Crypto ATM / kiosk operator in India
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in India with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Mandatory FIU-IND registration as a VDA Service Provider (Reporting Entity) under the Prevention of Money Laundering Act (PMLA), 2002, as amended March 7, 2023
- Implement transaction monitoring systems — risk-based, real-time, AI-powered systems to flag suspicious activities like large transfers, structuring, or high-risk patterns
- Deploy blockchain analytics tools (e.g. SaaS models analyzing wallets, histories, typologies like chain-hopping or mixers) for VASP compliance
- Travel Rule compliance: share originator/beneficiary details (name, account, address) for virtual asset transfers via secure channels with screening, recordkeeping, and rejection of incomplete data
- Continuous screening of wallets, addresses, and counterparties against OFAC SDN List, EU Consolidated Financial Sanctions List, and UN Consolidated List
- Immediately freeze sanctioned cryptoassets from designated wallets/exchanges and report to authorities
- 1% TDS on transactions above INR 50,000 under Finance Act 2022 Section 115BBH
- 30% flat tax on virtual digital assets under Finance Act 2022 Section 115BBH
- File Suspicious Transaction Reports (STRs) — general SAR obligations noted to enforcement bodies
- No specific cash-transaction reporting threshold identified for India — FATF recommends $1,000/€1,000 but India may apply requirements to all transactions
Key Restrictions
- No specific kiosk/money-transmitter licensing framework exists — VASPs operate under the general FIU-IND VDA Service Provider registration
- No specific custody framework for crypto; custody is covered only under general FIU registration
- No framework for stablecoins, DeFi, or token issuance
- RBI historically hostile to private crypto (attempted outright ban in 2018, reversed by Supreme Court in 2020) — regulatory uncertainty remains
- A 1% TDS applies on transactions above INR 50,000, creating operational friction for cash-in/cash-out kiosk transactions
- Offshore exchanges blocked in January 2024 for non-compliance — demonstrates active enforcement posture
- Cash-heavy model heightens AML/KYC risk; no explicit kiosk-specific cash reporting threshold identified — prudential operators should treat all cash transactions as reportable
Key Risks
- Regulatory ambiguity — no comprehensive crypto legislation exists (status 'upcoming' since 2021), leaving the kiosk operating model without clear law
- RBI hostility to private crypto creates risk of future restrictive regulations or payment-rail blocking
- Cash-intensive kiosk model poses elevated AML/structuring risk — enforcement precedent includes blocking 9 offshore exchanges in 2024
- Penalties under PMLA can reach up to 3x contravention value plus 3–7 years imprisonment; FEMA violations up to 3x amount
- No explicit cash-transaction reporting threshold for crypto kiosks creates ambiguity in compliance obligations
- Tax burden (30% flat + 1% TDS) may deter users and affect profitability of cash-to-crypto conversion at kiosks
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FIU-IND registers VDA service providers as reporting entities under the PMLA 2002 (FIU guidelines effective 10 Mar 2023); on 28 Dec 2023 it issued section 13 show-cause notices to nine offshore VDA service providers and asked MeitY to block their URLs.
The RBI runs the e₹ CBDC, which is being piloted in retail and wholesale segments (RBI FAQ, 1 Oct 2026); its 6 Apr 2018 circular barring regulated entities from dealing in virtual currencies was set aside by the Supreme Court on 4 Mar 2020.
PMLA 2002 s 2(1)(sa)(vi): Ministry of Finance notification F.No. P-12011/12/2022-ES Cell-DOR of 7 Mar 2023 brought five VDA activities under the Act, and VDA service providers must register with FIU-IND as reporting entities (FIU guidelines effective 10 Mar 2023).
Finance Act 2022 inserted s 115BBH (30% tax on income from transferring a virtual digital asset, from AY 2023-24) and s 194S (1% TDS from 1 Jul 2022; none where a specified person pays up to ₹50,000 a year or another payer up to ₹10,000). Section numbers are those of the Income-tax Act 1961; the Income-tax Act 2025 replaced that Act from 1 Apr 2026 and also defines VDAs.
India has no VASP licence: VDA service providers register with FIU-IND as PMLA reporting entities (guidelines effective 10 Mar 2023). PIB reported 31 registered as of 28 Dec 2023 and 50 as of 1 Oct 2025; FIU-IND publishes no register.
India has no custody-specific crypto framework; safekeeping or administration of VDAs, or of instruments enabling control over VDAs, is one of the five activities notified under PMLA s 2(1)(sa)(vi) on 7 Mar 2023, so custodians register with FIU-IND as reporting entities.
VDA exchanges (VDA–fiat and VDA–VDA) must register with FIU-IND under the PMLA; non-registered offshore exchanges received section 13 notices on 28 Dec 2023 (9), 1 Oct 2025 (25) and 9 Sep 2026 (15), with URL-blocking or IT Act s 79(3)(b) takedown action.
FIU-IND guidelines of 10 Mar 2023 (§6.1.3) require VDA service providers to monitor transactions passing through their systems and to maintain transaction monitoring systems that determine the origin of a VDA and monitor its destination.
Blockchain Analytics Tools: Supported indirectly. Sources highlight blockchain monitoring (e.g., SaaS models analyzing wallets, histories, and typologies like chain-hopping or mixers) as essential for VASP compliance, often integrated with transaction monitoring.
FIU-IND guidelines of 10 Mar 2023 (§11.3 "Travel Rule") require VDA service providers, under PMLA Rule 12(1)(a), to include accurate originator and beneficiary information on VDA transfers and to monitor for transfers lacking it; §11.3 states no threshold.
VDA service providers were brought under the Prevention of Money-laundering Act 2002 by Ministry of Finance notification F.No. P-12011/12/2022-ES Cell-DOR of 7 March 2023, which designated five VDA activities under s 2(1)(sa)(vi); FIU-IND's AML & CFT guidelines for these providers took effect on 10 March 2023.
FIU-IND's 10 March 2023 AML & CFT guidelines require VDA service providers to file a suspicious transaction report with FIU-IND irrespective of the transaction amount where there are reasonable grounds to believe the transaction involves proceeds of crime (§7); the travel-rule section (§11.3) sets no monetary threshold.
Five VDA activities carried on for or on behalf of another person make a provider a PMLA reporting entity: VDA-fiat exchange, VDA-VDA exchange, VDA transfer, safekeeping or administration of VDAs, and financial services for an issuer's VDA offer; all must register with FIU-IND, which counted 31 registered providers on 28 December 2023 and 50 on 1 October 2025.
FIU-IND's 10 March 2023 AML & CFT guidelines require VDA service providers to run transaction-monitoring systems that trace the origin and destination of VDAs (§6.1.3), expect blockchain-analytics and sanctions-screening tools in client due diligence (§5.8.5), and apply the travel rule to VDA transfers (§11.3).
The Prevention of Money-laundering Act 2002 was not amended to cover VDAs: the 7 March 2023 notification added VDA activities under s 2(1)(sa)(vi), so VDA service providers are reporting entities under s 2(1)(wa), bound by s 12 record-keeping and reporting duties and subject to FIU-IND penalties under s 13.
FIU-IND issued AML & CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets on 10 March 2023, effective immediately; FIU-IND lists an updated version dated 8 January 2026 and registration circulars of 4 July 2023, 17 October 2023, 20 January 2025 and 15 September 2025.
Screening obligations: Continuous screening of wallets, addresses, and counterparties against the Specially Designated Nationals (SDN) List (https://sanctionssearch.ofac.treas.gov), plus the 50% Rule (block entities owned ≥50% by SDN-listed persons) (https://ofac.treasury.gov/faqs/topic/1626). No crypto exceptions; includes sanctioned jurisdictions like Iran, North Korea, Syria, Cuba, Crimea/Donbas (https://ofac.treasury.gov/sanctions-programs-and-country-information).
Penalties: Civil fines up to $1M+ per violation (e.g., Binance $3.4B in 2023 for Iran/Russia/Cuba dealings; Bittrex $24M) (https://sanctionslawyers.net/ofac-lawyers/ofac-cryptocurrency-sanctions/); criminal penalties possible. Indian VASPs risk secondary sanctions or PMLA fines up to ₹10 lakh + imprisonment.
Penalties: PMLA fines (up to 3x contravention value) + 3-7 years imprisonment; FEMA violations up to 3x amount.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators may operate as VDA Service Providers registered with FIU-IND under PMLA, subject to AML/CFT obligations including transaction monitoring, blockchain analytics, Travel Rule compliance, and sanctions screening, with no dedicated kiosk-specific licensing framework and significant regulatory ambiguity given RBI's historically hostile stance.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?