's sanctions volume explains, US secondary sanctions can reach non-US persons who transact in US dollars cleared through US correspondent banks. For dollar-based IFSC business, screening against those lists is usually a commercial necessity. See sanctions and AML.
Monitoring, reporting and records
- Suspicious transactions: staff escalate to the Principal Officer, who records reasons. A Suspicious Transaction Report goes to FIU-IND promptly once the transaction is concluded to be suspicious. There is no minimum amount. Tipping off is prohibited (clause 10.4), and an account must not be restricted merely because an STR has been filed.
- Other reports: Non-Profit Organisation Transaction Reports by the 15th of the following month. Each day of delay in reporting is a separate violation.
- Records: due diligence records, transaction records, internal analyses and STRs must be kept for at least six years after the relationship ends or the transaction completes (clause 9.2), and produced immediately to IFSCA on request. Records held outside the IFSC must be accessible without delay, including where foreign secrecy laws apply.
- Central KYC: KYC records of Indian resident customers are uploaded to the Central KYC Records Registry within 10 days of starting an account-based relationship.
- Supervisory reporting: capital market intermediaries file an AML/CFT compliance sheet with their quarterly report every half-year (see Regulatory returns).
Training and independent audit
Chapter VIII requires periodic AML/CFT training for all relevant employees, tailored to the entity's products and customers, with training records kept (clause 9.7). It also requires an independent, adequately resourced audit function to test the framework periodically, including the risk assessment, training and escalation of non-compliance to senior management (clause 8.3).