FIU-IND registration in India, run end to end.
Infinilex runs FIU-IND registration for crypto exchanges, custodians and VDA platforms that serve Indian users, whether the company sits in India or offshore: the perimeter test, the FINGate filing, the document set, the in-person meeting and the AML programme behind it. Infinilex counsel qualified in India sign the India-law work, and the officers the statute names, your Designated Director and Principal Officer, stay yours. If your platform touches virtual digital assets for Indian users, you are a reporting entity under the PMLA. We also model the 30% VDA tax and 1% TDS into the business before they surprise you.
Advised on $100M+ of founder fundraising and $200M+ in deal value, with 10+ IPO and pre-IPO mandates. Figures are internal, as of 2026.
FIU-IND registration is an AML registration under the Prevention of Money Laundering Act, not a licence, and it binds any VDA service provider serving Indian users, including offshore platforms with no office in India: FIU-IND’s guidelines updated 8 January 2026 state that the obligations are activity-based and apply irrespective of physical presence in India (paragraph 1.4). The registration itself is the smallest part of the work. What decides whether you stay compliant is the programme behind it: KYC and AML that operate, a Principal Officer and Designated Director who know their obligations, reporting that files on time, and a tax model that priced in the 30% and the 1% TDS from the start. Building and running that programme is the work of an FIU-IND registration consultant, and it is what Infinilex does end to end for crypto exchanges, custodians and VDA platforms serving Indian users. The last official count is 54 VDA service providers registered as on 9 March 2026 (Lok Sabha Unstarred Question 5805, answered 30 March 2026); FIU-IND does not publish the list.
What our FIU-IND registration service covers
- The perimeter test. Whether your activity is caught at all, applied to what the platform actually does rather than what it calls itself. The full analysis is on the site: who must register, and what follows.
- The registration. The reporting-entity application prepared and filed, with the entity, officers and documentation in the shape FIU-IND expects.
- The meeting and the audit certificate. Your Designated Director and Principal Officer prepared for the in-person meeting and the live demonstration of KYC, monitoring, blockchain analytics, Travel Rule and sanctions screening systems; the cyber security audit certificate from a CERT-In empanelled auditor scoped and coordinated, and the PACT certificates from registered counterparties collected.
- The AML programme. KYC, monitoring, suspicious and prescribed transaction reporting, Travel Rule handling and record-keeping, built to run at your actual volumes.
- Officers and governance. Principal Officer and Designated Director obligations set up properly, because those are personal, named roles, not letterhead.
- The tax picture alongside. The 30% VDA tax, the 1% TDS and the reporting calendar modelled into the product economics, and readiness for the CARF-aligned crypto-asset reporting that begins with 2026 data.
What happens after you pitch FIU-IND
Founders who have just come out of the FIU-IND meeting ask the same question: what happens next. The sequence is set out in FIU-IND’s AML and CFT guidelines for VDA reporting entities, updated 8 January 2026 (section 2), and in the third revision of the registration circular of 15 September 2025, both read on 6 October 2026.
- Initiation on FINGate. You register the entity’s details on the FINGate portal (the September 2025 circular calls it the FINnet 2.0 portal). The status shows as awaiting approval and a temporary Reference ID is generated, for correspondence only (guidelines 2.2). The circular adds that a system-generated FIUREID is for reference and that registration is granted only after the online registration and the Director’s in-principle approval.
- The document set, at least 15 days before the meeting. The headline items are a cyber security audit certificate from a CERT-In empanelled auditor covering the CERT-In Directions of 28 April 2022, and a PACT (Partner Accreditation for Compliance and Trust) certificate from each FIU-IND registered VDA service provider you deal with (guidelines 2.3 and 2.4). The meeting is scheduled only once the set is complete to FIU-IND’s satisfaction, and it is subject to operational readiness. The full document list is in the FIU-IND registration checklist.
- The in-person meeting. Your Designated Director and Principal Officer must both attend. You give a live demonstration of the KYC, transaction monitoring, blockchain analytics, Travel Rule and sanctions screening systems (guidelines 2.5; circular paragraph V).
- Approval and the FIU RE-ID. Formal registration is granted only after the documents, the meeting and the Director’s approval; the FIU Reporting Entity ID is then assigned (guidelines 2.2(c) and (d)). The Director can deny or cancel registration if the obligations are not met (2.5.3). Conditional on-boarding exists: three of the 54 registrants in the Lok Sabha annexure of 30 March 2026 are marked conditionally on-boarded.
Two things the process does not give you. There is no published timeline: asked in the Lok Sabha whether a timeline had been prescribed for completing registration, the Government pointed to the guidelines and gave none (Unstarred Question 5805, answer (c), 30 March 2026). And registration is not an endorsement: FIU-IND withholds the list of registered providers because publishing it could create the impression that registrants are licensed, approved or endorsed (answer (f)). The register does keep moving, though. The official count was 50 on 1 October 2025 (PIB release 2173758) and 54 as on 9 March 2026, four net additions in about five months. What follows approval is the operating programme: the monthly report to FIU-IND (guidelines 5.7), suspicious transaction reports, KYC refresh every six months for high-risk clients and yearly for the rest (4.5.2), an independent annual audit of the AML controls placed before the board (3.6.3), and records kept for five years (6.2).
“With their presence in both the US and India, Infinilex provides Indian founders with US-incorporated entities seamless guidance through the complex maze of compliance requirements.”
Who signs what on an FIU-IND registration
Infinilex counsel qualified in India, advocates enrolled in India, sign the India-law work: the perimeter analysis against the 7 March 2023 notification, the registration notes, and the AML, CFT and CPF policy and client acceptance framework the guidelines require (paragraphs 3.4 and 3.5). Infinilex’s in-house chartered accountant and company secretary assemble and check the MCA, GST and tax records the document set draws on, and certify where a statute names that professional. Statutory signatories stay as the statute names them: the Designated Director and the Principal Officer are your own officers, they attend the meeting, and the Principal Officer furnishes the reports under rules 7(2) and 8(2) of the PML Rules; the cyber security audit certificate is signed by a CERT-In empanelled auditor, whom Infinilex scopes and coordinates; PACT certificates come from the registered VDA service providers you deal with. Where the group has a UAE or US leg, Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign.
Three section 13 rounds, and where the count stands
The perimeter is enforced in rounds, and the rounds have a pattern. On 28 December 2023 FIU-IND issued compliance show-cause notices under section 13 of the PMLA to nine offshore exchanges, including Binance, KuCoin and Kraken, and wrote to the IT ministry to block their URLs (Ministry of Finance, PIB release 1991372). The penalty orders followed: Rs 18.82 crore on Binance by order of 19 June 2024, for contraventions of section 12(1) read with rules 7(1), 3(1)(D), 7(3) and 8(2) of the PML Rules (FIU-IND order 10/DIR/FIU-IND/2024), and Rs 9.27 crore on Bybit by order of 31 January 2025 under section 13(2)(d) (PIB release 2098153). Both entities then appear among the registered providers in the Lok Sabha annexure of 30 March 2026, so the record shows registration after a penalty in both cases.
On 1 October 2025 came section 13 notices to 25 more offshore platforms (PIB release 2173758), which then appear in the 53-platform takedown list annexed to the Lok Sabha answer. On 9 September 2026 the Director issued the third round: section 13 notices to fifteen VDA service providers (Weex, Blofin, Rezorex, Bitunix, DigiFinex, Toobit, XT.com, Latoken, WOO X, Pionex, ChangeNow, SimpleSwap, FixedFloat, WhiteBIT and Guardarian), with notices to take down their apps and URLs under section 79(3)(b) of the Information Technology Act 2000 read with rule 3(1)(d) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2025, and the sentence that matters for offshore founders: the obligations are activity-based and are not contingent on physical presence of the entity in India (PIB release 2308131). All releases and orders read on 6 October 2026.
On the count: 54 VDA service providers were registered as on 9 March 2026, 47 incorporated in India and seven offshore (Singapore, Delaware, Seychelles, Estonia and Lithuania), nine flagged as not operational or wound up on the entity’s own submission and three conditionally on-boarded; takedown directions had issued against 53 platforms (Lok Sabha Unstarred Question 5805, 30 March 2026, Annexures I and II). FIU-IND does not publish the list, and the next official figure will come from a parliamentary answer, a PIB release or FIU-IND’s annual report. The fuller history, and the names, are on the FIU-IND explainer and our list of FIU-IND registered VDA service providers.
How an FIU-IND registration engagement runs
Fixed scope for the perimeter test and the registration, so you know the boundary before committing. The AML programme is built as a project and can be maintained on a monthly retainer, which is how most registered platforms run it. Everything starts with a free discovery call.
Frequently asked questions
Who has to register with FIU-IND?
Any entity carrying on the notified virtual digital asset activities for Indian users is a reporting entity under the Prevention of Money Laundering Act, following the March 2023 notification. That includes exchanges, custodians and platforms whose safekeeping or administration extends to instruments enabling control over VDAs, and it applies to offshore platforms serving Indian users, not only Indian companies.
Is FIU-IND registration a licence?
No, and the distinction matters. It is an anti-money-laundering registration as a reporting entity, not a product approval or a licence to operate. It does not certify your product; it obligates your compliance. The obligations that follow registration are the real work: the AML programme, reporting, and record-keeping.
What obligations follow registration?
A KYC and AML programme that actually operates, a Principal Officer and Designated Director notified to FIU-IND, suspicious and prescribed transaction reporting, Travel Rule information on transfers, and records kept for the statutory period. From 2027, crypto-asset reporting under the CARF-aligned framework adds annual information filings for reporting service providers.
What happens if a platform serves Indian users without registering?
FIU-IND has issued section 13 notices in three rounds: to nine offshore exchanges on 28 December 2023, to 25 offshore platforms on 1 October 2025 and to 15 VDA service providers on 9 September 2026. It has also moved to block or take down the apps and URLs of platforms operating without complying with the PMLA. FIU-IND imposed a penalty of Rs 18.82 crore on Binance by order of 19 June 2024 and Rs 9.27 crore on Bybit by order of 31 January 2025; both appear among the registered providers in the Lok Sabha annexure of 30 March 2026. Registration has also become the practical gate for banking and payment relationships in India. The perimeter is enforced, but the list of registered providers is not public: the Government told the Lok Sabha on 30 March 2026 that 54 VDA service providers were registered as on 9 March 2026, and that FIU-IND withholds the list so that registration is not mistaken for a licence or an endorsement.
Does an offshore crypto exchange need FIU-IND registration if it has no Indian office?
Yes, if it carries on a notified VDA activity for Indian users. FIU-IND's guidelines updated 8 January 2026 state that the obligations are activity-based and apply irrespective of physical presence in India, and that all entities, irrespective of their registered location, must register if engaged in notified activities (paragraphs 1.4 and 7.3). That is the basis on which the show-cause notices of 28 December 2023 were issued to nine offshore exchanges, the penalty orders of 19 June 2024 (Binance) and 31 January 2025 (Bybit) were made, and the section 13 notices of 1 October 2025 and 9 September 2026 went to 25 offshore platforms and then 15 VDA service providers, each round with takedown notices for apps and URLs. Seven of the 54 providers registered as on 9 March 2026 are incorporated outside India, so the route is open; the condition that bites is a Principal Officer based in India, full time and exclusive to the entity.
Can a foreign-owned company, foreign co-founders or an NRI-held holding company register with FIU-IND?
Nothing in the PMLA, the 7 March 2023 notification or FIU-IND's guidelines updated 8 January 2026 makes the nationality of the founders or the ownership of the entity a registration criterion. FIU-IND looks at the activity, the people and the programme. The annexure to the Lok Sabha answer of 30 March 2026 lists registrants incorporated in Singapore, Delaware, Seychelles, Estonia and Lithuania, and Indian companies recorded as linked to offshore groups. What a foreign-owned structure must still supply is the same as anyone else: a corporate structure note with significant beneficial ownership, the statutory filings the guidelines list for the applicant entity (MCA, GST, income-tax and TDS returns) or an account of why they do not yet exist, a Designated Director, and a Principal Officer who is based in India, full time and exclusive to the entity. Foreign investment into an Indian operating entity is a separate FEMA question, checked against the current route for the activity before anything is filed.
Who can be appointed Principal Officer of a VDA service provider, and can a founder or a consultant hold the role?
FIU-IND's guidelines updated 8 January 2026 set the minimum at paragraph 3.2. The Principal Officer must be at management level, preferably not below head of audit, compliance or risk; engaged with the reporting entity exclusively and full time, with no concurrent engagement with any other entity in any capacity; have at least three years of relevant AML experience; be based in India; be kept out of the business and operational activities of the entity to avoid conflicts of interest; and be a different individual from the Designated Director. Read together, an outside consultant cannot be your Principal Officer, and a founder who runs the business is a poor fit for the role. The Designated Director is the person who carries overall responsibility for compliance with Chapter IV of the PMLA and the Rules (paragraph 3.1). Both appointments are communicated to FIU-IND and kept current through the FINGate portal.
What are the Principal Officer and the Designated Director personally liable for?
Section 13(2) of the PMLA lets the Director, FIU-IND act against the reporting entity, its designated director on the board or any of its employees for failing to comply with Chapter IV: a written warning, directions to comply, directions to send periodic reports, or a monetary penalty of not less than Rs 10,000 and up to Rs 1 lakh for each failure. The Principal Officer carries the reporting duties in person: furnishing the prescribed information under rule 7(2), reporting suspicious transactions promptly under rule 8(2), recording the reasons for treating a transaction as suspicious or for closing an alert, and reporting to the board at least once a year (guidelines paragraph 3.3). Directors, officers and employees are also bound by the prohibition on tipping off under sections 12(2) and 12A(3). The counterweight is section 14: no civil or criminal proceedings lie against the reporting entity, its directors or employees for furnishing information under section 12(1)(b), save as section 13 provides.
Who does FIU-IND registration for a crypto exchange, and what does Infinilex do?
Infinilex is a legal, compliance and structuring consultancy that runs FIU-IND registration end to end for crypto exchanges, custodians and VDA platforms serving Indian users, onshore or offshore. We test the perimeter against the 7 March 2023 notification, prepare the FINGate filing and the document set the 8 January 2026 guidelines list, build the AML, CFT and CPF policy and the client acceptance framework, prepare your Designated Director and Principal Officer for the in-person meeting and the live demonstration, scope and coordinate the CERT-In empanelled auditor for the cyber security audit certificate, and then run or support the operating programme that follows approval. Infinilex counsel qualified in India sign the India-law work. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. For a platform run from Dubai with Indian users, the FIU-IND leg runs alongside the VARA leg on the same model. Email is answered within one working day.
Serving Indian users, or about to?
Tell us what the platform does and where it is incorporated. We will tell you whether the PMLA catches it, what registration involves for your setup, and what the compliance programme costs you in practice, before anything is filed.
Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.
Further reading
FIU-IND registration for crypto businesses in India: who must register, and what follows · The FIU-IND registration checklist · FIU-IND registered VDA service providers, categorised and dated · Licensing beyond India: MiCA vs VARA
Related services: VARA licensing, if Dubai is the next market · MiCA authorisation, if the EU is on the map · The crypto AML programme that follows registration
Sources read on 6 October 2026: FIU-IND, AML and CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets, updated 8 January 2026; FIU-IND, 3rd Revision of Circular for Registration of VDA Service Providers, 15 September 2025; Prevention of Money-laundering Act 2002, sections 12, 12A, 13 and 14, FIU-IND text; Lok Sabha Unstarred Question 5805, answered 30 March 2026, with Annexures I and II; Ministry of Finance press releases, PIB release IDs 1991372 (28 December 2023), 2098153 (31 January 2025), 2173758 (1 October 2025) and 2308131 (9 September 2026); FIU-IND order in original 10/DIR/FIU-IND/2024 in the matter of Binance, 19 June 2024.
This page is general information about the service, not legal advice for your specific platform. Whether an activity is caught, and what registration requires, depends on your facts, and the framework continues to evolve. Scope is confirmed on the discovery call.