Regulation 20 requires a KYC Registration Agency established as a company in an IFSC to obtain the Authority's prior approval for any direct or indirect change in control. A KRA operating through an IFSC branch must intimate the Authority of any direct or indirect change in control within fifteen days.

Every KYC Registration Agency must maintain a sound system for comprehensively managing risks arising from its operations. Adequate internal procedures and controls must be appropriate to the types of business it undertakes, including outsourced activities, to protect clients and their assets and ensure proper and effective management of risks throughout those business activities.

Inter-city transfer of income-tax jurisdiction requires concurrence of the competent jurisdictional authorities where the transfer crosses Commissioner jurisdictions. Centralisation following search proceedings may be justified by a recorded nexus with the searched group and the need for coordinated investigation and assessment. The receiving Principal Commissioner's independent consent after applying mind satisfies the concurrence requirement. Transfer is an administrative power reviewable only for arbitrariness or mala fides. Notice must disclose the grounds for centralisation and address objections, but relied-upon investigation material need not be supplied at the transfer stage; disclosure may be sought during assessment. These requirements supported the transfer's validity.

Cyber security and cyber resilience obligations require every KYC Registration Agency (KRA) to maintain a robust framework aligned with requirements specified by the Authority from time to time. Compliance remains dependent on applicable Authority requirements, which may be updated periodically, and covers cyber security safeguards and operational resilience within the KRA framework.

Each KYC Registration Agency must maintain a business continuity plan containing procedures for emergencies or significant business disruptions. It must update the plan following material changes to operations, structure, business, or location, and conduct an annual review. The requirements establish continuing preparedness, change-management, and periodic review for operational continuity.

Disputes arising out of or relating to activities of a KYC Registration Agency in an International Financial Services Centre must be resolved in accordance with the dispute-resolution mechanism specified by the Authority. The Authority-specified mechanism governs the resolution of disputes connected with the KYC Registration Agency's activities within that International Financial Services Centre.

KYC Registration Agencies must take adequate measures for consumer grievance redressal according to requirements specified by the Authority. They must also maintain records of investor grievances received and the redress provided. The obligations combine complaint-handling measures with documented tracking of grievance receipt and resulting redress as an ongoing recordkeeping duty in connection with consumer complaints.

A KYC Registration Agency must immediately furnish any material change in previously supplied application information or particulars where the change bears on its registration certificate. Changes in the Principal Officer, Compliance Officer, or key managerial personnel must be intimated within 15 days. It must also provide reports, returns, statements, and other particulars in the prescribed form, manner, and intervals.

KYC Registration Agencies must preserve financial statements, audit reports, quarterly net-worth statements, compliance records, client account-opening documents, authority forms and activity records in electronic retrieval form for at least eight years. Client KYC documents must be retained electronically for the period prescribed under the Prevention of Money Laundering Act and its rules, with retrieval of KYC information facilitated within the stipulated time period.

Regulation 12 requires every KRA to comply with the Code of Conduct set out in Schedule I. Adherence to those scheduled standards is mandatory for KRA regulatory compliance and conduct within the applicable registration framework.

Airport operational critical information infrastructure, including airfield lighting, operational control, access control, baggage handling, passenger-processing, surveillance and clock systems, is declared a protected system under the Information Technology Act, 2000. Access is confined to persons authorised in writing by Delhi International Airport Ltd, including designated employees, need-based service-provider or vendor personnel, and case-specific consultants, regulators, officials, auditors and stakeholders. The designation takes effect upon publication in the Official Gazette.

A registered KRA may apply to surrender its registration. Voluntary surrender of the certificate of registration is not effective merely upon filing the application; it becomes effective only when the Authority accepts the surrender. Acceptance is therefore a mandatory condition for completion of the registration-surrender process.

Certificate of registration of a KRA remains legally effective for the KRA without a fixed expiry period. Its validity ends only where the Authority suspends or cancels the certificate, or where the KRA surrenders it and the Authority accepts that surrender. Surrender alone does not terminate registration; Authority acceptance is required, while suspension or cancellation independently renders the certificate no longer valid.

Registration as a KYC Registration Agency is available to specified wholly owned subsidiaries and certain branches undertaking KRA-like activities, subject to the absence of conflicts of interest. Registration may be granted upon satisfaction of eligibility, compliance with applicable conditions and payment of the prescribed fee. Deficiencies must be communicated for rectification before refusal, and written submissions must be permitted. Registered KRAs may be subject to additional conditions for investor protection, market development and operational regulation, and registration may be withdrawn after a hearing.

KYC Registration Agency registration requires consideration of qualifications and work experience of the applicant, Principal Officer and Compliance Officer; adequate infrastructure; eligibility and net-worth compliance; and financial creditworthiness. Scrutiny also covers the fitness and propriety of the applicant and relevant personnel, prior certificate refusals involving the applicant or its Associates, and proceedings for breach of law involving the applicant or relevant personnel.

KYC Registration Agencies must appoint a Principal Officer and separate Compliance Officer based in the IFSC, meeting prescribed qualification and financial-services-market experience requirements. The Principal Officer requires at least ten years' experience and the Compliance Officer at least five years' experience. A Compliance Officer must immediately and independently report non-compliance to the Authority. Adequate IFSC-based manpower, commensurate with business activities, is also required.

KYC Registration Agency registration requires the entity and its Principal Officer, directors, key managerial personnel and controlling shareholders to remain fit and proper at all times. Fitness depends on fairness, integrity, financial integrity, reputation, character and honesty. Disqualifications include specified convictions, pending economic-offence proceedings, recovery proceedings, malfeasance, undischarged insolvency, regulatory restraints, financial unsoundness, wilful default and fugitive economic offender status. A person declared not fit and proper cannot apply for registration until satisfying the prescribed criteria.

Registration as a KYC Registration Agency requires an applicant to maintain net worth of at least USD 1 million at all times. Where the agency is established as a branch of an entity registered with SEBI, that entity must earmark and ringfence the prescribed minimum net worth for the branch.

Registration as a KYC Registration Agency requires an applicant to be established in an International Financial Services Centre as a company. An entity already registered with the Securities and Exchange Board of India for similar activities may establish a wholly owned subsidiary or branch in the International Financial Services Centre.

Certificate of registration as a KYC Registration Agency requires an entity seeking registration to submit an application accompanied by the applicable application fees. Submission may be made electronically or by another permitted means and must follow the form and manner specified by the Authority.