Of the Prevention of explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 9 is the core of the identity rules. Its first three sub-rules say when a reporting entity must carry out client due diligence, what it must do, how KYC records go to the Central KYC Records Registry, when it may rely on a third party, and how the beneficial owner of a company, firm, association or trust is worked out. The documents each type of client must give are in sub-rules (4) onwards, which have their own article.
This article reads the rule as per the consolidated Rules consulted (amendments listed up to 19 July 2024). The Rules sit alongside the Act, whose text consulted shows amendments only up to 1 August 2019; later changes to either should be checked. Reporting entities designing onboarding can start with financial and legal due diligence support to match their forms to the rule.
A reporting entity must, at the start of an account-based relationship or for an occasional transaction of fifty thousand rupees or more (or any international money transfer), identify the client, verify identity from reliable and independent sources, understand the business, and identify the beneficial owner. It must file the electronic KYC records with the Central KYC Records Registry within ten days of commencement and may reuse records through the KYC Identifier. A third party can be relied on only on set conditions, and the reporting entity stays ultimately responsible. The beneficial owner of a company is the natural person with more than ten percent ownership interest or control.
How rule 9 relates to the Act
The Act deals with the same subject in two places: section 11A, which requires every reporting entity to verify the identity of its clients and the beneficial owner by the modes it lists (see our article on sections 11 and 11A), and section 12(1)(e), which requires records of documents evidencing identity of clients and beneficial owners to be maintained (see our article on section 12). Rule 9 supplies the operating detail. The Act's own definition of "beneficial owner" in section 2(1)(fa) is "an individual who ultimately owns or controls a client of a reporting entity or the person on whose behalf a transaction is being conducted", including "a person who exercises ultimate effective control over a juridical person"; rule 9(3) says how the term is determined "for the purpose of sub-rule (1)".
Key definitions in rule 2(1)
| Clause | Term | As printed (summarised) |
|---|---|---|
| (ac) | Central KYC Records Registry | A reporting entity, substantially owned and controlled by the Central Government, authorised by notification to receive, store, safeguard and retrieve the KYC records in digital form of a client |
| (b) | Client due diligence | Due diligence carried out on a client referred to in clause (ha) of sub-section (1) of section 2 of the Act, using reliable and independent sources of identification |
| (cc) | KYC Identifier | The unique number or code assigned to a client by the Central KYC Records Registry |
| (cd) | KYC records | The records, including electronic records, relied upon by a reporting entity in carrying out client due diligence as referred to in rule 9 |
Sub-rule (1): when and what
When. At the time of commencement of an account-based relationship, or while carrying out an occasional transaction of an amount equal to or exceeding fifty thousand rupees, whether conducted as a single transaction or several transactions that appear to be connected, or any international money transfer operations. (The copy runs some words together, for example "outoccasional"; the sense is as stated. Markers 3 and 35 stand for G.S.R. 816(E) dated 12.11.2009 and G.S.R. 745(E) dated 17.10.2023.)
What. The reporting entity must:
- (a) identify its clients, verify their identity using reliable and independent sources of identification, and obtain information on the purpose and intended nature of the business relationship, where applicable;
- (b) take reasonable steps to understand the nature of the customer's business, and its ownership and control; and
- (c) determine whether a client is acting on behalf of a beneficial owner, and identify the beneficial owner and take all steps to verify the identity of the beneficial owner, using reliable and independent sources.
First proviso: delayed verification. Where the Regulator is of the view that money laundering and terrorist financing risks are effectively managed and where this is essential not to interrupt the normal conduct of business, the Regulator may permit the reporting entity to complete verification as soon as reasonably practicable following the establishment of the relationship.
Second proviso: foreign-resident beneficial owner. Where a client subscribing or dealing with depositary receipts or equity shares issued or listed in jurisdictions notified by the Central Government, of a company incorporated in India, acts on behalf of a beneficial owner who is a resident of such jurisdiction, the determination, identification and verification of that beneficial owner is as per the norms of such jurisdiction, and sub-rules (3) to (9) do not apply to that beneficial owner. The Explanation refers to the meaning of equity share capital in the Explanation to section 43 of the Companies Act, 2013 (18 of 2013); check the current company law for the corresponding provision.
Sub-rules (1A) to (1H): the Central KYC Records Registry
| Sub-rule | What it provides |
|---|---|
| (1A) | Subject to sub-rule (1), every reporting entity shall, within ten days after the commencement of an account-based relationship (marker 22: G.S.R. 1078(E) dated 31.10.2018), file the electronic copy of the client's KYC records with the Central KYC Records Registry |
| (1B) | The Registry processes the records for de-duplication and issues a KYC Identifier for each client to the reporting entity, which communicates it in writing to the client |
| (1C) | For verification of identity, or ongoing due diligence under sub-rule (12)(iii), the reporting entity shall seek or retrieve the KYC Identifier and obtain KYC records online, and shall not require the client to submit the same records again unless (a) there is a change in the information; (b) the record is incomplete or not as per current applicable KYC norms of the regulator; (c) the validity period of downloaded documents has lapsed; or (d) the reporting entity considers it necessary to verify identity or address, perform enhanced due diligence or build a risk profile |
| (1D) | After obtaining additional or updated information under (1C), the reporting entity shall furnish it to the Registry within seven days or such period as the Central Government notifies; the Registry updates the record and informs electronically all reporting entities that have dealt with the client |
| (1E) | The reporting entity which performed the last KYC verification or sent updated information is responsible for verifying the authenticity of the identity or address |
| (1F) | A reporting entity shall not use KYC records obtained from the Registry for purposes other than verifying identity or address, and shall not transfer them to a third party unless authorised by the client, the Regulator or the Director |
| (1G) | The regulator shall issue guidelines to ensure that the Central KYC records are accessible to reporting entities in real time |
| (1H) | If the Registry informs an update under (1D), the reporting entity shall retrieve the updated records and update its own record as per the regulator's guidelines under sub-rule (14) and rule 9A(2)(g) |
Sub-rules (1C), (1D) and (1H) carry marker 36 (G.S.R. 419(E) dated 19.07.2024). Printing point: sub-rule (1D) has no heading of its own in the copy; a stray line "Rule 9(1D)" precedes its text. It is read as the sub-rule between (1C) and (1E).
The functions of the Registry itself are in rule 9A, covered in our article on rules 9A to 11.
Sub-rule (2): reliance on a third party
For clause (a) of sub-rule (1), a reporting entity may rely on a third party subject to these conditions:
- (a) the reporting entity immediately obtains from the third party or from the Central KYC Records Registry the record or information of the client due diligence carried out by the third party;
- (b) it takes adequate steps to satisfy itself that copies of identification data and other relevant documentation will be made available from the third party upon request without delay;
- (c) it is satisfied that the third party is regulated, supervised or monitored for, and has measures for compliance with, client due diligence and record-keeping requirements in line with the Act;
- (d) the third party is not based in a country or jurisdiction assessed as high risk;
- (e) the reporting entity is ultimately responsible for client due diligence and for enhanced due diligence measures, as applicable; and
- (f) where it relies on a third party in the same financial group, the Regulator may issue guidelines to consider any relaxation in conditions (a) to (d).
Sub-rule (3): who is the beneficial owner
The beneficial owner for the purpose of sub-rule (1) is determined as follows.
| Client | Beneficial owner as printed |
|---|---|
| (a) Company | The natural person(s), acting alone or together, or through one or more juridical person, who has a controlling ownership interest or who exercises control through other means. Explanation 1: "controlling ownership interest" means ownership of or entitlement to more than ten percent of shares or capital or profits of the company (the figure is printed in brackets, marker 33: G.S.R. 1074(E) dated 07.03.2023). Explanation 2: "control" includes the right to appoint a majority of the directors or to control the management or policy decisions, including by virtue of shareholding, management rights, shareholders agreements or voting agreements |
| (b) Partnership firm | The natural person(s) who has ownership of or entitlement to more than ten percent of capital or profits of the partnership, or who exercises control through other means (marker 34: G.S.R. 652(E) dated 04.09.2023); "control" includes the right to control the management or policy decision |
| (c) Unincorporated association or body of individuals | The natural person(s) with ownership of or entitlement to more than fifteen percent of the property or capital or profits |
| (d) Where no natural person is identified under (a), (b) or (c) | The relevant natural person who holds the position of senior managing official |
| (e) Trust | Includes identification of the author of the trust, the trustee, the beneficiaries with ten percent or more interest in the trust and any other natural person exercising ultimate effective control through a chain of control or ownership |
| (f) Listed entities | Where the client or owner of the controlling interest is an entity listed on a stock exchange in India, or resident in notified jurisdictions and listed there, or a subsidiary of such listed entities, it is not necessary to identify and verify any shareholder or beneficial owner of such entities |
The percentages are exactly as printed. The Rules' company test is a rule-specific one and this article does not compare it with any test in company law; the company-law posts on significant beneficial owners deal with a different test.
A worked example
Tirupati Steel Industries Pvt Ltd (invented) applies to open a current account. At the start, the bank identifies the company, verifies its identity from reliable and independent sources and asks about the purpose of the account (sub-rule (1)(a)). It looks at ownership: Mr Gopal Iyer (invented) holds 12 percent of the shares and a trust holds 30 percent, with trustees as per its deed. Under sub-rule (3)(a), Mr Iyer holds more than ten percent and is a beneficial owner; for the trust, the bank identifies the author, trustee and beneficiaries with ten percent or more interest under (3)(e) and anyone exercising ultimate effective control. Within ten days of commencing the relationship the bank files the KYC records with the Registry, and when Mr Iyer next opens an account at another bank, that bank can retrieve the records through the KYC Identifier unless one of the exceptions in (1C) applies.
If the bank had relied on a broker's KYC, sub-rule (2) would apply and the bank would remain ultimately responsible.
Need help aligning onboarding with rule 9?
The ownership tests, the ten-day filing and the third-party conditions all need to be reflected in forms and checklists. Our team assists through financial and legal due diligence, starting from the onboarding documents you use now.
Key takeaways
- Client due diligence is triggered at commencement of an account-based relationship or an occasional transaction of fifty thousand rupees or more, or any international money transfer.
- The reporting entity identifies and verifies the client, understands its business and ownership, and identifies and verifies the beneficial owner.
- KYC records go to the Central KYC Records Registry within ten days; updates within seven days or the notified period.
- Reliance on a third party is allowed on six conditions, and the reporting entity remains ultimately responsible.
- Beneficial owner tests: more than ten percent for a company or partnership firm, more than fifteen percent for an unincorporated association or body of individuals, ten percent or more for trust beneficiaries.
- Check the current Rules and regulator directions for changes after 19 July 2024.
Read next
- Rule 9(4) to (19) PML Rules: KYC documents by client type and ongoing due diligence
- Rules 9A-11 PML Rules: Central KYC registry, record retention and audit
- Section 11A PMLA: verification of identity by a reporting entity
- KYC requirements under PMLA: CDD and EDD
Disclaimer: Based on the consolidated text of the Prevention of Money-laundering Act, 2002 published by the Enforcement Directorate, showing amendments up to Act 23 of 2019 (1 August 2019), and on the Department of Revenue consolidated copy of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005 listing amendments up to 19 July 2024, as consulted on 2 October 2026. Later amendments, notifications, other rules and regulator directions should be checked. This article is general information, not legal advice; check the official text before acting.