India’s FIU-IND Enforces Strict KYC and AML Regulations for Cryptocurrency

India has introduced stronger regulations for cryptocurrency platforms, bringing the entire sector under its anti-money laundering (AML) framework, as outlined in recent regulatory announcements.

Key Takeaways

All virtual asset providers are now considered reporting entities under the PMLA.
New compliance rules align cryptocurrency platforms with banks in terms of regulatory requirements.
Mandatory registration with FIU-IND is required for all cryptocurrency platforms.
Enhanced KYC procedures include live selfie verification and comprehensive identification checks.
Anonymity-enhancing tools like privacy tokens and mixers are banned.
Customer records must be preserved for a minimum of five years, with increased scrutiny for high-risk clients.
Enforcement actions have already resulted in significant fines for non-compliance.

India FIU-IND tightens crypto KYC and AML rules

Summary of New Regulations

The Financial Intelligence Unit of India (FIU-IND), which functions under the Ministry of Finance, has categorized all providers of virtual digital assets as "reporting entities" under the Prevention of Money Laundering Act (PMLA) of 2002. This change, effective from March 7, 2023, requires compliance with strict know-your-customer (KYC) and record-keeping protocols.

Strengthening Cryptocurrency Legislation in India

India is making substantial progress in regulating the cryptocurrency industry. The FIU-IND has established that all virtual digital asset service providers, including cryptocurrency exchanges and wallet services, are required to comply with the same standards as traditional banks.

Registration and Compliance Obligations

To legally operate in India, all virtual asset service providers must register with FIU-IND. Those who do not comply risk facing enforcement actions, including monetary fines and possible criminal charges. This rule applies evenly to domestic and offshore platforms servicing Indian users.

Expanded KYC Requirements

The updated guidelines extend the KYC requirements significantly. Cryptocurrency exchanges are now obligated to implement real-time selfie verification methods that confirm users' physical presence and are capable of detecting deepfake attempts through movement analysis. Additionally, platforms must gather geo-location data during account creation, which includes the user's IP address, registration date, and time. A verification method called "penny-drop" is mandated for bank accounts, alongside the submission of a government-issued photo ID accompanied by the user’s Permanent Account Number (PAN).

Prohibitions on Anonymity Tools

Under the new regulations, the use of anonymity-enhancing mechanisms, such as privacy tokens and mixing services, is strictly forbidden. Exchanges cannot facilitate any transactions involving these enhancements. Furthermore, platforms are required to conduct enhanced due diligence procedures for clients classified as high-risk, including individuals from jurisdictions flagged by the Financial Action Task Force and Politically Exposed Persons (PEPs).

Record-Keeping and Reporting

Cryptocurrency platforms must keep customer identification and transaction records for a minimum of five years, or longer if an investigation is active. When necessary, Suspicious Transaction Reports (STRs) are to be filed with FIU-IND as per the regulations.

Consequences for Non-compliance

The Enforcement Directorate, which is responsible for ensuring adherence to these rules, reported imposing fines of 28 crore rupees for non-compliance during the fiscal year 2024-25.

With these regulations, India seeks to enhance security and accountability within the cryptocurrency market, ensuring that it aligns with international financial standards.