PMLA and Suspicious Transaction Reports: A Practical Guide for Banks, NBFCs and Fintechs

The Prevention of Money-Laundering Act, 2002 (PMLA) is the legal backbone of anti-money laundering in India. For every bank, NBFC, payment company, broker, and virtual digital asset platform it covers, PMLA turns into a set of daily operational duties: identify customers, keep records, monitor transactions, and report to the Financial Intelligence Unit-India (FIU-IND).

Of those duties, the suspicious transaction report (STR) is the one that most tests an institution’s judgment. File too few and you miss laundering; file low-quality reports in bulk, and you bury the signal.

This guide explains the PMLA reporting framework, how STRs work in practice, the red flags that should trigger review, and how to build a programme that stands up to supervisory scrutiny.

What PMLA Is and Who It Covers

PMLA criminalises money laundering, provides for attachment and confiscation of proceeds of crime, and imposes preventive duties on “reporting entities.” The detailed duties sit in the PML (Maintenance of Records) Rules, 2005 and in sector regulators’ directions, such as RBI’s KYC Directions.

Reporting entities include banking companies, financial institutions (which cover NBFCs), intermediaries in the securities market, payment system operators, insurers, and, since March 2023, virtual digital asset service providers. Certain professionals and designated businesses are also covered for specified activities.

Core Obligations of a Reporting Entity

• Customer due diligence: Identify and verify customers and beneficial owners, and understand the purpose and intended nature of the relationship.
• Record keeping: Keep transaction records and identity records for at least five years, as prescribed.
• Monitoring: Monitor transactions on an ongoing basis, with intensity based on customer risk.
• Reporting: Furnish prescribed reports to FIU-IND within the set timelines.
• Governance: Appoint a Designated Director and a Principal Officer, and register with FIU-IND’s reporting system.
• Confidentiality: Keep reports confidential and avoid tipping off the customer.

Failure to meet these duties can attract penalties imposed by the Director, FIU-IND, for each failure, along with action by the sector regulator.

The Reports Filed with FIU-IND

Report	What triggers it	Timing (as prescribed)
Cash Transaction Report (CTR)	Cash transactions above ₹10 lakh, or integrally connected cash transactions that together exceed ₹10 lakh in a month	Monthly, by the 15th of the following month
Suspicious Transaction Report (STR)	Any transaction or attempted transaction that gives reasonable grounds for suspicion	Within seven working days of concluding it is suspicious
Counterfeit Currency Report (CCR)	Counterfeit notes detected or used as genuine	As prescribed, typically monthly
Non-Profit Organisation Transaction Report (NTR)	Receipts by non-profit organisations above ₹10 lakh	Monthly
Cross-Border Wire Transfer Report (CBWTR)	Cross-border wire transfers above ₹5 lakh where either end is outside India	Monthly

Thresholds and timelines are set in the PML Rules and FIU-IND’s reporting formats; confirm the current versions in your procedures.

What Makes a Transaction Suspicious

The PML Rules define a suspicious transaction broadly. It includes a transaction, or an attempted one, that, to a person acting in good faith:

• gives rise to a reasonable ground of suspicion that it may involve proceeds of a specified offence;
• appears to be made in circumstances of unusual or unjustified complexity;
• appears to have no economic rationale or bona fide purpose; or
• gives rise to a reasonable ground of suspicion that it may involve financing of terrorism.

Two points are often missed. STRs apply regardless of amount, and attempted transactions count: a customer who abandons an account opening when asked about source of funds may warrant a report.

How the STR Process Works

1. Alert generation: Transaction monitoring rules, models, staff referrals, and external intelligence raise alerts.
2. Level-1 review: Analysts clear false positives and escalate alerts that need investigation.
3. Investigation: Investigators review the customer profile, KYC, transaction history, counterparties, and open-source information, and document their reasoning.
4. Decision: The Principal Officer or a delegated committee decides whether grounds for suspicion exist. The seven-working-day clock runs from this point.
5. Filing: The STR is filed through FIU-IND’s online reporting system with a clear narrative.
6. Post-filing action: The customer’s risk rating is reviewed, monitoring is intensified, and the relationship may be restricted or exited, without tipping off.

The quality of the narrative matters. FIU-IND can act on a report that explains who, what, when, how much, and why it is suspicious. It can do little with a report that says “high cash deposits” and nothing else.

Common Red Flags by Sector

Banks and payment companies

• New accounts receiving many small credits from unrelated parties followed by rapid outflows
• Structuring of cash deposits just below reporting thresholds
• Accounts linked to cybercrime complaints or known mule patterns

Lenders

• Early foreclosure of loans with funds from unexplained third parties
• Loan proceeds moved immediately to unrelated accounts
• Borrower profile inconsistent with transaction scale

Securities and VDA platforms

• Rapid deposit and withdrawal with little trading
• Trading patterns that transfer value between linked accounts
• Use of multiple accounts sharing devices or bank details

Where AML Programmes Fall Short

• Rules never tuned: Generic scenarios produce thousands of low-value alerts and fatigue.
• Weak KYC foundation: Monitoring cannot judge “unusual” without an accurate customer profile, including occupation, income, and beneficial ownership.
• Late decisions: Investigations drift for weeks, so the suspicion is formed late, and the report is stale.
• Thin narratives: Reports lack the context FIU-IND needs.
• No feedback loop: Filed STRs and law enforcement requests are not used to improve scenarios.

Use Cases

Digital NBFC: An NBFC adds income and occupation verification at onboarding, then flags borrowers whose repayments come from multiple unrelated accounts. Investigations are faster because the baseline profile is reliable.

Payment aggregator: A PA monitors sub-merchants for sudden volume spikes and refund patterns that suggest pass-through laundering, and files STRs with transaction-level narratives.

Small finance bank: A bank integrates cybercrime complaint data and mobile-number risk signals into monitoring, cutting the time from first victim complaint to account restriction.

Key Takeaways

• PMLA and the PML Rules require customer due diligence, record-keeping, monitoring, and reporting to FIU-IND.
• STRs have no threshold, include attempted transactions, and must be filed within seven working days of forming suspicion.
• CTRs, NTRs, and cross-border wire reports are threshold-based monthly reports.
• Good STRs rest on a strong KYC baseline, timely investigation, and clear narratives.
• Tuned scenarios and feedback loops matter more than alert volume.

Frequently Asked Questions

Conclusion

PMLA compliance is judged less by policies than by outcomes: whether suspicious activity is detected, decided on and reported in time, with enough context to be useful. That depends on the quality of customer data at onboarding as much as on monitoring systems.

Institutions that verify customers well, tune scenarios to their real risks and write clear STRs spend less time on false alarms and more on the cases that matter.

BeFiSc strengthens the data layer beneath AML programmes, with identity, bank account, mobile and business verification APIs that make customer profiles accurate from day one.

Talk to the BeFiSc team about your AML data needs.