Insights · Web3 and digital assets

FIU-IND registration for crypto businesses in India: who must register, and what follows

By Prashant Sharma, Founder, Infinilex India · UAE · US Published 18 July 2026 About a 7 minute read

The most important thing about FIU-IND registration is what it is not: it is not a licence. It is registration as a reporting entity under the Prevention of Money-laundering Act 2002, India's AML statute, and India has no crypto licensing regime at all. Nobody in India grants permission to run an exchange. The law instead attaches AML obligations to anyone carrying out a notified virtual digital asset activity, and registering with FIU-IND is how you take those obligations on. That reframing changes how founders should plan for India.

Who must register

In March 2023 the Ministry of Finance notified five VDA activities under the PMLA (notification S.O. 1072(E) of 7 March 2023). Carry out any of them for or on behalf of another person, in the course of business, and you are a reporting entity:

  • exchange between virtual digital assets and fiat currencies;
  • exchange between one or more forms of virtual digital assets;
  • transfer of virtual digital assets;
  • safekeeping or administration of virtual digital assets, or of instruments enabling control over them;
  • financial services relating to an issuer's offer and sale of a virtual digital asset.

That covers exchanges, brokers, custodians, transfer services and token-sale service providers, and “virtual digital asset” takes its meaning from the Income-tax Act, so the AML perimeter tracks the tax definition. The obligation is activity-based, not residence-based: FIU-IND's guidelines require registration irrespective of where an entity is incorporated, which is the basis on which offshore exchanges serving Indian users have been pursued. Registration is a mandatory pre-requisite, operating without it is itself treated as a PMLA violation, and the Director, FIU-IND has been the designated AML regulator for VDA service providers since November 2023.

What registration involves

Registration runs through the FINGate portal, and it is more than a form. You initiate online, then submit a substantial document set at least 15 days before a mandatory in-person meeting with FIU-IND, which both your Designated Director and your Principal Officer must attend, and at which you give a live demonstration of your KYC, transaction monitoring, blockchain analytics, Travel Rule and sanctions screening systems. Registration is formal only when the Director approves it and assigns a reporting entity ID, and the Director can refuse or cancel it.

The document set is a diligence file in itself: a note mapping your activities to the notified list, corporate structure down to significant beneficial ownership, three years of financials, GST and income-tax filings including the VDA TDS forms, counterparty agreements and PACT certificates from the FIU-registered platforms you work with, and a cyber security audit by a CERT-In empanelled auditor.

The people requirements have teeth, especially for offshore platforms. The Designated Director carries overall responsibility for compliance. The Principal Officer must be management level, full time and exclusive to the entity, have at least three years of AML experience, be based in India, and be a different individual from the Designated Director. There is no registering from abroad without a real compliance presence in India.

The obligations that follow

Registration is the start of the work, not the end. FIU-IND's AML and CFT guidelines for VDA service providers, updated in January 2026, set the current expectations:

  • KYC: mandatory PAN verification, geo-location capture at onboarding and penny-drop verification of the client's bank account, with enhanced due diligence for high-risk clients and KYC refresh at least every six months for high-risk clients, annually for everyone else.
  • The Travel Rule: originator and beneficiary information must travel with every VDA transfer between reporting entities, before or with the transfer, never after. The guidelines state no minimum threshold.
  • Reporting: suspicious transaction reports regardless of amount, including attempted transactions, with tipping off prohibited, plus a monthly report to FIU-IND on metrics and compliance status.
  • Records: transaction records for at least five years from the transaction, client identification records for five years after the relationship ends, kept so individual transactions can be reconstructed.
  • Product limits: privacy coins cannot be deposited or withdrawn, mixer and tumbler flows cannot be facilitated, and ICO-related services are strongly discouraged, even though issuance service providers are themselves reporting entities.

Enforcement is real

The perimeter is not theoretical. In December 2023 FIU-IND issued show-cause notices to nine offshore exchanges, including Binance, KuCoin and Kraken, and asked the IT ministry to block their URLs. In January 2024 the apps came off Indian app stores and the URLs went dark. The way back in was registration plus penalty: KuCoin registered first after paying a penalty; Binance was fined Rs 18.82 crore by an order of June 2024 and completed registration that August, after roughly seven months out of the market; Bybit was fined Rs 9.27 crore in January 2025 and registered the following month. In October 2025 FIU-IND repeated the exercise at scale: notices to 25 more offshore platforms, with app and URL takedown notices under the IT Act. Per the government's release of 1 October 2025, 50 VDA service providers had registered by that date.

The pattern is consistent: serve Indian users without registering and the sanction is being blocked, and re-entry costs a penalty plus the registration you avoided.

The tax rules you model alongside

The AML registration is one half of how India treats crypto; tax is the other, and you model them together. Income from the transfer of a VDA is taxed at a flat 30% under section 115BBH of the Income-tax Act 1961, plus surcharge and cess, with no deduction other than the cost of acquisition, no set-off of VDA losses against any other income, and no carry forward. Section 194S adds a 1% TDS on consideration for VDA transfers, deducted at credit or payment, though not below annual thresholds of Rs 50,000 or Rs 10,000, depending on who is paying. For a platform, the TDS is an operational problem more than a rate problem: deducted, deposited and reported on every in-scope trade.

Two changes arrived on 1 April 2026, and both were still settling as of mid-July 2026. The Finance Act 2025 widened the VDA definition and introduced crypto-asset transaction reporting by prescribed entities, India's implementation of the OECD reporting framework, with information exchange expected from 2027. The Income-tax Act 2025 also replaced the 1961 Act from that date, renumbering these provisions; the substance carries over, but check the new section numbers against the Act itself. The 2026 Budget left the 30% rate and the 1% TDS unchanged and, per reporting on the Finance Act 2026, added penalties for lapses in the new crypto reporting.

Where this sits in a multi-market strategy

Because FIU-IND registration is an AML registration, it does none of the things a licence does: it does not authorise activity, it does not passport anywhere, and it says nothing about custody standards or solvency. If India is one market of several, the comparison you actually need is between the licensing regimes elsewhere: MiCA vs VARA for the EU-against-Dubai decision, and VARA vs ADGM vs DIFC inside the UAE. India then slots in as an obligations layer: register with FIU-IND for the Indian user base, and hold the licence where a licence exists. That is the structuring work we do across Web3 and digital assets for founders building across India, the UAE and the US.

What we check before you file

  • Activity mapping: whether what you actually do falls within the five notified activities, and which group entity is doing it.
  • Reach: whether an offshore entity in the group serves Indian users, and who therefore has to register.
  • People: the Designated Director and Principal Officer appointments, including the India-based, full-time Principal Officer requirement.
  • Systems: the KYC, monitoring, Travel Rule and screening stack you will demonstrate live at the FIU-IND meeting.
  • Tax posture: the TDS mechanics and the reporting obligations that arrived with the April 2026 changes.

Frequently asked questions

Is FIU-IND registration a crypto licence?

No. It is registration as a reporting entity under the Prevention of Money-laundering Act 2002, which is an anti-money-laundering obligation. India has no licensing or authorisation regime for crypto exchanges or trading platforms, so there is no licence to hold. Registration brings AML duties; it is not a permission, an endorsement or a mark of investor protection.

Do foreign crypto exchanges need FIU-IND registration to serve Indian users?

Yes. The obligation is activity-based and applies irrespective of where the entity is incorporated. Offshore exchanges serving Indian users have been pursued on exactly this basis: show-cause notices in December 2023, app removal and URL blocking in January 2024, and notices to 25 more platforms in October 2025. Several registered after paying penalties and resumed serving India.

What happens if you operate without registering?

Carrying out a notified VDA activity without registration is itself treated as a PMLA violation and can attract action under section 13, including monetary penalties. In practice, enforcement has meant show-cause notices, removal of apps from Indian app stores and URL blocking. The route back is registration plus penalty, as Binance, KuCoin and Bybit each found.

What are the AML obligations after registering with FIU-IND?

A full compliance programme: KYC with PAN verification and enhanced due diligence, Travel Rule information on transfers with no minimum threshold, suspicious transaction reports and a monthly report to FIU-IND, records kept for at least five years, and a Designated Director and an India-based, full-time Principal Officer accountable for all of it.

Is crypto legal in India?

Virtual digital assets are not banned in India, and they are not legal tender. Income from VDA transfers is taxed at a flat 30%, a 1% TDS applies on transfer consideration above annual thresholds of Rs 50,000 or Rs 10,000 depending on the payer, and holding a VDA is not itself a taxable event. Service providers must register with FIU-IND under the PMLA. There is no licensing regime, and neither taxation nor registration amounts to government endorsement of any crypto activity.

Next step

Registering with FIU-IND, or serving Indian users from offshore?

Tell us what you do with virtual digital assets and where your users are, and we will map whether you need to register, who your Designated Director and Principal Officer should be, and what the programme has to cover before you meet FIU-IND.

Book a discovery call Get the FIU-IND registration checklist

This article is general information for founders, not legal or tax advice for your specific business. The PMLA framework, FIU-IND's guidelines and the tax provisions change; confirm every point against the current texts before relying on it. Whether you must register, and what follows, depends on your activities, your users and your structure. Have the position reviewed before you file, and before you serve Indian users from offshore.