KYC/AML risk categorisation of customers

Key Points as per the RBI’s Directions on Risk Management under the KYC and PML Regime

-Anita Baid | Vice President | anita@vinodkothari.com

In line with the Reserve Bank of India’s (RBI) directions on risk management under the Know Your Customer (KYC) norms and Anti-Money Laundering (AML) standards, Non-Banking Financial Companies (NBFCs) are required to categorize their customers into low, medium, and high-risk categories. This risk categorization plays a crucial role in determining the level of due diligence to be undertaken by the NBFC while establishing and maintaining relationships with customers. Here are some key points to consider regarding the risk categorization process for legal entities (corporate borrowers, LLPs, trust, etc.) as well for individual borrowers:

Based on the Customer Profile:

• Income Source: The nature and stability of a customer’s income source are assessed to determine the level of risk associated with it. Customers with a stable and verifiable income source are generally considered lower risk.
• Residential Status: The residential status of a customer, whether they are residents or non-residents, influences the risk categorization. Non-resident customers may have additional regulatory requirements due to potential jurisdictional complexities.
• Geographical Location: The geographical location of a customer, especially if they reside in high-risk jurisdictions, can affect their risk categorization. Certain locations may be prone to money laundering or other financial crimes, requiring enhanced scrutiny.

Based on Financial Factors:

• Net Worth: The customer’s net worth, including assets, liabilities, and overall financial stability, is an important consideration. Higher net worth individuals or entities may be classified as lower risk.
• Legal Structure: For corporate borrowers, the legal structure of the entity is taken into account. Companies with sound legal structures and transparent ownership (identification of beneficial ownership) are typically considered lower risk.
• Turnover: The turnover of a corporate borrower provides insights into its financial performance. Higher turnover may indicate required more monitoring and be considered as a higher risk profile.
• Rating of Corporate Borrowers: If available, credit ratings of corporate borrowers are considered as an additional factor for risk assessment. Higher credit ratings suggest a lower risk level.

Presence of Credit Flags:

• Business Operations: Certain business operations are considered as risky and uncertain, such as dealing in crypto-assets, arms manufacturers/ dealers/ intermediaries; business relating to nuclear proliferation activities/ explosives; dealers in high value or precious goods (e.g jewel, gem/ precious metals dealers, art/ antique dealers and auction houses, estate agents, real estate brokers); ​multi-level marketing companies. Such customers are classified under the high-risk category.           
• Non-face-to-face Customers: Customers who are not physically present during the onboarding process, such as those who open accounts remotely, may pose higher risks due to the limited ability to verify their identity.
• Politically Exposed Persons (PEPs): PEPs are individuals who hold prominent public positions or have close associations with political figures. They are subject to higher scrutiny due to the potential risks associated with money laundering and corruption. In case the customer or Beneficial Owner is a PEP, the monitoring is high and so is the risk profile.

Specified customers falling in the low-risk category

The following customer shall be essentially categorised as ‘low risk’ considering their legal status and regulatory supervision:

• Primary Dealers and Financial Institutions regulated by Reserve Bank of India (RBI),
• Insurance companies regulated by IRDA,
• Mutual Funds and Portfolio Management Services regulated by Securities and Exchange Board of India (SEBI) or any other regulators,
• Listed entities regulated by SEBI and Stock Exchange
• PSUs / PSEs having majority shareholding of either state or central Governments,
• Government departments and Government-owned companies,
• Statutory bodies & Regulators,
• Trusts of Provident Funds, Pension Funds, Gratuity Funds and Superannuation Funds recognized by the Income Tax Department.

NBFCs conduct thorough due diligence, including obtaining appropriate documentation and conducting background checks, to identify and categorize customers based on the factors mentioned above. The risk categorization helps NBFCs determine the extent of ongoing monitoring, transaction limits, and enhanced due diligence required for each customer category.

It is important for NBFCs to maintain robust systems and processes to regularly review and update the risk categorization of their customers, as risk profiles can change over time. By implementing effective risk categorization measures, NBFCs can fulfill regulatory requirements, mitigate potential risks, and contribute to the overall integrity of the financial system.

Illustration

Figure 1 – Illustrative model for Risk categorisation of corporate customers.

The overall risk category is ‘Medium’ as the weighted risk score corresponds to the risk category of ‘Medium’ and none of the credit flags apply.

Figure 2 – Illustrative model for Risk categorisation of individual customers.

The overall risk category is ‘High’ as – although the weighted risk score corresponds to ‘Medium’; the non-face to face flag applies.