A Nagpur-based CA walked into my office last winter with a letter from FIU-IND asking for information on a transaction his firm had handled for a corporate client. He told me, in good faith, that there must be a mistake because "we are not a bank". It took me twenty minutes to walk him through the fact that his firm had been a Reporting Entity under PMLA since 3 May 2023, and that for the particular transaction he had assisted on, he had an active obligation to maintain records under Section 12 PMLA [L3-C1].
He is not unusual. The 2023 expansions moved the Reporting Entity perimeter so quickly that a large part of the newly-covered cohort still does not know it is covered. If you advise clients, run a professional practice, trade in VDAs, deal in real estate, work in a co-operative society or run any form of financial intermediary, you need to be sure where you sit on the Reporting Entity map.
The core categories are stable
The traditional Reporting Entity categories under Section 2(1)(wa) PMLA [L3-C2] have not changed. A banking company. A financial institution. An intermediary. These definitions sweep in commercial banks, co-operative banks (now including Multi-State Co-op Societies under the 2024 FIU guidelines), NBFCs across all layers of the RBI scale-based regulation, Housing Finance Companies, Payment Banks, Small Finance Banks, All India Financial Institutions, insurers of all classes under IRDAI, and the full intermediary list under Section 12 of the SEBI Act (brokers, DPs, bankers to an issue, trustees, registrars, merchant bankers, underwriters, portfolio managers, investment advisers, AIFs, Mutual Funds, InvITs, REITs, custodians, KRAs).
If you work in any of these, your organisation has carried Reporting Entity status for at least a decade. The current obligations are set out in Rule 9 CDD [L3-C3], Rule 3 record-keeping [L3-C4] and Rule 7 reporting [L3-C5]. Where the regime has moved is in operational tightening, not in whether you are covered.
The 2023 expansions are the real story
The three 2023 Ministry of Finance notifications under Section 2(1)(sa)(vi) [L3-C6] changed the shape of the Reporting Entity universe.
S.O. 1072(E) dated 7 March 2023 [L3-C7] brought in Virtual Digital Asset Service Providers. Five activities trigger Reporting Entity status: fiat-to-VDA exchange, VDA-to-VDA exchange, VDA transfer, safekeeping and administration of VDAs, and participation in or provision of financial services related to an issuer\'s offer and sale of a VDA. If your business touches any of the five, you are in. 54 VDA SPs are registered with FIU-IND as of July 2026, and in October 2025 FIU-IND issued fresh non-compliance notices to 25 offshore operators under Section 13 PMLA. The regime has teeth.
S.O. 1073(E) on the same date brought in real-estate agents and developers. The practical trigger is any transaction involving real-estate buying-selling on behalf of a client. The threshold and exemption position has not been clarified by a later notification, so field compliance is risk-based rather than threshold-based. If a real-estate agent in Mumbai is representing a buyer or seller on a Rs 15 crore transaction, there is no plausible argument that PMLA does not apply.
S.O. 2036(E) dated 3 May 2023 [L3-C8] brought in Chartered Accountants, Company Secretaries and Cost Accountants. The trigger is narrow and important. The notification applies only to financial transactions carried out by a relevant person on behalf of his client in the course of his profession, in five activity classes: buying and selling immovable property; managing client money, securities or other assets; management of bank, savings or securities accounts; organisation of contributions for creation, operation or management of companies; and creation, operation or management of companies, LLPs or trusts, and buying and selling business entities. The notification does not cover tax filings, statutory audits or compliance work. A CA firm that purely does audits is not caught. A CA firm that incorporates companies for clients, administers client trusts or manages client bank mandates is caught.
A Delhi High Court writ challenging the May 2023 notification was filed by Chartered Accountants shortly after it issued. Interim relief has been declined. The matter is pending. Until the court rules otherwise, the notification is in force. ICSI, ICAI and ICMAI have all published member guides to help their constituencies navigate it, and ICMAI issued updated KYC Guidelines for Practising Cost Accountants on 28 March 2025.
Multi-State Co-operative Societies joined in 2024
On 11 October 2024 the FIU-IND AML/CFT Guidelines for Multi-State Co-operative Societies [L3-C9] took effect. These extend the FIU reporting discipline to a sector that has historically operated with lighter infrastructure. The guidelines map Rule 3 reporting categories, Rule 7 timelines and Rule 9 CDD obligations onto co-op society operations and expect each MSCS to name a Principal Officer and Designated Director. The December 2025 penalty orders against Gandhinagar Nagarik Co-operative Bank and Rajgurunagar Sahakari Bank show the enforcement intent.
The five activities for professionals, in plain English
If you are a CA, CS or CMA, here is how to run the test on a client engagement. One, are you buying or selling immovable property for the client? Two, are you managing client money, securities or other assets? Three, are you managing a bank, savings or securities account for the client (not just advising, actually operating)? Four, are you organising contributions for the creation, operation or management of companies? Five, are you creating, operating or managing a company, LLP or trust for the client, or buying or selling business entities?
If any answer is yes, this specific engagement makes your firm a Reporting Entity for that engagement. The firm must identify and verify the client under Rule 9, maintain records, name a Principal Officer and Designated Director, and furnish information to FIU-IND when triggered. If every answer is no, you are not caught by this notification for that engagement. Pure statutory audit, pure tax return filing, pure compliance opinion work: not caught.
Five failure modes new Reporting Entities repeat
Assuming PMLA does not apply because you are not a bank. The entire 2023 expansion was built to catch exactly this reasoning.
Treating real-estate PMLA compliance as threshold-based. There is no threshold in the notification. Build a risk-based policy, document the risk ratings, and apply CDD proportionately.
A CA firm partner assuming his partnership structure insulates him. Section 70 PMLA deems every person in charge of and responsible for the conduct of the business guilty of a PMLA offence by the entity. Partnerships are not shields.
A VDA SP operating in India without FIU-IND registration, assuming offshore domicile is protection. The Binance Rs 18.82 crore order of 19 June 2024 and the Bybit Rs 9.27 crore order of 31 January 2025 are the obvious counter-examples. Both subsequently registered.
Ignoring the Delhi High Court pending writ as if it suspended the notification. It did not. Interim relief was declined. The notification is in force.
Your artifact from Lesson 3
Build a Reporting Entity applicability decision tree for your organisation. Start with the Section 2(1)(wa) core categories, add the three 2023 notifications, add the Multi-State Co-op coverage, and end at a yes-or-no for your own entity. Save it as Artifact 3 in your capstone workbook. Even if the answer is obviously yes, document the chain of reasoning. When an inspector asks why you registered, the decision tree is your answer.