Registering a Web3 or VDA Business in India: FIU-IND & PMLA

Any business in India that exchanges, transfers, safe-keeps, or helps issue virtual digital assets is a reporting entity under the Prevention of Money Laundering Act, 2002, whether it is incorporated in Bengaluru or Dubai. This obligation was created by a single notification from the Ministry of Finance in March 2023 and has since grown into a document-heavy, technology-audited registration process run by the Financial Intelligence Unit, India (FIU-IND). Founders often start by asking which state or country to incorporate in. The better first question is which of five designated activities their product performs, because that answer decides everything that follows, including whether a domestic private limited company is even the right vehicle.

Does a Web3 or crypto business in India need FIU-IND registration?

Yes, if it exchanges VDAs for fiat or for other VDAs, transfers VDAs on behalf of users, safe-keeps or administers VDAs, or participates in an issuer’s offer and sale of a VDA, as designated business or profession under the Ministry of Finance notification S.O. 1072(E) dated 07/03/2023 (Section 2(1)(sa)(vi), Prevention of Money Laundering Act, 2002). The obligation attaches to the activity, not to the place of incorporation, so offshore platforms serving Indian users are equally covered.

Which Web3 activities trigger FIU-IND registration under PMLA

The March 2023 notification designates five categories of activity as “designated business or profession”. Any entity carrying on one of these for another person, in the course of business, becomes a reporting entity under Section 2(1)(wa) of the PMLA and must register with FIU-IND. The scope is deliberately wide. It does not stop at “crypto exchange” in the popular sense, and founders who assume their product is too niche to qualify are usually wrong.

Five designated VDA activities and who they typically cover

Designated activity	Typical business model	Reporting entity example
Exchange between VDA and fiat currency	Centralised exchange with INR on-ramp	Domestic exchanges offering direct fiat deposit and withdrawal
Exchange between one or more forms of VDA	Spot trading interface, crypto-to-crypto swap	Trading apps, DEX aggregators with fiat nexus
Transfer of VDA on behalf of another	Custodial wallet executing transfers	Wallet providers, payment-linked VDA apps
Safekeeping or administration of VDA	Custody of assets or private keys	Institutional custody providers serving Indian clients
Participation in an issuer’s offer and sale of VDA	Token launch intermediary, brokerage	Launchpads, OTC desks, token brokers

A non-fungible token marketplace that takes payment and facilitates a sale is within scope. An over-the-counter desk executing trades for high-net-worth clients is within scope. A wallet that merely lets a user hold their own private key without the platform ever taking custody may sit outside the definition, but that is a fact-specific determination and not a default assumption a founder should make without documenting the reasoning. The FIU-IND has flagged narrow self-scoping, businesses defining their activity tightly to avoid registration, as one of its recurring rejection triggers when applications do eventually come in.

Choosing the right business structure before you register with FIU-IND

This is the step most guides skip, and it is where founders lose the most time. FIU-IND registration is not a licence and does not depend on a specific corporate form, but the structure chosen at incorporation determines how cleanly the beneficial ownership disclosure, the Designated Director appointment, and any future FEMA filings will go.

Common structuring options for a Web3 or VDA business in India

Structure	Foreign investment route	Tax treatment on VDA income	Typically suited for
Private limited company (Companies Act 2013)	FDI under the automatic or approval route depending on sector view; VDA activity has no dedicated FDI policy line, so legal characterisation matters	30 percent flat tax on VDA gains under Section 115BBH, no loss set-off, plus standard corporate tax on other income	Domestic exchanges, wallet providers, custody businesses with Indian retail users
Limited liability partnership	FDI permitted only in LLPs operating in sectors with 100 percent automatic route and no performance conditions; VDA activity is not a settled fit	Partnership taxation, but VDA income of the LLP still attracts Section 115BBH treatment	Advisory or services arms, rarely the operating VASP entity itself
IFSCA unit at GIFT City	Foreign investment and foreign currency operations permitted under the IFSCA framework, subject to IFSCA’s own fintech and VDA-related consultations	Distinct tax holiday and offshore banking treatment under IFSCA rules, separate from mainland Section 115BBH	Entities structuring for foreign institutional clients, cross-border custody, or funds exposure

A private limited company remains the default for a domestic-facing VASP because it aligns with the beneficial ownership disclosure that FIU-IND requires under Rule 9 of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005 (PMLR), which asks for ownership above the 10 percent threshold to be identified. Offshore holding layers, common in Web3 cap tables that raise from foreign VCs through a Cayman or Singapore holdco, are not prohibited, but they must be disclosed with enough clarity that FIU-IND can see through to the ultimate beneficial owner. Weak beneficial-ownership disclosure where an offshore structure obscures ultimate ownership is one of the most cited reasons applications are sent back for revision. Founders raising a priced round with a foreign holding company sitting above the Indian operating entity should resolve this disclosure question with counsel before filing, not after FIU-IND asks for it.

GIFT City, under the International Financial Services Centres Authority (IFSCA), is increasingly discussed for VDA-adjacent structures, particularly custody and fund-linked products serving foreign clients. It does not exempt an entity from FIU-IND registration if the entity is still carrying on a designated VDA activity for Indian users; it is a parallel consideration for entities structuring cross-border operations, not a substitute for the PMLA reporting-entity obligation.

What documents does FIU-IND ask for

The FIU-IND treats registration as recognition of an already-functioning compliance system, not as the trigger to build one. Rule 7(3) of the PMLR empowers FIU-IND to issue guidelines and scrutinise reporting entities, and that scrutiny starts the moment the application is filed. The registration circular first issued in October 2023 has been revised more than once since, and the operative AML/CFT Guidelines were last updated on 08/01/2026. Because the registration circular and its underlying notifications have been revised on a near-annual cadence since 2023, the exact circular reference number in force should be confirmed against the current FINgate portal instructions at the time of filing rather than assumed from an older article, including this one.

Before filing, the entity should already have in place an AML/CFT policy adopted by the board, a risk-based customer due diligence framework, an operational transaction monitoring system, sanctions screening against Indian and international lists, five-year record retention under Section 12 of the PMLA, an employee training programme, and an internal audit function. The 08/01/2026 Guidelines added live-selfie KYC with liveness detection, geo-tagging of onboarding sessions, penny-drop bank account verification, and delisting of privacy coins and mixer-linked tokens as baseline requirements, not aspirational ones.

The documentation package itself spans four categories.

• Corporate: a description of services mapped explicitly to the five activities under S.O. 1072(E), corporate structure and Significant Beneficial Owner (SBO) disclosure above the 10 percent threshold, incorporation documents, and MCA filings (annual returns, audited financials, balance sheets) for the last three financial years.
• Financial: GST returns for the last three years, income tax returns, and TDS returns filed under Section 194S of the Income Tax Act 1961 for VDA transactions where applicable.
• Compliance: the AML/CFT policy document, Designated Director and Principal Officer appointment letters, the board resolution appointing them, and a self-declaration confirming no pending proceedings against the entity or its officers.
• Operational: agreements with any Indian or foreign counterparty engaged in designated VDA activity, including custodians, liquidity providers, market makers, and technology vendors, since these relationships are reviewed in their own right, along with a Partner Accreditation for Compliance and Trust (PACT) certificate where the relevant partner integration requires one. Offshore applicants additionally submit incorporation documents from their home jurisdiction, local regulatory approvals, and a written explanation of their nexus to Indian users. A general “we serve global users including Indian ones” framing rarely satisfies this requirement; FIU-IND expects a specific, documented account of the India nexus.

The Significant Beneficial Owner concept is not unique to FIU-IND; it borrows the same threshold and disclosure logic that the Companies Act 2013 already applies to SBO filings with the Registrar of Companies, which is precisely why a cap table that has not kept its SBO filings current at the MCA tends to surface the same gap again at the FIU-IND stage.

Principal Officer and Designated Director: two roles, two liabilities

The PMLA framework requires two separate appointments, and conflating them is one of the more expensive mistakes founders make.

Designated Director versus Principal Officer

Aspect	Designated Director	Principal Officer
Level	Senior managerial person, typically a board director or C-suite executive	Operational compliance head
Core responsibility	Overall compliance with PMLA and PMLR	Day-to-day AML reporting: STRs, CTRs, and NTRs where applicable
Point of contact with FIU-IND	Ultimate accountability	Operational liaison for filings and queries
Conflict rule under 08/01/2026 Guidelines	Cannot be a nominee without real authority	Cannot simultaneously hold business-line responsibility such as sales
Notification	Through the FINgate portal, updated whenever details change	Through the FINgate portal, updated whenever details change

Both roles carry personal liability under Section 13 of the PMLA. FIU-IND can direct penalties not only at the reporting entity but at the individuals responsible for its compliance. A founder who names their head of growth as Principal Officer to save headcount, or who appoints a director in title only, is creating a rejection risk at the application stage and a personal liability exposure afterward. These should be treated as strategic compliance hires made early, not as line items filled in the week before submission.

How long does FIU-IND registration take?

Where the application is complete on first submission and the entity is already PMLA-compliant with an operational AML framework, approval typically takes two to six weeks. Applications with an AML policy adapted from a generic template, a Principal Officer holding a conflicting business role, or unclear beneficial ownership are sent back for remediation, and the clock resets from scratch rather than pausing.

The FINgate portal, the in-person meeting, and what actually gets tested

Applications are filed electronically through the FINgate portal, which also handles ongoing reporting once registration is granted. The process runs in a fixed sequence rather than as a single submit-and-wait step. The applicant first registers its details and uploads the full documentation package on FINgate. FIU-IND then examines the submission; if it is found satisfactory, the applicant is intimated and an in-person meeting is scheduled. If it is not satisfactory, the file goes back for remediation before a meeting is even offered, which is why a document deficiency costs more time than it appears to on paper: it is not reviewed alongside the in-person stage, it blocks reaching that stage at all.

Since the FY 2024-25 supervisory cycle, the in-person meeting has expanded well beyond a discussion of the business model. Attendance by both the Designated Director and the Principal Officer, or their authorised senior representatives, is mandatory, and applicants are expected to demonstrate, live, their KYC onboarding flow, sanctions screening against OFAC, EU, UN, and Indian lists, transaction monitoring alerts for typologies such as layering and structuring, blockchain analytics tools used to trace VDA flows, record-keeping and audit-trail capability, and FATF Travel Rule compliance for transfers above the applicable originator-beneficiary information threshold, which in India carries no de minimis cutoff. A slide deck built for investors is the wrong artefact to bring into this room.

The Director, FIU-IND retains the power to deny or cancel a registration where the applicant, or a previously registered entity, fails to meet its obligations under the PMLA, the PMLR, or the Guidelines. This makes registration a continuing state that has to be maintained, not a certificate that once issued can be filed away; a VDASP that lets its transaction monitoring or Travel Rule systems degrade after approval is exposed to cancellation on the same terms a first-time applicant is exposed to denial.

What compliance continues after FIU-IND registration

Registration is the start of a recurring reporting cycle, not a one-time filing that can be archived. The PMLR fixes specific cadences that a VDASP’s compliance team has to run against from day one, and most founder-facing guides stop at the registration certificate without walking through what the calendar actually looks like afterward.

Recurring reporting obligations under the PMLR

Report	Trigger	Filing timeline
Cash Transaction Report (CTR)	All cash transactions of value more than ₹10 lakh, or a series of connected transactions crossing that threshold	By the 15th day of the succeeding month, per Rule 3 read with Rule 8, PMLR
Suspicious Transaction Report (STR)	Any transaction, or attempted transaction, that gives rise to a reasonable ground of suspicion	Within a short window from the point the Principal Officer arrives at that conclusion, per Rule 8, PMLR, irrespective of transaction value
Non-Profit Organisation Transaction Report (NTR)	Transactions involving entities registered as non-profit organisations, where applicable to the VDASP’s client base	Monthly, in the format prescribed by FIU-IND

Alongside these filings, a registered VDASP must maintain records of client identification and transactions for five years from the date of the transaction under Section 12 of the PMLA, keep its FINgate portal profile current whenever the Principal Officer, Designated Director, ownership, or business model changes, and implement the FATF Travel Rule for VDA transfers, which requires originator and beneficiary information to travel with the transaction. India has adopted this with no de minimis threshold, so the rule applies to transfers of any value, unlike jurisdictions that exempt small transfers.

The FIU-IND’s own supervisory posture has shifted from onboarding to active intelligence-driven review. Its FY 2024-25 reporting describes using data from registered VDASPs’ STR filings to identify typologies such as hawala flows, illegal gambling proceeds, and fraud linked to spoofed exchange accounts. A registered entity should expect periodic supervisory contact, not a single interaction at the registration stage, and should resource its compliance function accordingly rather than treating the Principal Officer as a part-time role once the certificate is issued.

On cost, FIU-IND does not prescribe a separate government registration fee comparable to a SEBI or RBI licence fee; the real cost driver is building and running the AML/CFT infrastructure, hiring for the Designated Director and Principal Officer roles, and legal and compliance advisory spend. Founders budgeting for this should treat it as an operating cost line, not a one-time filing fee, and this position should be verified against the latest FINgate portal instructions before an application is filed, since fee structures can change with each circular revision.

Where do DeFi, DAOs and NFT platforms sit in this framework

The five designated activities under S.O. 1072(E) are written around an identifiable person carrying on VDA business for another person. That framing sits comfortably over centralised exchanges, custodians, and wallet providers, and far less comfortably over decentralised finance protocols, decentralised autonomous organisations, and some NFT models, which is the gap most competitor content either ignores or treats with a single caveated line.

A front-end interface to a decentralised exchange, operated by an identifiable team that takes a fee, markets the product, and can pause or upgrade the protocol, is difficult to distinguish from a centralised VDASP for PMLA purposes, because the intermediary role and the fee-taking business relationship are both present. A genuinely permissionless protocol with no operator exercising control, no fee capture by an identifiable entity, and no discretionary intervention sits in a harder-to-classify position, and the Financial Action Task Force’s own guidance to member states, which India has committed to implement, points regulators toward looking through to whoever exercises effective control, including DAO token holders or a founding team retaining upgrade keys, rather than accepting “no operator” as a self-executing exemption.

A DAO that governs a protocol used by Indian users faces the same look-through question. If a subset of founders or a foundation entity retains multisig control, receives protocol fees, or makes the practical decisions the DAO structure nominally decentralises, FIU-IND and enforcement agencies are likely to treat that entity as the reporting entity in substance. An NFT marketplace that only indexes on-chain listings without touching funds sits closer to the permissionless end of the spectrum; one that runs its own payment rail, escrow, or fiat on-ramp sits squarely within the transfer and exchange categories already discussed.

None of this is settled by a bright-line rule in the current notification, and any founder building a DeFi, DAO-governed, or hybrid NFT product in India should treat the registration question as a documented legal assessment specific to their control structure, revisited each time governance or fee mechanics change, rather than a one-time conclusion drawn at incorporation. India’s proposed crypto regulation bill, under discussion since mid-2025, may eventually address this gap directly; until it is enacted, the PMLA notification and FATF-aligned interpretation remain the operative test.

Is FIU-IND registration a crypto licence?

No. FIU-IND registration recognises an entity as a reporting entity under the PMLA and obliges it to comply with the anti-money-laundering framework under Chapter IV of the Act and the PMLR. It does not authorise any specific commercial activity, does not permit token issuance, does not substitute for a securities licence where the Securities and Exchange Board of India’s jurisdiction over security-like tokens applies, and does not remove Reserve Bank of India scrutiny over banking and payment arrangements.

This distinction has real consequences. A registered VDASP that launches a token structured with debt-like or equity-like features can still fall within SEBI’s jurisdiction over securities, since a token’s economic substance rather than its “crypto” label determines whether securities law applies, and this is an area where SEBI’s position has been evolving and should be checked against SEBI’s current circulars before a token launch, not assumed from an older article. A registered VDASP whose fiat rails run through non-standard banking arrangements can still draw RBI attention. A registered VDASP offering a deposit-like yield product can still attract scrutiny under banking and deposit-taking law separate from the PMLA. Treating FIU-IND registration as the complete answer to “are we compliant” is the single most expensive framing error a founder makes at the outset, because the downstream regulator does not care that the AML box has been ticked.

Activity-based obligation: why offshore platforms are covered too

FIU-IND’s framework applies on an activity basis, not a physical-presence basis, and this design choice has driven most of its enforcement activity to date. An exchange incorporated in the Seychelles, Cayman Islands, or Dubai that accepts Indian users, allows INR deposits through any channel, or facilitates VDA activity linked to India is a reporting entity and must register, regardless of whether it has an Indian office, Indian directors, or Indian banking relationships. The Ministry of Finance made this position explicit in its statement accompanying the December 2023 enforcement wave: the obligation is activity-based and not contingent on physical presence in India.

FIU-IND has operationalised this by issuing compliance show-cause notices under Section 13 of the PMLA to offshore platforms and, in parallel, directing the Ministry of Electronics and Information Technology to block their URLs and delist their mobile applications from Indian app stores. The first wave, in December 2023, targeted nine offshore exchanges. A second wave, on 01/10/2025, extended notices to a further 25 offshore VASPs. Per the FIU-IND Annual Report for FY 2024-25, 49 VDA service providers had registered by that point, 45 domestic and four offshore.

How enforcement penalties have escalated through aggregation

Pattern observed	Circumstance	Effect on the entity
Penalty preceding registration	Offshore exchange penalised before completing registration	Registration followed the enforcement order rather than preceding it
Penalty in the tens of lakhs	Single or early-stage enforcement action against a smaller offshore platform	Reflects a narrower set of aggregated failures
Penalty in the crores	Enforcement order against a large offshore exchange with a substantial Indian user base	Reflects aggregation of failures across multiple reporting periods and a larger transaction volume
Proactive registration with no prior order	Platform registered ahead of any enforcement action	No penalty preceded registration

Under Chapter IV of the PMLA, the statutory penalty range for a failure to comply is not less than ₹10,000 and may extend to ₹1,00,000. The much larger figures seen in actual enforcement orders arise because those orders aggregate multiple failures across reporting periods and, for larger platforms, larger transaction volumes. A further point that founders underestimate: registering after enforcement action does not extinguish liability for the period of prior non-compliance. A platform that registers in 2026 remains exposed to action for conduct during 2023 to 2025.

Tax and reporting obligations that ride alongside FIU-IND registration

FIU-IND registration is one piece of a wider compliance stack that a Web3 business in India must run in parallel, and the pieces are not independent of each other; a gap in one shows up as a document deficiency in the FIU-IND application.

• Income from transfer of a VDA is taxed at a flat 30 percent under Section 115BBH of the Income Tax Act 1961, with no deduction for expenses other than cost of acquisition and no set-off of losses against other income or across VDA transactions.
• A person paying consideration for transfer of a VDA must deduct tax at 1 percent under Section 194S, and these TDS returns are part of the financial documentation FIU-IND expects to see for the last three years.
• GST applies to the fee or commission earned by an exchange, wallet, or custody provider on VDA transactions, and returns for the last three years form part of the financial documentation package as well.
• India has committed to adopting the OECD Crypto-Asset Reporting Framework, which will require VDASPs to report user transaction data for cross-border tax information exchange; the exact implementation date has moved as the domestic notification process has progressed, so founders should confirm the current effective date with a tax advisor rather than build against a fixed year, and should in any case design their data architecture with this reporting obligation in view rather than retrofitting it later.

Common mistakes that cost founders time and money

Scoping the business too narrowly. Founders sometimes describe their product in a way designed to sit outside the five designated activities, for instance calling a custodial wallet a “non-custodial interface”. FIU-IND’s review compares the stated activity against the actual product flow, and a mismatch is treated as a red flag rather than a clever exemption.

Appointing a Principal Officer with a conflicting role. The 08/01/2026 Guidelines expressly prohibit the Principal Officer from also holding business-line responsibility such as sales. A head of growth or a co-founder running revenue targets is the wrong person for this seat, however convenient the org chart looks.

Filing before the AML system actually works. FIU-IND has moved from reviewing documents to demanding live demonstrations of KYC, sanctions screening, transaction monitoring, and Travel Rule compliance. A policy document copied from a template with no operating system behind it will be exposed in the in-person meeting, and the resubmission cycle costs more time than building the system properly the first time.

Leaving offshore beneficial ownership vague. Where a foreign holding company sits above the Indian operating entity, incomplete disclosure of ultimate ownership above the 10 percent PMLR Rule 9 threshold is one of the most common reasons applications are returned.

Treating registration as the finish line. FIU-IND registration is a reporting-entity status under the PMLA. It says nothing about SEBI’s jurisdiction over security-like tokens, RBI’s view of the banking arrangement, or GST and income tax obligations that continue independently. A founder who stops compliance planning at FIU-IND registration will discover the gap during due diligence in a fundraise or an exchange listing.

Assuming the certificate cannot be taken away. The Director, FIU-IND can cancel a registration for the same failures that would have blocked an application in the first place: a transaction monitoring system that stops working, a Principal Officer role left vacant after a resignation, or STR filings that lapse. Founders who staff compliance down once the certificate is issued are treating a continuing obligation as a one-time event.

Frequently asked questions

Q: Does an NFT marketplace need to register with FIU-IND?

A: If the marketplace facilitates the sale of NFTs on behalf of another person and takes payment or holds funds in the process, it falls within the designated activities under S.O. 1072(E) and must register. A platform that merely lists NFTs without touching the transaction flow needs a documented, fact-specific assessment before assuming it is exempt.

Q: What is the tax rate on income from crypto or VDA trading in India?

A: Gains from transfer of a VDA are taxed at a flat 30 percent under Section 115BBH of the Income Tax Act 1961, with no set-off of losses and no deduction beyond cost of acquisition. A further 1 percent TDS applies under Section 194S on the consideration paid for the transfer.

Q: How long does the FIU-IND registration process take from start to finish?

A: Two to six weeks once filed, provided the AML framework is already operational and the documentation is complete. Founders should budget three to six months before filing to build the compliance infrastructure the review will test, not three to six weeks.

Q: What documents are required to register a VDA business with FIU-IND?

A: Incorporation records, three years of MCA filings, three years of GST returns, income tax and Section 194S TDS returns, beneficial ownership disclosure above the PMLR Rule 9 threshold, the AML/CFT policy, Designated Director and Principal Officer appointment letters and board resolution, a self-declaration on pending proceedings, and counterparty agreements.

Q: Does an offshore crypto exchange need FIU-IND registration if it has no Indian office?

A: Yes. The obligation is activity-based, not presence-based. An exchange incorporated abroad that accepts Indian users or facilitates VDA activity linked to India must register, and the absence of an Indian entity does not remove the obligation.

Q: Is GIFT City or an IFSCA unit a way to avoid FIU-IND registration?

A: No. An IFSCA unit at GIFT City is a structuring option for cross-border operations and offers its own tax and banking framework, but it does not exempt an entity from FIU-IND registration if the entity is carrying on a designated VDA activity for Indian users.

Q: What happens if a Web3 business does not register with FIU-IND?

A: Section 13 of the PMLA allows the FIU-IND Director to issue warnings, directions to comply, directions to submit compliance reports, or monetary penalties, and to request the Ministry of Electronics and Information Technology to block URLs and delist apps. Penalties in enforcement orders have ranged from roughly ₹34.5 lakh to ₹18.82 crore, depending on the number of aggregated failures.

Q: Who can be appointed as Principal Officer for a VDASP?

A: A senior management executive with real operational authority over AML compliance and reporting, who does not simultaneously hold business-line responsibility such as sales or customer acquisition, per the conflict-of-interest rule in the 08/01/2026 Guidelines.

Q: Can foreign co-founders or NRI-held holding structures register with FIU-IND?

A: Yes, but the beneficial ownership above the 10 percent threshold under PMLR Rule 9 must be clearly disclosed and traceable through any offshore holding layer. Vague or opaque ownership structures are a common reason applications are returned for revision.

Q: Does FIU-IND registration mean a Web3 business is fully compliant in India?

A: No. It confirms reporting-entity status under the PMLA only. SEBI’s jurisdiction over security-like tokens, RBI’s oversight of banking and payment arrangements, and GST and income tax obligations continue to apply independently and must be assessed separately.

Q: What happens during the FIU-IND in-person meeting?

A: The Designated Director and Principal Officer, or authorised senior representatives, appear before FIU-IND officials and are expected to demonstrate, not merely describe, their KYC flow, sanctions screening, transaction monitoring, blockchain analytics, and FATF Travel Rule compliance.

Q: What reports does a registered VDASP have to file on an ongoing basis?

A: Cash Transaction Reports by the 15th of the succeeding month for cash transactions above ₹10 lakh, Suspicious Transaction Reports within a short window of the Principal Officer forming a suspicion regardless of transaction value, and Non-Profit Organisation Transaction Reports monthly where applicable, all under the PMLR read with Rule 8.

Q: Does a DeFi protocol or DAO need to register with FIU-IND?

A: There is no bright-line exemption for decentralisation alone. Where an identifiable team or entity retains fee capture, upgrade control, or multisig authority over a protocol used by Indian users, FIU-IND and FATF-aligned enforcement practice look through to that entity as the reporting party. A genuinely permissionless protocol with no controlling operator sits in a harder, fact-specific position that should be assessed and documented on its own facts rather than assumed.

Q: Can FIU-IND cancel a registration after it has been granted?

A: Yes. The Director, FIU-IND retains the power to deny or cancel registration where the entity fails to meet its obligations under the PMLA, the PMLR, or the AML/CFT Guidelines, whether that failure occurs before approval or after. Registration is a continuing compliance state, and a system that degrades after approval carries the same exposure a first-time applicant faces.

Q: What should an investor or acquirer check during due diligence on a VDA business?

A: Whether the target is registered as a reporting entity with FIU-IND, whether its Principal Officer and Designated Director appointments are free of the conflicts flagged in the 08/01/2026 Guidelines, whether STRs and CTRs have been filed on schedule, and whether any liability exists for conduct predating registration, since registration does not extinguish prior non-compliance.

Regulatory references:

• Prevention of Money Laundering Act, 2002: Section 2(1)(sa)(vi), Section 2(1)(wa), Section 12, Section 13, Chapter IV
• Prevention of Money-laundering (Maintenance of Records) Rules, 2005: Rule 3, Rule 7(3), Rule 8, Rule 9
• Ministry of Finance notification S.O. 1072(E), dated 07/03/2023
• FIU-IND AML/CFT Guidelines for VDA reporting entities, dated 10/03/2023 and revised 08/01/2026