Anti-Money Laundering: The Obligations on a Financial Intermediary

Anti-money laundering obligations require a financial intermediary to establish who its customers are, monitor activity against what it knows about them, report defined categories of transaction and suspicion, and keep records of all of it. The obligations come from the governing law and from the regulator's directions, read at sebi.gov.in and rbi.org.in, and they apply because the firm is a route through which money moves.

Start with a toll plaza on a state highway. Nobody built it to find anybody. The plaza exists because two cities are joined by one road and the road has to be paid for. But because every vehicle travelling between those two cities has to slow down at the same set of booths, the plaza becomes the only place on the whole route where somebody could reliably be required to look at who is passing. A chokepoint is exactly that: not a trap, and not an accusation, just a place where everything narrows to a point at which looking becomes possible.

A financial intermediary is a chokepoint in exactly that sense, and every anti-money laundering obligation follows from that one structural fact. Money moving through the regulated system has to pass somebody. The whole apparatus of anti-money launderingThe set of obligations requiring an intermediary to know its customers, to watch their activity, to report defined matters, and to keep the record of all three. obligation is built on making that somebody look, keep looking, and write down what they saw. The apparatus is not built on making that somebody solve anything. The distinction sounds small at first and it turns out to be the difference between a duty a compliance function can actually discharge and one that would be impossible.

Anti-money laundering obligations are Indian and do not travel. The obligations sit in the governing Indian anti-money laundering law and in the directions and circulars made under it, applied to market intermediaries by the Securities and Exchange Board of India and to the entities it supervises by the Reserve Bank of India. India implements standards that originate with the Financial Action Task Force, a body addressing countries rather than firms.

Every reporting threshold, limit, retention period and interval is read from the live text at the source. Thresholds move, they move without announcement, and a reader who carries away a threshold learned from teaching material will apply it with more confidence than anybody who never learned it at all. The shape is what can be carried away safely: what the four obligations are, how they connect, and which of them a firm is most likely to get wrong.

No customer, no occupation, no place and no pattern of activity is suspicious in itself. Whether anything is suspicious is judged inside a firm, with that one customer's facts in front of it.

Bhadra Securities Private Limited, an invented broker that is also a depository participant, carries these obligations inside the compliance function that Yashodhan Pai runs, alongside everything else that function carries. One inspection there looked at 3 areas of the firm's activity and wrote up 5 observations. The firm answered 3 of the 5 well enough that those 3 closed. The remaining 2 stayed open. Of the 2 left open, 1 was settled with no investigation at all, and 1 turned into an investigation covering a single matter. The investigation ended in one order. A sequence of that shape says nothing about which obligation was at issue. An inspection looks across everything a firm does, and an order names only the matter it decides.

What do anti-money laundering obligations require, in four groups?

Four groups, and they are worth learning as four because a firm can be strong in some and hollow in others without anybody noticing from the outside. Identify: establish who the customer is and who stands behind the customer. Monitor: compare what the customer actually does against what the firm already knows about them. Report: notify the designated authority of the categories of transaction and the kinds of suspicion the rules define. Record: retain the evidence that the first three happened, in a form somebody who was not there can read afterwards.

Look at the order before anything else. The order is doing work. Identification comes first because monitoring has nothing to compare against until it exists. Monitoring comes before reporting because reporting is what happens when monitoring produces something. And recording sits underneath all three rather than after them. Each of the first three produces evidence at the moment it happens and produces none at all if nobody captures it then.

The four groups are one chain rather than four separate duties, and a break anywhere in the chain makes the parts on either side of the break worth much less than they look. A firm with excellent identification and no monitoring has a chain broken at the first joint. A firm that monitors well and records nothing has one broken at the last. Both firms can describe a complete process in a policy document, and both are missing the step that turns the process into a control.

Why does a risk based approach mean the effort is deliberately unequal?

A risk based approachApplying more effort where the assessed risk is higher, rather than applying identical effort to everybody. means the firm applies more effort where the assessed risk is higher and less where it is lower, and this is the design rather than a compromise with it. The standard being aimed at looks at first like uniformity, in which every customer is treated identically and any variation is a lapse somebody will be pulled up for. The opposite is closer to the truth.

The everyday version is a hospital triage counter. Everybody who walks in is seen. Nobody is turned away and nobody is judged at the door. But the person with a cut finger and the person with chest pain do not get the same amount of the doctor's time, and a hospital that insisted on giving them the same amount would be worse at its job, not fairer at it. Effort is finite, and spreading it evenly across a queue guarantees nothing except that it is thin everywhere.

Unequal effort is what the obligations ask for, so a firm that treats every customer identically has not achieved a higher standard, it has spent the same total attention less usefully. Two consequences follow. One is that an unequal allocation with no stated basis is indistinguishable from an arbitrary one, so the firm has to be able to say how it assessed risk. The other is that the assessment is not a permanent label. A firm's knowledge of a customer changes, and an approach that graded everybody once and never again has quietly become a uniform approach with a historical accent.

Who do the obligations apply to, and why an intermediary rather than everybody?

The obligations apply to the firms through which money and instruments move under a licence: banks and the other entities the Reserve Bank of India supervises, and market intermediaries such as brokers, depository participants, portfolio managers and mutual fund distributors on the securities side. Bhadra Securities Private Limited is caught by both descriptions in different parts of its business. Being caught by both is ordinary rather than unusual, and it is one reason a compliance function carries two rulebooks at once.

The reason the duty attaches there and not everywhere is the toll plaza point made concrete. There is no point at which anybody could check a rule requiring every person in the country to establish the source of everybody they dealt with, so such a rule would be unenforceable and would achieve almost nothing. The small number of licensed firms through which money enters and leaves the regulated system are identifiable, inspected and already keeping records. A rule requiring them to establish who is using them is therefore enforceable.

An intermediary is the one place in the route where looking is structurally possible, so the obligations sit there. The duty is a consequence of holding the licence rather than a suspicion attached to anybody. The distinction matters for how a firm talks to its own customers. Being asked for documents is not an accusation and being asked again later is not an escalation. The licence is doing what the licence requires, in the same way that a pharmacy asking for a prescription is not a comment on the person holding it.

What does identifying a customer actually involve?

Customer identificationEstablishing who a customer is and who ultimately stands behind that customer, rather than collecting a set of documents. is the group that feels most familiar. Everybody has handed documents across a counter and watched somebody photocopy them. The counter experience teaches the wrong lesson. The obligation is not to collect a set of documents. The obligation is to establish who the customer is and who stands behind the customer, with the documents as evidence of the establishing rather than the establishing itself.

For an individual customer the two questions collapse into one. The individual case is therefore a poor guide to the rest. For anything that is not an individual, a company, a partnership, a trust, a society, the two questions come apart immediately. A company is a legal person and it can be identified perfectly well by name, registration and address, and none of that names a single human being. Behind it there are holders, and behind some of those holders there may be other entities, and behind those there are eventually people.

Reaching those people is the whole object of identification. The beneficial ownerThe person who ultimately holds or controls a customer, reached by working through any entities that sit in between. is the person who ultimately holds or controls the customer, and identifying them means working through each layer rather than stopping at the first one that has a name and a certificate. Identification works through to people, and a file that stops at a company name has recorded the customer without ever establishing who is behind the customer. The obligation is unmet however thick the file is.

What is monitoring, and what is the activity compared against?

MonitoringComparing what a customer actually does against what the firm already knows about that customer, on a continuing basis rather than once. is comparing what a customer actually does against what the firm already knows about that customer. The second half of that sentence is where all the content is. Monitoring is not watching activity in the abstract, and it is not looking for activity that seems odd in general. Nothing is odd in general. Activity is compared against a specific expectation that identification produced, for a specific customer.

Think of a landlord who has rented the same shop unit for eleven years. He is not watching the street for anything unusual. Watching a whole street would be exhausting and would tell him nothing. He knows one tenant, he knows what that tenant's business looks like across a normal month, and what he notices is the shape changing: shutters down on the days that were always the busiest, a delivery pattern that inverted. He is not more observant than anybody else on that street. He simply has one thing to compare against, and nobody else on the street has it.

Monitoring is continuing rather than periodic in principle, and what it detects is not activity that is strange in itself but activity that does not fit what the firm already knew. Notice how much this depends on the earlier group. A firm that recorded a customer's expected activity thinly at the start has given its monitoring nothing to work with, and no amount of attention later recovers a comparison that was never set up. The dependence of monitoring on identification is why the order of the two groups is not arbitrary.

Why are identification and monitoring two obligations rather than one?

Because one of them establishes a baseline and the other one uses it, and the second is not implied by the first. The distinction between a baseline and the use of it is the single most useful one here, and it is also the one most often collapsed. Firms collapse it by treating the onboarding pack as the obligation, on the reasonable sounding view that knowing who somebody is must be the substance of the know your customer obligation. Knowing who somebody is begins that obligation rather than completing it.

Take two firms holding identical files. Both have complete identification for every customer, worked through to people, with everything evidenced. The first firm compares nothing that happens afterwards against those files. The second firm compares activity against them continuously. On paper, at an inspection that only asks to see files, the two firms look the same. In substance one of them has a control and the other has a very well organised set of paper.

A baseline that nothing is ever measured against is not a baseline, it is just information, so identification without monitoring produces a filing cabinet rather than a control. The word control is doing precise work here. A control is something that would produce a different outcome if something were wrong. A file that sits in a cabinet produces the same outcome in every state of the world, and an unchanging outcome is exactly what a control does not have, however complete and however well indexed the file is.

What must be reported, and to whom?

ReportingNotifying the designated authority of the categories of transaction and the kinds of suspicion that the rules define. means notifying a designated authority of two different things, and separating them is worth doing because they behave differently. The first is a set of defined categories of transaction. The rules describe those categories and the firm identifies them mechanically. The second is suspicion, and suspicion is not mechanical. Suspicion arises when something the firm observes does not fit what the firm knows, and it is formed inside the firm on the facts in front of it.

Where the categories are defined, the firm has no discretion and needs none. Something either falls in the defined category or it does not, and the report follows without anybody forming a view about the customer. The absence of discretion is deliberate. A duty that depended entirely on the judgement of individuals would produce completely different behaviour in two identical firms, and the defined categories are the part of the system that does not vary.

The suspicion route is different in kind. The suspicion route depends on monitoring having happened, and the chain shows itself here for the second time. A firm that never compares activity against what it knows has no mechanism by which a suspicion could form in the first place, so its reporting will consist entirely of the defined categories. Such a firm is not quietly deciding not to report. The firm has removed its own capacity to reach the second route at all, usually without ever intending to.

The reporting obligation runs to a designated authority rather than to the customer, to the market, or to anybody else in the firm's commercial world, and the route is fixed by the rules rather than chosen by the firm. The authority, the form and the channel are all specified where the obligations are read, at sebi.gov.in for a market intermediary and at rbi.org.in for an entity the Reserve Bank of India supervises.

What happens after a report, and what may the firm not do?

Here is the part that surprises people, and it surprises them because instinct points the other way. After a report is made the firm tells the customer nothing. Not a hint, not a change of tone, not a helpful suggestion that the customer might want to move elsewhere. Telling a customer that they have been reported is tipping offTelling a customer, directly or by implication, that they have been reported. It is prohibited., and it is prohibited. The prohibition is one of the firmest rules anywhere in this area.

The second half is stranger still on first meeting. The firm does not decide whether a crime occurred. The firm does not investigate, it does not build a case, and it does not reach a conclusion about the customer. The firm reports what it is required to report, and unless it is told otherwise by somebody entitled to tell it, it carries on dealing with the customer normally. The report is not a verdict and the firm is not a court.

Reading the duty as decide whether this is a crime is what makes anti-money laundering feel impossible, and the duty has never said that. Sit with how much that removes. The firm is not asked to be certain. The firm is not asked to be right about the customer. The firm is asked to look, to compare, to report what the rules say to report, to say nothing to anybody it should not, and to keep the record. Every one of those is a thing a compliance function can actually do on a Tuesday morning. Determining whether a crime occurred is not, and was never on the list.

What records must sit behind all of it?

Record keepingRetaining the evidence of identification, monitoring and reporting, in a form somebody who was not there can read afterwards. is the fourth group and it is the one every firm believes it is good at, usually with justification. Filing is the oldest skill a back office has. The trap is narrower than it looks. Firms are good at retaining the documents identification produced. Firms are much weaker at retaining the evidence that monitoring happened and produced a result, partly because that evidence is a process leaving traces rather than a document arriving in an envelope.

Three questions define what has to survive. Who was identified, and how was the identification established. Establishing an identification is a different question from taking documents. Then what was monitored, against what, and what came out of the comparison, including the comparisons where nothing came out. Last, what was reported and when, held somewhere a person who was not present can find it afterwards.

Unrecorded work is indistinguishable from work that was never done, so the record is not administration that follows the obligation but the only form in which the obligation can be shown to have been met. The position is uncomfortable and it is also fair. Nobody reviewing the function later has access to what anybody remembers. A reviewer has access to what was written down at the time, and the honest position is that a firm which did excellent work and captured none of it is in the same evidential place as a firm that did none.

How does an inspector actually test whether the four groups are working?

The way the function is tested matters to anybody who sits inside a compliance function, reviews one, or simply wants to understand why a firm asks for the same document twice in five years. Somebody testing the function does not read the four groups in the order set out above. A tester reads them in the order that separates a working function from a described one, and that order starts in the middle.

The first request is rarely the customer files. Customer files are what every firm has ready. The more searching request is for the monitoring output: what comparisons ran, over what period, what they produced, and what happened to each thing they produced. A function that can hand that over in an afternoon is almost certainly working. A function that has to build it after the request is saying something without meaning to. Output assembled retrospectively is output that nobody was using.

The second question follows the first thing the output produced. Somebody picks one item and asks what happened to it next, then follows it to whatever it became, including if it became nothing. A comparison that produced a question, a question that somebody answered, and an answer somebody recorded is a complete loop. An inspector is not testing whether the firm has the four groups. Every firm has the four groups on paper. The test is whether anything ever travels between them.

The household version of this is the request a customer receives. When a firm asks a customer to confirm details given years ago, it is not reacting to anything about that customer. The firm is refreshing a baseline that has aged. A baseline set once and never revisited slowly stops describing anybody. The annoyance is real and the alternative is worse. The alternative is a firm comparing today's activity against an expectation formed about a different stage of a person's life.

What are these obligations not for?

The confusion does real damage to how the duty feels, so it is worth saying plainly. The obligations are not a mechanism for the firm to determine whether a crime occurred. Nor are they a mechanism for the firm to investigate anybody, to gather evidence for a proceeding, or to reach a conclusion about a customer's character or business. And they are not a licence for a firm to decide that some category of person is inherently suspect. No rule asks for that, and no rule could sensibly ask for it.

The purpose is narrower and much more achievable. The obligations put a party who can see something in a position to see it, require that party to look in a defined way, and require what is seen to reach somebody whose work it is to do something with it. The firm is one part of a longer arrangement, and it is the part with the visibility rather than the part with the authority.

Knowing where the firm's part stops is what makes these obligations bearable, and a function that has quietly taken on the deciding will be exhausted, slow and wrong about its own duty at the same time. There is a practical tell for this. When a compliance function starts arguing internally about whether a customer is probably innocent, it has drifted across a boundary that the rules drew for it. Probably innocent and probably not are both determinations, and neither is on the firm's list.

Where are the obligations read, and why is the shape taught rather than the figure?

Two rulebooks, and a firm like Bhadra Securities Private Limited sits under both without either one mentioning the other. For its activity as a market intermediary the obligations and the directions on how to discharge them are read at sebi.gov.in, in the governing anti-money laundering law and in the master circular and guidelines the Securities and Exchange Board of India issues to intermediaries. For activity that falls under the Reserve Bank of India, the equivalent directions are read at rbi.org.in. India implements standards that originate with the Financial Action Task Force at fatf-gafi.org. The Task Force sets standards for countries and imposes nothing directly on any firm.

The obligations are stable in shape and unstable in detail. The shape can be learned once. The detail has to be read at the source every time. Identification, monitoring, reporting and recording have been the four groups for a long time and are unlikely to stop being them. Every threshold, every limit, every retention period and every form is a moving part, and each moves without anybody sending a notice to whoever learned the old one. A reader who has the shape can read the live text intelligently. A reader carrying a number away from teaching material will apply it confidently long after it stopped being true.

Bhadra Securities Private Limited and Yashodhan Pai are invented.
Educational material. Not advice on any investment, tax, budget or market position.