Economic, Commercial and Intellectual Property Laws · Prevention of Money Laundering

Obligations of Reporting Entities under PMLA

Updated 11 October 2026 · Fact-checked

Under the Prevention of Money-Laundering Act, 2002, every reporting entity must verify the identity of clients and beneficial owners (section 11A), keep transaction and identity records (section 12), furnish prescribed information to the Director (section 12(1)(b)), and apply enhanced due diligence to specified transactions (section 12AA).

Understand Obligations of Banks, Financial Institutions and Intermediaries

A reporting entity is a person who sits on the money trail, such as a bank or a financial intermediary. The Act uses these entities as the first line of defence. They must know who their client is, remember what the client did, and tell the authorities when prescribed transactions occur.

There are four duties to learn. First, verify identity of clients and beneficial owners (section 11A). Second, maintain records of transactions and of identity documents (section 12). Third, furnish information to the Director, who heads the Financial Intelligence Unit-India (FIU-IND), the national agency that receives and analyses such reports. Fourth, carry out enhanced due diligence before a specified transaction (section 12AA).

Section 11A gives options for verification. A banking company may use Aadhaar authentication. Any reporting entity may use Aadhaar offline verification, a passport, or another officially valid document or mode notified by the Central Government. A non-bank can use Aadhaar authentication only if the Central Government permits it by notification, after consulting the UIDAI and the appropriate regulator.

The law protects the client too. Use of these modes is a voluntary choice, and no one can be denied services for not having an Aadhaar number. If Aadhaar authentication is used, the entity must also offer the other modes. Neither core biometric information nor the Aadhaar number may be stored when authentication or offline verification is used.

The Act sets the duty, and the rules fill in the detail. Section 15 lets the Central Government, in consultation with the Reserve Bank of India, prescribe the procedure and manner of maintaining and furnishing information. Section 73 lists the rule-making powers, such as the nature, value and time limit for reporting transactions.

Key rules to remember

Verification of identity: Section 11A(1): Aadhaar authentication (banking company) OR Aadhaar offline verification OR passport OR other notified officially valid document; Applies to clients and beneficial owners. Other entities may do Aadhaar authentication only if notified by the Central Government.
Voluntary choice and no denial: Section 11A(3): use of identification modes is voluntary; no service denied for lack of Aadhaar; Under section 11A(2), if Aadhaar authentication is used, the other modes must also be offered.
No storage rule: Section 11A(4): do not store core biometric information or Aadhaar number; Applies when authentication or offline verification is used.
Transaction records: Section 12(1)(a) and 12(3): keep records to reconstruct individual transactions for five years from the date of transaction; Includes transactions covered by the reporting duty.
Identity records: Section 12(1)(e) and 12(4): keep identity documents, account files and business correspondence for five years after the relationship ends or the account is closed, whichever is later; The clock starts at the end of the relationship, not at account opening.
Furnishing information: Section 12(1)(b): furnish to the Director, within the prescribed time, information on prescribed transactions, whether attempted or executed; Nature, value and time are set by rules (section 73(2)(i)).
Confidentiality: Section 12(2): information maintained, furnished or verified is confidential, save as otherwise provided by law; Do not state it as absolute.
Enhanced due diligence: Section 12AA(1): before each specified transaction - (a) Aadhaar authentication, (b) examine ownership and financial position including source of funds, (c) record purpose and intended nature of relationship; If the client fails, the transaction must not be allowed (section 12AA(2)). Records are kept for five years from the date of transaction (section 12AA(4)).
Specified transaction: Cash withdrawal or deposit above a prescribed amount; foreign exchange transaction above a prescribed amount; high value imports or remittances; other prescribed transactions; Amounts are prescribed by rules, so do not quote figures unless the question gives them.

How to solve Obligations of Banks, Financial Institutions and Intermediaries questions

Most questions give a fact pattern about a bank or intermediary and ask whether it complied, or ask you to explain the duties. Use this order.

1Identify the entity and confirm it is a reporting entity. Note whether it is a banking company, as this affects the Aadhaar mode.
2Spot which duty is in question: identity verification, record keeping, furnishing information, or enhanced due diligence.
3State the provision in plain words with the section number: 11A, 12 or 12AA.
4Apply it to the facts. Check the mode of verification, the period of retention, the timing, and whether the transaction is a specified transaction.
5Check the client-protection rules: voluntary choice, no denial of service, no storage of Aadhaar number or biometrics.
6Note that the nature, value, time and manner come from rules made under the Act (sections 15 and 73).
7Close with a clear conclusion: compliant or not, and what the entity must do.

Quickest way: Four-duty checklist

When to use it: Use when time is short and the question asks you to list or test compliance.

Write the four duties: Identify, Record, Report, Enhanced check.
Attach the section to each: 11A, 12(1)(a) and (e), 12(1)(b), 12AA.
Attach the retention rule: five years from transaction, or five years after the relationship ends.
Add the client protections: voluntary, no denial, no storage of Aadhaar number or biometrics.
Write one line of conclusion on the facts.

Common mistakes in Obligations of Banks, Financial Institutions and Intermediaries

Saying every reporting entity can use Aadhaar authentication.
Students remember Aadhaar as the main KYC tool.
Fix: Only a banking company can under section 11A(1)(a). Others may do so only if the Central Government permits by notification. All can use offline verification.
Treating the five-year period as the same for every record.
Both rules say five years, so they blur together.
Fix: Transaction records run five years from the date of transaction. Identity records run five years after the relationship ends or the account closes, whichever is later.
Saying a bank may refuse service to a client without Aadhaar.
KYC is thought of as mandatory Aadhaar.
Fix: Section 11A(3) makes the mode a voluntary choice and bars denial of services for not having an Aadhaar number.
Confusing section 11A verification with section 12AA enhanced due diligence.
Both involve verifying the client.
Fix: Section 11A applies to every client and beneficial owner. Section 12AA applies before each specified transaction and adds source-of-funds and purpose checks.
Quoting fixed rupee limits for cash or reporting thresholds.
Students recall figures from rules or circulars.
Fix: The Act says amounts are prescribed. Say that the nature, value and time are fixed by rules unless the question gives the figure.
Forgetting that attempted transactions must also be reported.
Students focus on completed transactions.
Fix: Section 12(1)(b) covers transactions whether attempted or executed.

Worked examples

Example 1

Sunrise Finance Ltd., a non-banking financial company, wants to verify its clients through Aadhaar authentication. A client, Meena, says she has no Aadhaar number. Advise Sunrise Finance.

Show the solution

Provision: section 11A(1) lists the modes of verification. Aadhaar authentication under clause (a) is available to a banking company. Another entity can use it only if the Central Government permits it by notification, after consulting the UIDAI and the appropriate regulator.
Facts: Sunrise Finance is not a banking company. Unless it has been so notified, it cannot perform Aadhaar authentication.
It can still use Aadhaar offline verification, a passport, or another officially valid document or mode notified by the Central Government.
Meena's position: under section 11A(3), the choice of identification mode is voluntary and no client can be denied services for not having an Aadhaar number. If authentication or offline verification is used, section 11A(4) bars storing her Aadhaar number or core biometric information.

Answer: Sunrise Finance cannot use Aadhaar authentication unless notified. It must accept another permitted mode, such as a passport or other officially valid document, and cannot deny Meena service for lacking an Aadhaar number.

Example 2

Horizon Bank closed the account of a client, Rakesh, on 31 March 2026. Rakesh's last transaction was on 10 January 2026. The bank wants to know until when it must keep (a) the record of that transaction and (b) Rakesh's identity documents.

Show the solution

Provision: under section 12(1)(a) and 12(3), transaction records are kept for five years from the date of transaction.
Apply: the transaction was on 10 January 2026, so the record must be kept until 10 January 2031.
Provision: under section 12(1)(e) and 12(4), identity documents, account files and business correspondence are kept for five years after the business relationship has ended or the account has been closed, whichever is later.
Apply: the account closed on 31 March 2026. Assuming no later end to the relationship, the period runs to 31 March 2031.

Answer: The bank must keep the transaction record until 10 January 2031 and the identity documents, account files and correspondence until 31 March 2031, assuming the relationship did not end later than the account closure.

Exam tips

Write the section number with each duty: 11A for identity, 12 for records and reporting, 12AA for enhanced due diligence.
Give both retention periods separately and name the starting point for each.
Use the structure: provision, application to facts, conclusion. A bare list of duties loses marks.
Mention that nature, value and time of reporting are prescribed by rules, and avoid inventing figures.
When asked about the FIU-IND, link it to the Director to whom information is furnished under section 12(1)(b), and keep the description short.

Practice questions from Prevention of Money Laundering

Obligations of Banks, Financial Institutions and Intermediaries in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Obligations of Banks, Financial Institutions and Intermediaries: frequently asked questions

What are the main obligations of reporting entities under PMLA?

They must verify the identity of clients and beneficial owners, maintain transaction and identity records, and furnish prescribed information to the Director. They must also apply enhanced due diligence before specified transactions.

What is the role of FIU-IND in these obligations?

The reporting entity furnishes prescribed information on transactions to the Director under section 12(1)(b). FIU-IND is the national agency that receives and analyses this information. Keep your answer anchored to the section.

How long must a reporting entity keep records?

Transaction records are kept for five years from the date of transaction. Identity documents, account files and business correspondence are kept for five years after the relationship ends or the account is closed, whichever is later.

Can a bank insist on Aadhaar for KYC?

No. Section 11A(3) makes the choice of identification mode voluntary, and services cannot be denied for not having an Aadhaar number. A bank using Aadhaar authentication must also offer the other modes.

What is a specified transaction under section 12AA?

It means a cash withdrawal or deposit above a prescribed amount, a foreign exchange transaction above a prescribed amount, a high value import or remittance, or another prescribed transaction. Before each one, the entity must apply enhanced due diligence.