AMFI Due Diligence for Mutual Fund Distributors: A Practical Preparation Guide (2026)

Most mutual fund distributors only start thinking seriously about AMFI due diligence the day a notice lands in their inbox. By then, you are reacting instead of preparing. The good news: due diligence is not designed to catch you out. It is a structured check of processes you can build long before anyone comes asking.

This guide covers what AMFI due diligence involves, who it applies to, and the records that turn a review into a formality rather than a scramble. It also covers what every mutual fund distributor (MFD) needs to get right regardless of due diligence: advisory versus execution only, risk profiling that holds up, and what AMFI’s Code of Conduct requires. It draws on a webinar Investwell Mint hosted in August 2026, alongside AMFI’s and SEBI’s published rules.

Quick summary: AMFI due diligence is a review the Association of Mutual Funds in India (AMFI) runs on behalf of asset management companies (AMCs), checking that a mutual fund distributor’s (MFD’s) processes are “fit and proper”. It applies to any distributor meeting at least one of four criteria, such as AUM or commission thresholds. Preparing means keeping documented processes, and evidence that you follow them.

Contents

1. What is AMFI due diligence for mutual fund distributors?
2. Who falls under AMFI due diligence?
3. What should you expect once you are selected?
4. What do auditors check during due diligence?
5. What does the DDQ cover?
6. Advisory or execution only: which are you?
7. How do you risk profile clients properly?
8. What evidence should be in each client file?
9. How should a mutual fund distributor handle complaints?
10. What do you owe clients on an ongoing basis?
11. How do you display your registration correctly?
12. What does AMFI’s Code of Conduct require, and forbid?
13. What data security and fraud controls should you have?
14. How do you renew your ARN, EUIN and NISM certification?
15. How do you fix compliance gaps in your existing client book?
16. How does Investwell Mint help?
17. Webinar Recording
18. Conclusion
19. Sources

1. What is AMFI due diligence for mutual fund distributors?

AMFI due diligence is a check of the processes a mutual fund distributor runs, to see that it takes the care a sensible business would, given that clients trust it with their money. It looks at how well your internal controls work and how closely you follow regulations and AMFI guidelines, so AMCs can judge whether you are “fit and proper”. This definition comes from AMFI’s Ready Reckoner (Feb 2025).

The obligation starts with SEBI and flows down through three more parties before you are actually reviewed:

• SEBI: The regulator that requires AMCs to run due diligence on distributors meeting certain criteria, both at empanelment and in later reviews, as AMFI’s due diligence FAQ describes.
• AMC: Carries that legal obligation. Rather than run a separate review for every distributor it works with, it takes part in one shared process.
• AMFI: Coordinates that shared process on behalf of all participating AMCs, so a distributor need not face several separate reviews.
• Audit firm: Appointed by AMFI to actually carry out the review, and typically fixes a date with you, sometimes requesting a filled due diligence questionnaire (DDQ), the form at the centre of this whole exercise, in advance. Its report goes back to your AMCs, who act on the findings.

As the due diligence FAQ frames it, the exercise looks at how you run your business, not at your sales numbers. As one practitioner sees it, the purpose is investor protection, in particular avoiding mis-selling.

2. Who falls under AMFI due diligence?

Under SEBI’s rules, meeting any one of the four criteria below is enough to bring a mutual fund distributor under due diligence, the same four criteria AMFI’s Ready Reckoner sets out.

These are SEBI’s criteria, set out in its Master Circular, and they apply both when an AMC first takes you on and during later review periods.

Close to 1,700 MFDs were shortlisted for this year’s exercise, similar to last year, Cafemutual reported. Even distributors below the thresholds can benefit from filling in the DDQ themselves each year, one practitioner suggests, as a way to get their own processes in shape ahead of time.

3. What should you expect once you are selected?

The process typically unfolds like this:

1. You receive an email with a blank DDQ.
2. An audit firm, appointed by AMFI, contacts you to fix a date and may ask for the filled DDQ in advance.
3. The firm may sample records such as risk profiling, transactions and complaints.
4. Your AMCs act on the report’s observations, sometimes writing to you about specific points.

The steps above reflect one practitioner’s experience of how the process tends to unfold; AMFI has not published a fixed sequence, so timelines and exact order can vary.

The review usually takes place at the address registered against your ARN, though you can ask for your office address instead.

Keep these ready:

• A copy of your ARN
• Registered address proof
• Complaint records
• Transaction details
• Compliance gap reports

Two habits that help the review go smoothly:

• Redact client names and PAN details on any sample reports you prepare for the reviewer.
• Have your reports exported and ready in advance, rather than navigating your software live during the session.

4. What do auditors check during due diligence?

The review is not a paperwork exercise. It checks whether your processes actually exist, are followed in practice, and can be shown on request. SEBI’s “fit and proper” standard breaks this into four broad factors, described as illustrative rather than exhaustive:

• Business model, experience and skills in running your distribution business.
• Track record: fines, penalties, legal suits and customer compensation, along with what caused them and the corrective action taken.
• Associates and subsidiaries, assessed on the same factors.
• Organisational controls, such as keeping the evaluation of a client’s risk and investment objectives, and of scheme appropriateness, separate from your sales and relationship management staff and processes.

SEBI separately requires your own compliance and risk management function to review:

• How often products are reviewed
• How customer risk categorisation is determined and revisited
• How transaction exceptions are checked and escalated through internal audit
• Periodic investor sample surveys

(Staff training, onboarding and grievance handling are part of the same clause, but covered later in this guide.)

Auditors may ask for samples that prove these processes run in practice, not just descriptions of them on paper.

5. What does the DDQ cover?

The Due Diligence Questionnaire, or DDQ, is the actual document at the centre of this exercise for a mutual fund distributor: the form you fill in, describing your processes, which the appointed audit firm then checks against evidence. The due diligence FAQ names six areas it covers; the plain-language descriptions below are drawn from a compliance practitioner’s explanation of what each area typically asks, rather than the questionnaire’s own wording.

Information about the distributor:

Your ARN and category, other registrations with other regulators, other business lines, AMC affiliations, family members in mutual fund distribution, and employees and sub-brokers with their Employee Unique Identification Numbers (EUINs), including how you track expiry.

Mutual fund business activities:

Your experience, transaction modes, whether you work as advisory or execution only, how you select schemes and review client portfolios, and how sales staff are kept from mis-selling.

Operations and customer service:

Transaction tracking, how information and risk disclosures reach clients, complaint handling and escalation, platform data security, how physical and digital transactions flow, and fraud checks.

Compliance and risk management:

Validity of National Institute of Securities Markets (NISM) certification and EUINs, commission disclosure, marketing material and branding, KYC gaps, records, cyber security, controls against mis-selling, and annual self-declarations.

Human resources management:

Training content and frequency, hiring, incentive structure, organisation chart, fraud and data-leak prevention, social media conduct, and use of the AMFI tagline.

Legal, including associates and subsidiaries:

Fines, litigation, warning letters or notices, and any action taken or proposed.

Under AMFI’s Master Circular for MFDs, all employees engaged in sales promotion need NISM certification and an EUIN, and the DDQ asks how many such employees you have. The DDQ is also understood to ask whether you or your family members hold ARNs, which must then be disclosed, based on practitioner experience of the questionnaire.

6. Advisory or execution only: which are you?

SEBI’s framework allows only two kinds of customer relationship, with no third category. This is not a one-time label for your whole business: SEBI categorizes each customer relationship and transaction separately, so you can run both models at once, provided each relationship is clearly categorized and you can explain how you keep the two apart.

Advisory:

You sell only within the client’s risk ceiling, with no exception. In practice this means “incidental advice”: a curated list of schemes based on your assessment of the client’s risk profile and suitability, not full financial planning or holistic advice, which needs separate registration as an investment adviser with SEBI.

Execution only:

The client decides and invests without your involvement, advice or recommendation, typically through your own online platform. Platforms such as BSE, NSE, MFU, CAMS and KFintech count as market infrastructure, not your own online service.

If you believe a scheme doesn’t suit the client, two things make an execution-only transaction valid anyway:

1. A written communication telling the client the scheme is unsuitable, which they acknowledge.
2. A separate execution-only confirmation from the client, obtained before you execute the transaction.

On execution-only transactions, the investor pays you nothing beyond the standard flat transaction charge. AMFI’s FAQ on the role of MFDs adds that the confirmation should be kept for inspection during audit or due diligence, alongside a suitable record or email trail.

One practitioner’s example:

A conservative 65-year-old client asks for a small-cap fund. The rule, per AMFI, is to tell the client in writing that the scheme does not match their profile, and to keep their written confirmation, such as an email reply.

7. How do you risk profile clients properly?

AMFI says mutual fund distributors must risk profile clients to understand each client’s risk appetite, needs and objectives, and to judge whether a recommendation suits them. It is advisable to keep each profile on record, in a physical register or electronically with proper backup, and to review and update it from time to time.

Two points come from press coverage rather than an AMFI text. Cafemutual, on clients who want more equity than their risk appetite, says AMFI has not prescribed a review period, but updating at least once a year is advisable. It also says risk profiling records are expected for all clients, existing and new, whether or not you fall under due diligence, a point covered in a Cafemutual report on records for all clients.

A practical six-step approach, drawn from practitioner experience:

1. Gather the client’s facts: age, dependants, income stability, liabilities, the objective in the client’s own words, the time horizon for each objective, liquidity needs and prior experience.
2. Score and assign a band: use one written questionnaire for every client, separate risk capacity (what the client can afford to lose) from risk tolerance (what they can stomach), and record the date, score and band.
3. Get the client’s confirmation: explain in plain language what the band excludes, and store the confirmed profile with a date stamp.
4. Map the band to a product: shortlist within the scheme category ceiling using a documented selection process, highlight scheme-specific risks from the scheme information document (SID), statement of additional information (SAI) and key information memorandum (KIM), and disclose commission across the competing schemes you considered.
5. Record the recommendation: why it fits, what you ruled out, and the client’s decision, including any deviation from your advice, kept as an email, note or call log.
6. Review on a stated cadence: half-yearly or yearly is typical. Write the frequency down, log every review even when nothing changes, and re-profile after life events such as a job change, inheritance, retirement or illness.

Treat each family member as a separate client with their own risk profile.

8. What evidence should be in each client file?

AMFI expects distributors to keep evidence of suitability and complaint handling, in physical or digital form. A practical way to organise this evidence is under four heads:

9. How should a mutual fund distributor handle complaints?

Complaint handling is a requirement under AMFI’s Code of Conduct, not just good practice. Whether you keep a formal complaints register or an electronic record, AMFI’s expectation is that you stay careful and methodical about it.

A practical five-step process:

1. Receive and log every complaint at a single intake point, noting date, client, nature and channel.
2. Acknowledge it in writing within a stated timeline.
3. Investigate using the client file, logs and transaction trail.
4. Resolve and close with a written outcome.
5. Report and review: assist the AMC, track themes and fix root causes. If a complaint turns out to be caused by something on the AMC’s side rather than yours, follow up with the AMC directly and keep the client updated within a stated turnaround time.

It also helps to publish your grievance process and escalation matrix (who a complaint goes to next) on your website.

10. What do you owe clients on an ongoing basis?

You must give full and updated scheme information from AMCs, highlight each scheme’s risk factors, and disclose your commissions and affiliations. The points below cover each duty:

• Scheme information: give full and updated information as provided by AMCs, such as the SID, SAI, addenda, fact sheets and portfolio disclosures.
• Risk factors: highlight each scheme’s risk factors and urge investors to read the SAI, SID and KIM.
• Specific risks: bring these to clients’ attention: capital loss, issuer default, portfolio segregation, suspension of redemption, new fund offer (NFO) price, liquidity, delisting risk and scheme winding up.
• Commission: disclose all commissions received or receivable for the competing schemes from which you recommend a scheme.
• Affiliations: disclose the mutual funds you are affiliated with, and tell clients they may consider alternatives you do not offer.
• Group links: if you are an associate, group company or sponsor of an AMC, say so and disclose the total commission received or receivable.
• Digital platforms: disclose that a scheme is a Regular Plan paying commission, and link prominently to commission rates and offer documents.

It also helps to tell clients proactively about material scheme changes, such as fund manager or liquidity provision changes, and to show your commission ranges on your website.

11. How do you display your registration correctly?

Both AMFI and SEBI set rules for how you present yourself to investors, covering what you display, how you market, and what you disclose online.

Name and tagline:

• Show your name, ARN and the tagline “AMFI-registered Mutual Fund Distributor” together, clear and legible, on your website, app, cards and signboards.
• Font size 12 or larger in print.
• Avoid terms like adviser or wealth manager in your name, unless you are SEBI-registered as an investment adviser.

Websites and marketing:

• One website or brochure can cover several products, if it shows your registered name and AMFI, SEBI or IRDAI numbers.
• Advertise freely, just not with rebates, gifts, or promises like “free advice” or a “free portfolio review”.
• Use AMC-provided material, and get prior written approval before showing an AMC’s name, logo or mark.

Social media. Share educational content, avoid scheme-specific recommendations or performance claims, and disclose your registered name and ARN, per SEBI’s circular of 26 February 2026. The points below reflect how press coverage has described these rules, with links to the original reporting:

• Effective date: content uploaded on or after 1 May 2026 (Mondaq, Lexology).
• Where it must appear: home page, and the start of each video or post.
• Wording: “AMFI Registered Mutual Fund Distributor (ARN),” per Cafemutual; differs slightly from the print tagline above.
• Verification: checked during due diligence, per AMFI’s reminder to MFDs (Cafemutual).
• Older posts: no change needed for those made before 1 May 2026.
• Registering your handles: submit your handles and apps to AMFI via the ARN portal.

12. What does AMFI’s Code of Conduct require, and forbid?

It sets out how you should recommend schemes, handle application forms, market yourself, and speak about others. The table below lists the main points.

13. What data security and fraud controls should you have?

The Code of Conduct sets requirements under two heads:

Data security.

• Keep adequate IT infrastructure and cyber security to protect electronic data during collection, transmission and storage.
• Follow AMFI’s Data Sharing Principles (set out in its Best Practices Circular, dated 29 March 2022) and applicable personal data protection laws.
• Keep records of client correspondence on suitability, and on agreement or disagreement.

Fraud controls.

• Have internal controls that can reasonably detect and prevent mis-selling.
• Reduce loss from fraud, theft or events outside your control; appropriate insurance is encouraged.
• Train representatives on their duty to clients, on preventing fraud and errors, and on responsible social media use.

Beyond what the Code of Conduct requires, a few practical checks help catch fraud early:

• For unusual redemption requests, call the client, then arrange a second call from a senior person, and watch for flags such as a change of bank, email or mobile number.
• When staff sell a scheme outside your approved list, ask for a written reason, and make random callbacks to new clients.
• Tell clients when a transaction has failed.

14. How do you renew your ARN, EUIN and NISM certification?

Staff certification.

• AMFI requires all employees engaged in sales promotion and distribution, including temporary and contract staff, to hold NISM certification, AMFI registration and an EUIN.
• ARN and EUIN are valid for three years and must be renewed before they expire; an individual’s ARN or EUIN can only be renewed after renewing the NISM certificate. Renewals are done online through the AMFI website.
• If an ARN expires, it is invalid from the next day and business is processed under Direct Plan; withheld commission is lost if renewal takes longer than three months.
• One practitioner’s view: directors or others who source business are also client-facing and need their own EUIN, since the EUIN identifies the salesperson who deals with the investor. Several branches should not share one EUIN if their people are client-facing.

Sub-distributors.

Sub-distributors must hold a valid ARN and follow the Code of Conduct. The principal MFD must monitor them, is responsible and accountable for their acts, and should not continue with a sub-distributor whose ARN is invalid.

Annual self-declaration.

AMFI requires the Declaration of Self-Certification to be filed within three months after each financial year. Miss 30 June, and commission accrued from 1 July is withheld. Miss 30 September, and the withheld commission is lost for good. It is filed online in the ARN renewal module, with one-time passwords (OTPs) sent to your registered mobile number and email.

15. How do you fix compliance gaps in your existing client book?

A practical approach is to work through your existing client book in three waves: highest exposure first, then structural gaps, then routine cases. Review and re-profile wave by wave, and batch the outreach so every attempt is logged.

• Wave 1, highest exposure: clients whose holdings look above their risk band (review and re-profile them); failed, on-hold or missing KYC, PAN, UBO or FATCA details; anyone who has complained recently; large or concentrated holdings.
• Wave 2, structural gaps: no risk profile on file; relationships never marked advisory or execution only; clients onboarded by a sub-distributor or a departed employee, including unmapped EUINs; files with no dated review note.
• Wave 3, routine: profiles older than your review cycle; SIP-only clients with stable low-risk allocations; dormant folios. Reconfirm these at the next natural touchpoint.

Whichever wave a client falls into, use the same outreach process: send one clear email or WhatsApp message with a link to a short form, then follow up with a reminder if they do not respond. Log every attempt, even the ones that go unanswered; that record is still evidence of diligence.

16. How does Investwell Mint help?

Knowing what to do is one thing. Doing it consistently, across hundreds of clients, without drowning in manual proof and paperwork, is another. That is exactly where Investwell Mint comes in. The features below are confirmed with the Investwell Mint team. 

Evidence and audit trail:

When a client or an auditor asks who placed a trade and when, you need that answer at once, not after a search through registers.

Investwell Mint’s My Orders view logs every order placed through the exchange platforms, with status (Pending, In Progress, Success, Failed), a timestamp, and a column showing who initiated it, distributor or investor.

Compliance gaps:

Missing KYC, an unlinked PAN or Aadhaar, or a folio with no nominee are easy to miss one client at a time, and expensive to discover during a review.

The compliance report under Data Management lists every such gap, synced daily with CAMS and KFintech, and exports with a click. When you need a specific list instead, such as everyone in one fund or category, the investor data mining report pulls it by fund, category, sub-category, client, family head or folio, with Excel export.

Risk profiling:

A profile that never got done, or quietly lapsed, is one of the easiest gaps to create and one of the hardest to defend later.

A setting under Portal Settings, IFA Preferences, shows clients a mandatory risk-profiling pop-up they cannot skip or continue past. The questionnaire is editable, in your own wording or language, submissions are logged, and the link can be sent to many clients at once rather than one by one. Clients see a riskometer result and get a copy by email, and you are notified when they submit. Each profile carries a validity date and a renewal prompt, so a lapsed one does not sit unnoticed.

Suitability and drift:

A portfolio that has quietly drifted from a client’s target allocation, or an order that does not match their saved risk profile, is a suitability problem waiting to surface at the worst time.

A variance and allocation report, filterable by variance percentage and AUM, flags drift by family head or investor before it becomes one, and at order placement the system checks the scheme against the client’s saved profile and shows a warning before the order goes through.

Website disclosures:

Getting the required disclosures onto your website, and keeping them there, is easy to overlook until it is not.

Websites built with Investwell Mint carry the required risk factors, ARN with validity, Regular Plan disclosure, and links to your disclaimer, privacy policy, SID/SAI/KIM and Code of Conduct, handled once rather than checked page by page.

Data security:

Client data deserves more than good intentions and a strong password.

Client data sits on AWS servers behind a private VPN, with yearly third-party VAPT and ISO/IEC 27001:2022 certification, security handled at the infrastructure level rather than left to individual habits. Certificates are available on request.

Used consistently, this turns much of what this guide covers into routine housekeeping rather than a scramble before a review.

17. Webinar Recording: Prefer to watch instead?

This guide is based on a webinar Investwell Mint hosted on 12 August 2026, covering everything above in more depth, with live audience questions.

18. Conclusion

Due diligence feels large because it touches so much: your processes, your client files, your staff and your disclosures.

None of this needs to happen all at once. Pick one gap, close it, then move to the next. The distributors who find due diligence straightforward are rarely the ones who did everything right from day one, they are the ones who stopped reacting and started keeping their own house in order, a little at a time.

Ready to take the first step? Book a demo of Investwell Mint and see how it fits your practice.

19. Sources

This guide relies first on AMFI and SEBI documents, then on press reports and legal commentary, alongside the webinar embedded above. Rules and dates can change, so the original documents linked below remain the definitive reference.

AMFI and SEBI

• AMFI Ready Reckoner (Feb 2025)
• AMFI FAQs on Distributors’ Due Diligence
• AMFI FAQs on the Role of MFDs
• AMFI Master Circular for MFDs
• AMFI Revised Code of Conduct for Mutual Fund Distributors (April 2022)
• AMFI Best Practices Circular 135/BP/99/2021-22, dated 29 March 2022
• AMFI: submission of annual declaration
• AMFI: annual declaration page
• SEBI circular of 26 February 2026 on disclosure of registered name and registration number on social media

A note on SEBI’s Master Circular for Mutual Funds: SEBI reissued this circular on 20 March 2026, in force from 1 April 2026, restructuring many of its provisions. Some AMFI documents linked above still reference the earlier structure. Where this guide states a SEBI rule, it reflects the current Master Circular, checked directly against SEBI’s text where possible.

Press reports and commentary

• Mondaq: SEBI requires disclosure of registered name and registration number on social media platforms
• Lexology: article on the social media disclosure rules
• Cafemutual: Be mindful of your social media disclosures as AMFI steps up compliance watch
• Cafemutual: New disclosure norms from May 1, 2026: what every distributor must know
• Cafemutual: Almost 1,700 MFDs qualify for AMFI’s due diligence exercise this year
• Cafemutual: MFDs will have to maintain a record of risk profiling of all clients
• Cafemutual: What to do if clients want higher equity allocation than their risk appetite

Last reviewed: 12th Oct 2026