Master Circular - Guidelines on Know Your Customer / Anti Money Laundering/Combating the Financing of Terrorism (KYC/AML/CFT)

Page 1 of 25 MASTER CIRCULAR PFRDA/Master Circular/2024/04/PoP-02 (Updated as on 25th September 2025) Updated as on 23rd September 2024) (Updated as on 10th April, 2024) (Updated as on 12th October, 2023) (Updated as on 7th August, 2023) Updated as on 7th June, 2023) Issued on 23rd January, 2023 To [1] All Point of Presence (PoPs), NPS Trust[a] Madam/Sir, Master Circular - Guidelines on Know Your Customer / Anti Money Laundering/Combating the Financing of Terrorism (KYC/AML/CFT) 1. This circular is issued in exercise of powers conferred under Section 14(1) of the Pension Fund Regulatory and Development Authority Act, 2013 (PFRDA Act) and the Prevention of Money- laundering (Maintenance of Records) Rules, 2005 for the implementation of the provisions of the Prevention of Money Laundering Act, 2002, and rules notified thereunder, in respect of the pension schemes regulated and administered by the Authority. 2. This master circular consolidates the existing instructions on the subject of “Guidelines on Know Your Customer / Anti-Money Laundering / Combating the Financing of Terrorism (KYC/AML/CFT)” at one place. 3. The list of underlying circulars consolidated in the Master Circular – is placed at Annexure I and the list of circulars rescinded from time to time and archived is placed at Annexure II. This circular is issued with the approval of the competent authority and all concerned shall take steps to implement the measures contained herein forthwith. Yours faithfully, (Ashish Kumar) Chief General Manager Copy to: All Central Record Keeping Agencies [1] Amended the previous text that read as: All Point of Presence (PoPs), NPS Trust[a] and Retirement AdvisersPage 2 of 25 CONTENTS PART I Introduction PART II General Guidelines Guidelines on Know Your Customer / Anti-Money Laundering / PART III Combating the Financing of Terrorism (KYC/AML/CFT) List of circulars consolidated in the Master Circular - Annexure I PART IV List of circulars Rescinded and Archived - Annexure IIPage 3 of 25 Guidelines on Know Your Customer / Anti-Money Laundering / Combating the Financing of Terrorism (KYC/AML/CFT) PART I 1. Introduction 1.1 These guidelines shall be called the Guidelines on Know Your Customer / Anti- Money Laundering / Combating the Financing of Terrorism (KYC/AML/CFT). 1.2 National Pension System (NPS) has an unbundled Architecture, where each function is performed by different intermediaries appointed by the PFRDA viz. Pension Funds, Custodian, Central Recordkeeping Agency (CRA), National Pension System Trust, Trustee Bank, Points of Presence (PoP), Retirement Advisers (RAs) and Annuity Service Providers (ASPs) registered with Insurance Regulatory and Development Authority of India (IRDAI). Wherein, the role of CRA is recordkeeping, administration and customer service functions for all the subscribers of the NPS including issuance of unique Permanent Retirement Account Number (PRAN) to each subscriber, maintaining a database of all PRANs issued and recording transactions relating to each subscriber’s PRAN. 1.3 Money Laundering is a process or activity through which proceeds of crime (i.e., illegally acquired money) are converted in the financial systems (by means of undertaking transactions) so that it appears to be legally acquired. Section 3 of PML Act prescribes the Offence of Money Laundering. 1.4 In terms of the provisions of Prevention of Money Laundering Act, 2002 (PML Act), Section 11A thereof and the Prevention of Money Laundering (Maintenance of records) Rules, 2005 (PML Rules), reporting entities (RE) are required to follow Customer Identification Procedures (CIP) while undertaking a transaction at the time of establishing an account-based relationship and monitor their transactions on an on-going basis. 1.4a [2] These Guidelines are for use by PoPs, NPS Trust and CRAs registered under the PFRDA Act and the respective Regulations. 1.5 The obligation to establish an anti-money laundering mechanism and formulate and implement a Client Due Diligence (CDD) Programme applies to Reporting Entities (REs) as per provisions of Section 12 and Section 12AA of the PML Act and Rule 9 of the PML (Maintenance of Records) Rules, 2015. REs shall have the responsibility for compliance of the provisions of the PML Act, rules and guidelines issued by the Authority in respect of NPS, NPS Lite, Atal Pension Yojana (APY) or any other pension scheme regulated / administered by Authority and take necessary actions including maintenance of records and reporting. 1.6 All REs shall take steps to implement provisions of the PML Act and the PML Rules, Section 51A of the Unlawful Activities (Prevention) Act, 1967(UAPA) as amended from time to time, including operational instructions issued through circulars/guidelines/ directions in pursuance of such amendment(s). 1.7 All regulated entities shall undertake appropriate measures to ensure compliance with Hon’ble Supreme Court Order dated April 30, 2025 in the matter of Pragya Prasun and Ors. vs Union of India (W.P.(C) 289 of 2024) and Amar Jain vs Union of India & Ors. (W.P.(C) 49 of 2025), as applicable. [2] Amended the previous text that read as: These Guidelines are for use by PoPs, NPS Trust, CRAs and Retirement Advisers registered under the PFRDA Act and the respective Regulations.Page 4 of 25 1.8 These Guidelines emphasize the importance of risk-based approach for periodic updation of KYC ensuring that the information or data collected under Client Due Diligence (CDD) is kept up-to-date and relevant. PART II 2 GENERAL GUIDELINES 2.1 The compliance obligation to the intermediary/entity shall not be confined merely to the Master Circular, but also the applicable laws, in this regard. 2.2 This Master Circular shall take effect from the date of its issuance but shall be without prejudice to earlier issued circulars, for the period when they were in force, until being subsumed under the Master Circular. Based on the above caveat, Part IV containing the list of circulars consolidated in the Master Circular – is placed at Annexure I, such that they are subsumed in the Master Circular and for all purpose and intent, remain operative, with no break of continuity. The list of circulars rescinded from time to time and archived is placed at Annexure II. 2.3 Notwithstanding such rescission of any circular, upon their merger in the Master Circular, or otherwise, anything done or any action taken or purported to have been done or taken, or to be taken hereafter, under the circulars now rescinded (for the period of their operation) shall be construed to have been validly taken as if the said circulars are in full force and effect and shall remain unaffected by their rescission, in any manner. 2.4 The previous operation of the rescinded circulars or anything duly done or suffered thereunder, any right, privilege, obligation or liability acquired, accrued or incurred, any penalty, any order passed, any violation committed, any investigation, legal proceedings pending in terms of the circular (now rescinded), shall be treated as if the circulars are in full force and effect, and shall remain unaffected by their rescission, in any manner. PART III 3 DEFINITIONS In these guidelines, unless the context otherwise requires, the terms herein shall bear the meanings assigned to them below: 3.1 “Aadhaar number", shall have the meaning assigned to it under clause (a) of section 2 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, hereinafter referred to as “Aadhaar Act”. 3.2 “Act / PML Act / PMLA” means the Prevention of Money Laundering Act, 2002. 3.3 “Authentication”, means the process as defined under clause (c) of section 2 of the Aadhaar Act. 3.4 “Central KYC Records Registry” (CKYCR) means an entity defined under clause (ac) of sub rule (1) of Rule 2 of the PML Rules. 3.5 [3] [***] [3] Deleted: Prior to deletion it read as “Certified copy” shall mean comparing the copy of officially valid document so produced by the subscriber with the original and recording the same on the copy by the authorised officer of the reporting entity in a manner specified by PFRDA.Page 5 of 25 3.6 “Client” shall have the meaning assigned to it under clause (ha) of sub section (1) of Section 2 of the PML Act. 3.7 “Client Due Diligence” (CDD) shall have the meaning assigned to it under clause (b) of sub-rule (1) of Rule 2 of the PML Rules. 3.8 “Designated Director" shall have the meaning assigned to it under clause (ba) of sub- rule (1) of Rule 2 of the PML Rules. 3.9 “Digital KYC” shall have the meaning assigned to it under clause (bba) of sub-rule (1) of Rule 2 of the PML Rules. 3.10 “Equivalent e-document” shall have the meaning assigned to it under clause (cb) of sub-rule (1) of Rule 2 of the PML Rules. 3.11 “Financial Group” means a group that consists of a parent company or of any other type of entity exercising control and coordinating functions over the rest of the group, together with branches and/or subsidiaries that are subject to AML/CFT policies and procedures at the group level[b] 3.12 “KYC Templates” means templates prepared to facilitate collating and reporting the KYC data to the CKYCR. 3.13 “KYC Identifier” shall have the meaning assigned to it under clause (cc) of sub-rule (1) of Rule 2 of the PML Rules. 3.14 “KYC Records” shall have the meaning assigned to it under clause (cd) of sub-rule (1) of Rule 2 of the PML Rules. 3.15 [4] “Non-face-to-face customers” shall have the same meaning assigned to it under sub clause (x) of 3(b) of Chapter I of Master Direction – Know Your Customer (KYC) Direction, 2016 issued by Reserve Bank of India (RBI), as amended from time to time. 3.16 “Offline verification” shall have the same meaning as assigned to it in clause (pa) of section 2 of the Aadhaar Act. 3.17 “On-going Due Diligence” means regular monitoring of transactions to ensure that they are consistent with the subscriber’s profile and source of funds. 3.18 "Officially valid document" shall have the meaning assigned to it under clause (d) of sub-rule (1) of Rule 2 of the PML Rules. 3.19 "Deemed OVD" shall have the meaning assigned to it under clause (d) of sub-rule (1) of Rule 2 of the PML Rules. 3.20 [5] “Politically Exposed Persons” (PEPs) shall have the same meaning assigned to it as under clause (db) of sub-rule (1) of Rule 2 of the PML Rules. 3.21 “Periodic updation” means steps taken to ensure that documents, data or information collected under the CDD process is kept up-to-date and relevant by undertaking reviews of existing records at periodicity prescribed by PFRDA. [4] Amended the previous text that read as “non-face-to-face customers” shall have the same meaning assigned to it under sub clause (ix) of 3(b) of Chapter I of Master Direction – Know Your Customer (KYC) Direction, 2016 issued by Reserve Bank of India (RBI), as amended from time to time. [5] Amended the previous text that read as “Politically Exposed Persons” (PEPs) shall have the same meaning assigned to it as under the explanation to para 41 of the Master Direction – Know Your Customer (KYC) Direction, 2016 issued by Reserve Bank of India (RBI), as amended from time to time.Page 6 of 25 3.22 “Principal Officer” shall have the same meaning assigned to it under clause (f) of sub-rule (1) of Rule 2 of the PML Rules. 3.23 “Reporting entity” has the same meaning assigned to it under clause (wa) of sub section (1) of section 2 of the PML Act. 3.24 “Rules / PML Rules” means the Prevention of Money Laundering (Maintenance of Records) Rules, 2005. 3.25 “Suspicious Transaction” shall have the meaning assigned to it under clause (g) of sub-rule (1) of Rule 2 of the PML Rules. 3.26 [6] “Video Based Customer Identification Process (VCIP)” means an alternate method of customer identification with facial recognition and client due diligence by an authorised official of the RE by undertaking seamless, secure, live, informed-consent based audio-visual interaction with the subscriber to obtain identification information required for CDD purpose, and to ascertain the veracity of the information furnished by the subscriber through independent verification and maintaining audit trail of the process. 3.27 “Subscriber” shall have the meaning as per clause (t) of sub-section (1) of section 2 of the PFRDA Act. In these guidelines, the phrase Subscriber, Customer and Client has been used interchangeably and shall be considered to have the same meaning. 3.28 Words and expressions used and not defined in these guidelines but defined in the Pension Fund Regulatory and Development Authority Act, 2013, the PML Act, the PML Rules, the Aadhaar Act, Unlawful Activities (Prevention) Act, 1967 shall have the meanings respectively assigned to them in those Acts, Rules, Regulations, Guidelines issued under those Acts, as the case may be. 4 Internal policies, procedures, controls, responsibility and compliance arrangement 4.1 Every reporting entity, has to establish and implement policies, procedures, internal controls and formulate and implement a Client Due Diligence (CDD) Programme that effectively serves to prevent and impede Money Laundering (ML) and Terrorist Financing (TF). 4.2 To be in compliance with these obligations, the senior management of every reporting entity shall be fully committed to establishing appropriate policies and procedures for the prevention of ML and TF and ensuring their effectiveness and compliance with all relevant legal and regulatory requirements. The reporting entities shall: 4.2.1 Develop a KYC/AML/CFT program comprising of policies and procedures, for dealing with KYC, ML and TF reflecting the current statutory and regulatory requirements. 4.2.2 [7] Ensure that the content of these guidelines is understood by all employees, Retirement Advisers and Pension agents associated with PoPs engaged in facilitating distribution of NPS / APY or any other pension scheme regulated or administrated by [6] Amended the previous text that read as Video Based Customer Identification Process (VCIP)” means an alternative (optional) electronic process of Identification/ KYC in paperless form, carried out by the reporting entities by undertaking seamless, secure, real-time with geo-tagging, consent based audio-visual interaction with the subscriber to obtain identification information including the necessary KYC documents required for the purpose of client due diligence and to ascertain the veracity of the information furnished by the subscriber. [7] Amended the previous text that read as Ensure that the content of these guidelines are understood by all employees, associated Retirement Advisers and Pension agents engaged in facilitating distribution of NPS / APY or any other pension scheme regulated or administrated by PFRDA and develop awareness and vigilance to guard against ML and TF amongst them.Page 7 of 25 PFRDA and develop awareness and vigilance to guard against ML and TF amongst them. However, the ultimate responsibility to adhere to the KYC/AML/CFT guidelines issued by the Authority in respect of NPS, NPS Lite or any other pension scheme regulated / administered by Authority lies on the Reporting Entities (REs) irrespective of the accounts being sourced/opened through the pension agents or Retirement Advisors. 4.2.3 The KYC/AML/CFT policy should have the approval of the Board of Directors of REs in case of company or of the management which takes significant decisions, in case of other REs. The program and processes emanating from the Board approved policy shall be reviewed periodically on the basis of risk exposure and suitable changes (if any) be effected based on experience and to comply with the extant PML Act / PML Rules / Regulations / Guidelines issued by the Authority or any amendments thereof and other applicable norms. [8] (If the RE already has the Board approved policy on KYC/AML/CFT in compliance of the guidelines issued by other financial sector regulator then activities related to NPS or any other schemes as approved by PFRDA from time to time may be included in that policy.) 4.2.4 The Board of Directors or equivalent authority or Committee of the Board or the Senior Management Official(s) designated by the Board shall keep themselves apprised about the observations, violations, reporting etc., including follow-up action on periodic basis. 4.2.5 Undertake CDD measures to an extent that is sensitive to the risk of ML and TF depending on the type of subscriber, business relationship or transaction. 4.2.6 Have in place a system for identifying, monitoring and reporting suspected ML or TF transactions to Financial Intelligence Unit – India (FIU-IND) and the law enforcement authorities in accordance with the guidelines issued by Government of India 4.3 Policies and procedures set under KYC/AML/CFT program shall cover: 4.3.1 Communication of policies relating to prevention of ML and TF to all level of management and relevant staff that handle subscribers’ information (whether in branches or departments) in all the offices of the reporting entities; 4.3.2 The Client Due Diligence Program including policies, controls and procedures, approved by the Board of Directors or equivalent authority or Committee of the Board or the Senior Management Official(s) designated by the Board to enable the reporting entities to manage and mitigate the risk that have been identified by the reporting entities; 4.3.3 Maintenance of records; 4.3.4 Compliance with relevant statutory and regulatory requirements; 4.3.5 Co-operation with the relevant law enforcement authorities, including the timely disclosure of information; 4.3.6 Role of internal audit or compliance function to ensure compliance with the policies, procedures and controls relating to the prevention of ML and TF including the testing of the system for detecting suspected money laundering transactions, evaluating and checking the adequacy of exception reports generated on large and/or irregular [8] Amended the previous text that read as “(If the RE already has the Board approved policy on KYC/AML/CFT in compliance of the guidelines issued by other financial sector regulator then activities related to NPS may be included in that policy.)Page 8 of 25 transactions, the quality of reporting of suspicious transactions and the level of awareness of frontline staff, of their responsibilities in this regard. The internal audit function shall be independent, adequately resourced and commensurate with the size of the business and operations, organization structure, number of subscribers and other such factors. 4.4 Responsibility of reporting entities: The guidelines place the responsibility of a robust KYC/AML/CFT program on the reporting entities. This necessitates that the following steps are taken to strengthen the level of control on employees, associated Retirement Advisers and pension agents of reporting entities: 4.4.1 Standard Operating Procedure / Guidance note / Process document covering responsibilities of representatives of reporting entities must be put in place. A clause to this effect should be suitably included as part of the contract(s) entered with them. 4.4.2 Reporting entities shall initiate appropriate actions against defaulting representative of reporting entity who expose the reporting entities to KYC/AML/CFT related risks. 4.4.3 As some reporting entities are allowed to engage the services of individuals like Retirement Advisers and pension agents for facilitating the distribution of pension schemes, thus the engagement process of such individuals shall be monitored scrupulously in view of set KYC/AML/CFT measures. Regulation 44 (2) of PFRDA (PoP) Regulations, 2018 as amended, specifies that “A point of presence shall be liable for any acts of omission or commission, by the pension agents in discharge of its functions, arising out of such engagement, including compliance with KYC and AML norms prescribed under Prevention of Money Laundering Act, 2002, monitoring and supervising their activities, imparting training on pension schemes to them.” 4.4.4 Financial groups shall be required to implement following group-wide programmes against ML/TF, which should be applicable, and appropriate to, all branches and majority- owned subsidiaries of the financial group: a. Policies and procedures for sharing information required for the purposes of Client Due Diligence and ML/TF risk management; b. The provision, at group-level compliance, audit, and/or AML/CFT functions, of customer, account, and transaction information from branches and subsidiaries when necessary for AML/CFT purposes. This should include information and analysis of transactions or activities which appear unusual (if such analysis was done). Similarly branches and subsidiaries should receive such information from these group-level functions when relevant and appropriate to risk management; and c. Adequate safeguards on the confidentiality and use of information exchanged, including safeguards to prevent tipping-off[b] 4.4.5 The overseas branches of the reporting entity to conduct client due diligence /AML standard for the subscribers specified by the PFRDA for the pension scheme regulated/administered by PFRDA. If the host country does not permit implementation of these guidelines, reporting entity should apply appropriate additional measures toPage 9 of 25 manage the money laundering and terrorist financing risks, and inform the same to PFRDA[b]. 4.5 Certificate of Compliance: Reporting entities shall adhere to these guidelines and submit certificate of compliance with respect to KYC/AML/CFT as provided in Annexure1 along with submission of Annual Compliance Certificate i.e., till 31st October of succeeding Financial Year. 5 Appointment of a Designated Director and a Principal Officer 5.1 A “Designated Director”, who has to ensure overall compliance with the obligations imposed under chapter IV of the PML Act and the PML Rules, shall be appointed or designated by the reporting entities. 5.2 A “Principal Officer” (PO) at a senior management level shall be appointed to ensure compliance with the obligations imposed under chapter IV of the PML Act and the PML Rules. 5.3 The contact details (including mobile number, email ID and business address) of the Designated Director and the Principal Officer shall be submitted within 30 days from the date of issuance of these guidelines to Pension Fund Regulatory and Development Authority (PFRDA) and FIU-IND. Any changes thereon shall be communicated to PFRDA and FIU-IND within 30 days of its effect. Provided further that any entity (falling under the definition of RE) shall at the time of making application for fresh registration, submit the details as mentioned above. 5.4 In terms of Section 13 of the PML Act, the Director, FIU-IND can take appropriate action, including imposing a monetary penalty on reporting entities or its Designated Director or any of its employees for failure to comply with any of its KYC/AML/CFT obligations. 6 Recruitment and Training 6.1 Adequate screening mechanism as an integral part of their personnel recruitment/hiring process shall be put in place. 6.2 On-going training programme shall be put in place so that the members / staff are adequately trained in KYC/AML/CFT policy. The focus of the training shall be different for frontline staff, compliance staff, staff dealing with new subscribers. The frontline staff shall be specially trained to handle issues arising from lack of subscriber education. Proper staffing of the audit function with persons adequately trained and well-versed in KYC/AML/CFT policies of the reporting entities, guidelines and related issues shall be ensured. 7 [9] Process of Internal Control/Audit Internal audit/inspection department of reporting entities or the external auditor appointed by RE shall periodically verify compliance with the extant policies, procedures and controls related to money laundering activities on the basis of overall risk assessment. Reporting entities shall also upgrade its questionnaire and system from time-to-time in accordance with the extant PML Act and PML Rules. The reports should specifically [9] Amended previous text as that read as “Internal Control/Audit”Page 10 of 25 comment on the robustness of the internal policies and processes in this regard and make constructive suggestions where necessary, to strengthen the policy and implementation aspects. Reporting entities shall submit audit notes and compliance to the Audit Committee and in its absence directly to the Board or equivalent authority of the RE. 8 Know Your Customer (KYC) Norms 8.1 KYC Norms 8.1.1 Reporting entities should make best efforts to determine the true identity of subscriber(s). 8.1.2 No reporting entity shall allow the opening of or keep any anonymous account or account in fictitious names or open account of any person whose identity has not been disclosed or cannot be verified. Effective procedures should be put in place to obtain requisite details for proper identification of new/ existing subscriber(s). 8.1.3 Reporting entities shall verify the identity, address and recent photograph in compliance with provision as specified in PML Rules. 8.1.4 At any point of time, where reporting entities are no longer satisfied about the true identity and the transaction made by the subscriber, a Suspicious Transaction Report (STR) should be filed with Financial Intelligence Unit-India (FIU-IND), if it is satisfied that the transaction meets the criteria specified in sub clause (g) of clause (1) of Rule 2 of the PML Rules and guidelines / indicators issued by FIU-IND or PFRDA. It is imperative to identify and report cases where contribution is disproportionate to income. 8.2 Modes of KYC 8.2.1 [10] Reporting entities may perform KYC process for all subscribers including Persons with Disabilities by any of the following methods. 8.2.1.1 Using unique CKYC identifier: RE may perform the KYC process preferably by using the unique CKYC identifier in both physical and digital modes with an explicit consent to download records from CKYCR, in order to avoid collection of KYC documents repeatedly; Or 8.2.1.2 Physical / Face-to-Face Verification: KYC process may be performed by obtaining CKYC identifier and in case, if the same is not available, the RE through its authorized officer may perform the KYC process by verifying original OVDs and maintaining a copy of the same as 'original seen and verified’; Or 8.2.1.3 [11] Aadhaar based KYC, subject to notification by the Government under section 11A of PML Act: (i). OTP based e-KYC authentication or Biometric e-KYC (fingerprint/IRIS/face) authentication; (including use of e-KYC Setu System[e]) (ii). Aadhaar offline XML/Aadhaar QR code; Or 8.2.1.4 [12] Digital KYC as per PML rules that involves capturing a live photograph of the subscribers, a digital image of an officially valid document (OVD), and geo-coordinates of the captured location, all recorded electronically by an authorized official. This method is deemed equivalent to in-person/face to face verification for client due diligence purposes.; Or Note: For conducting OTP based face-to-face digital KYC process, either RE official or the subscriber shall confirm that the KYC has been carried out through a face-to-face mode. [10] Amended the previous text that read as Reporting entities may perform KYC process by any of the following methods [11] Amended the previous text that read as “Aadhaar based KYC through Online Authentication subject to notification by the Government under section 11A of PML Act; Or [12] Amended the previous text that read as “Digital KYC as per PML Rules; Or”Page 11 of 25 8.2.1.5 [13] Video Based Customer Identification Process (VCIP) as consent based alternate method of establishing the subscriber’s identity using an equivalent e-document of any officially valid document (the reporting entity shall verify the digital signature as per the provisions of the Information Technology Act, 2000 (21 of 2000) and any rules issues thereunder and take a live photo as specified in Annexure I of PML Rules and the VCIP process for various activities under NPS as has been laid down by PFRDA vide circular no. PFRDA/2020/46/SUP-CRA/18 dated 6th October 2020 (Annexure 2). The following are the modes in VCIP: (i) Assisted VCIP with Human Officer Review: An official of the RE conducts a live video call with the subscriber to verify their identity. The official guides the subscriber through the process, ensuring real-time interaction and document verification. (ii) Unassisted VCIP (Self-Service Video KYC): The subscriber completes the KYC process independently via a secure video-based platform or app, without direct human interaction, using automated systems for verification. (iii) Hybrid VCIP (Combination of Assisted and Automated Verification): Combines elements of assisted and unassisted VCIP, where automated systems handle initial verification, and a human officer intervenes for final review or complex cases. Further, the facility of online / digital / Video Based Customer Identification Process also to be extended to persons with disability by adopting accessibility standards. On request of the subscriber, the RE shall extend their assistance for video capturing in live environment to facilitate online /Video for persons with disability. For the purpose of ‘liveliness’ check, intermediaries may use various parameters which not only involves checking the movement of eyelid and eyeball or blinking, but also may use other factors viz live facial expressions, nodding of head, subscriber showing OTP while being clearly visible on-screen, real-time video recording and displaying copies of documents on the screen etc. Where a subscriber is unable to perform OTP-based or expression-based checks, the RE shall provide alternative authentication methods, such as: (i) Document-based OVD verification with live photo capture. (ii) Use of CKYCR/UIDAI/DigiLocker records for identity confirmation. The liveliness check shall not result in exclusion of person with special needs and at the same time the accessibility options shall not dilute liveness/integrity checks under PML Rules.; Or 8.2.1.6 By “using Digilocker” as prescribed by the PFRDA vide circular no. PFRDA/2021/5/PDES/5 dated 3rd February 2021 (Annexure 3); Or 8.2.1.7 [14] [***]; 8.2.1.8 Where the subscriber is an existing customer of the bank, acting as PoP, the KYC records maintained in the bank’s core banking system (CBS) may be used for NPS onboarding, provided that such records are originally obtained in compliance to the Prevention of Money Laundering Act (PMLA), and the extant Master Directions of RBI as amended from time to time. PoPs shall ensure that such KYC records are valid, updated, fall within the prescribed periodic updation cycle, and meet the requirements applicable for opening an NPS account under these guidelines. Further, PoP shall require the subscriber to re-confirm the correctness and [13] Amended the previous text that read as Video Based Customer Identification Process (VCIP) as consent based alternate method of establishing the subscriber’s identity using an equivalent e-document of any officially valid document (the reporting entity shall verify the digital signature as per the provisions of the Information Technology Act, 2000 (21 of 2000) and any rules issues thereunder and take a live photo as specified in Annexure I of PML Rules and the VCIP process for various activities under NPS as has been laid down by PFRDA vide circular no. PFRDA/2020/46/SUP-CRA/18 dated 6th October 2020 (Annexure 2); Or [14] Deleted: Prior to deletion it read as “By using certified copy of an 'officially valid document' containing details of the identity and address, recent photograph and such other documents including financial status of the subscribers AND PAN/Form 60 (wherever applicable) and any other documents as may be requiredPage 12 of 25 completeness of such KYC information through OTP based authentication. PoPs shall maintain audit trail including consent records and make them available to the relevant authorities during inspection.; Or 8.2.1.9 For the purpose of KYC, PoPs may also rely on third party KYC related to the subscribers as mentioned under section 12 of these guidelines. Note: The PoPs shall establish a mechanism for human review of rejected KYC applications in cases where accessibility-related challenges prevent successful verification. No application for onboarding or periodic updation of KYC for persons with disabilities shall be rejected without application of mind. Reason(s) of rejection shall be duly recorded by the officer concerned. 8.3 Officially Valid Documents (OVDs): 8.3.1 All REs shall comply with the Officially Valid Documents (OVDs) as specified under Rule 2(1)(d) of the PMLA, as amended from time to time, which are as follows: 8.3.1.1 officially valid document” means the passport, the driving licence, proof of possession of Aadhaar number, the Voter’s Identity Card issued by the Election Commission of India, job card issued by NREGA duly signed by an officer of the State Government, the letter issued by the Unique Identification Authority of India or the National Population Register] containing details of name, address and Aadhaar number or any other document as notified by the Central Government in consultation with the Regulator; (a). Where the OVD furnished by the subscriber does not have updated address, the following documents or the equivalent e-documents thereof shall be deemed to be OVDs for the limited purpose of proof of address: (i) utility bill which is not more than two months old of any service provider (electricity, telephone, post-paid mobile phone, piped gas, Water bill); (ii) property or Municipal tax receipt; (iii) bank account or Post Office savings bank account statement/passbook (iv) pension or family pension payment orders (PPOs) issued to retired employees by Government Departments or Public Sector Undertakings, if they contain the address; (v) letter of allotment of accommodation from employer issued by State or Central Government departments, statutory or regulatory bodies, public sector undertakings, scheduled commercial banks, financial institutions and listed companies and leave and license agreements with such employers allotting official accommodation. (b). The subscriber shall submit OVD with current address within a period of three months of submitting the documents specified at ‘a’ above. 8.4 Client Due Diligence (CDD) Reporting entity shall undertake CDD as per the provisions of Rule 9 of PML Rules. Accordingly, the reporting entities shall undertake CDD as follows: 8.4.1 Knowing new subscriber [15] In case of every new subscriber including persons with disabilities, necessary client due diligence with valid KYC of the subscriber shall be done at the time of commencement of account-based relationship, such that the information or data collected under client due diligence is kept up-to-date and relevant, particularly for high risk subscribers[b] In reference to the point no. 8.2 above, REs shall avoid collection of [15] Amended the previous text that read as “In case of every new subscriber, necessary client due diligence with valid KYC documents of the subscriber shall be done at the time of commencement of account-based relationship/ client-based relationship, such that the information or data collected under client due diligence is kept up-to-date and relevant, particularly for high-risk clients[b]”Page 13 of 25 KYC documents repeatedly from subscribers including persons with disabilities during subscriber for onboarding and to use the CKYCR unique number as the primary reference for establishing an account-based relationship. Further, REs shall ensure the reporting requirements under the Foreign Account Tax Compliance Act (FATCA) and Common Reporting Standards (CRS) as amended by RBI from time to time. Accordingly, REs shall develop and implement a mechanism where subscribers who have already completed their KYC process with one regulated entity may authorize the sharing of their KYC information with other entities through the Central KYC Registry (CKYC). Further, with respect to person with disabilities, the following may be referred: 8.4.1.1 Establishing an account-based relationship can be performed in the name of persons with disabilities. 8.4.1.2 Every person who has attained the age of eighteen years is considered as major. Only a major, who is of sound mind and is not disqualified from contracting by law is competent to enter into contract. In accordance with the provisions of the Mental Health Care Act, 2017 and the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999, if the individual would require a guardian, the intermediary may rely upon the Guardianship Certificate issued by the Local Level Committee under the National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation and Multiple Disabilities Act, 1999. 8.4.1.3 If a person with disability is unable to sign for himself / herself, the account can be opened with his/her thumb impression or with the signature of the guardian. While during the digital KYC process, the digital thumb impression of the subscriber can also be accepted. 8.4.1.4 The guardian and person with disability have to comply with the applicable KYC norms. 8.4.1.5 The persons with disability may be classified as minor or major based on their age. Every person who has attained the age of eighteen years is considered as major and only a major, who is of sound mind and is not disqualified from contracting by any law is competent to enter into contract. 8.4.1.6 The facility of all forms of permitted KYC can be extended to persons with disability by adopting accessibility standards. On request of the subscriber, the intermediary should extend their assistance for video capturing in live environment to facilitate online /video to persons with disability. 8.4.1.7 The REs shall establish dedicated helplines for persons with disabilities, offering step-by-step assistance in completing the KYC process through voice or video support. 8.4.1.8 REs shall adhere to the following for compliance with Rule 9(1E) of the PML Rules, which states that the RE that has last uploaded the subscriber’s KYC records to CKYCR shall be responsible for verifying Customer Identification Procedures (CIP), including identity and address. Downloaded records by other REs shall not require re- verification of authenticity, provided they are current and compliant with PML Rules. Beyond identity/address, REs downloading and relying on CKYCR records remain ultimately responsible for maintaining the customer's economic profile, conducting risk assessment, and assigning risk categorization to ensure comprehensive CDD/EDD compliance as mentioned under section 8.4 of these guidelines.Page 14 of 25 8.4.2 Knowing existing subscribers 8.4.2.1 [16] The AML/ CFT requirements are applicable for all the existing subscribers including persons with disabilities. Hence, necessary CDD with KYC (as per extant PML Rules) shall be done for the existing subscribers from time-to-time on the basis of the adequacy of the data previously obtained. 8.4.2.2 [17] Risk categorization shall be undertaken based on parameters tabulated below, besides others like subscriber’s identity, nature of employment, high value deposits in Tier II account / in Tier I account near superannuation, unusual withdrawals in Tier II account etc. While considering subscriber’s identity, the ability to confirm identity documents through online or other services offered by issuing authorities may also be factored in. RE shall ensure enhanced due diligence (EDD) for Tier II accounts under NPS All Citizen/Corporate model. 8.4.2.3 For the purpose of risk categorization, individuals whose identities and source of income can be easily identified and transactions in whose pension accounts by and large conform to the known profile may be categorized as low-risk. For low-risk subscribers the PRAN account may require only the basic requirements like verifying the identity, current address, annual income and sources of fund of the subscriber are to be met. Notwithstanding the above, in case of continuing relationship, if the situation warrants, as for examples if the subscriber’s profile is inconsistent with the investment through subsequent contributions, a re-look on subscribers’ profile is to be carried out. 8.4.2.4 For the high-risk profiles, like for subscribers who are non - residents, high net worth individuals, politically exposed persons (PEPs), and those with adverse reputation as per available public information who need higher due diligence, KYC procedures should ensure higher verification and counter checks. 8.4.2.5. [18] Accordingly, periodic updation of KYC of NPS/NPS-Lite or any other schemes as approved by PFRDA from time to time shall be done as follows: Low-Risk-where periodic Medium-Risk-where High-Risk-where periodic updation of KYC is done once periodic updation of KYC is updation of KYC is done in every ten years from the done once in every Eight once in every two years date of opening of the account years from the date of from the date of opening of / last KYC updation opening of the account / last the account / last KYC KYC updation updation Salaried Employees or Other Salaried Employees; Politically Exposed pensioners of Persons (PEP) or Related Govt/PSUs/Listed Companies; Business person; to PEP; Self-employed, including Professionals; High-net worth individuals Individuals engaged in Agri, (HNI); Allied and MSMEs; Non-Resident Individuals (NRI); Minors/Student/Homemakers; Others (not specified elsewhere); Note: Above list is indicative and not exhaustive. RE may consider additional factors using its own judgement and past experience. [16] Amended the previous text that read as “The AML/ CFT requirements are applicable for all the existing subscribers. Hence, necessary CDD with KYC (as per extant PML Rules) shall be done for the existing subscribers from time-to-time on the basis of the adequacy of the data previously obtained. Further, periodic updation of KYC of NPS account shall be done as follows: [17] Amended the previous text that read as “Risk categorization shall be undertaken based on parameters detailed at clause 9.1 and 9.2 besides others like subscriber’s identity, nature of employment, high value deposits in Tier II account / in Tier I account near superannuation, unusual withdrawals in Tier II account etc. While considering subscriber’s identity, the ability to confirm identity documents through online or other services offered by issuing authorities may also be factored in. RE shall ensure enhanced due diligence (EDD) for NPS Tier II account (except accounts under NPS Tier II Tax Saver Scheme)”Page 15 of 25 8.4.3 Provisions for KYC updation: 8.4.3.1 At the time of withdrawal or exit from the NPS Tier I account under the All-Citizen/ Corporate Model or NPS Lite, or any other scheme as may be approved by PFRDA from time to time, the RE shall be mandatorily required to do the KYC afresh, irrespective of its updation status. 8.4.3.2 All modes of KYC as permitted for on-boarding of new subscriber, shall be applicable for such updation. 8.4.3.3 Policy in this regard shall be documented as part of REs’ internal KYC policy duly approved by the Board of Directors of REs or any committee of the Board to which power has been delegated. 8.4.3.4 In case of no change in the KYC information, a self-declaration from the subscriber shall be obtained through subscriber’s email-id / mobile number registered with the RE, letter and other means of communication as prescribed time to time. This is permitted only in case of periodic updation of KYC and not at the time of exit or withdrawal from the All-Citizen /Corporate Model. 8.4.3.5 With respect to the periodic updation or re-KYC, if there is a change only in address details of the subscriber, the RE shall preferably obtain a CKYC identifier for updating the address and in case if the same is not available or updated, the RE may obtain a valid OVD depicting the changed address within the timelines as prescribed in the PML rules. 8.4.3.6 Client Due Diligence (CDD)/periodic updation can also be done using the video- based KYC process or the “V-CIP” procedure for all subscribers including persons with disabilities, in accordance with the provisions of the MD on KYC, 2016, wherein blinking of the eyes is not a mandatory requirement. For the purpose of ‘liveliness’ check, intermediaries may use various parameters which not only involves checking the movement of eyelid and eyeball or blinking, but also may use other factors viz. live facial expressions, nodding of head, subscriber showing OTP while being clearly visible on- screen, real-time video recording and displaying copies of documents on the screen etc. The liveness check shall not result in exclusion of person with special needs. 8.4.3.7 During re-KYC of all indicated accounts becoming due for such activity either due to change in the risk category or periodic updation as per the specified frequency, the RE must obtain CKYC identifier for updating the recent photo and signature and in case if the same is not available or updated, the RE may obtain the recent photo and signature in physical or digital modes. 8.4.3.8 In respect of accounts categorized as low risk, the RE shall allow all transactions and ensure the updation of KYC within one year of its falling due for re-KYC. The RE shall subject accounts of such subscribers to regular monitoring. This shall also be applicable to low-risk accounts for whom periodic updation of KYC has already fallen due. Failure to complete the KYC process within the prescribed timelines shall result in freezing of service requests related to change in investment pattern or pension funds, as well as freezing of partial withdrawal and exit facilities. 8.4.3.9 In respect of accounts categorized as medium risk, the RE shall allow all transactions and ensure the updation of KYC within six months of its falling due for re- [18] Amended the previous text that read as “Further, periodic updation of KYC of NPS account shall be done as follows: a. In case of NPS Tier II accounts (excluding Tier II Tax Saver Scheme) - Every 3 years. b. In case of Tier II account, where subscriber is Politically Exposed Person (PEP) – Every 2 years. c. At the time of exit of the subscriber from NPS Tier I account. d. Whenever there is upward revision in the risk profile of the subscriber. e. As and when there are revision or changes in PML Act / PML Rules.Page 16 of 25 KYC. The RE shall subject accounts of such subscribers to regular monitoring. This shall also be applicable to medium risk accounts for whom periodic updation of KYC has already fallen due. Failure to complete the KYC process within the prescribed timelines shall result in freezing of service requests related to change in investment pattern or pension funds, as well as freezing of partial withdrawal and exit facilities. 8.4.3.10 With respect to all high-risk accounts, failure to complete the KYC process within the prescribed timelines shall result in immediate freezing of service requests related to change in investment pattern or pension funds, as well as freezing of partial withdrawal and exit facilities. 8.4.3.11 REs shall ensure that the fields provided by the CRA for recording Risk Category (Low / Medium / High) are duly updated for each account. REs shall also carry out periodic KYC updation and ensure that the risk categorization of each account is appropriately flagged in the system. 8.4.3.12 REs shall update the fields relating to (i) the date of last KYC and (ii) the due date for next re-KYC, as enabled by the CRA. REs shall also ensure initiation and completion of re-KYC before the due date. 8.4.3.13 REs shall review the quarterly reports provided by CRA containing details of accounts due for periodic KYC updation and accounts where there has been a change risk category. REs shall also ensure that the KYC of all such accounts is duly updated in accordance with the applicable guidelines within the prescribed timelines. 8.4.3.14 REs shall ensure that timely intimations are sent to the subscribers as per the risk-based approach and for periodic updation of KYC through SMS/emails/letters. 8.4.3.15 NPS subscriber, shifting from the Government to Private sector, a fresh KYC needs to be undertaken through any of the modes permitted under these guidelines. 8.4.3.16 NPS subscriber, shifting from one RE to another RE, the latter may perform the KYC preferably by using CKYC identifier, in case the same is not available, the KYC process may also be performed by other modes as mentioned in these guidelines. 8.4.4 Ongoing Due Diligence Besides verification of identity of the subscriber at the time of opening of pension account / initial contribution, risk assessment and ongoing due diligence should also be carried out at times when additional/ subsequent contributions are made. Any change which is inconsistent with the normal and expected activity of the subscriber should attract the attention of the reporting entities for further ongoing due diligence processes and action as considered necessary. RE shall consider the following factors, while doing ongoing due diligence: 8.4.4.3 [19] [***] 8.4.4.4 Source of contribution. 8.4.4.5 Mode of contribution (Cash / Online / Cheque / DD/ Card/ employer’s bank account etc) 8.4.4.6 Regularity in the flow of contribution (For eg – Contributions under employer and employee relationship) [19] Deleted the previous text that read as “Reporting entity shall identify the source of contribution and ensure that the contribution is being done through the subscriber’s source of funds [20] Amended the previous text that read as “Withdrawals under Tier I and Tier II account”Page 17 of 25 8.4.4.7 [20] Withdrawals under NPS Tier I and Tier II account under All Citizen Model/Corporate Model or any other scheme as may be approved by PFRDA from time to time. 8.4.4.8 Residence status of subscriber (For eg – Subscribers residing in jurisdiction with higher national risk assessment) 8.4.4.9 [21] [***] 8.4.4.10 Contributions made by the subscriber vis-à-vis the declared income/ income range. 8.4.4.11 Verification at the time of exit (superannuation /premature exit / death etc.) a. No payments should be made to third parties on attainment of superannuation except payments to nominee(s)/ legal heir(s) in case of death. b. Necessary due diligence of the subscriber(s) / nominee(s) / legal heir(s) should be carried out before making the pay-outs/settling claims. 8.4.4.12 Where Reporting Entity (RE) forms a suspicion of money laundering or terrorist financing, and it reasonably believes that performing the Client Due Diligence (CDD) process will tip-off the subscriber, it shall not pursue the CDD process, and instead file Suspicious Transaction Report (STR) with FIU-IND.[c] 8.4.4.13 Reporting entities are required to ensure that no vulnerable cases go undetected, especially, where there is suspicion of money- laundering or terrorist financing, or where there are factors to indicate a higher risk, STR should be filed with FIU- IND, if necessary and enhanced due diligence (EDD) would be conducted, consistent with the risks identified. In this regard, client due diligence, 8.4.5 Enhanced Due Diligence 8.4.5.3 Enhanced Due Diligence as mentioned in Section 12AA of PML Act shall be conducted for high-risk categories of subscribers. 8.4.5.4 Reporting entities should examine, as far as reasonably possible, unusual patterns of transactions, which have no apparent economic or lawful purpose. Where the risks of money laundering or terrorist financing are higher, reporting entities should be required to conduct enhanced due diligence measures, consistent with the risks identified. 8.4.5.5 Reporting entities shall a. [22] Verify the identity of the subscriber preferably using CKYC identifier or Aadhaar, subject to the consent of subscriber or; b. Verify the subscriber through other modes/ methods of KYC as specified through circulars / guidelines issued by the Authority from time to time. 8.4.5.4 Reporting entities shall examine the ownership and financial position, including subscriber’s source of funds commensurate with the assessed risk of subscriber and his/her profile. 9 [23] ML/TF Risk Assessment 9.1 [24] [***] 9.2 Reporting entities have to carry out ML and TF Risk Assessment exercise as [21] Deleted the previous text that read as “Politically Exposed Person” [22] Amended the previous text that read as “Verify the identity of the subscriber preferably using Aadhaar, subject to the consent of subscriber or [23] Amended the previous text that read as “Risk Assessment and Risk Categorisation”Page 18 of 25 provided in sub rule (13) of Rule 9 of PML Rules based on risk exposure, to identify, assess, document and take effective measures to mitigate its ML and TF risk for subscribers or specific geographic areas, products, services, nature and volume of transactions or delivery channels etc. While assessing the ML/TF risk, the reporting entities are required to take cognizance of the overall sector specific and country specific vulnerabilities, if any, that the Government of India / PFRDA may share with reporting entities from time to time. Further, the internal risk assessment carried out by reporting entities should be commensurate to their size, geographical presence, complexity or activities/ structure etc. 9.2 The documented risk assessment shall be updated from time to time. The reporting entities shall consider all the relevant risk factors before determining the level of overall risk and the appropriate level and type of mitigation to be applied. It shall be made available to competent authorities and law- enforcement agencies, as and when required. 9.3 Risk assessment for New Business Practices/Developments: 9.3.1 Reporting Entities shall pay special attention to money laundering threats that may arise from a) New business practices including new delivery mechanisms b) Use of new or developing technologies for the pension schemes regulated/administered by the PFRDA 9.3.2 Reporting Entities shall undertake the above risk assessment exercise, prior to the use of such practices and technologies and shall take appropriate measures to manage and mitigate the risks. [b] 10 Simplified Due Diligence (SDD) 10.1 Simplified measures as provided under clause (d) of sub-rule (1) of Rule 2 of PML Rules are to be applied by the reporting entities in case of accounts opened under APY, (being fixed and low contribution pension scheme) where the account is classified as Low Risk. [25] [***] 10.2 The list of simplified due diligence documents are specified in clause (d) of sub-rule (1) of Rule 2 of the PML Rules. 11 [26] Sharing and Updating KYC information with Central KYC Registry (CKYCR) [24] Deleted: Prior to deletion it read as “9.1 While assessing the subscriber`s risk profile under pensions schemes regulated / administered by PFRDA, RE may inter-alia take into account the following: 9.1.1 Whether contributions are mandatory contribution viz Employees of central / state government / autonomous bodies / public sector undertakings covered under NPS (These accounts would generally involve lower risk) 9.1.2 Whether contributions are voluntary and low-contribution: APY being fixed and low contribution pension scheme and NPS Lite being low contribution pension scheme (These accounts generally involve lower risk) 9.1.3 Contributions towards NPS Tier I account on a voluntary basis (These accounts generally involve moderate risk) 9.1.4 Voluntary contributions towards NPS Tier II account, which is a withdrawable account (These accounts involve generally higher risk in comparison to other categories) 9.2 Notwithstanding anything contained in 9.1 above, while assessing the subscriber’s risk profile, RE shall consider the following factors: 9.2.1 Nature of account (For eg - NPS Tier I, NPS Tier II, NPS Tier II Tax Saver Scheme, NPS Lite, APY and any other scheme regulated/administered by PFRDA) [25] Deleted: Prior to deletion it read as “However, Simplified Client Due Diligence measures are not acceptable whenever there is a suspicion of money laundering or terrorist financing or where specific high-risk scenarios apply, based on the Risk Assessment/categorization policy of the reporting entities.Page 19 of 25 11.1 Government of India has notified the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI), to act as, and to perform the functions of the CKYCR vide Gazette Notification No. S.O. 3183(E) dated November 26, 2015. 11.2 The Reporting entities are required to perform the CKYCR related functions such as filing, retrieval, and utilisation of the KYC records with the Central KYC Records Registry or any other matter in connection with or incidental thereto, in the manner as prescribed under the PML Rules. For the purpose of performing such functions the REs are required to get registered with CERSAI. Presently, under the NPS architecture the Reporting Entities registered under Regulation 3(1) of Pension Fund Regulatory and Development Authority (Point of Presence) Regulations, 2018 as amended shall register themselves with CERSAI. Further, REs already registered with CERSAI under another financial sector regulator may not be required to register themselves with CERSAI again, and may use such existing registration with CERSAI, for the purposes of fulfilling the obligations under the PFRDA Act and Regulations and these guidelines. 11.3 [27]For the purpose of verification of identity of a subscriber (Section 8.4) or on-going due diligence (Section 8.4.4), the reporting entity shall seek the KYC Identifier from the subscriber or retrieve the KYC Identifier on subscriber’s consent, if available, from the Central KYC Records Registry and proceed to obtain KYC records online by using such KYC Identifier and shall not require a subscriber to submit the same KYC records or information or any other additional identification documents or details, unless - a) there is a change in the information of the subscriber as existing in the records of Central KYC Records Registry; or b) the KYC record or information retrieved is incomplete or is not as per the current applicable KYC norms prescribed by the Authority; or c) the validity period of the downloaded documents has lapsed; or d) the reporting entity considers it necessary in order to verify the identity or address (including current address) of the subscriber as per these guidelines, or to perform enhanced due diligence or to build an appropriate risk profile of the subscriber. 11.4 A Reporting Entity after obtaining additional or updated information from the subscriber during verification of identity of a subscriber (Section 8.4) or On-going due diligence (Section 8.4.4), within seven (7) days or within such period as may be notified by the Central Government, furnish the updated information to the Central KYC Records Registry which shall update the existing KYC records of the client and the Central KYC Records Registry shall thereafter inform electronically all reporting entities who have dealt with the concerned subscriber regarding updation of KYC record of the said subscriber. 11.4a If any update in the KYC record of an existing subscriber is received by reporting entity from Central KYC Records Registry as per section 11.4, the RE shall retrieve the updated KYC records from the Central KYC Records Registry and shall update the KYC record maintained by the reporting entity. 11.5 If the KYC identifier is not submitted by the subscriber or not available in the CKYCR portal, reporting entities shall capture the KYC information in the manner as prescribed under the PML Rules and as per the KYC Template stipulated for Individuals. The KYC template for ‘individuals’ and the ‘Central KYC Registry Operating Guidelines 2016’ for uploading KYC records on CKYCR finalised by CERSAI are available at www.ckycindia.in [26] Amended the previous text that read as “Sharing and Updating KYC information with Central KYC Registry (CKYCR) [27] Amended the previous text that read as “For the purpose of verification of identity of a client (Para 8.2) or on- going due diligence (Para 8.2.3), the reporting entity shall seek the KYC Identifier from the client or retrieve the KYC Identifier, if available, from the Central KYC Records Registry and proceed to obtain KYC records online by using such KYC Identifier and shall not require a client to submit the same KYC records or information or any other additional identification documents or details, unless-“Page 20 of 25 11.6 Reporting entities shall file the electronic copy of the subscriber’s KYC records with CKYCR within ten (10) days after the commencement of account-based relationship with a subscriber as per the guidelines / instructions / circulars by PFRDA from time to time. 11.7 Once “KYC Identifier” is generated/ allotted by CKYCR, the reporting entities shall ensure that the same is communicated immediately to the respective subscriber in a confidential manner, mentioning its advantage/ use to the subscriber. 11.8 The following details need to be uploaded on CKYCR if Verification / Authentication is being done using Aadhaar: 11.8.1 For online Authentication, a) The redacted Aadhar Number (Last four digits) b) Demographic details c) The fact that Authentication was done 11.8.2 For offline Verification a) KYC data b) Redacted Aadhaar number (Last four digits) 11.9 At the time of periodic updation, it is to be ensured that all existing KYC records of subscriber are incrementally uploaded as per the extant CDD standards. Reporting entities shall upload the updated KYC data pertaining to active pension accounts against which “KYC identifier” are yet to be allotted/generated by the CKYCR. 11.10 [28] Reporting entities shall not use the KYC records of the subscriber obtained from Central KYC Records registry for purposes other than verifying the identity or address of the subscriber and should not transfer KYC records or any information contained therein to any third party as per Rule 9(2) of PML rules unless authorised to do so by the subscriber or PFRDA or by the Director(FIU- IND).Reporting entity shall ensure that in case of accounts that have been opened prior to operationalization of CKYCR, the KYC records are updated in the CKYCR during periodic updation and that the subscriber's accounts are migrated to current Client Due Diligence Standards (CDD). 11.11 Reporting entity shall submit the MIS related to the CKYC data upload/ download etc. to PFRDA as stipulated from time to time. 12. Reliance on third party KYC 12.1 [29] For the purposes of KYC norms under section 8, while reporting entities are ultimately responsible for subscriber due diligence and undertaking enhanced due diligence measures, as applicable, reporting entities may rely on a KYC done by a third party subject to the conditions specified under sub-rule (2) of rule (9) of the PML Rules, provided that such records are originally obtained in compliance to the Prevention of Money Laundering Act (PMLA) 12.2 Reporting entities can utilize the SEBI KRA for KYC in accordance with PFRDA circular PFRDA/2019/16/PDES/2 dated 23rd September 2019 (Annexure 4). 12.3 [30] The ultimate responsibility for relying on third party KYC remains with the REs [28] Amended the previous text that read as “Reporting entities shall not use the KYC records of the subscriber obtained from Central KYC Records registry for purposes other than verifying the identity or address of the subscriber and should not transfer KYC records or any information contained therein to any third party as per Rule 9(1F) of PML rules unless authorised to do so by the subscriber or PFRDA or by the Director (FIUIND). Reporting entity shall ensure that in case of accounts that have been opened prior to operationalisation of CKYCR, the KYC records are updated in the CKYCR during periodic updation and that the subscriber's accounts are migrated to current Customer Due Diligence Standards (CDD) [29] Amended the previous text the read as “For the purposes of KYC norms under para 8, while reporting entities are ultimately responsible for subscriber due diligence and undertaking enhanced due diligence measures, as applicable, reporting entities may rely on a KYC done by a third party subject to the conditions specified under sub- rule (2) of rule (9) of the PML Rules”Page 21 of 25 and RE must immediately obtain OVD copies/KYC records as per the timelines stipulated in PMLA. The RE must verify that the third party has performed Client Due Diligence as per PMLA norms. 13 Pension accounts of Politically Exposed Persons (PEPs) 13.1 It is emphasized that proposals of Politically Exposed Persons (PEPs) in particular requires examination by senior management of RE. 13.2 [31] Reporting entities are directed to lay down appropriate on-going risk management procedures for identifying and applying enhanced due diligence measures on an on- going basis to PEPs and subscribers who are family members, close relatives/associates of PEPs[b]. These measures are also to be applied to pension accounts of which a PEP is the beneficiary. 13.3 If the on-going risk management procedures indicate that the subscriber or beneficiary is found to be PEP or subsequently becomes PEP, the senior management should be informed on this business relationship and apply enhanced due diligence measures on such relationship. 13.4 Reporting entities to take reasonable measures to determine whether the beneficiaries of a pension account are PEPs at the time of the exit, and should ensure the internal controls are in place. The reporting entity that processes exit request should apply risk-based monitoring of such withdrawal to determine if the recipient of the funds is a PEP. 13.5 Reporting entities shall undertake reasonable measures to establish the source of wealth and the source of funds of subscribers identified as PEPs. [b]. 14 Implementation of Section 51A of the Unlawful Activities (Prevention) Act, 1967 (UAPA) 14.1 Section 51A of the Unlawful Activities (Prevention) Act, 1967(UAPA), relating to the purpose of prevention of, and for coping with terrorist activities was brought into effect through UAPA Amendment Act, 2008. In this regard, the Central Government has issued an Order dated 2nd February 2021 detailing the procedure for the implementation of Section 51A of the UAPA. 14.2 The reporting entities should not open pension account of a subscriber whose identity matches with any person in the UN sanction list and those reported to have links with terrorists or terrorist organizations. 14.3 Reporting entities shall periodically check MHA website for updated list of banned individuals. 14.4 Reporting entities shall maintain an updated list of designated individuals in electronic form and run a check on the given parameters on a regular basis to verify whether designated individuals are holding any pension accounts. An updated list of individuals and entities which are subject to various sanction measures as approved by Security Council Committee established pursuant to UNSC 1267 can be accessed regularly from the United Nations website at https://www.un.org/securitycouncil/sanctions/1267/aq_sanctions_list and UNSC 1988 can be accessed regularly from the United Nations website at [30] Amended the previous text that read as “The ultimate responsibility for relying on third party KYC is with the REs” [31] Amended the previous text that read as “Reporting entities are directed to lay down appropriate on-going risk management procedures for identifying and applying enhanced due diligence measures on an on-going basis to PEPs and customers who are family members, close relatives/associates of PEPs[b]. These measures are also to be applied to pension accounts of which a PEP is the beneficiary / nominee.Page 22 of 25 https://www.un.org/securitycouncil/sanctions/1988/materials. 14.5 By virtue of Section 51A of the Unlawful Activities (Prevention) Act, 1967 (UAPA), the Central Government is empowered to freeze, seize or attach funds of and/or prevent entry into or transit through India any individual or entities that are suspected to be engaged in terrorism. [The list is accessible at website http://www.mha.gov.in]. To implement the said section an order reference F. No. 14014/01/2019/CFT dated 2nd February, 2021 has been issued by the Government of India. The salient aspects of the said order with reference to insurance sector would also be applicable to NPS / NPS Lite / APY or any other scheme regulated or administered by PFRDA. 14.6 The list of Nodal Officers for UAPA is available on the website of Ministry of Home Affairs. 14.7 For the purpose of implementation of Section 51A of UAPA, PFRDA vide Circular No. PFRDA/2023/12/REG-POP/04 dated 20.03.2024, has nominated ‘Head of Department of Regulation Contribution Management’ as the UAPA Nodal Officer from PFRDA [d]. 15 Prospects residing in the jurisdiction of countries identified as deficient in AML/CFT regime Reporting entities are required to: 15.1 The Reporting Entity shall specifically apply enhanced due diligence (EDD) measures, proportionate to the risks, to business relationships and transactions with individuals from countries for which this is called for by the FATF. [b] 15.2 Pay special attention to unusual contributions, especially those which do not have apparent economic or visible lawful purpose. In all such cases, the background and purpose of such transactions will as far as possible, have to be examined and written findings have to be maintained for assisting competent authorities. 15.3 Agents / intermediaries / employees to be appropriately informed to ensure compliance with this stipulation. 15.4 [32] Go beyond the FATF statements and consider publicly available information when identifying countries which do not apply, or insufficiently apply the FATF Recommendations. REs shall undertake countermeasures when called upon to do so by any international or intergovernmental organisation of which India is a member and accepted by the Central Government. 15.5 Take similar measures on countries considered as high risk from terrorist financing or money laundering perspective based on prior experiences, transaction history or other factors (e.g., legal considerations, or allegations of official corruption). 16. Reporting Obligations 16.1 NPS being an unbundled architecture where Central Recordkeeping Agency (CRA) maintains the records centrally for all the transactions, CRA is responsible for filing of reports to Director, FIU- IND in accordance with PML Rules. 16.2 [33]In addition to above, every reporting entity should register with Financial Intelligence Unit - India (FIU-IND) and should mention a separate line of business on [32] Amended the previous text that read as “Go beyond the FATF statements and consider publicly available information when identifying countries which do not or insufficiently apply the FATF Recommendations.Page 23 of 25 FINNET 2.0 portal of FIU-IND by selecting PFRDA as a regulator, and shall also furnish to the Director, Financial Intelligence Unit- India (FIU-IND), information referred to in Rule 3 (Maintenance of records of transactions (nature and value)) in terms of Rule 7 (Procedure and manner of furnishing information) of the PML (Maintenance of Records) Rules, 2005. Explanation: In terms of Third Amendment Rules notified in September 22, 2015 regarding amendment to sub rule 3 and 4 of rule 7, Director, FIU- IND shall have powers to issue guidelines to the reporting entities for detecting transactions referred to in various clauses of sub-rule (1) of rule 3, to direct them about the form of furnishing information and to specify the procedure and the manner of furnishing information. 16.3 The reporting formats and comprehensive reporting format guide, prescribed/ released by FIU- IND and Report Generation Utility and Report Validation Utility developed to assist reporting entities in the preparation of prescribed reports shall be taken note of. The editable electronic utilities to file electronic Cash Transaction Reports (CTR) / Suspicious Transaction Reports (STR) which FIU-IND has placed on its website shall be made use of by reporting entities which are yet to install/adopt suitable technological tools for extracting CTR/STR from their live transaction data. The Principal Officers of those reporting entities, whose all branches are not fully computerized, shall have suitable arrangement to cull out the transaction details from branches which are not yet computerized and to feed the data into an electronic file with the help of the editable electronic utilities of CTR/STR as have been made available by FIU-IND on its website http://fiuindia.gov.in. 16.4 Red Flag Indicators issued by FIU-IND also be taken into account for Suspicious Transaction, wherever necessary. 16.5 While furnishing information to the Director, FIU-IND, delay of each day in not reporting a transaction or delay of each day in rectifying a mis-represented transaction beyond the time limit as prescribed in the Rule shall be constituted as a separate violation. Reporting entities shall not put any restriction on operations in the accounts where an STR has been filed. Reporting entities shall keep the fact of furnishing of STR strictly confidential. It shall be ensured that there is no tipping off to the subscriber at any level. Confidentiality requirement does not inhibit information sharing among entities in the group. [b] 16.6 Robust software, throwing alerts when the transactions are inconsistent with risk categorization and updated profile of the subscribers shall be put in to use as a part of effective identification and reporting of suspicious transactions. adoption of automated fraud monitoring, machine learning for anomaly detection, and annual policy reviews addressing technology shifts and new compliance threats 16.7 Reporting entities shall leverage the broadest number of data points / records available with them in implementing alert generation systems to assist in identifying and reporting suspicious activities. 16.8 Reporting entities should not enter into arrangement with any unregulated entity which may have the effect of directly or indirectly impairing any reporting obligations of the reporting entities. [33] Amended the previous text that read as “In addition to above, every reporting entity should register with Financial Intelligence Unit - India (FIU-IND) under the regulator "PFRDA", and shall also furnish to the Director, Financial Intelligence Unit- India (FIU-IND), information referred to in Rule 3 (Maintenance of records of transactions (nature and value)) in terms of Rule 7 (Procedure and manner of furnishing information) of the PML (Maintenance of Records) Rules, 2005Page 24 of 25 17. Record Keeping 17.1 In view of Rule 5 of the PML rules, the reporting entities, its Designated Director, Principal Officer, employees are required to maintain the information/records of types of all transactions [as mentioned under Rules 3 and 4 of PML Rules 2005] as well as those relating to the verification of identity of subscribers for a period of five years. The records referred to in the said Rule 3 shall be maintained for a period of five years from the date of transaction. Records pertaining to all other transactions, (for which reporting entities are obliged to maintain records under other applicable Legislations/Regulations/Rules) reporting entities are directed to retain records as provided in the said Legislation/Regulations/Rules but not less than for a period of five years from the date of end of the business relationship with the subscriber. 17.2 [34] Records can be maintained in electronic form and/or physical form. In cases where services offered by a third-party service provider are utilized, the following may be referred: 17.2.1 Reporting entities shall be satisfied about the organizational capabilities, and that technology, systems and measures are in place to safeguard the privacy of the data maintained and to prevent unauthorized access, alteration, destruction, disclosure or dissemination of records and data. 17.2.2 The physical or electronic access to the premises, facilities, automatic data processing systems, data storage sites and facilities including back-up sites and facilities and to the electronic data communication network of the service provider is controlled, monitored and recorded 17.2.3 The service provider has established standard transmission and encryption formats and non-repudiation safeguards for electronic communication of data. 17.2.4 It should also be ensured that the provisions under the relevant and extant data protection statutes are duly complied with. 17.3 Reporting entities should implement specific procedures for retaining internal records of transactions, to enable them to comply swiftly with information requests from the competent authorities. Such records must be sufficient to permit reconstruction of individual transactions (including the amounts and types of currency involved (if any) so as to provide, if necessary, evidence for prosecution of criminal activity. Reporting entities should retain the records of those accounts, which have been settled by claim, for a period of at least five years after that settlement. 17.4 In situations, where the records relate to ongoing investigations, or transactions which have been the subject of a disclosure, they should be retained until it is confirmed that the case has been closed. Wherever practicable, reporting entities are required to seek and retain relevant identification documents for all such transactions and report such transactions of suspicious funds. 17.5 In case of subscriber identification, data obtained through the subscriber due diligence process, account files and business correspondence should be retained (physically or electronically) for at least five years after the business relationship is ended. 18 Monitoring of Transactions 18.1 Regular monitoring of transactions is vital for ensuring effectiveness of the [34] Amended the previous text that read as “Records can be maintained in electronic form and/or physical form. In cases where services offered by a third-party service provider are utilizedPage 25 of 25 KYC/AML/CFT procedures. This is possible only if the reporting entities have an understanding of the normal activity of the subscriber so that it can identify deviations in transactions/ activities. 18.2 Reporting entities shall pay special attention to all complex large transactions/ patterns which appear to have no economic purpose. The reporting entities may specify internal threshold limits for each class of subscriber accounts and pay special attention to transactions which exceeds these limits. The background including all documents/ office records/ memorandums/ clarifications sought pertaining to such transactions and purpose thereof shall also be examined carefully and findings shall be recorded in writing. Further such findings, records and related documents shall be made available to auditors and also to PFRDA/ FIU-IND/ other relevant Authorities, during audit, inspection or as and when required. These records are required to be maintained and preserved for a period of five years from the date of transaction. 18.3 The Principal Officer of the reporting entities shall monitor and ensure that Suspicious transactions shall be regularly reported to the Director, FIU- IND. 18.4 Further, the compliance cell of reporting entities shall randomly examine a sample of transactions undertaken by subscribers to comment on their nature i.e., whether they are in nature of suspicious transactions or not. 19 Repeal provisions From the date of coming into force of these guidelines, the instructions / guidelines contained in the circular mentioned in the appendix, issued by PFRDA shall stand repealed. 19.1 Notwithstanding anything contained in these guidelines, in case of any issue with respect to interpretation of any provision of these guidelines, the provisions/ directives of the FIU India, the PML Act / the Aadhaar Act / Income Tax Act and their rules as amended from time to time, will prevail. 19.2 The reporting entities are also advised to refer to the extant relevant directives, rules, laws and provisions mentioned therein on a regular basis to broadly understand, apply, update their KYC/AML /CFT programme and implement the provisions of this guideline. Annexures Circular Number and Date Section Subject No. under Part C Annexure 1 NA 4.5 Certificate of Compliance Annexure 2 PFRDA/2020/46/SUP-CRA/18 8.2.1.5 Video based Customer Dated 06.10.2020 Identification process (VCIP) for NPS Annexure 3 PFRDA/2021/05/PDES/05 8.2.1.6 Digilocker for National Dated 03.02.2021 Pension System services Annexure 4 PFRDA/2019/16/PDES/02 12.2 Utilization of SEBI KRAs by Dated 23.09.2019 PoPs for onboarding of subscriber in National Pension System (NPS)Annexure 2Annexure 3PART IV List of circulars consolidated in the Master Circular – Annexure I Sl Subject Circular no Date no Guidelines on Know Your Customer / Anti-Money PFRDA/2023/05/REG- POP/02[b] 12.10.2023 1. Laundering/Combating the Financing of Terrorism (KYC/AML/CFT) 2. PFRDA/2023/5/REG- POP/05[c] --Do-- 07.08.2023 3. PFRDA/2023/22/REG-POP/05[e] Verification of Identity by Reporting Entity under 25.07.2023 sub-section (1) of Section 11A of the Prevention of Money Laundering Act, 2002 4. PFRDA/16/05/112/0018/2020- Guidelines on Know Your Customer / 07.06.2023 REG-POP[a] Anti-Money Laundering / Combating the Financing of Terrorism (KYC/AML/CFT) 5. PFRDA/2023/12/REG-POP/04[d] Designation of Nodal Officer of PFRDA for implementation of Section 51A of 20.03.2023 Unlawful Activities (Prevention) Act, 1967 PFRDA/2023/05/REG-POP/02 Guidelines on Know Your Customer / Anti-Money 23.01.2023 6. Laundering / Combating the Financing of Terrorism (KYC/AML/CFT) 7. PFRDA/2021/05/PDES/05 Digilocker for National Pension System services 03.01.2021 8. PFRDA/2020/46/SUP-CRA/18 Video based Customer Identification Process 06.10.2020 (VCIP) for NPS 9. PFRDA/2019/16/PDES/02 Utilization of SEBI KRAs by PoPs for 23.09.2019 onboarding of subscriber in National Pension System (NPS) List of Circulars Rescinded and Archived in the Master Circular - Annexure II Sl Circular no Subject Date Rescinded no on 1. PFRDA/2021/31/SUP- Central KYC Records Registry 26.07.2021 23.01.2023 POP/4 (CKYCR) 2. PFRDA/2021/11/SUP- Central KYC Records Registry 22.04.2021 23.01.2023 POP/1 (CKYCR) 3. PFRDA/2019/14/PDES/1 Point of Presence (PoP) relying on third 24.07.2019 23.01.2023 party client due diligence (KYC) for onboarding subscribers in NPS 4. PFRDA/8/PoP/122 Operationalization of Central KYC 29.09.2016 22.04.2021 Registry and providing KYC information by Aggregator 5. PFRDA/08/PoP/122 Providing KYC information to Central 14.07.2016 KYC (CKYC) Registry by PoP 22.04.2021 **********************************