FFMC Compliance, Audit and Reporting Requirements

FFMC Compliance, Audit and Reporting Requirements. Foreign exchange transactions play a vital role in facilitating international travel, education, medical treatment, business, and cross-border trade. In India, companies engaged in money-changing activities are regulated by the Reserve Bank of India (RBI) under the provisions of the Foreign Exchange Management Act, 1999 (FEMA). A Full-Fledged Money Changer (FFMC) is an entity authorised by the RBI to purchase foreign exchange from residents and non-residents and sell foreign exchange for approved purposes as permitted under FEMA.
Obtaining an FFMC licence is only the first step. After receiving authorisation, an FFMC is required to comply with several regulatory, operational, audit, and reporting obligations prescribed by the RBI. These compliance requirements are designed to ensure transparency, prevent financial crimes such as money laundering and terrorist financing, and maintain the integrity of India's foreign exchange market. This article explains the major compliance, audit, and reporting requirements applicable to FFMCs in detail.
Regulatory Compliance under FEMA and RBI Directions
Every FFMC must operate strictly within the framework prescribed by FEMA, RBI Master Directions, and other circulars issued by the RBI from time to time. The authorisation granted by the RBI does not provide unrestricted permission to deal in foreign exchange. Instead, every transaction undertaken by an FFMC must fall within the scope of activities permitted by the RBI.
The company must ensure that its business operations, customer dealings, record maintenance, reporting mechanisms, and internal control systems remain fully compliant with applicable regulations. Failure to follow these directions may result in penalties, suspension of business operations, or cancellation of the FFMC licence.
Customer Identification and KYC Compliance
Importance of Know Your Customer (KYC)
Know Your Customer (KYC) is one of the most important compliance requirements for an FFMC. Before purchasing or selling foreign currency, the FFMC must establish the identity of every customer and verify that the transaction is genuine. The objective of KYC is to prevent identity fraud, money laundering, terrorist financing, and illegal movement of foreign exchange. Proper customer verification also enables the company to maintain accurate transaction records and demonstrate regulatory compliance during inspections and audits.
Documents Required for Customer Verification
Before completing any foreign exchange transaction, the FFMC should verify and maintain copies of appropriate customer documents, which generally include:

Passport

Aadhaar Card

PAN Card

Visa (where applicable)

Air Ticket

Proof of Address

Purpose of foreign exchange requirement

Additional documents prescribed under RBI guidelines

The documents collected should be verified carefully, and any discrepancies should be resolved before processing the transaction.
Customer Due Diligence (CDD)
Conducting Risk-Based Customer Assessment
Apart from collecting identity documents, FFMCs are required to conduct Customer Due Diligence (CDD). This involves understanding the customer's profile, assessing the purpose of the transaction, identifying the source of funds where necessary, and evaluating the overall risk associated with the customer.
Higher-risk customers may require Enhanced Due Diligence (EDD), which involves obtaining additional information and carrying out more detailed verification. A risk-based approach enables FFMCs to identify unusual or suspicious transactions at an early stage and strengthens compliance with Anti-Money Laundering (AML) regulations.
Anti-Money Laundering (AML) Compliance
Establishing an Effective AML Policy
Every FFMC must establish a comprehensive Anti-Money Laundering policy that complies with the Prevention of Money Laundering Act (PMLA), FEMA, RBI directions, and other applicable regulations. The AML policy should define the company's procedures for customer identification, transaction monitoring, record maintenance, reporting obligations, employee responsibilities, and risk management. The policy should be approved by the Board of Directors and reviewed periodically to ensure that it remains aligned with evolving regulatory requirements.
Appointment of Principal Officer
The RBI requires FFMCs to appoint a Principal Officer who is responsible for overseeing compliance with AML and KYC regulations. The Principal Officer acts as the central point of contact for regulatory authorities and ensures that suspicious transactions are identified, investigated, and reported appropriately. The officer is also responsible for implementing internal compliance procedures, coordinating staff training, maintaining regulatory records, and ensuring timely submission of mandatory reports.
Monitoring Suspicious Transactions
An FFMC must continuously monitor customer transactions to identify activities that appear unusual, inconsistent, or suspicious. Transactions involving unusually high amounts, repeated small transactions designed to avoid reporting thresholds, or unexplained foreign currency exchanges should be reviewed carefully. Where appropriate, Suspicious Transaction Reports (STRs) must be filed with the Financial Intelligence Unit – India (FIU-IND) in accordance with applicable laws.
Record Maintenance Requirements
Maintaining Transaction Records
Every FFMC is required to maintain complete and accurate records of all foreign exchange transactions undertaken during its operations. These records should include customer details, transaction amounts, exchange rates applied, supporting documents, receipts issued, and other information necessary for regulatory verification. Proper documentation ensures transparency and enables regulators to verify that all transactions have been conducted in accordance with RBI guidelines.
Preservation of Records
The records maintained by an FFMC should be preserved for the period prescribed under applicable RBI directions and the Prevention of Money Laundering Act. In general, transaction records, customer identification documents, and supporting evidence should be retained for at least five years after the completion of the transaction or closure of the customer relationship, whichever is later. Proper record preservation facilitates audits, regulatory inspections, investigations, and dispute resolution.
Operational Compliance Requirements
Display of RBI Authorisation
Every FFMC must prominently display its RBI authorisation certificate at its registered office and all approved branch locations. Customers should be able to easily verify that the entity is legally authorised to undertake foreign exchange transactions. Displaying the authorisation enhances transparency and builds customer confidence.
Display of Exchange Rates
FFMCs are also required to display the prevailing foreign exchange buying and selling rates at a conspicuous place accessible to customers. The exchange rates should be updated regularly to reflect current market conditions and RBI requirements. Transparent display of exchange rates helps customers make informed decisions and prevents unfair trade practices.
Issuance of Proper Receipts
Every foreign exchange transaction should be supported by an official receipt containing complete transaction details. The receipt should include the customer's name, date of transaction, currency exchanged, applicable exchange rate, amount paid or received, and the authorised signature or system-generated authentication. Maintaining proper documentation is essential for regulatory compliance as well as customer dispute resolution.
Internal Control and Risk Management
Establishing Robust Internal Controls
An FFMC should implement a comprehensive internal control framework to ensure that its operations remain compliant with applicable laws. Internal controls should cover transaction approval processes, segregation of duties, document verification procedures, reconciliation mechanisms, and supervisory reviews. Strong internal controls minimise operational risks and reduce the possibility of fraud or regulatory violations.
Employee Training
Compliance is effective only when employees understand their responsibilities. FFMCs should organise periodic training programmes covering FEMA provisions, RBI guidelines, AML requirements, KYC procedures, customer due diligence, fraud prevention, and reporting obligations. Regular training helps employees identify compliance risks and respond appropriately to suspicious activities.
Audit Requirements for FFMCs
Statutory Audit
Every FFMC is required to undergo an annual statutory audit conducted by a qualified Chartered Accountant. The audit examines the financial statements, verifies compliance with RBI regulations, reviews internal controls, and evaluates whether the company's foreign exchange operations comply with FEMA and other applicable laws. The auditor also assesses whether the company has maintained adequate documentation, followed prescribed accounting standards, and implemented effective compliance mechanisms.
Internal Audit
In addition to the statutory audit, FFMCs should conduct periodic internal audits to evaluate operational efficiency and regulatory compliance. Internal audits focus on identifying weaknesses in internal controls, verifying transaction records, reviewing customer documentation, and ensuring adherence to AML and KYC requirements. Internal audit findings should be reported to senior management, and corrective actions should be implemented promptly.
Concurrent Audit
Large FFMCs or entities handling substantial volumes of foreign exchange transactions may also be required to conduct concurrent audits. Unlike annual audits, concurrent audits are carried out on an ongoing basis and review transactions almost in real time. The objective is to detect operational irregularities at an early stage, minimise compliance risks, and ensure continuous monitoring of foreign exchange activities.
Reporting Requirements for FFMCs
Submission of Periodic Returns
FFMCs are required to submit various returns and statements to the RBI as prescribed under applicable regulations. These reports generally contain information relating to foreign currency purchases, foreign currency sales, outstanding balances, branch-wise operations, and other regulatory data. Timely and accurate submission of returns enables the RBI to monitor the country's foreign exchange market effectively.
Suspicious Transaction Reporting (STR)
Whenever an FFMC identifies a transaction that appears suspicious or inconsistent with the customer's profile, it must submit a Suspicious Transaction Report (STR) to the Financial Intelligence Unit – India (FIU-IND). The report should be filed within the prescribed timelines and contain complete details of the suspicious activity. Failure to report suspicious transactions may expose the FFMC to regulatory penalties and legal action.
Reporting Material Changes to RBI
FFMCs must promptly inform the RBI about significant changes affecting their operations. These may include changes in shareholding, directors, key managerial personnel, registered office, branch network, ownership structure, or any event that could impact the validity of the RBI authorisation. Timely reporting ensures that the RBI's records remain accurate and up to date.
Penalties of Non-Compliance
Failure to comply with RBI guidelines, FEMA provisions, or reporting requirements may result in serious regulatory penalties. Depending on the nature and severity of the violation, the RBI may impose monetary penalties, suspend the FFMC licence, cancel the authorisation, or initiate enforcement proceedings under FEMA. Persistent non-compliance may also damage the company's reputation, affect customer confidence, and expose it to civil or criminal liability under applicable laws.
Best Practices for Maintaining Continuous Compliance
FFMCs should adopt a proactive compliance culture rather than treating regulatory obligations as periodic formalities. Management should regularly review compliance policies, strengthen internal controls, conduct periodic compliance audits, automate transaction monitoring, maintain accurate documentation, and ensure continuous employee training. Staying updated with RBI circulars, FEMA amendments, and AML regulations enables FFMCs to respond effectively to regulatory changes and maintain uninterrupted business operations.
Conclusion
Compliance, audit, and reporting obligations form the foundation of a legally compliant and efficiently managed Full-Fledged Money Changer. By implementing robust KYC and AML procedures, maintaining accurate records, conducting regular audits, establishing effective internal controls, and fulfilling all reporting obligations, FFMCs can ensure full regulatory compliance while safeguarding the integrity of India's foreign exchange system.
A well-managed compliance not only helps avoid regulatory penalties but also enhances operational efficiency, strengthens customer confidence, and contributes to the long-term sustainability and credibility of the business.
Frequently Asked Questions
Q1. What is an FFMC?
Ans. A Full-Fledged Money Changer, or FFMC, is an entity authorised by the Reserve Bank of India under FEMA to purchase foreign currency and sell foreign exchange for permitted purposes. It may serve residents, travellers, tourists, students and businesses, subject to RBI conditions, KYC requirements and applicable reporting obligations at all.
Q2. Is obtaining an FFMC licence enough to operate?
Ans. No. Obtaining an FFMC licence is only the first regulatory step. The company must continuously follow RBI directions, FEMA provisions, KYC and AML requirements, audit procedures, record-keeping standards and reporting timelines. It must also operate only from approved locations and undertake transactions permitted under its authorisation and applicable regulations continuously.
Q3. What are the main FFMC compliance requirements?
Ans. An FFMC must comply with customer identification, KYC verification, customer due diligence, AML controls, transaction monitoring, record preservation, statutory registers, exchange-rate display, receipt issuance, internal controls, staff training, audits and regulatory reporting. It must also report suspicious transactions and notify RBI about material operational, ownership or management changes within timelines.
Q4. Is KYC mandatory for foreign exchange transactions?
Ans. Yes. KYC is mandatory for foreign exchange transactions, although documentation may vary according to transaction type, value, purpose and customer risk. The FFMC must verify identity, address and supporting documents, understand the transaction purpose and ensure consistency with the customer’s profile before completing any purchase or sale of foreign currency.
Q5. What is Customer Due Diligence?
Ans. Customer Due Diligence means identifying and verifying the customer, understanding the purpose of the transaction, reviewing the source of funds where necessary and assessing risks. Higher-risk customers or unusual transactions may require enhanced due diligence, additional documents, closer monitoring or senior management approval before the FFMC processes any foreign exchange.
Q6. What records must an FFMC maintain?
Ans. An FFMC must maintain records of foreign currency purchases and sales, customer identification documents, applications, encashment certificates, receipts, vouchers, exchange rates, payment details and supporting documents. It should also preserve prescribed statutory registers, daily summaries and branch records so that every transaction can be verified during audits, inspections or investigations.
Q7. How long should FFMC records be preserved?
Ans. FFMC records must be preserved for the period prescribed under RBI directions, FEMA, PMLA and applicable rules. Transaction and customer identification records should be kept for at least five years from completion of the transaction or closure of the relationship, subject to longer retention required by law or regulatory proceedings.
Q8. Is annual audit mandatory for an FFMC?
Ans. Yes. An FFMC should undergo annual statutory audit by a qualified Chartered Accountant. The audit examines financial statements, foreign exchange transactions, customer documentation, statutory registers, internal controls and compliance with RBI conditions. Management must address audit observations promptly and maintain evidence showing that identified weaknesses have been corrected within timelines.
Q9. What is an internal audit of an FFMC?
Ans. An internal audit is a periodic review of an FFMC’s operations, controls and regulatory compliance. It checks customer verification, cash handling, foreign currency balances, reconciliations, documentation, AML monitoring, statutory registers and branch procedures. Internal audit findings help management identify weaknesses, correct errors and strengthen compliance before regulatory inspection or audit.
Q10. What is a concurrent audit?
Ans. A concurrent audit is a continuous or frequent review of transactions conducted close to the time they occur. It helps detect errors, unauthorised dealings, weak documentation and control failures early. Its scope and frequency may depend on transaction volume, branch network, risk profile and regulatory expectations applicable to the FFMC.

Foreign exchange transactions play a vital role in facilitating international travel, education, medical treatment, business, and cross-border trade. In India, companies engaged in money-changing activities are regulated by the Reserve Bank of India (RBI) under the provisions of the Foreign Exchange Management Act, 1999 (FEMA). A Full-Fledged Money Changer (FFMC) is an entity authorised by the RBI to purchase foreign exchange from residents and non-residents and sell foreign exchange for approved purposes as permitted under FEMA.

Obtaining an FFMC licence is only the first step. After receiving authorisation, an FFMC is required to comply with several regulatory, operational, audit, and reporting obligations prescribed by the RBI. These compliance requirements are designed to ensure transparency, prevent financial crimes such as money laundering and terrorist financing, and maintain the integrity of India's foreign exchange market. This article explains the major compliance, audit, and reporting requirements applicable to FFMCs in detail.

Regulatory Compliance under FEMA and RBI Directions

Every FFMC must operate strictly within the framework prescribed by FEMA, RBI Master Directions, and other circulars issued by the RBI from time to time. The authorisation granted by the RBI does not provide unrestricted permission to deal in foreign exchange. Instead, every transaction undertaken by an FFMC must fall within the scope of activities permitted by the RBI.

The company must ensure that its business operations, customer dealings, record maintenance, reporting mechanisms, and internal control systems remain fully compliant with applicable regulations. Failure to follow these directions may result in penalties, suspension of business operations, or cancellation of the FFMC licence.

Customer Identification and KYC Compliance

Importance of Know Your Customer (KYC)

Know Your Customer (KYC) is one of the most important compliance requirements for an FFMC. Before purchasing or selling foreign currency, the FFMC must establish the identity of every customer and verify that the transaction is genuine. The objective of KYC is to prevent identity fraud, money laundering, terrorist financing, and illegal movement of foreign exchange. Proper customer verification also enables the company to maintain accurate transaction records and demonstrate regulatory compliance during inspections and audits.

Documents Required for Customer Verification

Before completing any foreign exchange transaction, the FFMC should verify and maintain copies of appropriate customer documents, which generally include:

Passport
Aadhaar Card
PAN Card
Visa (where applicable)
Air Ticket
Proof of Address
Purpose of foreign exchange requirement
Additional documents prescribed under RBI guidelines

The documents collected should be verified carefully, and any discrepancies should be resolved before processing the transaction.

Customer Due Diligence (CDD)

Conducting Risk-Based Customer Assessment

Apart from collecting identity documents, FFMCs are required to conduct Customer Due Diligence (CDD). This involves understanding the customer's profile, assessing the purpose of the transaction, identifying the source of funds where necessary, and evaluating the overall risk associated with the customer.

Higher-risk customers may require Enhanced Due Diligence (EDD), which involves obtaining additional information and carrying out more detailed verification. A risk-based approach enables FFMCs to identify unusual or suspicious transactions at an early stage and strengthens compliance with Anti-Money Laundering (AML) regulations.

Anti-Money Laundering (AML) Compliance

Establishing an Effective AML Policy

Every FFMC must establish a comprehensive Anti-Money Laundering policy that complies with the Prevention of Money Laundering Act (PMLA), FEMA, RBI directions, and other applicable regulations. The AML policy should define the company's procedures for customer identification, transaction monitoring, record maintenance, reporting obligations, employee responsibilities, and risk management. The policy should be approved by the Board of Directors and reviewed periodically to ensure that it remains aligned with evolving regulatory requirements.

Appointment of Principal Officer

The RBI requires FFMCs to appoint a Principal Officer who is responsible for overseeing compliance with AML and KYC regulations. The Principal Officer acts as the central point of contact for regulatory authorities and ensures that suspicious transactions are identified, investigated, and reported appropriately. The officer is also responsible for implementing internal compliance procedures, coordinating staff training, maintaining regulatory records, and ensuring timely submission of mandatory reports.

Monitoring Suspicious Transactions

An FFMC must continuously monitor customer transactions to identify activities that appear unusual, inconsistent, or suspicious. Transactions involving unusually high amounts, repeated small transactions designed to avoid reporting thresholds, or unexplained foreign currency exchanges should be reviewed carefully. Where appropriate, Suspicious Transaction Reports (STRs) must be filed with the Financial Intelligence Unit – India (FIU-IND) in accordance with applicable laws.

Record Maintenance Requirements

Maintaining Transaction Records

Every FFMC is required to maintain complete and accurate records of all foreign exchange transactions undertaken during its operations. These records should include customer details, transaction amounts, exchange rates applied, supporting documents, receipts issued, and other information necessary for regulatory verification. Proper documentation ensures transparency and enables regulators to verify that all transactions have been conducted in accordance with RBI guidelines.

Preservation of Records

The records maintained by an FFMC should be preserved for the period prescribed under applicable RBI directions and the Prevention of Money Laundering Act. In general, transaction records, customer identification documents, and supporting evidence should be retained for at least five years after the completion of the transaction or closure of the customer relationship, whichever is later. Proper record preservation facilitates audits, regulatory inspections, investigations, and dispute resolution.

Operational Compliance Requirements

Display of RBI Authorisation

Every FFMC must prominently display its RBI authorisation certificate at its registered office and all approved branch locations. Customers should be able to easily verify that the entity is legally authorised to undertake foreign exchange transactions. Displaying the authorisation enhances transparency and builds customer confidence.

Display of Exchange Rates

FFMCs are also required to display the prevailing foreign exchange buying and selling rates at a conspicuous place accessible to customers. The exchange rates should be updated regularly to reflect current market conditions and RBI requirements. Transparent display of exchange rates helps customers make informed decisions and prevents unfair trade practices.

Issuance of Proper Receipts

Every foreign exchange transaction should be supported by an official receipt containing complete transaction details. The receipt should include the customer's name, date of transaction, currency exchanged, applicable exchange rate, amount paid or received, and the authorised signature or system-generated authentication. Maintaining proper documentation is essential for regulatory compliance as well as customer dispute resolution.

Internal Control and Risk Management

Establishing Robust Internal Controls

An FFMC should implement a comprehensive internal control framework to ensure that its operations remain compliant with applicable laws. Internal controls should cover transaction approval processes, segregation of duties, document verification procedures, reconciliation mechanisms, and supervisory reviews. Strong internal controls minimise operational risks and reduce the possibility of fraud or regulatory violations.

Employee Training

Compliance is effective only when employees understand their responsibilities. FFMCs should organise periodic training programmes covering FEMA provisions, RBI guidelines, AML requirements, KYC procedures, customer due diligence, fraud prevention, and reporting obligations. Regular training helps employees identify compliance risks and respond appropriately to suspicious activities.

Audit Requirements for FFMCs

Statutory Audit

Every FFMC is required to undergo an annual statutory audit conducted by a qualified Chartered Accountant. The audit examines the financial statements, verifies compliance with RBI regulations, reviews internal controls, and evaluates whether the company's foreign exchange operations comply with FEMA and other applicable laws. The auditor also assesses whether the company has maintained adequate documentation, followed prescribed accounting standards, and implemented effective compliance mechanisms.

Internal Audit

In addition to the statutory audit, FFMCs should conduct periodic internal audits to evaluate operational efficiency and regulatory compliance. Internal audits focus on identifying weaknesses in internal controls, verifying transaction records, reviewing customer documentation, and ensuring adherence to AML and KYC requirements. Internal audit findings should be reported to senior management, and corrective actions should be implemented promptly.

Concurrent Audit

Large FFMCs or entities handling substantial volumes of foreign exchange transactions may also be required to conduct concurrent audits. Unlike annual audits, concurrent audits are carried out on an ongoing basis and review transactions almost in real time. The objective is to detect operational irregularities at an early stage, minimise compliance risks, and ensure continuous monitoring of foreign exchange activities.

Reporting Requirements for FFMCs

Submission of Periodic Returns

FFMCs are required to submit various returns and statements to the RBI as prescribed under applicable regulations. These reports generally contain information relating to foreign currency purchases, foreign currency sales, outstanding balances, branch-wise operations, and other regulatory data. Timely and accurate submission of returns enables the RBI to monitor the country's foreign exchange market effectively.

Suspicious Transaction Reporting (STR)

Whenever an FFMC identifies a transaction that appears suspicious or inconsistent with the customer's profile, it must submit a Suspicious Transaction Report (STR) to the Financial Intelligence Unit – India (FIU-IND). The report should be filed within the prescribed timelines and contain complete details of the suspicious activity. Failure to report suspicious transactions may expose the FFMC to regulatory penalties and legal action.

Reporting Material Changes to RBI

FFMCs must promptly inform the RBI about significant changes affecting their operations. These may include changes in shareholding, directors, key managerial personnel, registered office, branch network, ownership structure, or any event that could impact the validity of the RBI authorisation. Timely reporting ensures that the RBI's records remain accurate and up to date.

Penalties of Non-Compliance

Failure to comply with RBI guidelines, FEMA provisions, or reporting requirements may result in serious regulatory penalties. Depending on the nature and severity of the violation, the RBI may impose monetary penalties, suspend the FFMC licence, cancel the authorisation, or initiate enforcement proceedings under FEMA. Persistent non-compliance may also damage the company's reputation, affect customer confidence, and expose it to civil or criminal liability under applicable laws.

Best Practices for Maintaining Continuous Compliance

FFMCs should adopt a proactive compliance culture rather than treating regulatory obligations as periodic formalities. Management should regularly review compliance policies, strengthen internal controls, conduct periodic compliance audits, automate transaction monitoring, maintain accurate documentation, and ensure continuous employee training. Staying updated with RBI circulars, FEMA amendments, and AML regulations enables FFMCs to respond effectively to regulatory changes and maintain uninterrupted business operations.

Conclusion

Compliance, audit, and reporting obligations form the foundation of a legally compliant and efficiently managed Full-Fledged Money Changer. By implementing robust KYC and AML procedures, maintaining accurate records, conducting regular audits, establishing effective internal controls, and fulfilling all reporting obligations, FFMCs can ensure full regulatory compliance while safeguarding the integrity of India's foreign exchange system.

A well-managed compliance not only helps avoid regulatory penalties but also enhances operational efficiency, strengthens customer confidence, and contributes to the long-term sustainability and credibility of the business.

Frequently Asked Questions

Q1. What is an FFMC?

Ans. A Full-Fledged Money Changer, or FFMC, is an entity authorised by the Reserve Bank of India under FEMA to purchase foreign currency and sell foreign exchange for permitted purposes. It may serve residents, travellers, tourists, students and businesses, subject to RBI conditions, KYC requirements and applicable reporting obligations at all.

Q2. Is obtaining an FFMC licence enough to operate?

Ans. No. Obtaining an FFMC licence is only the first regulatory step. The company must continuously follow RBI directions, FEMA provisions, KYC and AML requirements, audit procedures, record-keeping standards and reporting timelines. It must also operate only from approved locations and undertake transactions permitted under its authorisation and applicable regulations continuously.

Q3. What are the main FFMC compliance requirements?

Ans. An FFMC must comply with customer identification, KYC verification, customer due diligence, AML controls, transaction monitoring, record preservation, statutory registers, exchange-rate display, receipt issuance, internal controls, staff training, audits and regulatory reporting. It must also report suspicious transactions and notify RBI about material operational, ownership or management changes within timelines.

Q4. Is KYC mandatory for foreign exchange transactions?

Ans. Yes. KYC is mandatory for foreign exchange transactions, although documentation may vary according to transaction type, value, purpose and customer risk. The FFMC must verify identity, address and supporting documents, understand the transaction purpose and ensure consistency with the customer’s profile before completing any purchase or sale of foreign currency.

Q5. What is Customer Due Diligence?

Ans. Customer Due Diligence means identifying and verifying the customer, understanding the purpose of the transaction, reviewing the source of funds where necessary and assessing risks. Higher-risk customers or unusual transactions may require enhanced due diligence, additional documents, closer monitoring or senior management approval before the FFMC processes any foreign exchange.

Q6. What records must an FFMC maintain?

Ans. An FFMC must maintain records of foreign currency purchases and sales, customer identification documents, applications, encashment certificates, receipts, vouchers, exchange rates, payment details and supporting documents. It should also preserve prescribed statutory registers, daily summaries and branch records so that every transaction can be verified during audits, inspections or investigations.

Q7. How long should FFMC records be preserved?

Ans. FFMC records must be preserved for the period prescribed under RBI directions, FEMA, PMLA and applicable rules. Transaction and customer identification records should be kept for at least five years from completion of the transaction or closure of the relationship, subject to longer retention required by law or regulatory proceedings.

Q8. Is annual audit mandatory for an FFMC?

Ans. Yes. An FFMC should undergo annual statutory audit by a qualified Chartered Accountant. The audit examines financial statements, foreign exchange transactions, customer documentation, statutory registers, internal controls and compliance with RBI conditions. Management must address audit observations promptly and maintain evidence showing that identified weaknesses have been corrected within timelines.

Q9. What is an internal audit of an FFMC?

Ans. An internal audit is a periodic review of an FFMC’s operations, controls and regulatory compliance. It checks customer verification, cash handling, foreign currency balances, reconciliations, documentation, AML monitoring, statutory registers and branch procedures. Internal audit findings help management identify weaknesses, correct errors and strengthen compliance before regulatory inspection or audit.

Q10. What is a concurrent audit?

Ans. A concurrent audit is a continuous or frequent review of transactions conducted close to the time they occur. It helps detect errors, unauthorised dealings, weak documentation and control failures early. Its scope and frequency may depend on transaction volume, branch network, risk profile and regulatory expectations applicable to the FFMC.