Cost and Management Audit · Anti-Money Laundering

Authorities and Reporting Entities under PMLA

Updated 11 October 2026 · Fact-checked

Under the Prevention of Money-Laundering Act, 2002, a reporting entity must keep transaction records, furnish prescribed information to the Director, keep client identity records, and apply enhanced due diligence to specified transactions. The Director can inquire, warn, direct and fine for non-compliance. To solve questions, identify the duty, the time limit, and the consequence.

Understand Authorities and Reporting Entities under PMLA

Start with who does what. The Act puts duties on reporting entities. These are the banks, financial institutions and intermediaries that handle client money. The Director is the authority who checks whether they are doing their duties. The Central Government can set up an Inter-ministerial Co-ordination Committee so that ministries, law enforcement agencies, the Financial Intelligence Unit, India (FIU-IND) and regulators work together.

The reporting entity's core duties sit in Section 12. It must keep a record of all transactions so that it can reconstruct each one. It must furnish to the Director, within the prescribed time, information on transactions, whether attempted or executed, of the prescribed nature and value. It must also keep records of documents that prove the identity of clients and beneficial owners, plus account files and business correspondence. All such information must be kept confidential, unless another law provides otherwise.

Section 12AA adds enhanced due diligence for specified transactions. These include cash withdrawals or deposits above a prescribed amount, foreign exchange transactions above a prescribed amount, high value imports or remittances, and other prescribed high-risk transactions. Before the transaction, the entity must verify the client's identity through Aadhaar authentication (or another prescribed mode if the person cannot get an Aadhaar number). It must also examine ownership, financial position and source of funds, and record the purpose and intended nature of the relationship. If the client fails these conditions, the transaction must not be allowed.

The Director enforces this under Section 13. He may inquire, and may have the entity's records audited by a chartered accountant from a government panel, with the cost borne by the Central Government. If he finds a failure, he can issue a written warning, direct specific compliance, call for periodic reports, or impose a penalty of at least ₹10,000 and up to ₹1,00,000 for each failure. The thresholds, time limits and procedures are mostly left to rules made by the Central Government. Section 15 lets it prescribe the procedure after consulting the Reserve Bank of India.

The exact text of the Act you have been given does not use the labels KYC or STR. Treat them as the practical names for identity verification and for reporting suspicious transactions. The legal hooks are Sections 12 and 12AA, together with the rules.

Key rules to remember

Transaction records: retention: Retain for 5 years from the date of transaction between client and reporting entity; Section 12(3). Records must let the entity reconstruct individual transactions.
Client identity records: retention: Retain for 5 years after the business relationship ended or the account closed, whichever is later; Section 12(4). Covers identity documents, beneficial owners, account files and business correspondence.
Reporting to the Director: Furnish information on attempted or executed transactions within the prescribed time; Section 12(1)(b). The nature, value and time limit come from the rules.
Enhanced due diligence information: retention: Retain for 5 years from the date of transaction; Section 12AA(4). Note the start point differs from client identity records.
Enhanced due diligence steps: Verify identity (Aadhaar authentication) + examine ownership, financial position and source of funds + record purpose and intended nature of relationship; Section 12AA(1), before each specified transaction. If the client fails, do not allow the transaction (Section 12AA(2)).
Director's penalty: ₹10,000 ≤ penalty ≤ ₹1,00,000 for each failure; Section 13(2)(d). Other options: written warning, specific directions, periodic reports.
Confidentiality: Information maintained, furnished or verified is kept confidential unless another law provides otherwise; Section 12(2).

How to solve Authorities and Reporting Entities under PMLA questions

Use this method for any case or theory question on authorities and reporting entities under PMLA.

1Identify the party: the reporting entity, its designated director, an employee, or the Director.
2Name the duty breached or being tested: transaction records, furnishing information, client identity records, or enhanced due diligence.
3Quote the rule with its exact condition: for example, specified transaction, before commencement, or attempted or executed.
4Apply the time limit: five years from the transaction, or five years after the relationship ended or account closed, whichever is later.
5State what the entity must do: record, report, verify, refuse the transaction, or increase monitoring.
6State the Director's possible action: written warning, specific directions, periodic reports, or penalty of ₹10,000 to ₹1,00,000 for each failure.
7Note what the rules decide, such as amounts, forms and time limits, and conclude with a clear answer.

Quickest way: Duty, clock, consequence

When to use it: Use this for MCQs and short case questions where you have under two minutes.

Ask first: which section type is it, records (Section 12), enhanced checks (Section 12AA) or penalty (Section 13)?
For retention, ask what event starts the clock: transaction date or end of relationship.
For a penalty, check the range and that it is per failure.
For a failed client check, the answer is to refuse the specified transaction.
Eliminate options that give fixed numbers the Act leaves to rules.

Common mistakes in Authorities and Reporting Entities under PMLA

Applying one retention period start date to all records.
Both are five years, so students stop reading.
Fix: Transaction records run from the transaction date. Client identity records run from the end of the relationship or account closure, whichever is later.
Saying the penalty is a flat ₹1,00,000.
Students remember only the upper limit.
Fix: Write it as not less than ₹10,000 and up to ₹1,00,000 for each failure.
Treating suspicious transaction reporting as a separately numbered section you can quote.
Textbooks use the label STR freely.
Fix: Cite the duty to furnish information on transactions, attempted or executed, under Section 12(1)(b), with details as prescribed.
Forgetting that attempted transactions must also be reported.
Students think only completed transactions matter.
Fix: Use the phrase attempted or executed whenever you discuss reporting.
Allowing a transaction to go ahead when the client fails enhanced due diligence.
Students focus on documenting rather than refusing.
Fix: Under Section 12AA(2), if the client fails the conditions, the entity must not allow the specified transaction.
Saying the entity bears the audit cost when the Director orders an audit.
Students assume the audited party pays.
Fix: Under Section 13(1B), the Central Government bears the expenses of the audit under Section 13(1A).

Worked examples

Example 1

A bank closed a client's account on 30 June 2026. The account was opened in 2019. The bank also holds a transaction record for a deposit made on 10 March 2026. Until when must the bank keep (a) the identity documents and account files, and (b) the record of the 10 March 2026 transaction?

Show the solution

Identity documents and account files fall under Section 12(1)(e).
Under Section 12(4), keep them for five years after the relationship ended or the account was closed, whichever is later. Here the account closed on 30 June 2026, so the period runs to 30 June 2031.
The transaction record falls under Section 12(1)(a).
Under Section 12(3), keep it for five years from the date of the transaction, so until 10 March 2031.

Answer: (a) Until 30 June 2031. (b) Until 10 March 2031.

Example 2

A reporting entity fails to comply with obligations under the Act on three separate occasions. The Director finds the failures during an inquiry and decides to impose a monetary penalty only. State the minimum and maximum penalty he can impose in total, and list his other options.

Show the solution

Section 13(2)(d) allows a penalty of at least ₹10,000 and up to ₹1,00,000 for each failure.
For three failures the minimum is 3 × ₹10,000 = ₹30,000.
The maximum is 3 × ₹1,00,000 = ₹3,00,000.
Other options under Section 13(2) are a written warning, a direction to comply with specific instructions, or a direction to send periodic reports on the measures being taken.
These are without prejudice to any other action under the Act.

Answer: Total penalty can range from ₹30,000 to ₹3,00,000. The Director may alternatively issue a written warning, give specific directions, or require periodic reports.

Exam tips

Learn the three retention rules separately and note each start date.
In case questions, link each fact to a duty: record, report, verify or refuse.
Quote exact conditions such as specified transaction, before commencement and per failure.
Do not invent thresholds for cash or foreign exchange. Say they are as prescribed.
Mention the Inter-ministerial Co-ordination Committee under Section 72A when asked about co-ordination among agencies.

Practice questions from Anti-Money Laundering

Authorities and Reporting Entities under PMLA in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CS ProfessionalPMLA Obligations of Reporting Entities and FIU-IND

Authorities and Reporting Entities under PMLA: frequently asked questions

What is the role of the Director under PMLA for reporting entities?

The Director can inquire into whether reporting entities meet their obligations, either on his own motion or on an application. If he finds failures, he can warn, direct, call for reports or impose a monetary penalty under Section 13.

How long must a reporting entity keep records?

Transaction records are kept for five years from the date of transaction. Client identity records are kept for five years after the relationship ends or the account is closed, whichever is later.

How do I answer a question on filing a suspicious transaction report?

Base the answer on Section 12(1)(b), which requires furnishing to the Director information on transactions, attempted or executed, within the prescribed time. State that the nature, value and time limit come from the rules.

What is enhanced due diligence?

It is the extra checking required before a specified transaction under Section 12AA. The entity verifies identity, examines ownership and source of funds, and records the purpose of the transaction. If the client fails, the transaction must not be allowed.