The FIU-IND registration checklist for VDA service providers
FIU-IND registration has no published timeline: the guidelines updated 8 January 2026 require the eleven documents in para 2.4 at least 15 days before the in-person meeting, schedule that meeting only once the file is in order and the applicant is operationally ready, and make registration formal only when the Director, FIU-IND approves it and assigns the FIU RE-ID. At the meeting the Designated Director and the Principal Officer attend in person and demonstrate the KYC, transaction-monitoring, blockchain-analytics, Travel Rule and sanctions-screening systems live.
FIU-IND registration is the gate to running a VDA business for Indian users, and it is decided on the AML programme you can demonstrate, not the form you file. This is the readiness list we run with founders before they start on the FINGate portal. Read the explainer first: FIU-IND registration, explained.
Work through it in order. The perimeter decides whether you register at all; the people and the programme decide whether the application survives the meeting; reporting, tax and the ongoing obligations decide whether the registration survives contact with operations.
Confirm you are a VDA service provider under the PMLA
The March 2023 notification designates five activities. If you do one of them for or on behalf of others, in the course of business, you are in.
- Do you exchange virtual digital assets for fiat currency, or one VDA for another? Both are notified activities under S.O. 1072(E) of 7 March 2023.
- Do you transfer VDAs, or provide safekeeping or administration of VDAs or of instruments enabling control over them? Custody and wallet infrastructure sit here.
- Do you participate in, or provide, financial services related to an issuer's offer and sale of a VDA? Launch and issuance services are inside the perimeter, and 'VDA' takes its meaning from section 2(47A) of the Income-tax Act 1961, the definition the March 2023 notification points to, widened from 1 April 2026 and renumbered by the Income-tax Act 2025.
Understand what this is, and what it is not
An AML registration as a reporting entity under the PMLA. It is not a licence, and India has no crypto licensing regime.
- Registration makes you a reporting entity with AML and CFT obligations. It is not an authorisation to operate, a government endorsement, or an investor-protection mark.
- It is mandatory before you carry on a notified activity: non-registration is treated as a PMLA violation that can draw action under section 13.
- Location does not matter. The obligation is activity-based and applies irrespective of where you are registered, which is why offshore platforms serving Indian users must register too.
Appoint the people, then register with FIU-IND
The application is judged on two named individuals and a working demonstration, not on a form.
- A Principal Officer who is management level, engaged full-time and exclusively with your entity, has at least three years of relevant AML experience, is based in India, and is a different person from the Designated Director.
- A Designated Director who owns overall compliance with Chapter IV of the PMLA, with both appointments communicated to FIU-IND through the FINGate portal.
- The dossier, filed at least 15 days before a mandatory in-person meeting both must attend: corporate structure with significant beneficial ownership, three years of financials, tax and TDS filings, counterparty agreements, a PACT certificate and a CERT-In empanelled cyber-security audit, plus a live demonstration of your KYC, monitoring, blockchain-analytics, Travel Rule and sanctions-screening systems. Registration is formal only when the Director, FIU-IND approves it and assigns your FIU RE-ID. Until then the FINGate status reads 'awaiting approval' against a temporary Reference ID, which is for correspondence, not proof of registration (guidelines updated 8 January 2026, paras 2.2 to 2.5; the full document list and what the meeting covers are in the FAQ below).
Build the AML programme that must actually run
FIU-IND approves a running system, not a policy binder.
- KYC that meets the guidelines: PAN verification, geo-location captured at onboarding, penny-drop verification of the client's bank account, and enhanced due diligence for high-risk clients, PEPs and FATF grey-list and black-list jurisdictions.
- KYC refresh on a clock, at least every six months for high-risk clients and annually for everyone else, with records kept five years and able to reconstruct individual transactions.
- Screening with hard edges: India's Travel Rule requires originator and beneficiary information to travel before or with the transfer, never after, and states no monetary threshold for VDA transfers. Privacy coins and mixer flows cannot be facilitated at all.
Reporting: STRs, the monthly report, and no tipping off
The filings that make you a reporting entity, and the ones FIU-IND enforces.
- Suspicious transaction reports filed promptly wherever there are reasonable grounds of suspicion, irrespective of amount, and including attempted transactions.
- A monthly report to FIU-IND with metrics, activity indicators and compliance status, filed whether or not anything looked suspicious.
- No tipping off: the PMLA prohibits telling a client that an STR has been filed or may be filed.
Model the tax alongside
Registration is the AML half. The Income-tax Act runs in parallel and shapes the product economics.
- The 30% tax on VDA income, the 1% TDS on VDA consideration, who deducts it, the deposit dates and the section numbers under the Income-tax Act 2025 are kept current on one page: Crypto tax in India for operators in 2026. Work from that page, not from a section cite copied out of an older checklist.
- The framework moved in 2025 and 2026: the Finance Act 2025 widened the VDA definition and added crypto-asset transaction reporting from 1 April 2026, India's implementation of the OECD reporting framework, the Income-tax Act 2025 renumbers the VDA tax and TDS provisions from the same date, and Budget 2026 kept the 30% rate and the 1% TDS unchanged. Confirm the current section numbers before you file anything.
- Reporting readiness under the CBDT's Guidance Note of 24 July 2026: determine whether you are a reporting crypto-asset service provider under section 509 of the Income-tax Act 2025, capture tax residency in onboarding KYC, keep transaction records from 1 January 2026, and diarise the annual Form 167 statement, due by 31 May each year and first due 31 May 2027. Lapses carry section 446 penalties: Rs 200 per day of delay, and Rs 50,000 where inaccurate information is not corrected or the due diligence is not complied with.
Keep it alive
Registration is the start of a supervised relationship, and the enforcement history is real.
- Run the ongoing obligations as operations, not paperwork: the monthly report, KYC refresh cycles, five-year records, and the current FIU-IND guidelines, updated 8 January 2026, as the manual.
- Take enforcement seriously: FIU-IND issued show-cause notices to nine offshore exchanges in December 2023 and had their apps and URLs blocked; Binance paid a penalty of Rs 18.82 crore and registered in August 2024, Bybit paid Rs 9.27 crore and registered in February 2025, and notices went to 25 more offshore platforms on 1 October 2025. On the other side of the ledger, 54 VDA service providers had registered by 9 March 2026, per the government's Lok Sabha answer of 30 March 2026.
- Re-check the perimeter as the product changes: a new feature can add a notified activity, issuance-related services make the provider a reporting entity in its own right and are strongly discouraged by the guidelines, and privacy-coin support is barred.
Who does what, and who signs. The applicant files its own FINGate registration and self-declaration, a CERT-In empanelled auditor issues the cyber-security audit certificate, registered counterparties issue the PACT certificates, and the Designated Director and the Principal Officer attend the meeting in person. Infinilex builds the dossier and the programme around those acts. Where a written opinion is needed, Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign.
Primary texts: the FIU-IND AML and CFT guidelines for VDA service providers, updated 8 January 2026 (paras 2.1 to 2.5 and 3.2) and the 3rd revision of the registration circular, 15 September 2025, which the guidelines consolidate. Both are scanned PDFs on fiuindia.gov.in; the paragraph numbers above are the guidelines' own.
Frequently asked questions
How long does FIU-IND registration take?
FIU-IND publishes no statutory timeline, and the time is set by the applicant's readiness rather than by a clock. The AML and CFT guidelines updated 8 January 2026 fix two timing rules: the documents listed in para 2.4 go in at least 15 days before the in-person meeting, and the meeting is scheduled only once FIU-IND has examined the file, found it in order and judged the applicant operationally ready (paras 2.3 and 2.5). Registration is formal only when the Director, FIU-IND approves it and the FIU RE-ID is assigned; the temporary Reference ID shown as 'awaiting approval' on the FINGate portal is for correspondence only (para 2.2). In practice the long pole is the dossier: three years of financials and tax filings, a cyber-security audit by a CERT-In empanelled auditor, PACT certificates from registered counterparties and an AML stack that can be demonstrated live. The public record shows how wide the range is: Binance received its show-cause notice in December 2023 and registered in August 2024, after a penalty; Bybit paid Rs 9.27 crore and registered in February 2025. Plan in months, not weeks, and start the audit and the officer appointments first.
What documents are needed for FIU-IND registration?
Para 2.4 of the FIU-IND guidelines updated 8 January 2026 lists eleven items: (a) a note on the nature of the service and how each activity falls within the list notified on 7 March 2023; (b) a corporate structure note with an organogram and significant beneficial ownership; (c) incorporation documents, annual returns, balance sheets and profit and loss accounts for the last three financial years as filed with the MCA, with the registered office or principal place of business in India; (d) GST returns for the last three financial years and GST registration certificates for every operating state; (e) income-tax returns and the TDS statements for VDA transactions, which the guidelines name as Form 26Q, 26QF and 26QE (check the current form number under the Income-tax Act 2025 before you assemble the file); (f) copies of every agreement with exchanges, brokers, custodians, intermediaries or other VDA service providers, domestic or international, with a description of each; (g) a PACT certificate from each FIU-IND registered VDA service provider you have, or intend, a business relationship with; (h) a self-declaration that no law-enforcement proceeding or criminal case is pending against the applicant or its directors or partners; (i) FIU-IND's AML, CFT and CPF questionnaire, completed; (j) a cyber-security audit certificate from a CERT-In empanelled auditor covering governance, infrastructure, application and AML systems security, third-party and cloud risk, and incident response, against the CERT-In directions of 28 April 2022; and (k) anything else FIU-IND asks for. The covering submission must also state whether you are already operational, and since when, or your expected start date (para 2.3).
What happens at the FIU-IND in-person meeting?
The meeting is called at FIU-IND's office and both the Designated Director and the Principal Officer must attend; the guidelines updated 8 January 2026 (para 2.5) describe it as the step that ascertains and verifies the AML, CFT and CPF systems, processes and tools actually in place. You give a live demonstration and walkthrough of the KYC system, transaction monitoring, blockchain analytics, Travel Rule compliance and sanctions screening, and of any other tool you rely on to meet Chapter IV of the PMLA and the PMLR. Be ready to speak to the dossier as well: how each product maps to a notified activity, who the beneficial owners are, how the Principal Officer meets the minimum requirements in para 3.2 (management level, full-time and exclusive to your entity, at least three years of relevant experience, based in India and a different person from the Designated Director), and what the cyber-security audit found. The meeting is scheduled only after FIU-IND has examined the documents and found them in order, and the Director, FIU-IND can deny or cancel registration if the applicant does not meet its PMLA obligations (para 2.5.3). Treat it as an inspection of a running system, not a presentation.
What does Infinilex do in an FIU-IND registration, and who signs?
Infinilex maps your product to the five notified activities, builds the para 2.4 dossier, drafts the AML, CFT and CPF policies and the client acceptance framework, prepares the Designated Director and the Principal Officer for the in-person meeting and rehearses the live demonstration, and runs the monthly reporting, KYC refresh and record-keeping calendar once the FIU RE-ID is assigned. The statutory acts stay where the guidelines put them: the applicant files its own FINGate registration and gives the self-declaration in its own name, the CERT-In empanelled auditor issues the cyber-security audit certificate, your registered counterparties issue the PACT certificates, and the Designated Director and the Principal Officer attend the meeting in person. Where a written opinion is needed, for example on whether an activity is notified or on the tax position, Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. Infinilex's in-house chartered accountant and company secretary prepare or review the MCA, GST and TDS filings the dossier draws on. Email is answered within one working day.
Register before you operate, and build the programme before you register. FIU-IND approves a working system: named people, KYC that runs, records that reconstruct transactions, reports that actually go out. The offshore exchanges that were blocked and fined were not punished for being crypto businesses; they were running notified activities without registering. The route in is open, and it is cheaper walked early than bought back after a blocking order and a penalty.
Preparing an FIU-IND application?
Send us what you do with VDAs and who your users are, and we will map the notified activities, the people you need and the gaps in the programme, in one call.
Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.
Want this as a PDF in your inbox?
Email us and we will send the current version, and the updated one each time the law moves. Or print the page: it is built for paper.
This checklist is general information for founders, not legal or tax advice for your specific business. The PMLA framework, the FIU-IND guidelines and the tax provisions change; confirm every point against current law before relying on it. Whether an activity is notified depends on the facts of your product. Have your setup reviewed before you file.
Prepared by Infinilex Consultancy · infinilex.io · Verified as of 6 October 2026. Printed copies date; check infinilex.io/resources/ for the current version.