A new AIF manager engages a fund administrator to onboard investors, run KYC and maintain the investor register. Months later, it emerges that one investor's beneficial owner was never properly identified. The administrator made the mistake, but SEBI and the anti-money laundering framework look to the manager. This article explains the KYC, AML and outsourcing obligations that apply to AIFs, what can and cannot be delegated, and how managers can oversee service providers effectively.
AIFs are SEBI-registered intermediaries, so SEBI's circulars on KYC, anti-money laundering and outsourcing apply to them, and the manager is responsible for compliance. Managers may use third parties for KYC processing and back-office work, but core functions and compliance cannot be outsourced, and the manager remains fully accountable for anything done on its behalf, including investor screening and suspicious transaction reporting.
Which KYC and AML rules apply to AIFs?
The SEBI Master Circular for AIFs (reissued on 3 June 2026) requires AIFs, as SEBI-registered intermediaries, to comply with SEBI's circulars on KYC, anti-money laundering (AML) and outsourcing of activities, and places responsibility for this on the manager. The main layers are:
AIFs face particular money-laundering risks. Tickets are large, many investors are companies, trusts, family offices or offshore vehicles with layered ownership, and money arrives in instalments over several years through drawdowns. Each drawdown is a fresh inflow that can come from a different account, and secondary transfers of units can bring in new beneficial owners mid-life. A KYC file that was adequate at the first close may not be adequate three years later. These features make ongoing monitoring, not just onboarding checks, the heart of an AIF's AML programme.
What investor screening does the AIF Master Circular require?
Beyond standard KYC, the Master Circular sets eligibility conditions for onboarding investors. The manager must ensure that:
- a foreign investor is resident in a country whose securities market regulator is a signatory to the IOSCO multilateral MoU or has a bilateral MoU with SEBI (with separate treatment for certain government-related investors);
- the investor, or its underlying beneficial owner, is not named in the United Nations Security Council sanctions list; and
- the investor is not resident in a jurisdiction identified in the FATF public statement as having strategic AML deficiencies.
If an existing investor later stops meeting these conditions, the manager must not draw down further capital from that investor until the condition is met again. Screening is therefore not a one-time onboarding event; it must be repeated, especially before each drawdown.
Sanctions lists and FATF statements change during the life of a fund. Build a re-screening step into the drawdown process so that each capital call is checked against current lists.
What should an AIF's AML programme include?
- Written policy. Board-approved AML and KYC policies covering customer due diligence, risk categorisation and monitoring. The Code of Conduct also requires AIFs to have written AML policies.
- Beneficial ownership. Identify and verify the natural persons who ultimately own or control entity investors, including trusts and layered structures.
- Risk-based due diligence. Apply enhanced due diligence for higher-risk investors, such as politically exposed persons and investors from higher-risk jurisdictions.
- Source of funds. Understand where the investor's money comes from, particularly for large or unusual commitments.
- Ongoing monitoring. Review transactions, transfers and drawdown payments for unusual patterns, including payments from third parties.
- Reporting. Appoint a principal officer and designated director as required, and file suspicious transaction and other reports with FIU-India.
- Records. Retain KYC and transaction records for the period required under PMLA, which runs beyond the end of the investor relationship.
What can an AIF manager outsource?
SEBI's guidelines on outsourcing of activities by intermediaries, issued in 2011 and applied to AIFs through the Master Circular, permit outsourcing of support activities but not of core business or compliance functions. The intermediary remains fully responsible for outsourced activities as if it performed them itself.
| Usually acceptable to outsource (with oversight) | Should stay with the manager |
|---|---|
| KYC document collection and verification processing | The decision to accept or reject an investor |
| Fund accounting, NAV computation support and investor statements | Investment decisions and portfolio management |
| Registrar and transfer functions, unit allotment processing | The compliance function and compliance officer role |
| Sanctions and adverse media screening tools | Suspicious transaction reporting decisions and FIU filings |
The dividing line is between doing the work and owning the decision. A fund administrator can collect and verify KYC documents; the manager decides whether the investor is acceptable and answers for that decision.
How should managers oversee outsourced providers?
- Due diligence before appointment: assess the provider's financial soundness, capability, systems, reputation and any concentration risk.
- Written contract: cover scope, service levels, confidentiality (including after termination), data security, business continuity, sub-contracting, audit rights and termination.
- Regulator access: ensure SEBI and the manager's auditors can access the provider's records relating to the AIF.
- Ongoing monitoring: review exception reports, sample KYC files and test screening results periodically.
- Records: make sure records of outsourced activities are available to the manager centrally and are retained for the required period.
A manager samples 10% of the investor files onboarded by its administrator each quarter. In one file, a company investor's shareholding chart stops at an intermediate holding company. The manager asks for the full chain to the ultimate natural person before the next drawdown is accepted. That simple sampling step is evidence of oversight in an inspection.
What is the specific due diligence of investors and investments?
The Master Circular also contains a chapter on specific due diligence of investors and investments. Its aim is to stop AIF structures from being used to get around other regulatory frameworks, for example where an investor or group uses an AIF to do indirectly what it could not do directly. Managers are expected to check, at onboarding and before investments, whether any investor or group of investors has a relationship with the proposed investee that triggers these concerns, and to document the outcome.
This sits naturally with AML work: both rely on knowing who the investor really is and why money is moving. Our articles on the AIF compliance officer and KMP and the PPM audit cover who should own these controls and how they are tested.
Frequently asked questions
Do AML and KYC rules apply to AIFs?
Yes. AIFs are SEBI-registered intermediaries and must comply with SEBI's KYC and AML/CFT requirements and the Prevention of Money-laundering Act, 2002. The AIF Master Circular places responsibility for this on the manager.
Can an AIF manager outsource KYC to a fund administrator?
The processing work can be outsourced, but the manager remains responsible. The decision to accept an investor, AML reporting and the compliance function stay with the manager.
What happens if an investor becomes sanctioned after investing?
If an investor stops meeting the eligibility conditions, for example by being named in a UN sanctions list, the manager cannot draw down further capital from that investor until the condition is met again, and AML obligations to report and act also apply.
Which activities cannot be outsourced by SEBI intermediaries?
SEBI's outsourcing guidelines prohibit outsourcing of core business activities and compliance functions. For an AIF manager, investment decisions and the compliance function are examples.
Who files suspicious transaction reports for an AIF?
The AIF, through its principal officer, files reports with FIU-India. A service provider may flag unusual activity, but the reporting obligation and decision remain with the regulated entity.
How long must AIF KYC records be kept?
Records must be kept for the period required under the PMLA and SEBI's AML guidelines, which extends beyond the end of the investor relationship. Managers should make sure outsourced providers retain and hand over records accordingly.
Conclusion
Outsourcing is a sensible way for AIF managers to handle KYC processing and back-office work, but it does not move responsibility. The manager decides who is admitted to the fund, answers for the quality of KYC and AML checks, and must be able to show how it supervised every service provider. Managers who keep the decisions in-house, screen investors before every drawdown and test their vendors regularly will meet both the letter and the purpose of SEBI's framework.
Launching or managing an AIF?
H K Davra & Co. supports AIF managers with SEBI compliance, PPM audits, CA certifications and investor reporting.
Talk to usThis article is for general information only and does not constitute professional advice or solicitation. Examples are illustrative. Provisions are summarised as of October 2026. Please refer to the relevant provisions and seek advice on your specific facts.