When Professional Advice Becomes a PMLA-Regulated Service: Duties of CAs, CSs and Cost Accountants

The Prevention of Money-Laundering Act, 2002 does not make every chartered accountant, company secretary or cost accountant a reporting entity for every professional assignment. The decisive change made on 3 May 2023 is narrower and more exacting: a practising professional becomes a reporting entity when, in the course of the profession, he or she carries out specified financial transactions on behalf of a client.

That distinction is essential. A statutory audit, tax opinion, certification, representation or general advisory engagement is not covered merely because a certificate-of-practice holder performs it. But an engagement letter cannot neutralise the law if the professional actually manages money, operates an account, structures a company or executes a notified transaction for the client.

The statutory gateway

Notification S.O. 2036(E), dated 3 May 2023, was issued under Section 2(1)(sa)(vi) PMLA. It covers a practising chartered accountant, company secretary or cost accountant, whether acting individually or through a firm, when carrying out any of the following activities for and on behalf of a client:

buying and selling immovable property;

managing client money, securities or other assets;

managing bank, savings or securities accounts;

organising contributions for the creation, operation or management of companies;

creating, operating or managing companies, limited liability partnerships or trusts, and buying and selling business entities.

The named professions are defined by reference to their respective professional statutes, and the individual must hold a certificate of practice. The notification is therefore both status-based and activity-based. Professional status alone is insufficient; performance of a notified activity for and on behalf of a client is the operative trigger.

Advice, facilitation and execution

The words “carrying out” and “for and on behalf of” require attention to what the professional actually does. Giving an opinion on stamp duty for a proposed property purchase differs from signing documents, controlling escrow, handling consideration or completing the acquisition as the client's representative. Advising on company incorporation differs from creating and operationally managing the entity. Reviewing bank records differs from operating or managing the account.

The boundary will be fact-sensitive where the professional coordinates counterparties, holds authority, controls transaction steps, or manages assets without formally signing the final instrument. Firms should not classify work only by the engagement title. They should record the service components, authority granted, funds or accounts touched, entities created and persons for whom action is taken.

A second Central Government notification dated 9 May 2023, S.O. 2135(E), separately designated specified activities of trust and company service providers, subject to stated exclusions. A professional engagement may need to be tested against both notifications, but the same facts should not be described as outside the regime merely because another service-provider category also exists.

Consequences of becoming a reporting entity

Once a covered activity is undertaken, the professional enters the Chapter IV PMLA framework. The principal obligations arise from Sections 11A, 12, 12A, 12AA, 13 and 14 PMLA, the Prevention of Money-laundering (Maintenance of Records) Rules, 2005, and the FIU-IND guidelines for certificate-of-practice holders.

The professional or firm must register through the prescribed FIU-IND and FINnet process, communicate the required compliance appointments, establish a client-due-diligence programme, identify and assess risk, maintain reconstructable records, monitor covered relationships, furnish prescribed information and protect the confidentiality of reports. Registration is not the source of the legal duty; the notification and statutory classification are. Failure to register does not place an otherwise covered person outside the law.

Designated Director and Principal Officer

The Designated Director bears overall responsibility for compliance with Chapter IV and the Rules. The appropriate person depends on the legal form of the reporting entity: the Rules identify senior governing persons for a company, partnership, proprietorship, trust and other forms. The Principal Officer must be a management-level officer and is the focal point for reporting information to FIU-IND.

In a small practice, the same natural person may perform several operational functions, but responsibility must still be formally allocated. In a larger firm, the Principal Officer requires access to engagement information across service lines, freedom to escalate concerns, and protection from commercial pressure. The governing body should approve the AML programme, review meaningful risk metrics and ensure timely remediation.

Risk assessment before client acceptance

Rule 9 requires a documented and current assessment of money-laundering and terrorist-financing risks relating to clients, countries or geographic areas, products, services, transactions and delivery channels. For professional firms, relevant risk factors include opaque ownership, politically exposed persons, high-risk jurisdictions, unusual use of trusts or shell entities, unexplained source of funds, nominee arrangements, rapid changes in shareholders or directors, transactions inconsistent with stated business, and client resistance to disclosure.

Risk classification is not a substitute for evidence. A foreign client or complex structure is not inherently unlawful. The purpose is to decide the intensity of due diligence, approval, monitoring and review. The firm should document both the risk indicators and the legitimate commercial explanation it accepts.

Customer and beneficial-owner due diligence

At the required stage, the reporting entity must identify the client, verify identity through reliable and independent sources, understand the purpose and intended nature of the relationship, take reasonable steps to understand the client's business and ownership, and identify the natural person who ultimately owns or controls the client or on whose behalf the transaction is conducted.

The current Rules generally treat ownership or entitlement above ten per cent as relevant for companies and partnerships, without excluding control through other means. A percentage check alone is therefore inadequate. Voting arrangements, appointment rights, trust control, funding, informal directions and the person supplying the economic benefit may reveal the true beneficial owner.

Due diligence should extend to authorised signatories and persons granting instructions. If the professional cannot complete required due diligence, the firm must apply the statutory and rule-based consequences, consider whether the circumstances are suspicious and avoid tipping off the client.

Records that reconstruct the transaction

Section 12 requires records sufficient to reconstruct individual transactions. A defensible file should show the parties, beneficial owners, instructions, authority, asset, amount, currency, date, source and destination of funds, relevant accounts, documents executed and the firm's role. It should also preserve the risk assessment, due-diligence results, alert analysis and the reasons for escalation or closure.

Transaction records must be maintained for five years from the transaction date. Identity records, account files and business correspondence must be maintained for five years after the business relationship ends or the account is closed, whichever is later. Enhanced-due-diligence information under Section 12AA carries the statutory retention period stated there. Firms should suspend ordinary destruction where a lawful preservation requirement, inquiry or proceeding applies.

Suspicious transaction reporting

Suspicion is not a finding of guilt. It is an intelligence threshold based on facts, context and reasonable analysis. Relevant indicators may include circular movement of funds, unexplained third-party consideration, sham directors, a property price grossly inconsistent with available information, sudden layering through newly formed entities, misuse of client accounts, false invoices, an implausible source of wealth or deliberate concealment of the controlling person.

Under Rule 8, the Principal Officer must furnish a suspicious transaction report promptly and no later than seven working days after being satisfied that the transaction is suspicious. Attempted transactions are within the statutory reporting architecture. The professional should document the point at which suspicion crystallised; delaying that decision artificially does not extend the reporting period.

Confidentiality, privilege and tipping off

Section 12(2) requires information maintained, furnished or verified to be kept confidential, subject to law. The Rules also protect the confidentiality of the fact that records are maintained or information is furnished. A client should not be told that an STR has been or may be filed if that disclosure would amount to tipping off.

Professional confidentiality and legal professional privilege are not interchangeable. Accountants and company secretaries owe professional duties of confidentiality, but a statutory PMLA reporting obligation prevails within its field. The privileged-communication provisions of the Bharatiya Sakshya Adhiniyam, 2023 principally protect specified communications involving advocates and legal advisers; privilege cannot be assumed merely because a communication is commercially sensitive or was sent to an accountant. Where a multidisciplinary engagement includes lawyers, every communication should be classified by its purpose, participants and governing law rather than covered by a blanket label.

Section 14 PMLA protects the reporting entity, directors and employees from civil or criminal proceedings for furnishing information under Section 12(1)(b), within the terms of that section. It does not protect disclosure to outsiders, bad record governance or unrelated professional misconduct.

Withdrawal from the engagement

Resignation does not erase knowledge already acquired or a reporting duty that has arisen. Nor should withdrawal be used as a coded warning to a client. The firm should obtain internal legal and compliance advice, preserve the file, make any required report confidentially, and communicate only what professional rules and law permit. It should also assess connected clients and transactions without assuming that association alone proves suspicion.

Enforcement, monetary consequences and appeal

Under Section 13, the Director may inquire into compliance and may order the special audit contemplated by subsection (1A). If a reporting entity, its Designated Director or an employee has failed to comply with Chapter IV, the Director may issue a written warning, direct compliance with specified instructions, require periodic reports, or impose a penalty of not less than ₹10,000 and up to ₹1 lakh for each failure. Repeated omissions can therefore create cumulative exposure.

An aggrieved reporting entity may appeal a Section 13(2) order to the Appellate Tribunal under Section 26. Unpaid penalties may be recovered under Section 69. Separate conduct may also attract disciplinary action under the professional statutes or criminal liability where the professional knowingly participates in an offence. Reporting-entity status itself does not make a professional guilty of money laundering; guilt under Section 3 requires proof of that offence's own ingredients.

Judicial position and the need for precision

No located Supreme Court or High Court merits judgment, as of 5 September 2026, comprehensively interprets the scope of S.O. 2036(E), the boundary between advice and “carrying out” a transaction, or the FIU-IND professional guidelines. The operative framework is therefore the notification read with the PMLA, the Maintenance of Records Rules and current official guidance. Decisions involving accountants accused of substantive laundering or granted bail on their individual facts do not answer the distinct reporting-entity classification question and should not be inserted as if they did.

Practical control framework

A professional firm should create an engagement-screening form that maps actual tasks against each notified activity. Covered engagements should enter an enhanced workflow before work begins: identity and beneficial ownership, purpose, source of funds and wealth where appropriate, sanctions and politically exposed person screening, risk approval, transaction monitoring, records plan and escalation route.

The firm should prohibit client money from passing through office or personal accounts except under a lawful, approved and controlled arrangement. Access to incorporation tools, bank mandates, digital signatures and trust records should be restricted and logged. Training should use profession-specific examples. Independent testing should sample both engagements classified as covered and those classified as outside the regime, because misclassification is the central risk.

Conclusion

The 2023 notification makes practising CAs, CSs and cost accountants AML gatekeepers only when they perform defined transactional activities for and on behalf of clients. Its restraint is as important as its reach: ordinary professional work is not automatically converted into a reporting service, but substance prevails over the label on the file. Accurate engagement mapping, beneficial-owner transparency, confidential reporting, reconstructable records and senior accountability are the core of lawful compliance.

Sources

Central Government Notification S.O. 2036(E), dated 3 May 2023, issued under Section 2(1)(sa)(vi) PMLA: https://egazette.gov.in/WriteReadData/2023/245673.pdf

Central Government Notification S.O. 2135(E), dated 9 May 2023, concerning trust and company service-provider activities: https://egazette.gov.in/WriteReadData/2023/245790.pdf

Prevention of Money-Laundering Act, 2002, Sections 2, 3, 11A–14, 26 and 69: https://www.indiacode.nic.in/handle/123456789/15402

Prevention of Money-laundering (Maintenance of Records) Rules, 2005, as amended: https://fiuindia.gov.in/files/AML_Legislation/notification.html

Financial Intelligence Unit–India, AML/CFT Guidelines for Professionals with Certificates of Practice from ICAI, ICSI and ICMAI: https://fiuindia.gov.in/files/Downloads/Downloads.html

Bharatiya Sakshya Adhiniyam, 2023, provisions governing professional communications and statutory savings: https://www.indiacode.nic.in/handle/123456789/20063

This article provides general information and does not constitute legal advice. Whether a particular engagement is covered depends on its actual scope, the authority exercised and current official directions.

#PMLA #ProfessionalCompliance #FIUIND