CAIIB BRBL KYC, AML & Consumer Protection Laws — Complete Guide
Quick Answer — BRBL Module D
What are the key numbers in CAIIB BRBL KYC, AML and Consumer Protection?
- CTR (Cash Transaction Report): Cash transactions ≥ ₹10 lakh — file with FIU-IND within 15 days from close of that month
- STR (Suspicious Transaction Report): No monetary threshold — file within 7 working days of confirming suspicion; no tipping-off allowed
- Beneficial Ownership: more than 10% in a company or partnership, 10%+ in a trust, more than 15% in an unincorporated association (PMLA Rules, March 2023); listed companies are exempt from BO identification
- Consumer Protection Act 2019 (Jurisdiction Rules, 2021): District ≤ ₹50 lakh; State ₹50 lakh–₹2 crore; National above ₹2 crore
- PMLA 2002 — Section 4 punishment: Imprisonment 3–7 years (up to 10 years for drug-related offences); Section 12: records to be maintained for 5 years
Why KYC/AML and Consumer Protection Anchor BRBL Module D
Every branch banker has opened accounts, asked for KYC documents, and seen Suspicious Transaction alerts. IIBF’s Module D tests whether you can translate that daily practice into the statutory framework behind it — PMLA 2002, RBI’s KYC Master Direction, and the Consumer Protection Act 2019. These are not abstract laws: they govern decisions you make every day at the counter. The exam rewards candidates who can name the Act, cite the section, and apply the threshold correctly under exam conditions.
Module D — What Gets Tested
✓ KYC — CDD, EDD, SDD, Simplified KYC
✓ Risk categorisation (Low / Medium / High)
✓ PMLA 2002 — three stages, key sections
✓ CTR / STR / CCR — thresholds and timelines
✓ FIU-IND — role, reports, tipping-off prohibition
✓ Consumer Protection Act 2019 — forum thresholds
✓ RBI Integrated Ombudsman Scheme 2026 (replaced the 2021 scheme from 1 July 2026)
✓ Beneficial Ownership — 10% / 15% thresholds
KYC Framework — RBI Master Direction on KYC
KYC (Know Your Customer) is the process by which banks identify and verify the identity of their customers and understand the nature of their business. RBI’s Master Direction on KYC (2016, updated regularly) is the primary regulatory document. It operationalises India’s obligations under FATF (Financial Action Task Force) recommendations and the PMLA 2002.
Customer Due Diligence — Three Levels
| Level | When Applied | What It Requires |
|---|---|---|
| SDD Simplified Due Diligence |
Low-risk customers — BSBD accounts, small accounts (balances ≤ ₹50,000; credits ≤ ₹1 lakh/year) | Reduced documentation; self-declaration of address accepted; Aadhaar OTP-based eKYC |
| CDD Customer Due Diligence |
Normal / medium-risk customers — standard account opening | Identity proof, address proof, photo; for legal entities — registration documents, MoA, AoA, UBO identification |
| EDD Enhanced Due Diligence |
High-risk customers — PEPs, non-face-to-face accounts, complex structures, high-value business, FATF high-risk countries | Additional verification, source of funds/wealth documentation, senior management approval, enhanced ongoing monitoring |
Risk Categorisation of Customers
| Risk Category | Customer Type | KYC Update Frequency |
|---|---|---|
| LOW | Salaried employees, pensioners, small deposit holders, agriculturists | Every 10 years |
| MEDIUM | Business entities, SMEs, professionals with moderate transaction volumes | Every 8 years |
| HIGH | PEPs, NRIs, high-net-worth individuals, trusts, NGOs, cash-intensive businesses, offshore entities | Every 2 years |
Exam pattern: Questions often give a customer profile and ask which risk category applies, or give a category and ask the update period. Memorise the 10/8/2 year cycle — it is consistently tested.
Politically Exposed Persons (PEPs)
PEPs — Definition and Treatment
Who qualifies as a PEP? Individuals entrusted with prominent public functions by a foreign country — heads of state, senior politicians, senior government/judicial/military officials, senior executives of state-owned enterprises, important political party officials. Also includes their family members and close associates.
Treatment: Always classified as HIGH RISK — EDD mandatory regardless of transaction amount. Senior management approval required for account opening. Source of wealth and funds must be established.
Indian office-holders: Under the PML Rules and RBI’s KYC Direction (definition clarified 4 January 2024), Indian politicians and officials are not PEPs by definition — there was no amendment adding domestic PEPs. Banks may still rate them high risk under their own risk-based policy.
Beneficial Ownership — The 10% / 15% Rule (since March 2023)
Ultimate Beneficial Owner (UBO) — Identification Thresholds
| Entity Type | Threshold for UBO | What Must Be Identified |
|---|---|---|
| Companies (unlisted) | More than 10% of shares / capital / profits (25% before March 2023) | Natural person(s) who ultimately own or control |
| Listed companies | Exempt from BO identification | Listed companies (and their majority-owned subsidiaries) need not identify BOs — exchange disclosure already provides transparency |
| Partnership firms | More than 10% of capital or profits (15% before March 2023) | All partners with more than 10% entitlement |
| Trusts | Trustee, Settlor, Beneficiaries with 10% or more interest (15% before March 2023) | All identifiable beneficiaries above threshold |
Exam trap: The PMLA Rules amendment of 7 March 2023 cut the company threshold from 25% to more than 10% and the trust/partnership thresholds from 15% to 10%; only unincorporated associations/bodies of individuals stay at more than 15%. Older study material still shows 25%/15% — answer with the current figures. Listed companies are exempt from BO identification altogether.
V-CIP (Video-Based Customer Identification Process)
What it is: Live video interaction between bank official and customer for remote KYC without physical visit.
Applicable to: Resident individuals with Aadhaar and PAN.
Key requirement: Bank must record the video; customer must show original OVDs (Officially Valid Documents) on screen; liveness check required.
Accounts opened via V-CIP: Treated as face-to-face accounts — not subject to limits applicable to non-face-to-face customers.
PMLA 2002 — Prevention of Money Laundering Act
The Prevention of Money Laundering Act 2002 is India’s primary anti-money laundering legislation. It criminalises money laundering, mandates reporting obligations on banks and financial institutions, and empowers the Enforcement Directorate (ED) to attach and confiscate proceeds of crime.
Three Stages of Money Laundering
Money Laundering — Placement → Layering → Integration
1. Placement
Introducing dirty money into the financial system. Cash deposits, purchase of high-value goods for later resale, currency smuggling across borders.
Most vulnerable point for detection — high cash volumes are observable.
2. Layering
Concealing the trail through multiple transactions. Wire transfers through multiple accounts/countries, conversion to other instruments, shell companies.
Most complex stage — creates false paper trails to defeat tracing.
3. Integration
Re-entering funds as legitimate money. Investing in real estate, businesses, luxury assets — now appearing as legal income or gains.
Hardest stage to detect — money appears clean by this point.
PMLA 2002 — Key Sections
| Section | Provision |
|---|---|
| Sec 2 | Definitions — “Money Laundering”, “Proceeds of Crime”, “Reporting Entity”, “Attachment” |
| Sec 3 ★ | Offence of Money Laundering — directly or indirectly dealing with proceeds of crime |
| Sec 4 ★ | Punishment — Rigorous Imprisonment 3 to 7 years + fine (up to 10 years for Schedule 1 offences — drugs) |
| Sec 8 | Adjudication — Attachment and Confiscation of proceeds of crime |
| Sec 12 ★ | Reporting entities must maintain records for 5 years from date of transaction |
| Sec 12A ★ | Access to information — reporting entity must furnish information to Director, FIU-IND |
| Sec 13 | Director, FIU-IND has power to inspect reporting entities |
| Sec 17 | ED’s power to search and seize documents / assets |
| Sec 50 | ED has powers of a civil court to summon persons and compel production of records |
Transaction Reports — What, When, and to Whom
PMLA Reporting Obligations — Banks as Reporting Entities
| Report Type | Trigger | Threshold | Timeline | Recipient |
|---|---|---|---|---|
| CTR Cash Transaction Report |
Cash transactions (deposits/withdrawals) in a month; also linked transactions | ≥ ₹10 lakh | Within 15 days from close of month | FIU-IND |
| STR Suspicious Transaction Report |
Any transaction — regardless of amount — that raises suspicion of money laundering or terrorist financing | NO threshold | Within 7 working days of confirming suspicion | FIU-IND (via Principal Officer) |
| CCR Counterfeit Currency Report |
Receipt of counterfeit currency notes of any denomination | Any amount | Within 15 days from close of month | FIU-IND |
| NTR Non-Profit Org Transaction Report |
Cash transactions by/with registered NGOs, trusts, Section 8 companies | ≥ ₹10 lakh | Within 15 days from close of month | FIU-IND |
| Cross-border Wire Transfer Report | International wire transfers, both incoming and outgoing | ≥ USD 1,000 (or equivalent) | Within 15 days from close of month | FIU-IND |
Tipping-Off Prohibition — Critical Rule
Once a bank has filed or decided to file an STR, it must not inform the customer (the subject of the report) or any third party that a report has been or will be made. This is called “tipping-off” and is a criminal offence under PMLA.
Bank staff must not: Warn the account holder, freeze the account without legal order (which would alert the customer), or discuss the STR with anyone not authorised to know.
Exam scenario: “A customer asks the branch manager if a report has been filed about their account. The manager should ___.” → Decline to confirm or deny; must not tip off.
FIU-IND — Financial Intelligence Unit India
Established: November 2004 under Ministry of Finance
Function: Central national agency to receive, process, analyse, and disseminate information relating to suspect financial transactions
Receives: CTR, STR, CCR, NTR, and cross-border wire transfer reports from reporting entities (banks, financial institutions, intermediaries)
Disseminates to: Intelligence and law enforcement agencies (CBI, ED, Income Tax, CEIB, RAW, IB)
Reporting entities must designate: A Principal Officer at sufficiently senior level who is responsible for timely and accurate STR/CTR filing
Not an investigative agency: FIU-IND analyses and shares intelligence — actual investigation is done by ED (PMLA), CBI, or other agencies
Consumer Protection Act 2019
The Consumer Protection Act 2019 replaced the 1986 Act with significantly expanded jurisdiction thresholds, a new Central Consumer Protection Authority (CCPA), e-commerce coverage, and product liability provisions. Banking is explicitly a “service” under the Act — deficiency in banking service is a ground for consumer complaint. Every bank officer should understand the jurisdiction thresholds because they determine which court a banking customer can approach.
Consumer Dispute Redressal Forums — Jurisdiction
| Forum | Pecuniary Jurisdiction (2019 Act) | Where Located | Appeal Goes To |
|---|---|---|---|
| DCDRC District Commission |
Up to ₹50 lakh | District headquarters | SCDRC (State Commission) |
| SCDRC State Commission |
₹50 lakh to ₹2 crore | State capital | NCDRC (National Commission) |
| NCDRC National Commission |
Above ₹2 crore | New Delhi | Supreme Court of India |
Old vs New thresholds (exam trap): Under the 1986 Act, District had up to ₹20 lakh and State up to ₹1 crore. The 2019 Act first raised these to ₹1 crore / ₹10 crore, but the Consumer Protection (Jurisdiction) Rules, 2021 (in force from 30 December 2021) revised them to the current limits — memorise District ₹50 lakh / State ₹2 crore / National above ₹2 crore, based on the value paid as consideration.
Key Definitions Under Consumer Protection Act 2019
| Term | Definition / Banking Relevance |
|---|---|
| Consumer | Person who buys goods or hires services for consideration — NOT for commercial resale. A bank customer who takes a home loan or uses remittance service is a consumer. |
| Deficiency | Fault, imperfection, shortcoming, or inadequacy in quality/nature/manner of performance of service. Wrongful dishonour of cheque, delay in credit, wrong debit = deficiency in banking service. |
| Unfair Trade Practice | Misleading representation, false information to promote services. Mis-selling of insurance at bank counter can qualify. |
| Restrictive Trade Practice | Practice that manipulates conditions of delivery or requires purchase of another good/service as a condition. Tying savings account to insurance purchase. |
| CCPA | Central Consumer Protection Authority — new body under 2019 Act to regulate, protect, and enforce consumer rights. Can recall products, impose penalties, file class action suits. |
| Product Liability | New chapter in 2019 Act — manufacturers/service providers liable for harm caused by defective products/deficient services. Banks can be held liable for digital banking product failures causing harm. |
Time Limit to File Consumer Complaint
Limitation Period
Complaint must be filed within 2 years from the date on which the cause of action arose.
The Commission may condone delay if the complainant shows sufficient cause for delay.
Banking example: Bank wrongly debits customer account on 1st July 2024. Customer must file consumer complaint by 30th June 2026.
RBI Integrated Ombudsman Scheme — 2021 to RB-IOS 2026
In November 2021, RBI merged three separate ombudsman schemes (Banking Ombudsman, Ombudsman for NBFCs, and Ombudsman for Digital Transactions) into a single Integrated Ombudsman Scheme — “One Nation One Ombudsman.” It covers all regulated entities under RBI and provides a free, quick alternate dispute resolution mechanism. The Reserve Bank – Integrated Ombudsman Scheme, 2026 (RB-IOS 2026) replaced the 2021 scheme from 1 July 2026, raising compensation limits and shortening the filing window; the table below shows the current rules.
Integrated Ombudsman Scheme — Key Features
| Aspect | Detail |
|---|---|
| Prerequisite | Complainant must first approach the regulated entity (bank). Wait 30 days for response, or if response is unsatisfactory. |
| Time limit to approach Ombudsman | Within 90 days from the bank’s last communication or the expiry of its 30-day response window, whichever is later (RB-IOS 2026; was 1 year under the 2021 scheme) |
| Award limit (compensation) | Up to ₹30 lakh for consequential loss; additional ₹3 lakh for mental agony/harassment, time and expenses (RB-IOS 2026; was ₹20 lakh + ₹1 lakh) |
| Cost | Free — no fee from the complainant |
| Coverage | All banks (including RRBs, cooperative banks), NBFCs, payment system operators regulated by RBI |
| Not covered | Complaints pending in court/tribunal/arbitration; commercial judgements (credit decisions); HR matters of banks |
| Appeal against Award | Complainant or bank may appeal to the Appellate Authority — the Executive Director in charge of RBI’s Consumer Education and Protection Department — within 30 days of the award |
Ombudsman vs Consumer Court — Which Route When?
| Factor | RBI Ombudsman | Consumer Court (DCDRC/SCDRC/NCDRC) |
|---|---|---|
| Cost | Free | Nominal court fees |
| Speed | Faster (usually 3–6 months) | Slower |
| Max compensation | ₹30 lakh + ₹3 lakh (harassment) — RB-IOS 2026 | No upper limit — can award actual damages + punitive |
| Punitive damages | Not available | Available |
| Parallel proceedings | Cannot approach Ombudsman if case in court | Independent route |
Master Quick-Reference — All Key Numbers
| Item | Number / Threshold | Context |
|---|---|---|
| KYC | ||
| Low-risk KYC update | 10 years | Salaried, pensioners, agriculturists |
| Medium-risk KYC update | 8 years | SMEs, business entities |
| High-risk KYC update | 2 years | PEPs, NRIs, cash-intensive businesses |
| UBO threshold — companies | > 10% | Unlisted companies (listed: exempt) |
| UBO threshold — partnership / trust / association | > 10% / 10%+ / > 15% | Partnership firms; trusts; unincorporated associations |
| PMLA Reporting | ||
| CTR threshold | ≥ ₹10 lakh | Cash transactions in a month |
| CTR filing deadline | 15 days | From close of month |
| STR threshold | NONE | Any suspicious transaction, any amount |
| STR filing deadline | 7 working days | From confirmation of suspicion |
| Records retention under PMLA | 5 years | From date of transaction (PMLA Sec 12) |
| Consumer Protection | ||
| District Commission (DCDRC) | ≤ ₹50 lakh | Jurisdiction Rules, 2021 |
| State Commission (SCDRC) | ₹50 lakh to ₹2 crore | Jurisdiction Rules, 2021 |
| National Commission (NCDRC) | Above ₹2 crore | Jurisdiction Rules, 2021 |
| Complaint filing limitation | 2 years | From date of cause of action |
| RBI Ombudsman | ||
| Time to approach Ombudsman | 90 days (RB-IOS 2026) | After waiting 30 days for bank response |
| Ombudsman max award | ₹30 lakh + ₹3 lakh | Actual loss + mental agony |
| Appeal against Ombudsman award | 30 days | To Appellate Authority (Dy. Governor, RBI) |
Frequently Asked Questions
CAIIB BRBL Series
Banking Regulation & Business Laws — All Articles
Paper Hub
BRBL Syllabus & Exam Guide
All 4 modules, study plan, key laws overview
Live →
Module C Deep-Dive
SARFAESI Act & NI Act
Enforcement timeline, Section 138 cheque dishonour, DRT jurisdiction
Live →
Other CAIIB Papers
0 Comments