The consultation paper on the draft IFSCA (KYC Registration Agency) Regulations, 2024 invites public feedback on a proposed framework to establish centralized KYC (Know Your Customer) processes within the International Financial Services Centre (IFSC). The aim is to improve customer due diligence (CDD) procedures by creating a centralized platform for client verification, minimizing redundancy in the process across various regulated entities. This proposal aligns with the IFSCA’s existing Anti-Money Laundering (AML) guidelines, ensuring entities comply with global standards such as the FATF recommendations. The regulations outline the eligibility criteria for KYC Registration Agencies (KRAs), their operational duties, data protection protocols, and cybersecurity measures. It also covers obligations for regulated entities in relation to client KYC, emphasizing the need for robust validation systems and compliance with the Digital Personal Data Protection Act, 2023. Additionally, KRAs will facilitate seamless interconnectivity with other KYC agencies, including SEBI-registered entities, ensuring efficient data management and inter-operability.
International Financial Services Centres Authority
CONSULTATION PAPER ON DRAFT IFSCA (KYC REGISTRATION AGENCY) REGULATIONS, 2024
Dated: 06/12/2024
Objective
1. The objective of this consultation paper is to seek comments and suggestions from the public and stakeholders on the draft IFSCA (KYC Registration Agency) Regulations, 2024.
Statement of Object and Reasons
2. The purpose of the proposed IFSCA (KYC Registration Agency) Regulations, 2024 (“KRA Regulations”) is to provide the regulatory framework for registration, regulation and supervision of KRAs set up in the IFSC.
3. The objective of the KRA Regulations to enable the KRAs to set up in IFSC and to centralize the KYC records of the clients/customers onboarded by various types of regulated entities. The purpose is to facilitate smooth onboarding of the clients/customers by Regulated Entities and enhance their efficiency with respect to Customer Due-Diligence (CDD).
Background
4. The Regulated Entities in IFSC are subject to the Know Your Customer (KYC) and CDD requirements as per the IFSCA (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines (hereinafter referred to as “AML-CFT Guidelines”).1
5. The AML-CFT Guidelines have been prepared in accordance with the recommendations of the Financial Action Task Force (FATF), the Prevention of Money Laundering Act, 2002 (PMLA), the PML Rules and the best practices prevailing in the AML‐CFT regulatory regimes across the globe.
6. These Guidelines enable a Regulated Entity to adopt Risk‐Based Approach (RBA) to identify and assess the Money Laundering and Terrorist Financing risks and undertake the measures of CDD accordingly.
7. The AML-CFT Guidelines have also enabled the Regulated Entities to rely on the third party to perform the CDD measures subject to following conditions:
(a) The Regulated Entity shall obtain records or information of the client due diligence carried out by the third party, within 2 days;
(b) The Regulated Entity shall take adequate steps to satisfy itself that the copies of identification data and other relevant documentation relating to the client due diligence will be made available by the third party upon request, without delay;
(c) The Regulated Entity is satisfied that the third party, it intends to rely upon, is regulated, supervised or monitored for, and has measures in place for compliance with client due diligence and record-keeping requirements mentioned under recommendation 10 and 11 of the FATF recommendations and also are in line with the requirements and obligations under the Act;
(d) The third party is not based in a country or jurisdiction assessed as high risk;
(e) No Regulated Entity shall rely on a third party to conduct ongoing monitoring of business relations with customers;
(f) No Regulated Entity shall rely on a third party specifically precluded by the Authority from relying upon;
(g) The Regulated Entity shall document the basis for its satisfaction that the requirements under sub-clause (c) above, have been met;
(h) The reliance on Third Party shall also be subject to the conditions that are specified in rule 9 (2) of the Rules and shall be in accordance with the regulations and circulars/guidelines issued by Authority from time to time; and,
(i) The Regulated Entity is ultimately responsible for client due diligence and undertaking enhanced due diligence measures, as applicable.
Need for a KRA in IFSC
8. The AML-CFT Guidelines, have permitted Third-Party Reliance for undertaking the CDD measures. However, as per feedback received, the Regulated Entities , in certain cases, do not find it easy to satisfy the conditions for such a reliance. The Regulated Entities may not be able to obtain the documents from the other entity within the specified timeline of 2 days (refer para 7a) if a specific bilateral agreement for such a purpose is not in place between such parties.
9. In the absence of such Third Party-Reliance, if a client has to open accounts with different types of Regulated Entities, the client will have to undergo the KYC process with each Regulated Entity separately. This results in duplication of CDD, reductions of efficiency and and expenditure of manpower which can be avoided.
10. To resolve such issues, it is imperative to put enable a centralized platform for verifying customer information so that the need for multiple verifications across different financial institutions is eliminated.
11. It is pertinent to note that Rule 9A of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (PML Rules) deals with the Central KYC Records Registry (CKYCRR) for the purpose of receiving, storing, safeguarding and retrieving electronic copies of KYC records obtained by the reporting entities from their clients. However, an exemption has been provided for the foreign nationals transacting in IFSC from the storage, safekeeping and retrieval of their KYC records.
12. To facilitate the seamless onboarding of clients by a registered intermediary, SEBI had come up with the concept of a KRA in 2011 which would serve as the repository of KYC data and identification documents. Such KRA(s) would have :
a. the provision of inter-connectivity with other KRA(s) and
b. a secure data transmission link with each of the registered intermediaries for upload / download of KYC documents.
13. SEBI notified the SEBI (KYC Registration Agency) Regulations, in 2011 which deal with the regulatory framework for KRAs in India.
14. On similar lines, in order to smoothen the process of CDD for the Regulated Entities in IFSC, a regulatory framework for KRAs in IFSC is proposed to be issued.
Draft KRA Regulations
15. The salient features of the KRA Regulations, include:
A. Eligibility Criteria for registration as KRA
An entity shall be eligible to be registered as KRA only if it belongs to one of the following categories, namely:
(a) a wholly owned subsidiary of a stock exchange recognised in India, in IFSC or in Foreign Jurisdiction; or
(b) a wholly owned subsidiary of a depository recognised in India, in IFSC or in Foreign Jurisdiction; or
(c) a wholly owned subsidiary of a KRA registered in India, in IFSC or in Foreign Jurisdiction.
B. Functions and Obligations of a KRA
The obligations of KRA registered with IFSCA shall include:
(a) A KRA shall obtain the KYC documents of the Client from the Regulated Entity in terms of the AML-CFT Guidelines.
(b) A KRA shall have electronic connectivity and with other KRA(s) in IFSC and also may have the connectivity with the SEBI registered KRAs to establish inter-operability.
(c) KRA shall have a secure data transmission link with other KRA(s) and with each Regulated Entity that uploads the KYC documents on its system and relies upon its data.
(d) KRA shall be responsible for storing, safeguarding and retrieving the KYC documents and submit to the Authority or any other statutory authority as and when required.
(e) KRA shall carry out an independent validation of the KYC records uploaded onto its system by the Regulated Entity in such a manner as specified by the Authority from time to time.
(f) Any information updated about a Client shall be disseminated by KRA to all intermediaries that avail of the services of the KRA in respect of that Client.
(g) KRA shall take all precautions necessary to ensure that the KYC documents/records are not lost, destroyed or tampered with and that sufficient back up of electronic records is available at all times at a different place.
(h) KRA shall have checks built in its system so that a Regulated Entity can access the information only for the Clients who approach him.
(i) KRA shall maintain an audit trail of any upload/ modification /download regarding the KYC records of each Client.
(j) KRA shall be compliant with the provisions of the Digital Personal Data Protection Act 2023.
(k) KRA shall enter into an agreement with Regulated Entities before granting access to the KRA database services.
(l) KRA shall take adequate cybersecurity measures to ensure safety and security of the KYC databases.
C. Functions and Obligations of the Regulated Entities
The Regulated Entity shall have the following functions and obligations:
(a) The Regulated Entity shall perform the initial KYC/due diligence of the Client, upload the KYC information with proper authentication on the system of the KRA, furnish the scanned images of the KYC documents to the KRA, and retain the physical KYC documents
(b) When the Client approaches another Regulated Entity subsequently, the Regulated Entity shall verify and download the Client’s details from the system of KRA
(c) Upon receipt of information on change in KYC details and status of the Clients by the Regulated Entity or when it comes to the knowledge of the Regulated Entity, at any stage, the Regulated Entity shall be responsible for uploading the updated information on the system of KRA and retaining the physical documents
(d) A Regulated Entity shall not use the KYC data of a Client obtained from the KRA for purposes other than it is meant for; nor shall it share the same with any third party including its affiliates or associates.
(e) A Regulated Entity shall have the ultimate responsibility for the KYC of its Clients, by undertaking enhanced KYC measures commensurate with the risk profile of its Clients
(f) A Regulated entity using services of the KRA databases shall be compliant with the provisions of Digital Personal Data Protection Act 2023.
(g) A Regulated entity using KRA services shall take adequate cybersecurity measures to ensure safety and security of the KYC databases.
D. Sharing of KYC information with other financial sector regulators
The entities, regulated by other regulators in the financial sector, in India or overseas, (and as specified by the Authority from time to time) may access the KRA for undertaking KYC of their Clients.
E. Principal Officer, Compliance Officer and Other Human Resources
A. Principal Officer
The Principal Officer of a KRA shall be based out of the IFSC and shall have the following minimum qualification and experience:
(a) A professional qualification or post-graduate degree or post graduate diploma (minimum one year in duration) in finance, law, accountancy, business management, commerce, economics, capital market, banking, insurance or actuarial science from a university or an institution recognised by the Central Government or any State Government or a recognised foreign university or institution or association or a CFA or a FRM from Global Association of Risk Professionals; and
(b) An experience of at least five years in the financial markets
B. Compliance Officer
A KRA shall designate a person, based out of IFSC, as its Compliance Officer for ensuring compliance with the applicable legal and regulatory requirements.
C. Other human resources
A KRA shall have adequate manpower commensurate with its business activities in the IFSC.
F. Other features
The draft KRA Regulations, inter-alia, also specify the :
- registration requirements,
- fit and proper requirements,
- Annual Audit,
- Inspection
- Risk Management and
- Code of Conduct to be followed by KRAs.
Regulatory Objective and expected Impact
16. The regulatory objective of the KRA Regulations is to specify the regulatory framework for registration, supervision and regulation of KRAs operating in the IFSC with the objective to create a centralized database of KYC information in IFSC and to smoothen the CDD process for the Regulated Entities.
17. These Regulations aim to promote the Ease of Doing Business by enabling inter-operability amongst the KRAs in IFSC and also with SEBI registered KRAs.
Public Comments
18. In view of the above, comments and suggestions from public are invited on the draft IFSCA (KYC Registration Agency) Regulations, 2024 contained in Annexure-I. The comments may be sent by email to Shri Praveen Kamat, General Manager at kamat@ifsca.gov.in and to Shri Shubham Goyal, Assistant General Manager at goyal.shubham@ifsca.gov.in with the subject line “Comments on draft IFSCA (KYC Registration Agency) Regulations, 2024” latest by December 27, 2024.
19. The comments should be provided in the following format:
| Name and Designation | ||||
| Contact No. and Email address | ||||
| Name of Organisation | ||||
| S. No. | Regulation no./Sub regulation no. | Text of the Regulation/ Sub- Regulation | Comments/ Suggestions/ Suggested modifications |
Detailed Rationale |
December 06, 2024
Gandhinagar
International Financial Services Centres Authority (KYC Registration Agency) Regulations, 2024
In exercise of the powers conferred by sub-section (1) of Section 28 read with sub-section (1) of Section 12 and sub-section (1) of Section 13 of the International Financial Services Centres Authority Act, 2019; the International Financial Services Centres Authority hereby makes the following regulations, namely: –
CHAPTER-I
PRELIMINARY
Short title and commencement
1. (1) These regulations may be called the International Financial Services Centres Authority (KYC Registration Agency) Regulations, 2024.
(2) They shall come into force on the thirtieth day of its publication in the Official Gazette. Definitions
2. (1) In these regulations, unless the context otherwise requires, the terms defined herein shall bear the meanings as assigned to them below, and their cognate expressions shall be construed accordingly-
(a)“Act” means the International Financial Services Centres Authority Act, 2019 (50 of 2019);
(b) “Authority” or “IFSCA” means the International Financial Services Centres Authority established under sub-section (1) of section 4 of the Act;
(c) “Customer” or “Client” for the purpose of these Guidelines shall mean a person who is engaged in a financial transaction or activity with a Regulated Entity and includes a person on whose behalf the person engaged in the transaction or activity, is acting;
(d) “Foreign Jurisdiction” means a country, other than India, whose securities market regulator is a signatory to International Organization of Securities Commission’s Multilateral Memorandum of Understanding (Appendix A signatories) or a signatory to bilateral Memorandum of Understanding with the Authority, and which is not identified in the public statement of Financial Action Task Force as:
i. a jurisdiction having a strategic Anti-Money Laundering or Combating the Financing of Terrorism deficiencies to which counter measures apply; or
ii. a jurisdiction that has not made sufficient progress in addressing the deficiencies or has not committed to an action plan developed with the Financial Action Task Force to address the deficiencies;
(e) “Inspecting Authority” means one or more persons appointed by the Authority to undertake inspection of the books, accounts, records and documents of a KRA in terms of these regulations;
(f) “International Financial Services Centre” or “IFSC” shall have the same meaning as assigned to it under clause (g) of sub-section (1) of section 3 of the Act;
(g) “KYC Registration Agency” or “KRA” means an entity which has been granted certificate of registration under these regulations;
(h) “Principal Officer” means a designated employee of the KRA responsible for overall activities of the KRA;
(i) “Regulated Entity” means a unit/entity which has been granted license, recognition, registration or authorisation by the Authority;
(j) “SEBI” means the Securities and Exchange Board of India established under section 3 of the Securities and Exchange Board of India Act, 1992.
(2) Words and expressions used and not defined in these regulations but defined in the Act or Acts mentioned in the First Schedule to the Act, or the Companies Act, 2013, or any rules or regulations made thereunder shall have the same meanings respectively assigned to them in those Acts, rules or regulations or any statutory modification or re-enactment thereto, as the case may be.
CHAPTER II
RECOGNITION
Application for grant of certificate of registration
3. An entity desirous of obtaining a certificate of registration as a KRA in IFSC shall submit, electronically or otherwise, an application form in the format, along with the application fees, as specified by the Authority.
Legal form of the Applicant
4. A KRA seeking registration with the Authority shall be required to be present in an IFSC, by establishing a company in an IFSC.
Net worth requirements
5. An entity seeking registration as a KRA shall maintain the net worth of at least USD 1 Million and the same shall be maintained at all times.
Fit and proper requirements
6. (1) A KRA shall ensure that the entity and its principal officers, directors/ partners/ designated partners, key managerial personnel and controlling shareholders are fit and proper persons, at all times.
(2) For the purpose of sub-regulation (1), a person shall be deemed to be a fit and proper person if, –
(a) such person has a record of fairness and integrity, including but not limited to-
(i) financial integrity;
(ii) good reputation and character; and
(iii) honesty
(b) such person has not incurred any of the following disqualifications –
(i) the person has been convicted by a court for any offence involving moral turpitude or any economic offence or any offence against securities laws;
(ii) a recovery proceeding has been initiated against the person by a financial regulatory authority and is pending;
(iii) an order for winding up has been passed against the person for malfeasance;
(iv) the person has been declared insolvent and not discharged;
(v) an order, restraining, prohibiting or debarring the person from accessing or dealing in financial products or financial services, has been passed by any regulatory authority, in any matter concerning securities laws or financial markets and such order is in force;
Provided that in case any person has been declared as not ‘fit and proper person’ by an order of a regulatory authority, such a person shall not be eligible to apply for registration during the period provided in the said order or for a period of five years from the date of effect of the order, if no such period is specified in the order.
(vi) any other order against the person, which has a bearing on the securities market, has been passed by the Authority or any other regulatory authority and a period of three years from the date of the order has not elapsed;
(vii) the person has been found to be of unsound mind by a court of competent jurisdiction and the finding is in force;
(viii) the person is financially not sound or has been categorized as a willful defaulter;
(ix) the person has been declared a fugitive economic offender; or
(x) any other disqualification as may be specified by the Authority.
Appointment of Principal Officer, Compliance Officer and other human resources
7. (1) A KRA shall have at least one person designated as Principal Officer based out of IFSC, who shall have:
(a) A professional qualification or post-graduate degree or post graduate diploma (minimum one year in duration) in finance, law, accountancy, business management, commerce, economics, capital market, banking, insurance or actuarial science from a university or an institution recognised by the Central Government or any State Government or a recognised foreign university or institution or association or a CFA or a FRM from Global Association of Risk Professionals; and
(b) An experience of at least five years in the financial markets.
(2) A KRA shall designate a person, based out of IFSC, as its Compliance Officer who shall be responsible for monitoring the compliance of the Act, rules and regulations, notifications, guidelines, instructions, etc., issued by the Authority or the Central Government.
(3) The compliance officer shall immediately and independently report to the Authority any non-compliance observed by him.
(4) A KRA shall have adequate manpower commensurate with its business activities in an IFSC.
Registration Requirements
8. The Authority shall take into account all matters which it deems relevant for grant of registration to a KRA and in particular the following, namely, whether:
a) the applicant or its Principal Officer has adequate past experience in the activities for which it is desirous of obtaining a certificate of registration;
b) the applicant has the necessary infrastructure like adequate office space, equipment, communication facilities and manpower to effectively discharge its activities;
c) the applicant satisfies the eligibility criteria, net worth and fund allocation requirements, if applicable, as specified in these regulations;
d) the applicant has satisfactory financial credit worthiness;
e) the applicant and its principal officers, directors/ partners/ designated partners, key managerial personnel and controlling shareholders are fit and proper persons;
f) the applicant or any of its associates have in the past been refused certificate by the Authority and if so, the ground for such refusal; and
g) the applicant or its Principal Officer is subject to any proceeding for breach of law by the Authority.
Grant of Registration
9. (1) An entity shall be eligible to be registered as KRA only if it belongs to one of the following categories, namely:
(d) a wholly owned subsidiary of a stock exchange recognised in India, in IFSC or in Foreign Jurisdiction; or
(e) a wholly owned subsidiary of a depository recognised in India, in IFSC or in Foreign Jurisdiction; or
(f) a wholly owned subsidiary of a KRA registered in India, in IFSC or in Foreign Jurisdiction.
(2) The Authority may, after considering the application and on being satisfied that the applicant has complied with the conditions laid down in these regulations and is eligible to act as a KRA, and upon receipt of registration fees (as specified by the Authority), grant registration to the applicant subject to the conditions as the Authority may deem fit.
(3) If the Authority is of the opinion that the registration cannot be granted, it shall communicate the deficiencies to the Applicant giving it thirty days’ time to rectify them.
(4) If the Applicant fails to rectify such deficiencies to the satisfaction of the Authority within the specified time, the Authority may refuse to grant registration and shall communicate the same to the Applicant, giving reasons for such refusal:
Provided that no such refusal shall be made by the Authority without giving the Applicant an opportunity to make written submissions on the grounds on which the registration is proposed to be refused.
(5) The KRA shall comply with any other condition as may be imposed by the Authority as it deems fit in the interest of the investors or orderly development of the securities market or for regulating the working of the KRA, in an IFSC.
The registration granted to a KRA may be withdrawn by the Authority only after giving a reasonable opportunity of being heard.
Period of validity
10. The certificate of registration of a KRA shall be perpetual unless it is suspended or cancelled by the Authority.
Surrender of Registration
11. A registered KRA may file an application with the Authority for surrender of its registration.
Code of Conduct
12. A KRA shall abide by the Code of Conduct as specified in Schedule I.
Maintenance of books of account, records and other documents
13. A KRA shall maintain and preserve the following books of accounts, records and documents, in electronic retrieval form for a minimum of eight years, namely: –
(a) a copy of the balance sheet at the end of each accounting period;
(b) a copy of profit and loss account for each accounting period;
(c) a copy of the auditor’s report on the accounts for each accounting period;
(d) a statement of net worth for each quarter;
(e) documentation relating to compliance with AML and CFT guidelines;
(f) documents relating to account opening of each Client and any power of attorney or signature authority forms of the Clients;
(g) relevant records and documents relating to its activities; and
(h) such other books of accounts, records and documents as may be specified by the Authority from time to time.
Provided that a KRA shall retain the KYC documents of the Client, in electronic form for the period specified by the Prevention of Money Laundering Act, 2002 (15 of 2003) or the rules issued thereunder, as well as ensuring that retrieval of KYC information is facilitated within stipulated time period.
Information to the Authority
14. (1) A KRA shall furnish to the Authority any material change in the information or particulars previously furnished along with the application, which has a bearing on the certificate of registration granted to it.
(2) A KRA shall furnish such reports, returns, statements and particulars, in such manner, interval and form, as may be specified by the Authority from time to time.
Redress of grievances
15. (1) A KRA shall take adequate steps for redress of grievances of the investors in accordance with the requirements as may be specified by the Authority.
(2) The KRA shall maintain records regarding investor grievances received by it and redress of such grievances.
Business Continuity Plan
16. (1) A KRA shall maintain a business continuity plan identifying procedures relating to an emergency or significant business disruption.
(2) A KRA shall update its business continuity plan in the event of any material change to operations, structure, business, or location.
(3) A KRA shall conduct an annual review of its business continuity plan.
Cyber Security and Cyber Resilience
17. (1) A KRA shall have robust cyber security and cyber resilience framework in accordance with the requirements as may be specified by the Authority from time to time.
Risk Management and Internal Controls
18. (1) A KRA shall have a sound risk management system for comprehensively managing risks.
(2) A KRA shall have adequate internal procedures and controls, given the types of business in which it engages (including any activities which have been outsourced) with the aim of protecting the interests of Clients and their assets and ensuring proper management of risk.
Change in control
19. A KRA is incorporated in an IFSC, shall seek prior approval of the Authority in case of any direct or indirect change in control of the KRA.
Payment of Fees
20. A KRA shall pay the fees as may be specified by the Authority or the market infrastructure institutions from time to time.
Annual Audit
21. (1) A KRA shall have an annual audit conducted in respect of compliance with these regulations by a member of the Institute of Chartered Accountants of India or a member of the Institute of Company Secretaries of India or a member of the Institute of Cost Accountants of India or any person authorised to conduct audit in a Foreign Jurisdiction.
(2) A copy of such audit report for a financial year shall be furnished to the Authority by the 30th of September of such year.
(3) A KRA shall have additional audits and submit such reports as may be specified by the Authority from time to time.
OBLIGATIONS AND RESPONSIBILITIES
CHAPTER III
FUNCTIONS AND OBLIGATIONS OF KRA AND REGULATED ENTITY
Documents to be obtained by the KRA for the purpose of KYC
22. A KRA shall obtain the KYC documents of the Client from the Regulated Entity in terms of the International Financial Services Centres Authority (Anti Money Laundering, Counter-Terrorist Financing and Know Your Customer) Guidelines, 2022 or any other rules, regulations, guidelines and circulars issued by the Authority or Central Government for Prevention of Money Laundering, from time to time.
Functions and obligations of the KRA
23. The KRA has the following functions and obligations –
(a) KRA may prepare the Operating Instructions in co-ordination with other KRA(s) and issue the same to implement the requirements of these regulations.
(b) KRA(s) shall have electronic connectivity and with other KRA(s) in IFSC in order to establish inter-operability among KRAs.
(c) KRA(s) may also have electronic connectivity with the KRA(s) registered with SEBI to establish inter-operability among KRAs of both the jurisdictions.
Explanation: Inter-operability means the ability of the KRA to determine whether the KYC documents of the Client are in the custody of another KRA.
(d) KRA shall have a secure data transmission link with other KRA(s) and with each Regulated Entity that uploads the KYC documents on its system and relies upon its data.
(e) KRA shall be responsible for storing, safeguarding and retrieving the KYC documents and submit to the Authority or any other statutory authority as and when required.
(f) KRA shall carry out an independent validation of the KYC records uploaded onto its system by the Regulated Entity in such a manner as specified by the Authority from time to time.
(g) Any information updated about a Client shall be disseminated by KRA to all intermediaries that avail of the services of the KRA in respect of that Client.
(h) KRA shall ensure that the integrity of the automatic data processing systems for electronic records is maintained at all times.
(i) KRA shall take all precautions necessary to ensure that the KYC documents/records are not lost, destroyed or tampered with and that sufficient back up of electronic records is available at all times at a different place.
(j) KRA shall have adequate mechanisms for the purposes of reviewing, monitoring and evaluating its
controls, systems, procedures and safeguards.
(k) KRA shall cause an audit of its controls, systems, procedures and safeguards to be carried out periodically and take corrective actions for deficiencies, if any and report to Authority.
(l) KRA shall take all reasonable measures to prevent unauthorized access to its database and have audit of its systems and procedures at regular intervals as specified by the Authority from time to time.
(m) KRA shall ensure compliance with the Digital Personal Data Protection Act 2023.
(n) KRA shall enter into an agreement with Regulated Entities before granting access to the KRA database services.
(o) KRA shall have checks built in its system so that a Regulated Entity can access the information only for the Clients who approach him.
(p) KRA shall send a letter to each Client after receipt of the KYC documents from the Regulated Entity, confirming the Client’s details thereof.
(q) KRA shall maintain an audit trail of any upload/ modification /download regarding the KYC records of each Client.
Functions and obligations of a Regulated Entity
24. The Regulated Entity has the following functions and obligations –
(a) The Regulated Entity shall perform the initial KYC/due diligence of the Client, upload the KYC information with proper authentication on the system of the KRA, furnish the scanned images of the KYC documents to the KRA, and retain the physical KYC documents.
(b) When the Client approaches another Regulated Entity subsequently, the Regulated Entity shall verify and download the Client’s details from the system of KRA:
Provided that upon receipt of information on change in KYC details and status of the Clients by the Regulated Entity or when it comes to the knowledge of the Regulated Entity, at any stage, the Regulated Entity shall be responsible for uploading the updated information on the system of KRA and retaining the physical documents.
(c) A Regulated Entity shall not use the KYC data of a Client obtained from the KRA for purposes other than it is meant for; nor shall it make any commercial gain by sharing the same with any third party including its affiliates or associates.
(d) A Regulated Entity shall have the ultimate responsibility for the KYC of its Clients, by undertaking enhanced KYC measures commensurate with the risk profile of its Clients.
(d) The Regulated Entity shall integrate its systems with the KRA to facilitate seamless movement of KYC documents to and from the Regulated Entity to the KRA.
Sharing of KYC information in the financial sector
25. (1) The entities, regulated by other regulators in the financial sector specified by the Authority from time to time, may access the system of KRA for undertaking KYC of their Clients who engage them for financial services.
(2) The provisions of these regulations shall, mutatis mutandis, apply to the entities regulated by other regulators specified in sub-regulation (1).
(3) The system of KRA may be connected with any central KYC registry authorised by the Central Government for the purpose of collation and sharing of the KYC information in the financial sector.
CHAPTER IV
INSPECTION
Inspecting Authority
26. (1) The Authority may suo motu or upon receipt of information or complaint at any time appoint one or more persons as Inspecting Authority to undertake the inspection of the books, accounts, records, and documents of a KRA, for any purpose, including the purposes as specified under sub-regulation (2).
(2) The purposes referred to in sub-regulation (1) may include, –
(a) to ensure that the books of account, records and documents are being maintained in the manner as required under these regulations;
(b) to ensure that the provisions of the Act, the regulations and circulars made thereunder, are complied with;
(c) to ascertain whether adequate internal control systems, procedures and safeguards have been established or are being followed by the KRA to fulfil its obligations under these regulations;
(d) to ascertain whether any circumstances exist which would render the KRA unfit or ineligible;
(e) to inquire into the complaints received from the investors, Clients, other market participants, or any other person on any matter having a bearing on the activities of the Regulated Entity; and
(f) to inquire suo motu into such matters as may be deemed fit in the interest of investors in IFSC.
(3) Before undertaking an inspection under sub-regulation (1), the Inspecting Authority shall give a notice to the KRA:
Provided that where the Inspecting Authority is satisfied that in the interest of the investors no such notice should be given, it may, for reasons to be recorded in writing, dispense with such notice.
Obligations upon inspection by the Authority
27. (1) Where an inspection of a KRA is undertaken by the Authority, such KRA and every Principal Officer, proprietor, partner, designated partner, trustee, director, chairperson, officer, employee and any agent of the KRA shall provide all assistance and cooperate with the Inspecting Authority and shall furnish books of accounts, records and documents to the Inspecting Authority with such statements and information relating to its activities within such time as decided by the Inspecting Authority.
(2) The KRA shall give all assistance as may be required in connection with the inspection and allow the Inspecting Authority to have reasonable access to its premises and extend reasonable facility for examining any books of accounts, records and documents in its possession, and also provide copies of records or documents or other material which in the opinion of the Inspecting Authority are relevant for the purposes of the inspection.
28. Inspection by third parties
(1) The Authority may appoint a professional to inspect the books of account, records, documents infrastructures, systems and procedures or affairs of a KRA:
Provided that such professional so appointed shall have the same powers of an Inspecting Authority:
Provided further that a KRA and its employees shall have the same obligations as specified in regulation 27 with respect to such inspection.
(2) The Authority shall be entitled to recover expenses relating to such inspection from the KRA.
29. Submission of report
The Inspecting Authority shall submit an inspection report including interim reports to the Authority, and the Authority may take such action as it may deem fit and appropriate.
CHAPTER VI
MISCELLANEOUS
Suspension, cancellation of registration or any other actions
30. The Authority may take such action as deemed fit, including suspension or cancellation of registration, against a KRA if it:
(a) fails to comply with any conditions subject to which a certificate of registration has been granted; or
(b) contravenes any of the provisions of the Act or rules or regulations or circulars or guidelines or directions or instructions issued thereunder.
31. Power to call for information
The Authority may call for any information, documents or records from a KRA.
32. Power to remove difficulties
In order to remove any difficulties in the interpretation or application of the provisions of these regulations, the Authority shall have the power to issue directions through guidance notes or circulars.
33. Power to relax strict enforcement of the regulations
(1) The Authority may, in the interest of development and regulation of financial services in IFSC, relax the strict enforcement of any requirements of these regulations.
(2) For seeking relaxation under sub-regulation (1), an application, giving details and the grounds on which such relaxation has been sought, shall be filed with the Authority along with a non-refundable fee as may be specified by the Authority.
(3) The Authority shall process such application within thirty days of the date of receipt of the application complete in all respects and shall record reasons for acceptance or refusal of the relaxations sought by the applicant.
34. Power to specify procedures and issue clarifications
For the purposes of implementation of these regulations and matters incidental thereto, the Authority may specify norms, procedures, processes etc. by way of circulars or guidelines or directions to KRA.
Schedule-I
CODE OF CONDUCT
(Regulation 12)
1. A KRA shall make all efforts to protect the interest of its Clients.
2. A KRA shall maintain high standards of integrity, dignity and fairness in the conduct of its business.
3. A KRA shall fulfill its obligations in a prompt, ethical and professional manner.
4. A KRA shall at all times exercise due diligence, ensure proper care and exercise independent professional judgment.
5. A KRA shall ensure that any change in registration status/any penal action taken by the Authority or any material change in financial position which may adversely affect the interests of Clients is promptly displayed on its website.
6. A KRA shall not divulge to anybody either orally or in writing, directly or indirectly, any confidential information about the Clients which has come to its knowledge, without taking prior permission of its Clients, except where such disclosures are required to be made in compliance with any law for the time being in force.
7. A KRA shall not indulge in any unfair competition.
8. A KRA shall display on its website adequate and appropriate information about its business, including contact details of persons and services available to Clients.
9. A KRA shall ensure that grievances of Clients are redressed in a timely and appropriate manner.
10. A KRA shall make reasonable efforts to avoid misrepresentation and ensure that the information provided to the Clients and intermediaries is not misleading.
11. A KRA shall abide by the provisions of the Act and the rules, regulations issued by the Government and the Authority, from time to time, as may be applicable.
12. A KRA shall not make untrue statement or suppress any material fact in any documents, reports, papers or information furnished to the Authority.
13. A KRA shall ensure that the Authority is promptly informed about any action, legal proceeding, etc., initiated against it in respect of any material breach or non-compliance by it, of any law, rules, regulations and directions of the Authority or of any other regulatory body.
14. A KRA or any of his employees shall not render, directly or indirectly, any investment advice about any security in the publicly accessible media.
15. KRA shall not make a recommendation to any Client who might be expected to rely thereon to acquire, dispose of or retain any securities.
16. A KRA shall ensure that any person it employs or appoints to conduct business is fit and proper and otherwise qualified to act, in the capacity so employed or appointed including having relevant professional training or experience.
17. A KRA shall have internal control procedures and financial and operational capabilities which can be reasonably expected to protect its operations, its Clients from financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions.
18. A KRA shall be responsible for the acts or omissions of its employees in respect to the conduct of its business.
19. A KRA shall provide adequate freedom and powers to its compliance officer for the effective discharge of its duties.
20. A KRA shall ensure that the senior management, particularly decision makers have access to all relevant information about the business on a timely basis.
21. A KRA shall ensure that good corporate policies and corporate governance are in place.
22. A KRA should have adequately trained staff and arrangements to render fair, prompt and competence services to its Clients.
23. A KRA shall develop its own internal code of conduct for governing its internal operations and laying down its standards of appropriate conduct for its employees and officers in the carrying out of their duties. Such a code may extend to the maintenance of professional excellence and standards, integrity, confidentiality, objectivity, avoidance of conflict of interests, disclosure of shareholdings and interests, etc.
24. A KRA shall not be party to—
(a) creation of false market;
(b) price rigging or manipulation;
(c) passing of unpublished price sensitive information in respect of securities which are listed and proposed to be listed in any stock exchange to any person.
25. A KRA shall maintain proper inward and outward system for all types of mail received and dispatched in all forms.
26. A KRA shall follow maker-checker concept in its activities to ensure accuracy of data.
27. A KRA shall not indulge in manipulative, fraudulent practices in the process of identification, verification and updation of a Client’s KYC information with a view to distort market equilibrium or making personal gains.
Notes:-
1 https://ifsca.gov.in/Document/Legal/ifsca-aml-cft-and-kyc-guidelines-202202112022051558.pdf
****
