Skip to content
Spectra Forensics, Investigation Specialist

Regulatory framework · Bribery and financial crime

Beneficial ownership and money-laundering risk

Who really stands behind our counterparty, and what are we obliged to do about it?

Spectra Forensics6 laws and regulators

Short answer

It depends on who you are. Banks, financial institutions and other reporting entities under the Prevention of Money Laundering Act 2002 must identify beneficial owners and report suspicious transactions. Every company must identify its own significant beneficial owners under section 90 of the Companies Act 2013. Other companies have no statutory duty to look behind a customer or supplier, but they carry the consequences if they deal with a front, so a risk-based ownership check is sound governance.

The landscape

Laws and regulators in play

Prevention of Money Laundering Act 2002 (ss.3, 4, 12)
Defines money laundering and its punishment (three to seven years, ten where narcotics offences are involved) and requires reporting entities to keep records for five years and furnish information to FIU-IND.
PML (Maintenance of Records) Rules 2005
Set the beneficial-ownership tests for reporting entities: for a company, ownership of or entitlement to more than 10% of shares, capital or profits, or control by other means.
Notification S.O. 2036(E), 3 May 2023
Brought practising chartered accountants, company secretaries and cost accountants within the PMLA when they carry out specified financial transactions for clients, such as managing client money or creating and operating companies.
Companies Act 2013 (ss.89 and 90) and the SBO Rules 2018
Require individuals with 10% or more of shares, voting rights or dividend rights, held indirectly, or with significant influence or control, to declare themselves, and the company to identify them, keep a register and file with the Registrar.
FIU-IND
Receives suspicious and cash transaction reports from reporting entities.
FATF Recommendations 24 and 25
Set the global standard for beneficial-ownership transparency of companies (revised March 2022) and trusts and other legal arrangements (revised February 2023). India’s mutual evaluation was adopted in June 2024 and placed it in regular follow-up.

Step by step

Decision framework

  1. 01

    Work out which hat you are wearing

    A reporting entity has statutory customer due diligence and reporting duties. A company acting as itself has SBO duties about its own shareholders. A company buying from or selling to others has no statutory screening duty, but faces fraud, sanctions and reputational risk if a counterparty is a front.

  2. 02

    Trace ownership to a natural person

    Follow shareholdings through each layer, including foreign holding companies and trusts, until you reach individuals. Note where control comes from agreements, board rights or family relationships rather than shares.

  3. 03

    Test the documents against the facts

    Compare registry filings, SBO declarations and KYC documents with what you see: common addresses, directors who resign together, nominee patterns, and payments routed through unrelated entities.

  4. 04

    Decide the risk and record why

    Proceed, proceed with conditions such as enhanced monitoring or payment controls, or decline. Keep the reasoning; it is what a regulator, auditor or court will ask for.

  5. 05

    Report where the law requires it

    A reporting entity files a suspicious transaction report promptly and no later than seven working days after concluding a transaction is suspicious. Do not tip off the customer.

  6. 06

    Fix your own register

    If your own SBO picture is incomplete, send notices in Form BEN-4, follow up non-responses, and consider applying to the Tribunal for restrictions on the shares.

Duties and deadlines

Who must do what, and by when

  • Individual who is a significant beneficial owner

    Declare the beneficial interest to the company in Form BEN-1.

    By whenOn becoming an SBO and on any change

    Companies Act 2013 s.90; SBO Rules 2018

  • Company

    File the declaration with the Registrar in Form BEN-2 and keep the register of SBOs in Form BEN-3.

    By whenBEN-2 within 30 days of receiving the declaration

    Companies Act 2013 s.90; SBO Rules 2018

  • Company

    Take steps to identify SBOs, including notices in Form BEN-4 to persons it believes may be SBOs.

    By whenOngoing

    Companies Act 2013 s.90; SBO Rules 2018

  • Company, where information is not given

    Apply to the Tribunal for an order restricting rights attached to the shares.

    By whenWithin 15 days after the notice period expires

    Companies Act 2013 s.90(7)

  • Reporting entity

    Identify the beneficial owner of a customer, keep records and file suspicious transaction reports with FIU-IND.

    By whenSTR promptly and within seven working days of being satisfied that a transaction is suspicious; records kept five years

    PMLA 2002 s.12; PML (Maintenance of Records) Rules 2005

  • Reporting entity

    File cash transaction reports.

    By whenMonthly, by the 15th of the following month

    PML (Maintenance of Records) Rules 2005, rule 8

Analysis

How the regimes interact

Why this question matters

Most frauds that Indian companies suffer from outside run through an entity whose real owner is hidden: a supplier owned by a purchase manager, a distributor fronting for a competitor, a borrower's group company receiving diverted funds. Ownership is also where the law has tightened most. Thresholds for identifying beneficial owners fell to 10% in 2023, professionals who form and run companies for clients became reporting entities, and India's 2024 FATF evaluation kept the subject on regulators' agendas.

How the regimes interact

Two registers that should agree, and often do not. A reporting entity forms its own view of a customer's beneficial owner under the PML rules. The customer, as a company, files its own SBO declaration under the Companies Act. The two tests are similar but not identical. The PML test for a company is more than 10% ownership or control by other means. The SBO test is 10% or more held indirectly, or with indirect and direct holdings together, or significant influence or control. Where the bank's KYC file and the Registrar's BEN-2 filing tell different stories, that difference is itself a finding.

Ownership is a fraud question as well as an AML one. A company that is not a reporting entity has no PMLA duty to screen suppliers. But when an investigation finds that a vendor was secretly owned by an employee, the questions turn to the company's own controls: conflict-of-interest declarations, vendor onboarding, and whether anyone looked. The same tracing techniques serve both purposes.

Professionals sit on both sides. Since May 2023, a chartered accountant or company secretary who creates or manages companies for a client may be a reporting entity for that work, with the duty to identify the client's beneficial owner. The same professional's statutory audit work is not a specified activity. Firms need to know which engagements carry which duties.

How Spectra Forensics can help

We trace ownership through layered structures in integrity due diligence and pre-investment promoter due diligence, and follow funds in asset tracing. Speak to us in confidence.

Warning signs

Red flags

  • A counterparty that will not say who owns it, or whose answer changes.
  • Several suppliers or customers sharing an address, phone number, email domain or director.
  • Layers of holding companies in other jurisdictions for a small domestic business.
  • Payments to or from accounts in names that do not match the contracting party.
  • Shareholders who are employees, drivers or relatives of a promoter.
  • Newly incorporated entities winning large contracts soon after formation.

Checklist

What good looks like

  • A risk-based ownership check for high-value or high-risk counterparties, documented in the vendor or customer file.
  • Ownership traced to individuals, not stopped at the first corporate shareholder.
  • Related-party and conflict checks run against the company’s own directors and senior staff.
  • The company’s own SBO register complete, with BEN-4 notices followed up.
  • A clear owner for each decision to proceed with a higher-risk counterparty, and the reasons recorded.
  • For reporting entities: STR decisions logged, timelines tracked and no tipping off.

Myths and corrections

Common misreadings

Misreading

Only banks need to worry about beneficial ownership.

Better reading

Banks and other reporting entities have the statutory screening duty, but every company has SBO duties about its own shareholders, and every company carries the fraud and reputational cost of dealing with a front.

Misreading

If the registry filing shows no one above 10%, there is no beneficial owner.

Better reading

Control can come from agreements, board rights or influence, and holdings can be split to stay under thresholds. Both the PML rules and the SBO rules look at control by other means.

Misreading

The 25% threshold still applies to companies.

Better reading

For reporting entities the test for a company has been more than 10% since the March 2023 amendment to the PML (Maintenance of Records) Rules. The SBO rules under the Companies Act also use 10%.

For the board pack

Takeaways

  • 01Know which duties apply to you: reporting entity, company with its own SBO duties, or ordinary commercial counterparty.
  • 02Trace ownership to individuals and look for control that does not show up in shareholdings.
  • 03Document the decision to proceed; the record is your defence.
  • 04Reporting entities must report suspicion within seven working days and must not tip off.

Questions we are asked

Are chartered accountants reporting entities under the PMLA?

Only for specified activities. Since the notification of 3 May 2023, practising chartered accountants, company secretaries and cost accountants are reporting entities when, on behalf of a client, they handle transactions such as buying and selling property, managing client money or accounts, or creating and operating companies, LLPs or trusts. Statutory audit is not one of the specified activities.

What is the penalty for not complying with section 90?

After the 2020 amendment, an individual who fails to declare faces a penalty of ₹50,000 plus ₹1,000 a day for a continuing default, up to ₹2 lakh. A company faces ₹1 lakh plus ₹500 a day, up to ₹5 lakh, and each officer in default ₹25,000 plus ₹200 a day, up to ₹1 lakh. Wilfully false information is treated more seriously.

Does a company have to check the owners of its suppliers?

There is no general statutory duty outside the PMLA. But procurement fraud often runs through entities secretly owned by employees, and a court or regulator will ask what checks were done. A risk-based ownership check is the practical answer.

Sources

  1. Prevention of Money Laundering Act 2002 link
  2. Prevention of Money-laundering (Maintenance of Records) Amendment Rules 2023, notified 7 March 2023 link
  3. Notification S.O. 2036(E), 3 May 2023 (chartered accountants, company secretaries and cost accountants) link
  4. FIU-IND, reporting obligations link
  5. Companies Act 2013, s.90, and Companies (Significant Beneficial Owners) Rules 2018 link
  6. FATF Recommendations 24 and 25, and Mutual Evaluation of India (June 2024) link

This guide is general information on the law as stated above, not legal advice. Facts change outcomes; take advice on your own matter.

Go deeper

Further reading

Due diligence24 Aug 2026

Due Diligence on Business Partners in India: What to Check Before You Sign

A practical checklist for vetting distributors, suppliers and JV partners in India: MCA and GST records, litigation, site visits, references and red flags.

Fraud investigation18 Aug 2026

Investigating Employee–Vendor Conflicts of Interest: A Practical Guide

How Indian companies can detect and investigate undisclosed employee and director interests in vendors, from s. 184 and s. 188 to data matching and interviews.

Asset tracing27 Aug 2026

How Asset Tracing Works in India: Sources, Techniques and Legal Routes to Recovery

How investigators find assets in India through MCA, land, CERSAI and court records, and the legal routes from attachment before judgment to PMLA.

Confidential consultation

Facing this question on a live matter? Talk to us.

Tell us what has happened. A senior member of our team will help you work out who must do what, and in what order, in strict confidence.

Speak to an expertAll regulatory frameworks
Confidential enquiry