Internal and Forensic Audit · Forensic Audit: Laws and Regulations

PMLA Obligations of Reporting Entities and the Role of FIU-IND

Updated 11 October 2026 · Fact-checked

Under the Prevention of Money-Laundering Act, 2002, a reporting entity must identify its clients, keep records, report suspicious and other prescribed transactions to the Financial Intelligence Unit (FIU-IND), and apply enhanced due diligence to specified transactions. Answer by stating the duty, applying it to the facts, and concluding with the consequence.

Understand PMLA Obligations of Reporting Entities and FIU-IND

Money laundering is the process of making money from crime look legitimate. The PMLA does not wait for a court to catch the launderer. It makes banks, financial institutions, intermediaries and other covered persons act as the first line of defence. These are called reporting entities.

A reporting entity has four broad duties: know your client, keep records, watch transactions, and report. Knowing the client is called KYC or client due diligence. Records let investigators rebuild a money trail later. Monitoring spots unusual activity. Reporting passes that information to the authorities.

The Financial Intelligence Unit - India (FIU-IND) is the central agency that receives, processes, analyses and shares this information with intelligence and enforcement agencies. It works under the Director appointed under the Act, who oversees the unit and its dealings with reporting entities. FIU-IND is not the prosecutor. It is the data hub. Prosecution and attachment are for the enforcement authorities.

Section 12AA, inserted with effect from 1-8-2019, adds enhanced due diligence for certain high-risk 'specified transactions'. These are cash withdrawals or deposits above a prescribed amount, foreign exchange transactions above a prescribed amount, high value imports or remittances, and other prescribed transactions or classes where there is high risk of money laundering or terrorist financing. The thresholds and manner of compliance are in the Rules, not in the section.

For a forensic auditor, these duties matter in two ways. First, you test whether the entity has complied. Second, gaps in KYC, records or reporting are red flags and also expose the entity to penalty.

Key rules to remember

Section 12AA(1): steps before each specified transaction: Verify identity (Aadhaar authentication) + examine ownership, financial position and source of funds + record purpose and intended nature of relationship; Done prior to commencement of each specified transaction. Where the person cannot obtain an Aadhaar number, another prescribed process or mode is used. Manner is as prescribed.
Section 12AA(2): consequence of client's failure: Client fails conditions → reporting entity shall not allow the specified transaction; This is a mandatory bar, not a discretion.
Section 12AA(3): suspicious clients: Suspicious or likely proceeds of crime → increase future monitoring and scrutiny of the relationship; Applies to a specified transaction or a series of them. Manner is as prescribed.
Section 12AA(4): retention of EDD information: Retention period = 5 years from the date of transaction between client and reporting entity; This is for information obtained under enhanced due diligence. Do not apply it blindly to all records.
Specified transaction (Explanation to s. 12AA): Cash withdrawal or deposit above prescribed amount | foreign exchange above prescribed amount | high value imports or remittances | other prescribed high-risk transactions; Do not quote a rupee threshold unless the question gives it.

How to solve PMLA Obligations of Reporting Entities and FIU-IND questions

Use this provision, analysis, conclusion method for any question on reporting entity duties.

1Identify who the person is. Check whether the facts describe a reporting entity, such as a bank, financial institution or intermediary.
2Identify the duty in play: client identification, record keeping, monitoring, reporting to FIU-IND, or enhanced due diligence.
3State the rule in plain words. For enhanced due diligence, quote the section 12AA steps.
4Test whether the transaction is a 'specified transaction'. Check cash, foreign exchange, high value imports or remittances, or a prescribed high-risk class.
5Apply the rule to the facts. Note what was done, what was missed, and whether the client failed the conditions.
6State the consequence: the transaction must not be allowed, monitoring must increase, or the record must be kept for the stated period.
7Add the practical point: documents to collect, register to maintain, report to file, and the role of the Principal Officer and FIU-IND.
8Conclude in one clear line that answers the question asked.

Quickest way: Four-question check

When to use it: Use when you have little time on a short-note or case question.

Who is the reporting entity?
Is it a specified transaction?
Were identity, ownership, source of funds and purpose checked before the transaction?
If not, the transaction should not have been allowed. If suspicious, increase monitoring and report to FIU-IND. Keep the information for five years.

Common mistakes in PMLA Obligations of Reporting Entities and FIU-IND

Treating FIU-IND as the body that prosecutes money launderers.
Students mix up FIU-IND with enforcement agencies.
Fix: Write that FIU-IND receives, analyses and disseminates financial information. Enforcement and prosecution lie elsewhere.
Quoting a fixed rupee threshold for cash or forex specified transactions.
Students memorise figures from rules or circulars.
Fix: The section says 'exceeding such amount' as prescribed. Use the amount only if the question gives it.
Saying the transaction can proceed with verification done later.
Confusion with ordinary onboarding practice.
Fix: Section 12AA(1) requires the steps prior to commencement of each specified transaction. Under s. 12AA(2), failure means the transaction shall not be allowed.
Applying the five-year retention to every record.
Students over-generalise section 12AA(4).
Fix: Say the section fixes five years from the date of transaction for information obtained under enhanced due diligence. Other record rules are as prescribed.
Stopping at KYC and forgetting source of funds and purpose of the transaction.
KYC is understood as identity proof only.
Fix: List all three limbs of s. 12AA(1): identity, ownership and financial position including source of funds, and purpose and intended nature of relationship.
Forgetting increased monitoring when a transaction looks suspicious.
Students focus on reporting alone.
Fix: Add section 12AA(3): greater scrutiny of the business relationship going forward.

Worked examples

Example 1

Meridian Finance Ltd, a reporting entity, is asked by a new client, Mr Arvind Rao, to carry out a large cash deposit that is a specified transaction. The client provides a PAN card but refuses to explain the source of the funds. The branch manager proceeds because the client is well known. Advise on the legal position.

Show the solution

Provision: under section 12AA(1) of the PMLA, a reporting entity must, before each specified transaction, verify the client's identity through Aadhaar authentication as prescribed, examine ownership and financial position including source of funds, and record the purpose and intended nature of the relationship.
Facts: a large cash deposit above the prescribed amount is a specified transaction. The client gave only a PAN card, and refused to explain the source of funds.
Analysis: identity verification by Aadhaar authentication, or the prescribed alternative where the person is not entitled to an Aadhaar number, is not shown. The source-of-funds step is not done. Being well known is not an exception in the section.
Consequence: under section 12AA(2), where the client fails the conditions, the reporting entity shall not allow the transaction.
Practical point: the refusal to disclose the source is itself a red flag. The entity should consider increasing monitoring of the relationship under section 12AA(3) and escalate to its Principal Officer to consider reporting to FIU-IND as per the Rules.

Answer: The manager acted wrongly. The deposit should not have been allowed, because the client did not meet the section 12AA(1) conditions. Meridian Finance should stop the transaction, document the refusal, escalate internally, and consider reporting to FIU-IND.

Example 2

Explain the role of FIU-IND and state how long information obtained under enhanced due diligence must be kept.

Show the solution

Role: FIU-IND is the central national agency that receives information from reporting entities, processes and analyses it, and shares it with intelligence and enforcement agencies. It works under the Director appointed under the Act.
Contrast: it does not prosecute. It supports investigation by turning raw transaction data into usable intelligence.
Link with reporting entities: entities provide reports and records as prescribed. FIU-IND can then identify patterns across institutions, which a single entity cannot see.
Retention: section 12AA(4) says information obtained while applying enhanced due diligence under section 12AA(1) must be maintained for five years from the date of transaction between a client and the reporting entity.
Practical point: store identity, source-of-funds and purpose records so they can be produced quickly to the authorities.

Answer: FIU-IND is the central intelligence hub for financial information under the PMLA, not a prosecuting body. Enhanced due diligence information must be kept for five years from the date of the transaction.

Exam tips

Write the section 12AA steps as a short numbered list. Examiners reward a complete list.
Never invent a rupee threshold. Say 'exceeding the amount prescribed'.
In case questions, always give a clear verdict: transaction allowed or not allowed, report or not report.
Separate the roles clearly: reporting entity reports, FIU-IND analyses, enforcement agencies act.
Add one practical point such as KYC file, register, Principal Officer or internal escalation to show drafting and compliance awareness.

Practice questions from Forensic Audit: Laws and Regulations

PMLA Obligations of Reporting Entities and FIU-IND in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

PMLA Obligations of Reporting Entities and FIU-IND: frequently asked questions

Who is a reporting entity under PMLA?

It is a person covered by the Act who must carry out client due diligence, keep records and report to FIU-IND. Banks, financial institutions and intermediaries are typical examples. Use the Act's definition when the question asks for it.

What is enhanced due diligence under section 12AA?

It is extra checking before a specified transaction. The entity verifies identity, examines ownership and source of funds, and records the purpose and nature of the relationship. If the client fails, the transaction is not allowed.

How long must records of enhanced due diligence be kept?

Section 12AA(4) requires the information to be kept for five years from the date of transaction between the client and the reporting entity. This is specific to information obtained under enhanced due diligence.

What does FIU-IND do with suspicious transaction reports?

It receives and analyses them with other financial data and shares relevant intelligence with enforcement and intelligence agencies. It does not itself prosecute.