CFT, Sanctions and PEP Screening: How Indian Banks and NBFCs Run the Checks

Financial crime compliance relies on three distinct controls across the customer lifecycle:

In money laundering, funds derive from crimes like fraud or corruption. Terrorist financing often uses clean money. Lawful earnings, personal savings, donations, or remittances can be diverted to terror cells. Because initial funds are clean, institutions cannot rely only on origin checks; they must screen names against designated lists and verify destinations.

Under the Reserve Bank of India KYC Directions for commercial banks, suspicious transactions include any transaction or attempt raising suspicion of links to terrorist activities. This mandate links onboarding checks, explained in our KYC and AML glossary, directly to counter-terrorism controls.

Indian financial institutions must screen customers and transactions against United Nations Security Council lists, domestic terror registers, and proliferation orders.

Under Customer Acceptance Policy rules, banks and NBFCs must ensure no applicant matches designated sanctions lists. Parallel obligations bind non-bank lenders under the Reserve Bank of India KYC Directions for NBFCs. Regulated firms screen against four primary registers:

1. UNSC Sanctions Lists: The UNSC Consolidated Sanctions List, encompassing the ISIL (Da'esh) and Al-Qaida register under Resolutions 1267, 1989, and 2253, and the Taliban register under Resolution 1988.
2. Domestic Terrorist Registers: The First Schedule (banned terror groups) and Fourth Schedule (individual terrorists, added in 2019) of the Unlawful Activities (Prevention) Act, 1967, maintained by the Ministry of Home Affairs.
3. WMD Act List: Ministry of Finance Orders under Section 12A of the Weapons of Mass Destruction Act, 2005. Accounts are checked against the FIU-IND portal list to stop matching transactions without delay. Matches are communicated immediately to the Central Nodal Officer (Director, FIU-IND), State Nodal Officer, and RBI.
4. DPRK Sanctions List: The UNSCR 1718 register, checked daily for updates from the Ministry of External Affairs.

Statutory powers derive from the Prevention of Money Laundering Act, 2002. Section 12 requires recordkeeping, and Section 12AA mandates enhanced due diligence. Under PMLA Section 13(2)(d), FIU-IND can levy fines of ₹10,000 to ₹1,00,000 per violation.

Indian regulations require enhanced due diligence for foreign Politically Exposed Persons, their family members, and their close associates.

Under Rule 2(1)(db) of the PML Rules, 2005 and RBI Directions, PEPs are individuals entrusted with prominent public functions by a foreign country, including Heads of State, senior politicians, judicial or military officials, state corporate executives, and party leaders.

Indian law draws a strict statutory boundary, specifying that domestic political figures are not PEPs. While lenders often apply enhanced scrutiny to domestic figures under internal policies, FIU-IND regulatory guidance confirms that domestic figures carry no statutory PEP designation.

When onboarding or managing a foreign PEP, institutions must enforce five core controls:

• •Family and Associates: Enhanced due diligence extends to family members and close associates.
• •Senior Management Approval: Onboarding a PEP customer or beneficial owner requires senior management sign-off.
• •Mid-Tenure Status Changes: If an existing client becomes a PEP, senior management must approve continuing the account.
• •Source of Wealth and Funds: Institutions must take reasonable steps to verify source of funds and wealth.
• •Enhanced Monitoring: PEP accounts undergo ongoing higher-frequency transaction review.

Automated screening verifies customer records across four operational junctures using fuzzy matching, secondary identifier triage, and tiered review.

Institutions run screening at four distinct checkpoints:

1. Pre-Onboarding: Customer Acceptance Policy checks stop listed entities from opening accounts.
2. Daily Batch Runs: Automated delta scans check customer files whenever official lists change.
3. Transaction Execution: Real-time screening checks originators and beneficiaries on cross-border wire transfers.
4. Lifecycle Triggers: Updates to directors, beneficial owners, or addresses prompt immediate re-screening.

The RBI encourages modern technological tools for name screening. Systems deploy fuzzy matching algorithms like Levenshtein distance, Jaro-Winkler, Soundex, and Metaphone to spot spelling variants, name reversals, and script transliterations. Neither the RBI nor FATF sets a fixed matching score (such as 80% or 85%); firms calibrate thresholds under board policies to ensure designated targets are not missed.

Automated searches often trigger false positives on common names. Analysts clear benign alerts using secondary identifier attributes from KYC records: date of birth, father's or spouse's name, nationality, ID numbers (PAN, Passport), and address.

Unresolved alerts pass through tiered escalation workflows. Level 1 analysts document false-positive rationale, while ambiguous alerts escalate to Level 2 compliance managers or the Principal Officer.

When a true match with a designated terrorist is confirmed, Section 51A of the Unlawful Activities (Prevention) Act, 1967 requires an immediate freeze on all debits, credits, and transactions. This freeze occurs without prior customer notice to prevent fund diversion, with details reported immediately to the Ministry of Home Affairs Nodal Officer and FIU-IND. Similar rapid responses support mule account detection.

Institutions must submit Suspicious Transaction Reports within seven working days of forming suspicion, under an absolute ban against alerting the customer.

Under Rule 8(2) of the PML Rules, 2005, reporting entities must send an STR to FIU-IND within seven working days of concluding suspicion. Under RBI Directions, this deadline carries strict enforcement: each day of delay constitutes a separate regulatory violation.

Indian law also enforces an absolute tipping-off ban. Under RBI Directions, if an institution suspects money laundering or terror financing and believes Customer Due Diligence will tip off the customer, it must stop CDD immediately and file an STR at once without questioning the client further.

Filing an STR does not authorize an account freeze. RBI Directions state clearly that institutions must not restrict account operations merely because an STR was filed. Unless a statutory freeze order applies under Section 51A of the UAPA or Section 12A of the WMD Act, accounts must continue operating normally.

Institutions submit STRs through FIU-IND reporting formats on FINnet 2.0 using XML schemas and validation utilities with digital signatures.

Sanctions screening must extend beyond immediate legal entities to natural-person beneficial owners and resolve frequent operational bottlenecks.

Screening only corporate entities creates dangerous blind spots. Under RBI KYC Directions, screening must reach natural-person Beneficial Owners holding:

• •Over 10% ownership or control in companies and partnerships.
• •Over 15% in unincorporated associations or bodies of individuals.
• •10% or more interest in trusts.

Wire transfer rules mandate real-time originator and beneficiary screening, barring transactions with designated entities.

According to industry operational reviews, screening programs encounter four common pitfalls:

1. Stale List Updates: Missing daily delta scans leaves firms exposed during list update lags.
2. Corporate-Only Checks: Screening corporate names while ignoring directors and beneficial owners lets sanctioned actors hide behind corporate shells.
3. Overly Narrow Match Thresholds: Rigid string matching misses phonetic and transliteration variants.
4. Alert Fatigue: High alert volumes lead analysts to dismiss alerts without checking secondary KYC data.

Using specialized AML software helps address these bottlenecks through automated list syncs and systematic secondary identifier matching.

Examining how CFT, sanctions, and PEP rules intersect reveals three practical operational priorities:

First, the divergence between AML and CFT means institutions cannot treat CFT as a subset of transaction monitoring. While AML detects crime by spotting anomalies after money moves, CFT demands pre-transaction interception because terror funds often derive from lawful sources. This suggests relying only on post-event monitoring leaves blind spots at payment entry points. The practical implication is that institutions need real-time screening coverage at onboarding and payment dispatch.

Second, compounding penalties make manual backlogs high-risk liabilities. Under RBI Directions, each day of reporting delay constitutes a separate violation under PMLA Section 13. Read together, high alert volumes and daily penalty exposure indicate that slow manual queues are legal hazards. The practical implication is that teams should automate secondary-identifier matching to clear benign alerts instantly, reserving analyst review for genuine escalations.

Third, compliance teams need clear operational separation between STR filings and asset freezes. Filing an STR bars tipping off the client, but the bank cannot restrict normal account activity merely because an STR was filed. In contrast, confirming a terror register match mandates an immediate freeze under UAPA Section 51A without notifying the client. This suggests maintaining two distinct operational playbooks: one that quietly files intelligence while keeping accounts open, and another that executes immediate holds upon a verified sanctions hit.