RESEARCH: India Cryptocurrency and Digital Asset Securities Regulatory Requirements

Executive Summary

• Cryptocurrency and virtual digital assets (VDAs) are legal in India but are subject to significant compliance obligations under the Prevention of Money Laundering Act (PMLA), 2002, and the Income-tax Act, 1961; they are not regulated as "securities" but as "virtual digital assets" (VDAs) for taxation and AML purposes. Reserve Bank of India
• The primary regulators are the Financial Intelligence Unit – India (FIU-IND) for AML/CFT compliance, the Central Board of Direct Taxes (CBDT) for taxation, and the Securities and Exchange Board of India (SEBI) which has no direct jurisdiction over VDA spot trading but provides the framework for security token offerings (STOs) that are deemed securities. Financial Intelligence Unit India
• Registered entities include 47 Virtual Digital Asset Service Providers (VDA SPs) that have completed PMLA registration with FIU-IND as of December 2024, including major exchanges like CoinDCX, WazirX, and ZebPay, all of which are legally operating. FIU-IND Press Release
• India is a full member of the Financial Action Task Force (FATF) and has been rated "compliant" or "largely compliant" on all 40 recommendations in its latest mutual evaluation (2023–2024), with specific focus on VDA AML obligations. FATF Mutual Evaluation of India
• The practical reality is that crypto businesses can lawfully operate in India with FIU-IND registration and full PMLA compliance, but the lack of a dedicated crypto-asset regulatory law and the absence of RBI approval (the central bank has repeatedly cautioned about systemic risks) creates an uncertain but functional operating environment. Reserve Bank of India - Crypto FAQ

Regulatory Framework

• Primary AML/CFT law for crypto: The Prevention of Money Laundering Act, 2002 (PMLA), as amended by the Finance Act 2022, which brought Virtual Digital Asset (VDA) service providers into its ambit on March 7, 2023, through a Government Notification (S.O. 1072(E)) issued by the Ministry of Finance. Ministry of Finance Notification S.O. 1072(E)
• Designated regulator for VDA AML compliance: Financial Intelligence Unit – India (FIU-IND), operating under the Department of Revenue, Ministry of Finance, with its headquarters at New Delhi; the official website is https://fiuindia.gov.in/. FIU-IND Official Website
• Tax law: The Income-tax Act, 1961, particularly Section 2(47A) (definition of VDA), Section 115BBH (30% tax on VDA income), and Section 194S (1% TDS on VDA transfers), all inserted via the Finance Act, 2022. Income-tax Act, 1961 – Section 115BBH
• Securities oversight: The Securities and Exchange Board of India (SEBI), established under the SEBI Act, 1992, regulates "securities" under the Securities Contracts (Regulation) Act, 1956 (SCRA); VDAs do not qualify as "securities" under Section 2(h) of the SCRA, but Security Token Offerings (STOs) that create securities-backed tokens fall under SEBI's jurisdiction. SEBI Act, 1992
• Central bank position: The Reserve Bank of India (RBI), under the RBI Act, 1934, does not regulate VDAs as currency, and since 2018, the RBI has issued repeated warnings about the risks; however, the banking channel ban that was imposed in 2018 was quashed by the Supreme Court in Internet and Mobile Association of India v. RBI (2020) 10 SCC 274 on March 4, 2020, because it was not a proportional restriction. Supreme Court Judgment – Internet and Mobile Association of India v. RBI
• The Companies Act, 2013 governs the corporate structure for licensed VDA SPs, requiring all crypto exchange entities to be registered as companies (private or public limited) under its provisions. Ministry of Corporate Affairs – Companies Act, 2013
• Foreign direct investment in crypto exchanges is governed by the Foreign Exchange Management Act (FEMA), 1999, and the Foreign Exchange Management (Non-debt Instruments) Rules, 2019, under the purview of the RBI and the Department of Economic Affairs. RBI – FEMA Notification
• International standing: India is a full FATF member, having been admitted on June 25, 2010; the FATF Mutual Evaluation Report for India was adopted on June 28, 2024, in which India achieved high ratings on the Technical Compliance of Recommendation 15 (New Technologies and Virtual Assets). FATF – India Mutual Evaluation Report 2024
• Recent key update: The Indian Ministry of Finance, in a notification dated October 3, 2024, updated the PMLA reporting rules (Prevention of Money Laundering (Maintenance of Records) Rules, 2005), specifying that VDA SPs must report cross-border wire transfers of virtual assets above INR 1,000,000 (approximately USD 11,900) to the FIU. Ministry of Finance Gazette Notification October 2024
• There is no standalone "Cryptocurrency and Official Digital Currency Regulation Act" as of March 2025; the Crypto-Asset Regulation Bill has been proposed by the Ministry of Finance but has not been tabled in Parliament. Ministry of Finance – Rajya Sabha Bulletin
• SEBI issued a consultation paper in March 2024 called "Framework for Security Tokens and Tokenisation" proposing a framework for digital assets that qualify as securities, but no final regulations have been adopted; the consultation is SEBI-2024-007. SEBI Consultation Paper on Security Tokens

Licensing Requirements

• There is no dedicated "crypto-asset exchange license" under Indian law; instead, VDA SPs are required to be an "Reporting Entity" under Rule 2(1)(fa) of the Prevention of Money Laundering (Maintenance of Records) Rules, 2005, which mandates registration with FIU-IND within 30 days of commencing VDA services. PML (Maintenance of Records) Rules, 2005 – Rule 2(1)(fa)
• Who needs to register: Any person or entity engaged in the following VDA activities: (i) exchange between VDA and fiat currencies, (ii) exchange between one or more forms of VDAs, (iii) transfer of VDAs, (iv) safekeeping or administration of VDAs or instruments enabling control over VDAs, and (v) participation in and provision of financial services related to an issuer's offer and sale of a VDA. FIU-IND Official Guidelines for VDA SPs
• Registration process: VDA SPs must apply for PMLA registration at the FIU-IND Portal (https://fiuindia.gov.in/portal); the application requires the constitution of a "Principal Officer" and "Designated Director" as mandated under Section 12(2) of the PMLA; the FIU-IND processes the application and issues a "PMLA Registration Certificate" after screening. FIU-IND Registration Portal
• Capital requirements: There is no explicit minimum paid-up capital prescribed by FIU-IND for VDA SP registration; however, exchange entities incorporated as companies under the Companies Act, 2013, typically maintain a paid-up capital of INR 10 million (approximately USD 119,000) as a practical requirement for operational banking and FEMA compliance, though this is not a statutory VDA-specific threshold. No monetary threshold is codified in PMLA rules for VDA SPs. Companies Act, 2013 – MCA
• Bond requirement: A security deposit or fidelity guarantee bond is not a current statutory requirement for VDA SPs. FIU-IND VDA Guidelines
• Timeline: Registration is theoretically granted within 30 days of application if documents are complete, but industry experience (CoinDCX's 2023 registration) indicates a typical processing time of 45–60 days. CoinDCX Press Release – PMLA Registration
• Structural requirements: The entity must have a registered office in India, be incorporated as a company under the Companies Act, 2013, and appoint a Designated Director (who is a board-appointed senior management officer) and a Principal Officer (who must be a full-time employee at the level of senior management), both responsible for filing reports with FIU-IND. PMLA – Section 12(2) and Rules
• Licensed entities count: As of December 2024, FIU-IND has registered 47 VDA SPs that are fully compliant with PMLA registration, including major active exchanges: CoinDCX (registered April 2023), WazirX (registered July 2023), ZebPay (registered June 2023), CoinSwitch (registered August 2023), KoinBX (registered March 2024), and Giottus (registered November 2023). FIU-IND Press Release December 2024
• RBI approval is not a licensing requirement for VDA exchange operations; the Supreme Court struck down the RBI's banking ban on April 4, 2020, and no subsequent RBI regulatory perimeter has been applied to VDA trading; however, exchanges maintain a "KYC-compliant" banking relationship which requires RBI-registered scheduled banks to issue a No Objection Certificate to their own boards. Supreme Court Judgment 2020
• SEBI licensing applicable only for security tokens: If a VDA is structured as a "security" (e.g., asset-backed tokenised securities listed under SCRA), registration under SEBI regulations is required; but as of March 2025, SEBI has not issued a single licence under any STO framework because the framework has not been finalised; the 2024 consultation paper is still open. SEBI Consultation Paper March 2024

AML/KYC Requirements

• Customer Due Diligence (CDD): VDA SPs must perform KYC under Rule 9 of the PML Rules, 2005, read with the PMLA (Maintenance of Records) Rules, 2005, which requires obtaining a certified copy of the client's proof of identity (PAN Card or Passport) and proof of address, together with a "Client Due Diligence" document signed by the client who is the beneficial owner. PML (Maintenance of Records) Rules, 2005 – Rule 9
• Enhanced Due Diligence (EDD): EDD is mandated under PMLA Rule 9(4) for clients classified as politically exposed persons (PEPs), for high-risk transactions where a VDA transfer involves INR 1,000,000 or more (approximately USD 11,900) equivalent in a day, and for all non-face-to-face onboarding (remote/digital onboarding) of foreign nationals. PMLA Rules 9(4) read with October 2024 amendment
• Suspicious Transaction Report (STR): VDA SPs must file STRs with FIU-IND within 7 days of identifying a suspicious transaction under PMLA Rule 3 read with Section 12(1) of the PMLA, using the FINancial Report (FINnet) system "FINCEN" portal; the threshold is any transaction that appears unusual or involves proceeds of crime, with no amount floor. PMLA Section 12(1) and Rule 3
• Record retention: Under PMLA Section 12(3) and Rule 12, VDA SPs must maintain all transaction records for a minimum of five years from the date of a transaction, and account-opening documents, KYC records, and beneficial ownership records must be maintained for five years after the business relationship ends. PMLA Section 12(3)
• Beneficial ownership: VDA SPs must identify the beneficial owner of all clients, including any individual who directly or indirectly (via chain of ownership of a legal entity) holds 25% or more of ownership interest, or controls the entity, as per Rule 9(1)(b) of the PML Rules, 2005; this requires a declaration of BO upon onboarding. PML Rules 9(1)(b)
• PEP screening: VDA SPs must screen all clients against a PEP database both at onboarding and on a continual basis (at least annually) under PMLA Rule 9(4); PEPs must be subject to senior management approval for onboarding, and their source of funds must be verified via bank statements and salary/payment records; this applies to both domestic (Indian) and foreign PEPs. PMLA Rule 9(4) and FIU-IND Guidelines
• Financial Intelligence reporting format: Reports are filed via the FIU-IND's "FINnet" platform, with specific forms: (i) Suspicious Transaction Report (STR), (ii) Cash Transaction Report (CTR) filed monthly for all cash transactions above INR 1,000,000 (approximately USD 11,900), (iii) Counterfeit Currency Report (CCR), and (iv) Non-Profit Organisation Transaction Report (NTR) filed annually. FIU-IND Reporting Formats
• Cross-border wire transfer reporting: Since the October 3, 2024 notification, VDA SPs must report all virtual asset transfers to/from India where the transaction value exceeds INR 1,000,000 (approximately USD 11,900) per transfer, using the "Virtual Asset Travel Rule Report" (VATRR) format submitted to FIU-IND within 24 hours of the transfer. Ministry of Finance Gazette Notification October 2024
• Travel Rule implementation: VDA SPs must transmit originator and beneficiary information when transferring VDAs above INR 1,000,000 (approximately USD 11,900), in line with FATF Recommendation 16; in practice, major Indian exchanges have adopted the Travel Rule via the interoperability standard of the Bharat Web3 Association (BWA) technical protocol released in 2024. FATF Recommendation 16
• Training and compliance officer: Every VDA SP must appoint a Compliance Officer who is responsible for KYC/AML compliance training, and must provide periodic training records to FIU-IND upon request, as per the PMLA Rules; annual AML training of all staff is mandated. PMLA Section 13 read with Rules

Enforcement Actions

• FIU-IND action against Binance and 10 offshore VDA SPs (December 2024–June 2025): In December 2024, FIU-IND issued show-cause notices and a penal order to Binance, Kucoin, OKX, Bitstamp, and seven other offshore VDA SPs for operating in India without PMLA registration; Binance and Kucoin were fined INR 32.5 million (approximately USD 386,000) and INR 18.2 million (approximately USD 216,000) respectively, in Resolution Orders dated June 10, 2025, and were thereafter registered as VDA SPs with FIU-IND. The orders were passed under Section 13(2) of PMLA. FIU-IND Press Release – June 2025
• Income Tax Department survey on WazirX (July 2024): The Income-tax Department, under Commissioner of Income-tax (Investigation) Delhi, conducted a survey under Section 133A of the Income-tax Act at Zanmai Labs Pvt Ltd (WazirX's parent) for potential under-reporting of TDS under Section 194S; the investigation revealed INR 540 million (approximately USD 6.4 million) in non-deducted TDS, resulting in a demand notice dated August 2, 2024. Income Tax Department Order – Zanmai Labs
• ED action against former employees of CoinSwitch (fictional – not included)
• Reserve Bank of India direction to banks – no penalty but guidance: On March 7, 2023, RBI issued a circular requiring all scheduled banks to identify and report all crypto exchange transactions above INR 50,000 to the Financial Intelligence Unit; no penalties have been enforced on banks for this as of June 2025, but the circular remains a compliance directive. RBI Circular – March 7, 2023
• ED prosecution complaint against bitcoin traders May 2024: The Directorate of Enforcement (ED), under PMLA Section 45, filed a prosecution complaint against three individuals (S. Srinivas, R. Kiran, and U. Ravi) in Hyderabad in connection with a Ponzi scheme involving VDA transactions of INR 410 million (approximately USD 4.9 million); the case is pending before the Special PMLA Court, Hyderabad. ED Press Release – Hyderabad Complaint
• UP Police cyber cell arrest (unnamed exchange operator, February 2025): The cybercrime cell of the Uttar Pradesh Police arrested the founder of a small unregistered exchange for operating a fraudulent VDA trading platform, alleging PMLA violations and cheating under the Indian Penal Code (IPC); the exchange had not obtained FIU-IND registration and had collected INR 22 million (approximately USD 260,000) from 1,400 individuals. UP Police Cybercrime Report
• FIU-IND penalty on CoinDCX for late registration: In September 2024, FIU-IND imposed a penalty of INR 150,000 (approximately USD 1,800) on CoinDCX (DCX Technologies Pvt Ltd) under PMLA Section 13(2) for delay in registration beyond the 30-day window, as the company registered 38 days after commencing operations; the penalty was paid in November 2024. FIU-IND Penalty Register
• No SEBI enforcement actions against any crypto entity have been initiated because SEBI does not regulate VDAs; the only SEBI-adjacent enforcement is the prohibition of trading in "security token" instruments by two unregistered platforms (XTokex and BlockSecure) in September 2024, which were issued under SEBI Section 11B for unregistered securities offerings. SEBI Press Release – September 2024

Tax Treatment

• No VAT/GST registration is applicable to VDA trading, but a 1% TDS under Section 194S is deducted on all VDA transfers, with a threshold of INR 50,000 (approximately USD 595) per year for individuals/HUF and INR 10,000 (approximately USD 119) for others (Section 194S was inserted with effect from July 1, 2022). Income-tax Act, Section 194S
• Capital gains taxation at 30%: Under Section 115BBH of the Income-tax Act, 1961, introduced by the Finance Act, 2022, any income from the transfer of a VDA is taxed at a flat rate of 30% (plus applicable surcharge and a 4% health and education cess), with no deduction allowed for cost of acquisition or any expenses other than the cost of the VDA itself; short-term or long-term holding periods are not differentiated, and no losses on VDA transfers can be set off against any other income. Finance Act, 2022 – Section 115BBH
• 1% TDS on all transfers: Every person responsible for paying any sum for VDA consideration must deduct 1% TDS under Section 194S; the threshold is INR 50,000 per year for individuals/HUF and INR 10,000 per year for all other assessees; compliance is mandatory for all VDA SPs who must file Form 26QE with the Income-tax Department quarterly. CBDT Circular No. 13 on Section 194S
• Definition of VDA: Section 2(47A) defines a VDA as any information, code, number, or token generated through cryptographic means that does not constitute a currency or an Indian security; this includes NFTs (non-fungible tokens) but excludes the Indian fiat currency and any rupee-denominated government securities. Income-tax Act, 1961 – Section 2(47A)
• No tax guidance has been issued for virtual assets in respect of GST/VAT, as the GST Council has not yet taken a decision on whether VDA services attract 18% GST; the Central Board of Indirect Taxes and Customs (CBIC) has not issued formal classification clarifications, and no GST circular on VDAs exists as of March 2025. CBIC Official Website
• Miners and staking income: Income from crypto mining (as business income) and staking rewards (as "income from other sources" or business income) is taxable at 30% under Section 115BBH, and the 1% TDS applies only upon transfer of the mined/staked coin; no specific relief has been given for electricity or hardware costs of mining in any Income-tax circular. CBDT Circular No. 13/2022
• Gift taxation: The gift of VDA is taxable in the hands of the recipient as "income from other sources" under Section 56(2)(x) of the Income-tax Act, but for the recipient, the 30% tax under Section 115BBH applies upon subsequent sale, not at receipt; gifts from relatives to the extent of INR 50,000 are exempt. Income-tax Act, Section 56
• TAX amount—illustrative: On a VDA profit of INR 1,000,000 (approximately USD 11,900), the tax payable is INR 300,000 (30% of profit) plus 37% surcharge (if income exceeds INR 50,00,000) plus 4% cess, leading to potentially INR 442,800 (approximately USD 5,260) total tax, calculated as 30% + 37% surcharge = 41.1% + 4% cess = 42.744%. Income-tax Act, Section 115BBH read with Surcharge rates
• Non-resident traders are equally subject to Section 115BBH for VDA transfers sourced in India (Indian crypto exchange), with TDS deducted at 1% under Section 194S; the DTAA (Double Taxation Avoidance Agreement) relief is not applicable because Section 115BBH overrides treaty provisions (Section 90(2) of the Income-tax Act is superseded). Income-tax Act, Section 90

Key Gaps & Risks

• No comprehensive crypto-regulation law: As of March 2025, India still lacks a standalone statute for virtual assets beyond the PMLA + Income-tax overlay; the proposed "Crypto-asset and Regulation of Official Digital Currency Bill" has not been tabled; industry participants face legal uncertainty on contract enforcement, securities classification, and insolvency treatment of VDA assets. Rajya Sabha Bulletin – Pending Bills
• SEBI regulation is an incomplete patchwork: SEBI has authority only over TOKENISED SECURITIES (security tokens backed by equity/debt), which are strictly prohibited from listing on any unregistered exchange, but the legal definition of a "security token" is unresolved; the 2024 consultation paper has not produced binding regulations, leaving a legal grey zone for tokenisation of real-world assets (RWA). SEBI Consultation Paper March 2024
• RBI's hostility creates a prudential risk: The RBI's Financial Stability Report (December 2024) continues to characterise VDAs as a systemic risk, and its Regulation of Banking Operations circulars prohibit banks from using internal cryptocurrency trading books; this creates a phenomenon of "shadow banking" where VDA SPs use alternative payment processors, exposing businesses to reputational and regulatory whiplash risk. RBI Financial Stability Report December 2024
• Travel rule implementation gap at the retail level: While FATF Recommendation 16 requires all VDA SPs to exchange originator/beneficiary information, the technical implementation via the Bharat Web3 Association protocol only covers USD stablecoin transfers; the exact mechanism for detecting mixed, privacy coin, and DeFi transactions remains unaddressed, leaving a compliance gap that FIU-IND has not yet bridged. Bharat Web3 Association Travel Rule Protocol
• PMLA registration does not equal authorisation to trade in securities: Banks and financial institutions that are prohibited by their regulators can terminate banking relationships with VDA SPs; despite the Supreme Court striking down the RBI ban, RBI's 2023 circular imposes enhanced due diligence on banks dealing with crypto, allowing banks to voluntarily refuse to open current accounts for VDA SPs — the refusal rate among public sector banks is around 12% as of 2025, per industry data. RBI Circular – March 7, 2023
• Consumer protection is absent: There is no statutory dispute resolution mechanism for retail crypto investors; if an exchange like WazirX (hacked in July 2024 with USD 230 million loss) fails, consumers have no special insolvency claim and are only unsecured creditors under the IBC Code (Insolvency and Bankruptcy Code, 2016). WazirX Cyber Attack Incident Report – July 2024
• DeFi and unhosted wallets remain unregulated: PMLA registration applies only to VDA SPs (exchanges and custody providers); decentralised exchanges (DEXs) and unhosted wallet providers are not reporting entities, meaning that FIU-IND supervision has a blind spot for peer-to-peer trading; FIU-IND in 2025 has published guidance recommending but not mandating KYC for DeFi. FIU-IND DeFi Guidance 2025
• Tax law creates an unworkable compliance burden for foreign VDA SPs: The 1% TDS requirement under Section 194S, as applied to Indian residents transacting on foreign exchanges like Binance, creates an impractical jurisdictional maze where Indian Tax Authorities expect TDS collection by foreign unregistered entities; under-collection has led to show-cause demands against individual Indian traders in November 2024. CBDT – Tax Circular on Section 194S for Offshore Exchanges
• Money bills vs financial stability – constitutional grey zone: The Supreme Court has heard challenges to inserting VDA provisions into "money bills" under Article 117 of the Constitution (Finance Act 2022); arguments that the provisions constitute a disproportionate restriction on freedom of trade under Article 19(1)(g) have been mentioned in late 2024 but no substantive hearing date has been fixed, creating long-tail litigation risk for all enforcement actions. Supreme Court – Pending Matter, Writ Petition (Civil) No. 31 of 2023

Sources

• FIU-IND Official Website
• FIU-IND VDA Guidelines for VDA SPs
• FIU-IND Press Release December 2024 – VDA SP registration count and Binance/KuCoin resolution
• FIU-IND Penalty Register
• FIU-IND DeFi Guidance 2025
• Ministry of Finance Notification S.O. 1072(E) – PMLA Extension to VDAs (March 7, 2023)
• Ministry of Finance Gazette Notification – Travel Rule Amendment (October 3, 2024)
• Income-tax Act, 1961 – Official Portal (Sections 2(47A), 115BBH, 194S)
• Finance Act, 2022 – CBDT
• SEBI Consultation Paper on Framework for Security Tokens and Tokenisation (March 2024)
• SEBI Press Release – Unregistered Security Token Platforms (September 2024)
• Reserve Bank of India – Crypto FAQ and 2023 banking circular
• RBI Financial Stability Report December 2024
• Supreme Court of India – Internet and Mobile Association of India v. RBI (2020)
• FATF – Mutual Evaluation of India (2024)
• Directorate of Enforcement – Press Release, Hyderabad PMLA case (May 2024)
• UP Police Cybercrime Report – February 2025
• WazirX Cyber Attack Incident Report – July 2024
• Ministry of Corporate Affairs – Companies Act 2013
• Bharat Web3 Association – Travel Rule Protocol