FIU-IND registration for crypto businesses in India: who must register, and what follows

The most important thing about FIU-IND registration is what it is not: it is not a licence. It is registration as a reporting entity under the Prevention of Money-laundering Act 2002, India's AML statute, and India has no crypto licensing regime at all. Nobody in India grants permission to run an exchange. The law instead attaches AML obligations to anyone carrying out a notified virtual digital asset activity, and registering with FIU-IND is how you take those obligations on. That reframing changes how founders should plan for India. If you searched for an FIU licence, that is the answer: there is none to get, and the registration you need instead is the work described on how we run FIU-IND registration, with the documents and the in-person meeting set out in our FIU-IND registration checklist.

If you run an exchange with Indian users and have read that FIU-IND issued section 13 notices to offshore platforms, the message is the one it has now sent three times since December 2023: register or be taken down. The rounds are dated below, together with the only route back on the record, registration plus a penalty. If your product is a DeFi protocol, a DAO, an NFT marketplace or a GIFT City unit, the perimeter section answers whether you are inside at all.

Service Need this handled rather than explained? See FIU-IND registration, or book a 30-minute call with the author.

Who must register

In March 2023 the Ministry of Finance notified five VDA activities under the PMLA (notification S.O. 1072(E) of 7 March 2023). Carry out any of them for or on behalf of another person, in the course of business, and you are a reporting entity:

• exchange between virtual digital assets and fiat currencies;
• exchange between one or more forms of virtual digital assets;
• transfer of virtual digital assets;
• safekeeping or administration of virtual digital assets, or of instruments enabling control over them;
• financial services relating to an issuer's offer and sale of a virtual digital asset.

That covers exchanges, brokers, custodians, transfer services and token-sale service providers, and “virtual digital asset” takes its meaning from the Income-tax Act, so the AML perimeter tracks the tax definition. The obligation is activity-based, not residence-based: FIU-IND's guidelines require registration irrespective of where an entity is incorporated, which is the basis on which offshore exchanges serving Indian users have been pursued. Registration is a mandatory pre-requisite, operating without it is itself treated as a PMLA violation, and the Director, FIU-IND has been the designated AML regulator for VDA service providers since November 2023.

Perimeter questions: DeFi, DAOs, NFTs and GIFT City

The notification is drafted around activities, not labels. Each of the five activities counts when it is carried out “for or on behalf of another natural or legal person in the course of business” (FIU-IND AML and CFT guidelines of 10 March 2023, para 1.3, reproducing the 7 March 2023 notification). That phrase answers most of the perimeter questions founders bring us. The guidelines also define DApp, DeFi, NFT and P2P in their glossary, so none of these models sits outside FIU-IND’s contemplation.

• DeFi protocols. Software is not a reporting entity. People are. The guidelines state that using an automated process such as a smart contract to carry out service-provider functions does not relieve the parties of responsibility, and that the controlling parties responsible for executing the contracts, where they qualify as service providers, must assess money-laundering risk before the platform launches (para 11.1 of the March 2023 text; check the equivalent paragraph in the 8 January 2026 edition, the updated version FIU-IND lists as of that date). The test for a DeFi team with Indian users is therefore control: who holds the admin keys, who can upgrade the contracts, who earns from running the front end, and whether that work is a business. A team that does those things for Indian users is inside the perimeter whether or not the code is open source.
• DAOs. India has no DAO statute and the PMLA does not mention DAOs. The question is the same: is there an identifiable person or group exchanging, transferring or safekeeping virtual digital assets for others in the course of business? A DAO whose core contributors run a swap, bridge or custody product for Indian users does not step outside registration by voting with governance tokens; the contributors, and any legal wrapper they use, are the candidates for reporting entity. A DAO that only holds and votes on its own treasury is not carrying out a notified activity for another person.
• NFT marketplaces. The PMLA borrows the Income-tax definition of a virtual digital asset, which names non-fungible tokens. A marketplace that matches buyers and sellers, custodies tokens or moves them for users is exchanging, transferring or safekeeping virtual digital assets for others, which is activities (ii), (iii) and (iv). The edges are where the work is: the CBDT’s notifications of 30 June 2022 narrowed the NFT limb for tokens whose transfer passes legally enforceable ownership of an underlying tangible asset. Verify the current wording of section 2(111) of the Income-tax Act 2025 and the status of those carve-outs before relying on either, because the tax definition and the AML perimeter move together.
• Unhosted wallets and peer-to-peer. Transfers to or from unhosted wallets are classed as high risk, and where one side is a hosted wallet the compliance burden sits on the entity hosting it (para 11.2.2 of the March 2023 text). On the notification’s wording, a pure self-custody wallet that exchanges, transfers or safekeeps nothing for anyone else is not carrying out an activity for another person; add a swap, a bridge or a fiat on-ramp run as a business and the analysis changes.

• GIFT City. Two different questions get merged here. First, will IFSCA license a crypto exchange in GIFT IFSC? No. IFSCA stated on 18 December 2024 that there is “no such move on its part to regulate crypto exchanges, cryptocurrencies or allied virtual assets in the IFSC”, and its consultation paper of 26 February 2025 on tokenising real-world assets excludes cryptocurrencies, crypto assets and NFTs from scope and records that IFSCA does not intend to regulate, permit trading in or endorse them.

  Second, does a GIFT City unit sit outside FIU-IND? Also no. IFSCA’s AML, CFT and KYC guidelines of 2022 require every IFSCA-regulated entity, other than an alternative investment fund of a registered fund management entity, to register on FIU-IND’s FINGate 2.0 portal and report to the Director, FIU-IND, selecting IFSC as the entity type and IFSCA as the regulator (IFSCA FAQs on those guidelines, questions 13 to 18). GIFT City is a venue for tokenised regulated financial products under IFSCA’s own frameworks, not a route around the PMLA for a crypto exchange.

Two anchors hold across all five. Central bank digital currencies are outside the guidelines because they represent fiat (para 3(c)). And the power behind every notice is section 13(2)(d) of the PMLA, under which the Director can fine a reporting entity, its Designated Director or its employees not less than Rs 10,000 and up to Rs 1 lakh for each failure (PMLA text as published by FIU-IND, read 6 October 2026), on top of the takedown route used against offshore platforms.

What registration involves

Registration runs through the FINGate portal, and it is more than a form. You initiate online, then submit a substantial document set at least 15 days before a mandatory in-person meeting with FIU-IND, which both your Designated Director and your Principal Officer must attend, and at which you give a live demonstration of your KYC, transaction monitoring, blockchain analytics, Travel Rule and sanctions screening systems. Registration is formal only when the Director approves it and assigns a reporting entity ID, and the Director can refuse or cancel it.

The document set is a diligence file in itself: a note mapping your activities to the notified list, corporate structure down to significant beneficial ownership, three years of financials, GST and income-tax filings including the VDA TDS forms, counterparty agreements and PACT certificates from the FIU-registered platforms you work with, and a cyber security audit by a CERT-In empanelled auditor.

The people requirements have teeth, especially for offshore platforms. The Designated Director carries overall responsibility for compliance. The Principal Officer must be management level, full time and exclusive to the entity, have at least three years of AML experience, be based in India, and be a different individual from the Designated Director. There is no registering from abroad without a real compliance presence in India.

The obligations that follow

Registration is the start of the work, not the end. FIU-IND's AML and CFT guidelines for VDA service providers, updated in January 2026, set the current expectations:

• KYC: mandatory PAN verification, geo-location capture at onboarding and penny-drop verification of the client's bank account, with enhanced due diligence for high-risk clients and KYC refresh at least every six months for high-risk clients, annually for everyone else.
• The Travel Rule: originator and beneficiary information must travel with every VDA transfer between reporting entities, before or with the transfer, never after. The guidelines state no minimum threshold.
• Reporting: suspicious transaction reports regardless of amount, including attempted transactions, with tipping off prohibited, plus a monthly report to FIU-IND on metrics and compliance status.
• Records: transaction records for at least five years from the transaction, client identification records for five years after the relationship ends, kept so individual transactions can be reconstructed.
• Product limits: privacy coins cannot be deposited or withdrawn, mixer and tumbler flows cannot be facilitated, and ICO-related services are strongly discouraged, even though issuance service providers are themselves reporting entities. Which launch-service providers sit inside that perimeter is the India leg of a token legal opinion.

Enforcement is real

The perimeter is not theoretical. In December 2023 FIU-IND issued show-cause notices to nine offshore exchanges, including Binance, KuCoin and Kraken, and asked the IT ministry to block their URLs. In January 2024 the apps came off Indian app stores and the URLs went dark. The way back in was registration plus penalty: KuCoin registered first after paying a penalty; Binance was fined Rs 18.82 crore by an order of June 2024 and completed registration that August, after roughly seven months out of the market; Bybit was fined Rs 9.27 crore in January 2025 and registered the following month. In October 2025 FIU-IND repeated the exercise at scale: notices to 25 more offshore platforms, with app and URL takedown notices under the IT Act. The register keeps growing on the other side of the ledger: per the Minister of State for Finance's answer in the Lok Sabha of 30 March 2026, 54 VDA service providers had registered by 9 March 2026, three of them no longer operational, while takedown directions had issued against 53 platforms operating without meeting the PMLA's requirements.

The pattern is consistent: serve Indian users without registering and the sanction is being blocked, and re-entry costs a penalty plus the registration you avoided.

The section 13 rounds, dated

For an exchange that still has Indian users, this is the record to plan against. Every date below is drawn from the sources cited on this page.

FIU-IND and the offshore perimeter, March 2023 to September 2026

Date	What happened
7 March 2023	Ministry of Finance notifies the five VDA activities under the PMLA (S.O. 1072(E)).
10 March 2023	FIU-IND’s first AML and CFT guidelines for VDA service providers take effect.
December 2023	First round: show-cause notices to nine offshore exchanges, including Binance, KuCoin and Kraken, and a request to the IT ministry to block their URLs.
January 2024	Apps removed from Indian app stores; URLs blocked.
June 2024	Binance fined Rs 18.82 crore; it completes registration in August 2024. KuCoin had registered earlier after paying a penalty.
January 2025	Bybit fined Rs 9.27 crore; it registers the following month.
October 2025	Second round: section 13 notices to 25 offshore platforms, with app and URL takedown notices under the IT Act.
8 January 2026	FIU-IND issues its AML and CFT guidelines for VDA service providers, updated as on 8 January 2026.
30 March 2026	Lok Sabha answer: 54 VDA service providers registered as on 9 March 2026; takedown directions against 53 platforms.
9 September 2026	Third round: section 13 notices to 15 offshore platforms, with takedown notices (PIB release 2308131).

Read it as a schedule, not a history. The gap between rounds has shortened from twenty-two months to eleven, each round has been larger in reach than a single platform, and nobody named in one has returned without registering. If you are not named, you are not cleared; the obligation is activity-based and does not depend on an office in India.

The tax rules you model alongside

The AML registration is one half of how India treats crypto; tax is the other, and you model them together. Income from the transfer of a VDA (defined in section 2(111) of the Income-tax Act 2025) is taxed at a flat 30% under section 194(1), Table Sl. No. 4 of the 2025 Act (formerly section 115BBH of the 1961 Act), plus surcharge and cess, with no deduction other than the cost of acquisition, no set-off of VDA losses against any other income, and no carry forward. Section 393(1), Table Sl. No. 8(vi) (formerly section 194S) adds a 1% TDS on consideration for VDA transfers, deducted at credit or payment, though not below annual thresholds of Rs 50,000 or Rs 10,000, depending on who is paying. For a platform, the TDS is an operational problem more than a rate problem: deducted, deposited and reported on every in-scope trade.

The tax side has its own enforcement lane too: the CBDT has run a disclosure campaign against unreported VDA income, reporting roughly Rs 889 crore identified and tens of thousands of nudge notices sent, and since the Finance Act 2025 undisclosed VDA income found in a search can be assessed under the block-assessment regime at 60%.

Two changes arrived on 1 April 2026, and both were still settling as of mid-July 2026. The Finance Act 2025 widened the VDA definition and introduced crypto-asset transaction reporting by prescribed entities, India's implementation of the OECD reporting framework, with information exchange expected from 2027. The Income-tax Act 2025 also replaced the 1961 Act from that date, renumbering these provisions; the substance carries over, but check the new section numbers against the Act itself. The 2026 Budget left the 30% rate and the 1% TDS unchanged. The penalties for reporting lapses sit in section 446 of the Income-tax Act 2025, substituted by the Finance Act 2026 with effect from 1 April 2026: Rs 200 for every day a required statement stays unfiled, and Rs 50,000 where inaccurate information is furnished and not corrected, or where the due-diligence requirement is not complied with.

The reporting regime became concrete on 24 July 2026, when the CBDT issued its Guidance Note on Crypto-Asset Reporting Obligations, a 198-page manual operationalising India's version of the OECD framework. A reporting crypto-asset service provider must run customer due diligence, capture each user's tax residency, and file an annual statement in Form 167 under section 509 of the Income-tax Act 2025: reporting periods are calendar years starting 1 January 2026, each statement is due by 31 May of the following year, and the first filings therefore fall due by 31 May 2027, with exchanges of information with other tax authorities targeted from 2027. Individuals get no new filing obligation; the burden sits on the platform, which means the systems that satisfy FIU-IND and the systems that satisfy the CBDT now have to be designed together.

The policy outlook: a framework recommended, not yet built

The registration-plus-tax settlement is now under active review. On 23 July 2026 the Parliamentary Standing Committee on Finance presented its report on the Securities Markets Code to Parliament and used it to call for a comprehensive examination of virtual digital assets and an appropriate statutory framework, while cautioning that folding crypto directly into the securities code would be premature. Its interim suggestion is oversight through recognised self-regulatory organisations under a designated regulator such as the RBI or SEBI. The government's separate crypto policy discussion paper has, per press reporting, been shelved again after RBI objections, with the RBI reported to still favour prohibition. None of this changes what a founder must do today: register, report and pay the tax. It does mean the perimeter you register into is likely to move, which argues for a structure that can absorb a licensing regime if one arrives.

Where this sits in a multi-market strategy

Because FIU-IND registration is an AML registration, it does none of the things a licence does: it does not authorise activity, it does not passport anywhere, and it says nothing about custody standards or solvency. If India is one market of several, the comparison you actually need is between the licensing regimes elsewhere: MiCA vs VARA for the EU-against-Dubai decision, and VARA vs ADGM vs DIFC inside the UAE. India then slots in as an obligations layer: register with FIU-IND for the Indian user base, and hold the licence where a licence exists. That is the structuring work we do across Web3 and digital assets for founders building across India, the UAE and the US.

What we check before you file

• Activity mapping: whether what you actually do falls within the five notified activities, and which group entity is doing it.
• Reach: whether an offshore entity in the group serves Indian users, and who therefore has to register.
• Perimeter: for DeFi, DAO and NFT structures, who controls the contracts and the front end, whether that work is a business serving Indian users, and which entity is the candidate reporting entity.
• People: the Designated Director and Principal Officer appointments, including the India-based, full-time Principal Officer requirement.
• Systems: the KYC, monitoring, Travel Rule and screening stack you will demonstrate live at the FIU-IND meeting.
• Tax posture: the TDS mechanics, and readiness for the Form 167 reporting cycle the CBDT's July 2026 Guidance Note put on the calendar.

Update of 29 September 2026: a third section 13 round, and where the register count stands

On 9 September 2026 the Director, FIU-IND issued notices for non-compliance under section 13 of the PMLA to fifteen more offshore VDA service providers: Weex, Blofin, Rezorex, Bitunix, DigiFinex, Toobit, XT.com, Latoken, WOO X, Pionex, ChangeNow, SimpleSwap, FixedFloat, WhiteBIT and Guardarian. As in October 2025, the Director also issued notices to take down their apps and URLs, acting as nodal officer under section 79(3)(b) of the Information Technology Act 2000 read with rule 3(1)(d) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2025, and the release repeats the sentence that matters for offshore founders: the obligations are activity-based and are not contingent on physical presence in India (Ministry of Finance press release, PIB release ID 2308131, 9 September 2026, read on 29 September 2026). That is the third round since December 2023. Each has opened the same way, with a section 13 notice and a takedown notice; the only route back on the record so far is the one KuCoin, Binance and Bybit took after the first round, registration plus a penalty.

On the count, there is no register to read. FIU-IND does not publish the list of registered VDA service providers, and the Government told the Lok Sabha on 30 March 2026 that it withholds the list deliberately, because publishing it could give the impression that registered entities are licensed, approved or endorsed (Lok Sabha Unstarred Question 5805, answers (e) and (f)). We checked fiuindia.gov.in on 29 September 2026: the downloads page carries the registration circulars and the 8 January 2026 guidelines, and the archive carries no VDA notice after them, so the latest official count is still the one in that answer: 54 VDA service providers registered as on 9 March 2026, 47 of them incorporated in India and seven offshore, with nine flagged as not operational or wound up on the entity’s own submission and three conditionally on-boarded. The next official figure will come from a parliamentary answer, a PIB release or FIU-IND’s annual report, not from the site. The names behind the number, categorised and dated, are on our list of FIU-IND registered VDA service providers; this page remains the home for the enforcement rounds and the registration path.

Frequently asked questions

This article is general information for founders, not legal or tax advice for your specific business. The PMLA framework, FIU-IND's guidelines and the tax provisions change; confirm every point against the current texts before relying on it. Whether you must register, and what follows, depends on your activities, your users and your structure. Have the position reviewed before you file, and before you serve Indian users from offshore.