India’s FIU-IND now treats all virtual asset providers as reporting entities under PMLA, mandating strict KYC, record-keeping and a ban on privacy tools and mixers.

India has implemented stricter oversight of cryptocurrency platforms, formally bringing the sector under the country’s anti-money laundering framework, according to regulatory notifications.

India continues to push ahead with cryptocurrency legislation

The Financial Intelligence Unit, operating under the Ministry of Finance, has classified all virtual digital asset service providers as “reporting entities” under the Prevention of Money Laundering Act, 2002. The designation took effect following a notification issued on March 7, 2023.

Crypto exchanges, wallet providers, and related platforms, whether based in India or offshore, are now subject to the same compliance standards as banks and other regulated financial institutions, according to the new framework.

All virtual digital asset service providers must register with FIU-IND to legally operate in the country. Platforms that fail to register face enforcement action, including financial penalties and potential criminal liability. The rules apply to centralized exchanges, custodial wallet providers, and offshore platforms offering services to Indian users.

The guidelines introduce expanded know-your-customer requirements. Exchanges are required to implement live selfie verification designed to confirm physical presence and detect deepfakes through movement-based checks. Platforms must also capture geo-location data at account creation, including IP address, date, and time. Bank account verification is mandatory through a “penny-drop” process, while users must submit an additional government-issued photo identification alongside their Permanent Account Number.

Transactions involving anonymity-enhancing tools, including privacy tokens, tumblers, or mixers, are prohibited under the new rules. Exchanges are barred from facilitating such activity. The rules also mandate enhanced due diligence for high-risk clients, including individuals from jurisdictions on Financial Action Task Force black or grey lists, Politically Exposed Persons, and non-profit organizations.

Crypto platforms must retain customer identity and transaction records for at least five years, or longer if an investigation is ongoing. Suspicious Transaction Reports must be submitted to FIU-IND when required, according to the regulations.

The Enforcement Directorate holds enforcement authority and has imposed fines totaling 28 crore rupees during the 2024-25 fiscal year for non-compliance, according to official data.