The Prevention of Money Laundering Act, 2002 requires banks, financial institutions and intermediaries to verify customers, keep records and report suspicious transactions to FIU-IND. Regulators expect employees who handle customers and transactions to be trained to recognise red flags.
Our PMLA course covers KYC, the stages of money laundering and suspicious transaction reporting. The guides below focus on the red flags customer-facing staff miss and the deadlines compliance teams need to track.
Quick answer
The Prevention of Money-laundering Act, 2002 requires reporting entities such as banks, financial institutions, intermediaries and designated businesses to verify clients, keep records for five years and report specified and suspicious transactions to FIU-IND. Staff who onboard customers, process transactions or monitor accounts need training to meet those duties.
The course
What the law requires
The money-laundering offence (sections 3, 4 and 70)
Section 3 of the Prevention of Money-laundering Act, 2002 makes it an offence to directly or indirectly attempt to indulge in, knowingly assist, knowingly be a party to, or be actually involved in any process or activity connected with the proceeds of crime. The Explanation lists concealment, possession, acquisition, use, and projecting or claiming the proceeds as untainted property, and treats the activity as continuing for as long as a person enjoys the proceeds.
Section 4 sets the punishment: rigorous imprisonment of three to seven years and a fine. The upper limit rises to ten years where the proceeds relate to offences in paragraph 2 of Part A of the Schedule. Under section 70, where a company contravenes the Act, every person in charge of and responsible for its business at the time is also deemed guilty, unless they prove the contravention happened without their knowledge or despite all due diligence.
Obligations of reporting entities (sections 11A, 12, 12AA, 13 and 14)
A "reporting entity" under section 2(1)(wa) means a banking company, financial institution, intermediary or a person carrying on a designated business or profession. Section 11A requires reporting entities to verify the identity of their clients and beneficial owners.
Section 12(1) requires every reporting entity to keep a record of all transactions in a way that allows individual transactions to be reconstructed, to furnish information on prescribed transactions (whether attempted or executed) to the Director of FIU-IND, and to keep records of client and beneficial owner identity, account files and business correspondence. Transaction records must be kept for five years from the date of the transaction (section 12(3)). Identity records must be kept for five years after the business relationship ends or the account is closed, whichever is later (section 12(4)).
Section 12AA requires enhanced due diligence, including source of funds checks, before certain specified transactions. Section 13 empowers the Director to inquire into compliance and to act against the reporting entity, its designated director on the Board or any of its employees. Section 14 protects the entity, its directors and employees from civil or criminal proceedings for furnishing information under section 12(1)(b).
PML (Maintenance of Records) Rules, 2005: what gets reported and when
The PML (Maintenance of Records) Rules, 2005 set out what must be recorded and reported. Rule 3(1) covers, among others, cash transactions above ten lakh rupees or the foreign currency equivalent, series of connected cash transactions below that amount that together exceed ten lakh rupees in a month, cash transactions involving counterfeit currency or forged documents, and all suspicious transactions whether or not made in cash.
Rule 7 requires each reporting entity to designate a Principal Officer at management level and to communicate the officer's name, designation and address to the Director, FIU-IND. Under rule 8(1), monthly reports such as cash transaction reports are due by the 15th day of the following month. Under rule 8(2), once the Principal Officer is satisfied that a transaction is suspicious, the information must be furnished promptly. FIU-IND's AML and CFT guidelines state this as no later than seven working days from being satisfied that the transaction is suspicious. Rule 8(4) treats each day of delay as a separate violation.
RBI Know Your Customer Directions
RBI-regulated entities must also follow RBI's KYC directions. For commercial banks these are now the Reserve Bank of India (Commercial Banks - Know Your Customer) Directions, 2025, which replaced the Master Direction - Know Your Customer (KYC) Direction, 2016. RBI has issued separate KYC directions for other classes of regulated entity, so check the version that applies to you.
The 2016 Master Direction (paragraph 70) required an on-going employee training programme so that staff are adequately trained in KYC/AML/CFT policy, with a different focus for frontline staff, compliance staff and staff dealing with new customers. It also asked regulated entities to ensure that staff dealing with KYC/AML/CFT have high integrity and a good understanding of current standards. Check the corresponding paragraph in the 2025 directions that apply to your entity.
Who must be trained and how often
PMLA itself does not prescribe staff training or a frequency. The training expectation comes from regulators: RBI's KYC directions have required an on-going employee training programme, and FIU-IND's AML and CFT guidelines (for example, those issued in March 2023 for virtual digital asset service providers) call for training based on job profile and customised to specific roles.
Neither source sets a fixed interval. Common practice, not a legal requirement, is training at induction, an annual refresher for all relevant staff, and an update whenever the rules, red flags or internal procedures change.
| Audience | Focus | Common practice |
|---|---|---|
| Frontline and customer-facing staff | KYC, beneficial ownership, spotting and escalating red flags | Induction plus annual refresher |
| Operations and transaction processing | Cash and connected transactions, attempted transactions, record-keeping | Annual role-based training |
| Compliance and transaction monitoring | Alert review, STR quality, rule 8 timelines, FIU-IND formats | Annual training plus updates on rule changes |
| Principal Officer and Designated Director | Personal accountability under section 13, governance and reporting | Annual briefing |
Penalties and consequences
Consequences stated in the Prevention of Money-laundering Act, 2002 and the PML (Maintenance of Records) Rules, 2005.
| Breach | Provision | Consequence |
|---|---|---|
| Money-laundering offence | Sections 3 and 4 | Rigorous imprisonment of 3 to 7 years and fine (up to 10 years for offences in paragraph 2 of Part A of the Schedule) |
| Contravention by a company | Section 70 | Persons in charge of the business are also deemed guilty unless they prove lack of knowledge or due diligence |
| Reporting entity, designated director or employee fails to meet Chapter IV obligations | Section 13(2) | Written warning, directions, periodic reporting, or a monetary penalty of Rs 10,000 to Rs 1 lakh for each failure |
| Late reporting or late correction of a mis-represented transaction | Rule 8(4), PML Rules | Each day of delay is a separate violation |
Section 13(1A) also allows the Director to order a special audit of a reporting entity's records by a chartered accountant.
What good Anti-Money Laundering (PMLA) training covers
- The three stages of money laundering and the activities that section 3 treats as laundering.
- Customer due diligence and identification of beneficial owners, including when enhanced due diligence applies.
- Red flags by product and channel: structuring of cash below ten lakh rupees, unexplained third-party payments, mismatched profiles.
- How to escalate a suspicion internally and why attempted transactions must also be reported.
- Rule 8 timelines: monthly reports by the 15th, suspicious transaction reports without delay once suspicion is formed.
- Avoiding tipping off the customer while a suspicion is being reported.
- Record-keeping periods under section 12 and keeping records in a form that allows reconstruction.
- The role of the Principal Officer and Designated Director and individual exposure under section 13.
- Screening against UN and domestic designation lists and freezing obligations.
- Scenario practice and an assessment, with completion records kept for regulators and auditors.
Our courses for this topic
| Course | Audience | Duration | Language | Format |
|---|---|---|---|---|
| Prevention of Money Laundering Act | Financial Staff | 50 min | English | SCORM eLearning |
Laws & standards covered
- Prevention of Money Laundering Act 2002 (India)
- RBI AML Guidelines
- SEBI AML Circular
- FATF Recommendations
Who it's for
- Banking and NBFC employees
- Finance and accounts teams
- Compliance officers
- Customer-facing financial services staff
Guides & insights
Frequently asked questions
Is AML training a legal requirement for our employees?
PMLA does not mention training directly, but regulators do. RBI's KYC directions have required an on-going employee training programme, and FIU-IND guidance asks reporting entities to train employees based on their job profile.
What is the deadline for filing a suspicious transaction report?
Rule 8(2) requires the Principal Officer to furnish the information promptly once satisfied that a transaction is suspicious. FIU-IND guidance states this as no later than seven working days, and every day of delay counts as a separate violation under rule 8(4).
Can an individual employee be penalised by FIU-IND?
Yes. Section 13(2) allows the Director to act against the reporting entity, its designated director on the Board or any of its employees, including a monetary penalty of Rs 10,000 to Rs 1 lakh for each failure.
Are staff protected when they report a suspicious transaction?
Section 14 protects the reporting entity, its directors and employees from civil or criminal proceedings for furnishing information under section 12(1)(b), save as provided in section 13.
We are an NBFC, not a bank. Do the commercial bank KYC directions apply?
No. RBI has issued separate KYC directions for different classes of regulated entity, so use the directions that apply to your licence category. Your PMLA obligations as a reporting entity apply either way.
Which Anti-Money Laundering (PMLA) Training courses does Compliance at Workplace offer?
Prevention of Money Laundering Act (50 min, for Financial Staff).
Which laws and standards does Anti-Money Laundering (PMLA) Training cover?
Prevention of Money Laundering Act 2002 (India); RBI AML Guidelines; SEBI AML Circular; FATF Recommendations.
Who should take Anti-Money Laundering (PMLA) Training?
Banking and NBFC employees, Finance and accounts teams, Compliance officers, Customer-facing financial services staff.
Can the Anti-Money Laundering (PMLA) Training be customised to our organisation?
Yes. Every course can be customised to your policies, branding and industry scenarios, and delivered on your LMS as SCORM or on our Compliance Central platform.
Sources
- Prevention of Money-laundering Act, 2002 (Department of Revenue, Ministry of Finance)
- PML (Maintenance of Records) Rules, 2005 (FIU-IND)
- FIU-IND AML and CFT Guidelines for Reporting Entities providing Virtual Digital Asset services, March 2023
- RBI (Commercial Banks - Know Your Customer) Directions, 2025
- RBI Master Direction - Know Your Customer (KYC) Direction, 2016 (superseded for commercial banks)
Last updated by the Compliance at Workplace Editorial Team.

