Crypto exchanges in India: KYC and FIU registration

Since 7 March 2023, any business that exchanges, transfers, safeguards or helps sell virtual digital assets for others is covered by India’s anti-money laundering law (PMLA). Such a “VDA service provider”, Indian or foreign, must register with FIU-IND, verify its customers (KYC), keep records and report suspicious transactions. As a user, you should check registration before depositing money, but registration is not a licence or a guarantee that your coins are safe.

What the 2023 notification changed

Before March 2023, an exchange asked for KYC mainly as company policy. After the notification, it became a legal duty. The notification brought five activities, carried on for or on behalf of another person, within the PMLA:

• exchange between virtual digital assets and fiat currency;
• exchange between one or more forms of virtual digital assets;
• transfer of virtual digital assets;
• safekeeping or administration of virtual digital assets, or of instruments that give control over them; and
• participation in, and provision of financial services linked to, an issuer’s offer and sale of a virtual digital asset.

The term “virtual digital asset” is borrowed from the income-tax definition. A platform that does these things for Indian users becomes a “reporting entity” with the same kind of duties as a bank or a stock broker. FIU-IND issued separate anti-money laundering guidelines for such providers in March 2023.

What a VDA service provider must do

1. Register with FIU-IND as a reporting entity.
2. Know its customer: verify identity and beneficial ownership, understand the purpose of the account, and apply enhanced checks for higher-risk customers.
3. Keep records of identity documents and transactions for the period the PMLA rules prescribe.
4. Report suspicious transactions and other prescribed reports to FIU-IND.
5. Appoint a designated director and a principal officer who answer for compliance.

If a provider fails, the Director of FIU-IND can act under section 13 of the PMLA. This is the power used against foreign platforms in recent years.

What users should check before depositing money

• Registration: does the platform say it is registered with FIU-IND? Ask support for details, and look for any official notice naming the platform. FIU-IND does not publish a full public list, so absence of a name in the news is not proof either way.
• Indian presence: is there an Indian entity, an address and a named grievance officer, as the IT Rules require for intermediaries?
• TDS: does the platform deduct 1 percent TDS on your sales and give you statements to match with your tax records?
• Dispute clause: where is arbitration or court jurisdiction? A foreign seat is costly for an individual.
• Your own KYC: use your own PAN and bank account only. Never lend your account or buy a “verified account”. Accounts opened on other people’s identity are a common tool of fraudsters, and the KYC holder can be pulled into a criminal case.

Offshore exchanges and blocking

Many Indians trade on large foreign exchanges. The government’s position is that these must register too. Public record shows the following sequence.

• 28 December 2023: show cause notices to nine offshore providers and a request to block their web addresses.
• June 2024 and January 2025: monetary penalties on two large platforms under the PMLA, reported as ₹18.82 crore on Binance and ₹9.27 crore on Bybit.
• 2025: notices to 25 more offshore providers.
• Later notices: further notices and blocking directions have been reported. The number of registered providers keeps changing, so check FIU-IND’s current list instead of relying on a headline figure.

Blocking targets the platform’s apps and sites in India, not your coins. But withdrawals can become hard and support can vanish. Using a VPN to keep trading on a blocked platform does not make it compliant and makes any later complaint weaker. Tax still applies to residents, and since no Indian TDS may have been cut, you must compute and pay it yourself.

Your rights and the P2P trap

An exchange is a private company serving you under its terms. It can ask for ID and for proof of source of funds, especially for large or unusual deposits. If an account is restricted, you can ask in writing for the reason and whether a police or court order is involved. It will not tell you if it files a suspicious transaction report, because “tipping off” is not allowed.

Peer-to-peer markets carry a specific risk. A seller receives rupees directly from the buyer. If the buyer’s money came from a cyber fraud victim, police can ask your bank to freeze your account under section 106 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (old CrPC section 102). To lower the risk, accept payment only from an account in the counterparty’s own verified name, refuse third-party or split payments, and keep screenshots of the order, chat and bank credit. If your account is frozen, ask the bank in writing for the police station, case number and amount held, write to the investigating officer with your trade records, and if needed apply to the Magistrate for release of the amount above the disputed sum.

If funds are lost because a platform fails or cheats, your remedies are a legal notice, a complaint on e-Jagriti, a police complaint, and in suitable cases a civil or arbitration claim. See our guide on crypto fraud complaints and recovery.

For a structured walk-through, see the Crypto and VDA Law and Tax course.

Frequently asked questions

Is it compulsory to do KYC on a crypto exchange?

Yes, for any provider covered by the PMLA. Expect PAN, an identity document, a selfie and bank details.

How do I know if an exchange is registered with FIU-IND?

Ask the platform for its registration details and look for official FIU-IND or Finance Ministry announcements. FIU-IND does not publish a complete list for the public, so be cautious with any platform that cannot say.

Does FIU-IND registration mean my money is safe?

No. It is an anti-money laundering requirement. It is not a licence, a solvency check or an investor protection scheme.

Do I need KYC for my own hardware wallet?

No intermediary does KYC when you transact directly from your own wallet, and the PMLA duties are on businesses. Your tax duties remain the same.

Can FIU-IND take my complaint if an exchange cheats me?

FIU-IND collects reports from reporting entities and shares intelligence. For personal losses, use 1930, cybercrime.gov.in and the police.

Can I use an offshore exchange that is not registered?

It is not a good idea. The platform may be blocked, recovery is hard, and your transactions may draw scrutiny. Tax is payable regardless.

Quick quiz

Sources

• Prevention of Money-laundering Act, 2002, section 13 (powers of the Director)
• Ministry of Finance notification of 7 March 2023 bringing VDA activities under the PMLA
• FIU-IND anti-money laundering guidelines for VDA service providers (March 2023)
• Ministry of Finance press notes on offshore VDA service providers (28 December 2023 and 2025)
• Bharatiya Nagarik Suraksha Sanhita, 2023, section 106
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (grievance officer)

This page is for education and general information, not legal advice for a specific case. Law as on 7 November 2026.