Rule 9(4) to (19) of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005: KYC documents by client type and ongoing due diligence

Rule 9 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.

After rule 9(1) to (3) sets out when client due diligence is done, rule 9(4) to (19) says what documents each type of client must give and what a reporting entity must keep doing after the account is opened. It covers individuals, companies, partnership firms, trusts and associations, the small account, a ban on anonymous accounts, ongoing due diligence, risk assessment, Aadhaar-related steps and the digital KYC process in Annexure 1.

This article reads the rule as per the consolidated Rules consulted (amendments listed up to 19 July 2024). Later changes to the Rules and regulator directions should be checked. A business that has to collect these documents from its own clients can begin with financial and legal due diligence to align its checklist to the rule.

An individual gives the Aadhaar number (where benefits are sought or it is offered voluntarily) or proof of possession of Aadhaar or an officially valid document, the Permanent Account Number or Form No. 60, and any other documents on business and financial status the reporting entity requires. A company, partnership firm, trust or association gives certified copies of its constitution documents, resolutions, PAN and details of those who act for it. Anonymous or fictitious accounts are not allowed (sub-rule (11)). Due diligence is ongoing, risk is assessed and documented, and the regulator issues guidelines.

Rule 2 definitions this rule uses

The definition of "officially valid document" has provisos for simplified measures (identity card with photograph from Government and other listed bodies; letter from a gazetted officer; utility bill, property or municipal tax receipt, bank statement and similar for proof of address), for foreign nationals and International Financial Services Centres, and an Explanation that a document remains valid after a change of name supported by a marriage certificate or Gazette notification. Printing point: the copy prints the list of documents twice, the second time without amendment markers; it is read as printed and the official text should be checked. Clause (bba) prints "digitial KYC" and clause (i) prints "Aadhar", both quoted as printed.

Sub-rule (4): an individual

A client who is an individual shall, for sub-rule (1), submit to the reporting entity:

• (a) the Aadhaar number where (i) he is desirous of receiving any benefit or subsidy under any scheme notified under section 7 of the Aadhaar Act, 2016, or (ii) he decides to submit it voluntarily to a banking company or a reporting entity notified under the first proviso to section 11A(1) of the Act; or
• (aa) the proof of possession of Aadhaar number where offline verification can be carried out; or
• (ab) the proof of possession of Aadhaar number where offline verification cannot be carried out, or any officially valid document or its equivalent e-document containing details of identity and address; and
• (b) the Permanent Account Number or its equivalent e-document, or Form No. 60 as defined in the Income-tax Rules, 1962; and
• (c) such other documents, including in respect of the nature of business and financial status of the client, or equivalent e-documents, as the reporting entity may require.

Section 11A of the Act, read in our article on sections 11 and 11A, makes the Aadhaar mode a voluntary choice of the client. Check the current law for the corresponding provision of the Aadhaar Act, 2016 and the Income-tax Rules, 1962, both named as printed.

Sub-rule (5): the small account

An individual who desires to open a small account in a banking company may, as an alternative to sub-rule (4), be allowed to do so on production of a self-attested photograph and affixation of signature or thumb print on the form. Rule 2(1)(fc) defines a small account as a savings account where aggregate credits in a financial year do not exceed rupees one lakh, aggregate withdrawals and transfers in a month do not exceed rupees ten thousand, and the balance at any time does not exceed rupees fifty thousand (with a proviso on deposits of government grants, welfare benefits and payments against procurements).

Conditions in the proviso: the designated officer certifies the signature or thumb print was affixed in his presence (with a rule for prisoners in jail); the account is opened only at Core Banking Solution linked branches or where it is possible to monitor limits and bar foreign remittances; it remains operational initially for twelve months and for a further twelve months if the holder shows he has applied for an officially valid document, with review after twenty four months; it stays operational between 1 April 2020 and 30 June 2020 and other notified periods; on suspicion of money laundering or financing of terrorism the identity is established as per sub-rule (4); and foreign remittance cannot be credited until identity is fully established.

Sub-rules (6) to (9): documents by type of client

Each is "one certified copy" of the documents (or equivalent e-documents).

Sub-rules (9A), (9B) and (10) to (11)

• (9A) A banking company, financial institution or intermediary shall register the details of a client that is a non-profit organisation on the DARPAN Portal of NITI Aayog, if not already registered, and maintain such registration records for five years after the business relationship has ended or the account has been closed, whichever is later.
• (9B) A client who has submitted documents shall submit any update within 30 days of such updation.
• (10) Where the client purports to act on behalf of a juridical person, individual or trust, the reporting entity shall verify that the person is so authorised and verify that person's identity. In the case of a trust, trustees must disclose their status at the start of the relationship or when carrying out a transaction under rule 9(1).
• (11) No reporting entity shall allow the opening of or keep any anonymous account, account in fictitious names, or account on behalf of other persons whose identity has not been disclosed or cannot be verified.

Sub-rules (12) to (14): ongoing due diligence and risk

(12) Ongoing due diligence. (i) Exercise ongoing due diligence on every business relationship and closely examine transactions to ensure they are consistent with knowledge of the client, business and risk profile and, where necessary, the source of funds. (ii) On suspicion of money laundering or financing of terrorism, or doubts about the adequacy or veracity of earlier identification data, review the due diligence, including verifying identity again. (iii) Apply client due diligence to existing clients on the basis of materiality and risk, at appropriate times or as the regulator specifies, keeping the data up to date, particularly where there is high risk.

(13) Risk assessment. Carry out a risk assessment to identify, assess and mitigate money laundering and terrorist financing risk for clients, countries or geographic areas, and products, services, transactions or delivery channels, consistent with any national risk assessment by a body notified by the Central Government. It must be documented, consider all relevant risk factors, be kept up to date and be available to competent authorities and self-regulating bodies.

(14) Regulator's guidelines and the Client Due Diligence Programme. The regulator issues guidelines on sub-rules (1) to (13), (15) and (17) and may prescribe enhanced or simplified measures; simplified measures are not acceptable where there is suspicion of money laundering or terrorist financing, or higher-risk scenarios apply. The guidelines also include alternatives for clients unable to undergo biometric authentication or to provide PAN, and countermeasures when called upon by an international or intergovernmental organisation of which India is a member and accepted by the Central Government. Every reporting entity shall formulate and implement a Client Due Diligence Programme, approved by senior management, having regard to risk and the size of the business.

Enhanced due diligence for specified transactions is dealt with in the Act itself, in section 12AA; see our article on section 12AA. The site's guides on KYC under PMLA and on simplified and enhanced customer due diligence give their own accounts.

Sub-rules (15) to (19): Aadhaar, redaction, PAN and address

• (15) Where the client has submitted an Aadhaar number under (4)(a), the entity shall authenticate it using the e-KYC authentication facility of the Unique Identification Authority of India; for proof of possession under (aa), offline verification; for an equivalent e-document, verify the digital signature and take a live photo under Annexure 1; for an officially valid document or proof of possession under (ab), carry out digital KYC as in Annexure 1. A proviso allows, for a notified class and period, a certified copy plus a recent photograph instead of digital KYC.
• (16) Where a client submits proof of possession of Aadhaar and authentication is not required under (15), the entity must ensure the client redacts or blacks out the Aadhaar number.
• (17) A client with an existing account-based relationship shall submit PAN (or equivalent e-document) or Form No. 60 on the date notified by the Central Government, failing which the account shall temporarily cease to be operational until it is submitted; before that the entity shall give an accessible notice and a reasonable opportunity to be heard. If the client says in writing that he does not wish to submit it, the account shall be closed and obligations settled after establishing identity as the regulator determines.
• (18) Where the officially valid document has no updated address, utility bills not more than two months old, property or municipal tax receipts, pension payment orders, or employer accommodation letters are deemed officially valid documents for the limited purpose of proof of address, provided the client submits an updated document with current address within three months.
• (19) A client who provided Aadhaar and wants a current address different from the Central Identities Data Repository may give a self-declaration.

Annexure 1: the Digital KYC Process, in one paragraph

Annexure 1 requires reporting entities to develop an authenticated application for digital KYC, accessed only by authorised officials through login controls, in which the authorised officer takes a live photograph of the client and of the original document, watermarked with the customer application form number, location coordinates, official's name and employee code, date and time; the form is filled from the documents, and a one-time password sent to the client's mobile number is treated as the client's signature; the officer gives a declaration validated by his own one-time password, a transaction or reference number is generated, the officer verifies that the document details, the live photograph and the mandatory fields match, and the form is digitally signed by an authorised representative of the reporting entity.

A worked example

Anjali Textiles LLP (invented), a partnership firm, applies for a business account. Under sub-rule (7), the bank collects a certified copy of the registration certificate, the partnership deed, the firm's PAN, individual documents for the beneficial owner and for the partner who will operate the account, the names of all the partners, and the address of the registered office. After opening, sub-rule (12) means the bank watches the account against the firm's profile, and if a partner changes, the firm must send updated documents within 30 days (sub-rule (9B)). If the account were proposed in a fictitious name, sub-rule (11) would bar it outright.

Need help with KYC documents and ongoing due diligence?

Mapping each client type to the documents above, and setting a refresh and risk-assessment routine, is largely a matter of checklists tied to the rule. Our team helps through financial and legal due diligence, starting from your current forms.

Key takeaways

• An individual submits Aadhaar (or proof of possession), or an officially valid document, plus PAN or Form No. 60, plus other documents the entity requires.
• Companies, firms, trusts and associations submit certified copies of constitution documents, authority and PAN, with individual documents for the beneficial owner and signatories.
• A small account has limits of one lakh rupees in credits per financial year, ten thousand rupees in withdrawals and transfers per month, and fifty thousand rupees balance.
• Anonymous and fictitious accounts are prohibited; updates must reach the entity within 30 days.
• Ongoing due diligence and a documented risk assessment are mandatory, and a Client Due Diligence Programme must be approved by senior management.
• Annexure 1 sets the digital KYC process; Aadhaar numbers must be redacted where authentication is not required.

Read next

• Rule 9(1) to (3) PML Rules: client due diligence, Central KYC registry and beneficial owner
• Rules 9A-11 PML Rules: Central KYC registry, record retention and audit
• Section 12AA PMLA: enhanced due diligence
• Customer due diligence: simplified and enhanced

Disclaimer: Based on the consolidated text of the Prevention of Money-laundering Act, 2002 published by the Enforcement Directorate, showing amendments up to Act 23 of 2019 (1 August 2019), and on the Department of Revenue consolidated copy of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005 listing amendments up to 19 July 2024, as consulted on 2 October 2026. Later amendments, notifications, other rules and regulator directions should be checked. This article is general information, not legal advice; check the official text before acting.