Anti-Money Laundering Guidelines for Insurers
Life insurance can launder money. Here is how the law and IRDAI stop it.
Money laundering means making the proceeds of crime look clean. Section 3 of the Prevention of Money Laundering Act, 2002 (PMLA) catches anyone who attempts, assists, is a party to or is involved in any activity connected with proceeds of crime, including concealing, possessing, acquiring or using them, or projecting or claiming them as untainted property. The Act's explanation treats laundering as a continuing activity for as long as the person keeps enjoying the proceeds.
It is usually described in three stages: placement (getting the money into the system), layering (moving it around to hide the trail) and integration (bringing it back as apparently legitimate wealth). That is why the guidelines single out premiums out of line with income, repeated free-look cancellations and assignments to unrelated third parties.
IRDAI first issued AML/CFT guidelines for insurers in March 2006, under the PMLA and its rules. They stress three things: customer due diligence, reporting and record keeping. They were later consolidated into IRDAI's Master Guidelines on AML/CFT (2022), which repealed the earlier IRDAI AML/CFT circulars listed in its appendix. Where interpretation is in doubt, the directives of FIU-IND, the PML Act, the Aadhaar Act and the Income Tax Act prevail over the guidelines.
You save ₹250
- Full 100-question mocks
- Chapter-wise practice
- Section-wise sets
One payment, no subscription · Valid for 1 month
Who Is Responsible
- Board and audit committee
- Insurers run their AML/CFT systems under the broad oversight of the board, through the audit committee. Internal audit checks effectiveness and reports to the Audit Committee.
- Designated Director
- Ensures overall compliance with the obligations under Chapter IV of the PML Act and the PML Rules.
- Principal Officer
- A senior officer appointed to ensure compliance with Chapter IV obligations. Monitors regular reporting of suspicious transactions to the Director, FIU-IND.
- FIU-IND
- Financial Intelligence Unit, India: receives the reports. Under Section 13 of the PMLA its Director may act, including by monetary penalty, against the insurer, the Designated Director or employees for non-compliance.
- Intermediaries
- The insurer stays responsible even when it sells through intermediaries. Their contracts should make KYC norms mandatory, and the insurer must act against an intermediary who exposes it to AML/CFT risk on multiple occasions.
Deadlines and Thresholds in the 2022 Master Guidelines
| Rule | Figure |
|---|---|
| Contact details of Designated Director and Principal Officer (and any change) to IRDAI and FIU-IND | Within 7 days |
| Electronic KYC copy filed with CKYCR | Within 10 days of starting the account-based relationship |
| KYC from a third party in the same financial group | Obtained within 15 days |
| Annual AML/CFT compliance certificate (signed by Principal Officer/CCO and CEO) | Within 45 days of the end of the financial year |
| Missing KYC of existing customers | 2 years for low risk; 1 year for others, including high risk |
| PAN/Form 60 for existing customers with aggregate premium up to ₹50,000 a year | By a date notified by the Central Government |
| Simplified Due Diligence | Individual policies with aggregate premium not above ₹10,000 a year, low-risk customers only |
| Aadhaar XML file or Secure QR Code for video KYC | Generated not more than 3 days before the VBIP |
| Records of transactions and identity verification | 5 years |
KYC and Customer Due Diligence
- 1
Identify the customer
Insurers must make best efforts to find the true identity of customers; no anonymous or fictitious-name contracts. For individuals, verify identity, address and a recent photograph. For a company or other juridical person, identify the entity and its beneficial owners, and collect proof of its name, legal form, existence, registered address and authorised signatories.
- 2
Pick a KYC method
Aadhaar online authentication (subject to notification under Section 11A of the PMLA), Aadhaar offline verification, Digital KYC, Video Based Identification Process (VBIP), the CKYCR KYC identifier, or Officially Valid Documents. A customer who cannot or does not wish to use Aadhaar may give OVDs; Section 11(3) of the PMLA says no client may be denied service for lacking an Aadhaar number.
- 3
Use CKYCR
If the customer gives a KYC identifier, fetch the record from the Central KYC Registry (CERSAI, notified 26 November 2015); the customer need not resubmit unless details changed. If not, search the portal, and if nothing is found capture KYC on the prescribed template, upload it within 10 days, and tell the customer the new identifier confidentially.
- 4
Check the money makes sense
Premium should not be disproportionate to income or assets. Insurers must avoid unwittingly insuring assets bought with illegal funds.
- 5
Keep watching
Repeat due diligence on additional remittances and when activity departs from the customer's normal pattern. Before any payout, do due diligence on the policyholder, beneficiary, legal heir or assignee. Watch repeated free-look cancellations and assignments to unrelated third parties.
Quick practice on accounts and ratios. No signup.
Low Risk vs High Risk Customers
At a minimum, customers are classed as high risk or low risk, using identity, social and financial status, nature of business and location.
| Low risk (basic checks) | High risk (Enhanced Due Diligence) |
|---|---|
| Salaried employees with well-defined salary structures | Non-residents and high net worth individuals |
| People from lower economic strata | Trusts, charities, NGOs and organisations receiving donations |
| Government departments and government-owned companies | Companies with close family shareholding; firms with sleeping partners |
| Regulators and statutory bodies | Politically exposed persons (PEPs) and persons of dubious reputation |
Enhanced Due Diligence and PEPs
- check_circleEDD under Section 12AA of the PML Act applies to high-risk clients: examine ownership, financial position and source of funds in line with the risk.
- check_circleComplex or unusual transactions with no apparent economic or lawful purpose must have their background and purpose examined.
- check_circleA proposal from a PEP must be examined by senior management. Ongoing EDD covers PEPs, their close relatives and contracts where a PEP is the ultimate beneficial owner. If a customer later becomes a PEP, senior management is told and EDD applied.
- check_circleContracts linked to countries FATF identifies as deficient need EDD, with written findings.
- check_circleNon-face-to-face business and new products, practices and technologies need special attention.
Reporting and Record Keeping
- check_circleSuspicious transactions are reported to FIU-IND as a Suspicious Transaction Report (STR). FIU-IND offers electronic utilities for CTR and STR filing on its website.
- check_circleEach day of delay in reporting, or in correcting a misreported transaction, is a separate violation.
- check_circleFiling an STR is strictly confidential: no tipping off the customer at any level. The insurer must not restrict operations on the account because an STR has been filed.
- check_circleInsurers need software that raises alerts when transactions do not fit the customer's risk profile.
- check_circleRecords are kept for five years: transaction records from the date of the transaction; identity records and account files for five years after the relationship ends. Records linked to an ongoing investigation are kept until the case is closed. Records must be good enough to reconstruct individual transactions as evidence.
Exam Traps
Reports go to FIU-IND, not IRDAI, SEBI or the ED. The record period is five years, not 7 or 10. Keep the deadlines apart: 7 days (officer contact details), 10 days (CKYCR upload), 15 days (group third-party KYC), 45 days (compliance certificate). ₹10,000 is the Simplified Due Diligence limit; ₹50,000 is the existing-customer PAN/Form 60 limit. CKYCR is run by CERSAI, not IRDAI.
FAQs
Which IRDAI document sets out AML rules for insurers?expand_more
The IRDAI Master Guidelines on AML/CFT (2022). They repealed the earlier IRDAI AML/CFT circulars listed in their appendix. The first IRDAI AML/CFT guidelines for insurers came in March 2006.
Who is the Principal Officer under AML rules?expand_more
A senior officer the insurer appoints to ensure compliance with Chapter IV of the PML Act and to oversee suspicious transaction reporting to FIU-IND. The Designated Director has overall responsibility for compliance.
How long must insurers keep AML records?expand_more
Five years. Transaction records run from the date of the transaction; identity records and account files run from the end of the business relationship.
When does Simplified Due Diligence apply?expand_more
To individual policies with aggregate premium not above ₹10,000 a year, and only for low-risk customers with no suspicion of money laundering or terrorist financing.
Can an insurer tell a customer that an STR has been filed?expand_more
No. Filing an STR is strictly confidential and there must be no tipping off at any level.
Access exam-specific mock tests directly from your Android device.Next steps
Take a full IC-26 mock testFull-length IC-26 practice, timed to 2 hours and scored.