Three dates explain where India stands. On 7 March 2023, notification S.O. 1072(E) brought five crypto activities, when carried out for another person in the course of business, under the Prevention of Money Laundering Act, 2002 (PMLA). On 8 January 2026, FIU-IND updated its AML and CFT guidelines for virtual digital asset (VDA) service providers, which set the controls a registered platform runs and ask for a live demonstration of its KYC, transaction monitoring, blockchain analytics, travel rule and sanctions screening systems at the registration meeting. On 9 September 2026, FIU-IND issued notices for non compliance to 15 VDA service providers and sent takedown notices for their apps and URLs.
The comparison of crypto regulations across 24 jurisdictions files India among its restrictive regimes: trading is permitted and taxed, and providers register for AML purposes with no licensing law behind them.
Is crypto legal in India in 2026?
Yes. No Indian law bans buying, holding or selling crypto, and none licenses it. The state taxes crypto income and supervises platforms for money laundering, yet two government releases, of 1 October 2025 and 9 September 2026, close with the same warning: crypto products and NFTs "are unregulated and can be highly risky. There may be no regulatory recourse for any loss from such transactions."
A holder who loses money on a failed platform may have no regulator to turn to.
The nearest India came to a ban did not last. On 6 April 2018 the Reserve Bank of India (RBI) barred the banks and other entities it regulates from dealing in virtual currencies or helping anyone else deal in or settle them. The Supreme Court set that circular aside on 4 March 2020 in Internet and Mobile Association of India v. Reserve Bank of India, and the RBI's circular of 31 May 2021 told banks that the 2018 text "cannot be cited or quoted from". Banks may continue customer due diligence on these transactions under the KYC, AML and PMLA rules.
Is bitcoin legal tender in India, and can you pay with it?
No, it is not legal tender. The Income Tax Act, 2025 defines a virtual digital asset in s. 2(111) as information, code, number or token "(not being Indian currency or foreign currency)" generated through cryptographic means or otherwise, and limb (d) adds any crypto asset that relies on a cryptographically secured distributed ledger or a similar technology. Bitcoin is taxed as such an asset, and the definition itself keeps it apart from Indian and foreign currency. The digital rupee sits outside all of this: FIU-IND's guidelines exclude the RBI's central bank digital currency as "a digital form of sovereign fiat currency" (para 1.4(c)).
How is crypto taxed in India from April 2026?
Two rules apply from 1 April 2026, when the Income Tax Act, 2025 came into force. Income from transferring a VDA is taxed at 30 percent (s. 194(1), Table entry 4), with no deduction other than the cost of acquisition, no set off of a loss and no carry forward. Whoever pays for a VDA deducts 1 percent at source, the TDS (s. 393(1), Table entry 8(vi)).
Picture an individual who bought tokens for ₹60,000 and sells them for ₹100,000. The payer deducts ₹1,000 at source. The ₹40,000 gain is taxed at 30 percent, so ₹12,000. A ₹15,000 loss on another token offsets none of it and cannot be carried forward. No TDS is due while the year's consideration stays within ₹50,000 for an individual or Hindu undivided family payer meeting the Act's conditions, or ₹10,000 for other payers (s. 393(4), Table entry 12).
For a platform, most of the tax work is reporting. At registration, FIU-IND asks to see its income tax returns and its TDS returns on VDA transactions (para 2.4(e)). A platform prescribed as a reporting entity under s. 509 also furnishes a statement on crypto asset transactions, in the form and on the dates the rules prescribe, with due diligence to identify each crypto asset user or owner. The Finance Act, 2026 rewrote s. 446 from 1 April 2026: ₹200 for every day the statement is late, and ₹50,000 for inaccurate information left uncorrected or for failed due diligence.
What happened to section 194S and the 1961 Act's VDA rules?
They moved into the new Act. Under the Income Tax Act, 1961, the 1 percent TDS sat in s. 194S and the VDA definition in s. 2(47A). The 2025 Act repeals the 1961 Act (s. 536(1)) and from 1 April 2026 carries the TDS in s. 393(1), the 30 percent tax in s. 194(1) and the definition in s. 2(111), which includes the crypto asset limb (d). The Finance Act, 2026 text amends neither rate entry.
Who regulates crypto in India?
No single authority does. The work is split by function, and no function includes licensing an exchange:
- FIU-IND, for anti money laundering. Notification S.O. 4877(E) of 9 November 2023 named the Director of FIU-IND the regulator of VDA service providers, and the guidelines call FIU-IND their AML, CFT and CPF regulator (paras 1.2.3 and 1.2.5). Registration and reporting run under the Prevention of Money Laundering Act.
- The income tax authorities, for tax. They administer the 30 percent tax, the TDS and the s. 509 statement.
- FIU-IND again, for blocking. As nodal officer under s. 79(3)(b) of the Information Technology Act, 2000, the Director of FIU-IND sends takedown notices for the apps and URLs of non compliant platforms.
- The RBI, for banks. It does not license crypto platforms, and banks may run due diligence on crypto customers. In a speech of 12 December 2025, a deputy governor urged caution on stablecoins and described unbacked cryptocurrencies as merely speculative bets.
Day to day, a platform's compliance team answers to FIU-IND, which wants to see the AML systems working before it registers anyone. Crypto firms on complead, formerly Sanction Scanner, for crypto compliance run sanctions, wallet and name screening on one engine, and that screening is among the systems FIU-IND asks to see.
Does a crypto exchange need FIU-IND registration, even offshore?
Yes. Since notification S.O. 1072(E) of 7 March 2023, a business that carries out any of these five activities for or on behalf of another person is a reporting entity under the PMLA:
- exchange between VDAs and fiat currencies;
- exchange between one or more forms of VDAs;
- transfer of VDAs;
- safekeeping or administration of VDAs, or of instruments that give control over them;
- financial services linked to an issuer's offer and sale of a VDA.
A VDA service provider is India's term for a virtual asset service provider. Registration must come before the service (para 2.1(a)), and the duties apply "irrespective of their physical presence in India" (para 1.4). An offshore exchange with Indian users is in scope.
What registration takes:
- Documents at least 15 days ahead (para 2.3), so FIU-IND can examine the file before it invites the applicant to a meeting.
- Three financial years of company filings with the Ministry of Corporate Affairs (2.4(c)).
- Income tax returns and the TDS forms (2.4(e)), the tax side of the same file.
- A cyber security audit certificate from an auditor empaneled by India's Computer Emergency Response Team (2.4(j)).
- A Principal Officer working full time, based in India, with at least three years of relevant experience, and a different person from the Designated Director (3.2).
- An in person meeting, held to verify the compliance systems in place, which both must attend and where the live demonstration happens (2.5.1, 2.5.2).
What FIU-IND grants is registration as a reporting entity. No Indian law issues a license to run an exchange.
What do the FIU-IND guidelines of 8 January 2026 require?
They turn the PMLA duties into controls a platform runs and can show on request. Table 1 maps twelve of them to the paragraph behind each.
Table 1. What FIU-IND expects from a VDA service provider, as of November 2026 (guidelines updated as on 8 January 2026)
| Obligation | Para | What the team runs | What the file should show |
|---|---|---|---|
| Registration | 2.3 to 2.5 | Documents 15 days before an in person meeting with the Designated Director and Principal Officer | Company and tax filings, cyber audit certificate, a live walkthrough of the systems |
| CDD and PAN | 4.1.4, 4.2 | PAN check, selfie with liveness detection, onboarding coordinates and IP, penny drop | Verified PAN; IP, device, geo location and wallet addresses per client |
| KYC refresh | 4.5.2 | Update high risk files every six months, all others every year | Date of the last update per client; self declaration where nothing changed |
| Risk classification | 3.6.1(d), 3.6.2(c) | Review each account's risk class; repeat the risk assessment | Reviews at least every six months; assessments no more than a year apart |
| EDD | 4.4.2 | Enhanced measures for tax havens, FATF grey and black list countries, PEPs and non profits | The trigger and the extra checks on each such file |
| Sanctions screening | 5.4.1, 5.4.4 | Screen at onboarding, KYC change, list change and transaction start | A screening record per moment; no transfer completed before screening clears |
| Monitoring | 5.2.1, 2.5.2 | Transaction monitoring that identifies where a VDA came from and went; blockchain analytics tools | The same tools working in the registration walkthrough |
| Travel rule | 5.3.4 to 5.3.7 | Send originator and beneficiary data before or with the transfer; screen the other party | Data sent no later than the transfer; the counterparty screening result |
| Unhosted wallets | 7.2.1 | Compliance by the platform where the wallet is hosted | Originator, beneficiary and other relevant data obtained from the client |
| Anonymity enhancing tokens and mixers | 7.4, 7.5 | No deposits or withdrawals of such tokens; no mixer transactions | Blocked transactions and the risk measures each one triggered |
| STR and monthly report | 5.5.5, 5.7, 3.3(g) | STR regardless of amount; a monthly report | The Principal Officer's closure decision and reasons for not reporting |
| Records | 6.2 | Keep identity and transaction records | Kept five years past the relationship's end, or past each transaction; a tamper proof audit trail |
Monitoring is asked for twice. Para 5.2.1 wants transaction monitoring systems that can identify the origin and destination of a VDA, and para 2.5.2 puts those systems and blockchain analytics tools into the live walkthrough at registration.
Enhanced due diligence is mandatory for clients from countries designated as tax havens and from FATF grey and black list countries, for politically exposed persons and for non profit organizations (para 4.4.2). The Principal Officer decides every alert closure, and the reasons for not reporting must be recorded (para 3.3(g)). ICO and ITO activity is "strongly discouraged" (para 7.1.3).
How often must a crypto platform refresh KYC in India?
Every six months for clients assessed as high risk and every year for all others, measured from account opening or the most recent update (para 4.5.2). Where nothing has changed, the client signs a self declaration (4.5.3(a)). The file under review was built at onboarding from a verified PAN, a selfie with liveness detection, onboarding latitude and longitude with a time stamp and IP address, and a penny drop bank check (4.1.4, 4.2.1(d), 4.2.6). Risk class reviews also run at least every six months (3.6.2(c)). A client moved to high risk comes due sooner.
When must a crypto platform screen for sanctions?
At four moments at least: at onboarding, when KYC details change, when the sanctions lists change, and "at the time any VDA transaction is initiated" (para 5.4.1). No VDA transfer may complete without screening. The safeguard "may include putting a wallet on hold until screening is completed", or taking the transfer into the provider's own wallet and moving it to the client's wallet only once screening raises no concern (5.4.4).
Transfers to another platform add the travel rule. The originator's PAN, ID number, name, wallet, address and date of birth, with the beneficiary's name and wallet, go before or with the transfer, never after it (5.3.4, 5.3.5). Each side screens the other's customer against sanctions lists (5.3.7).
What happens to crypto exchanges that do not register?
On 9 September 2026, FIU-IND issued notices for non compliance under Section 13 of the PMLA to 15 VDA service providers, among them Weex, Blofin, DigiFinex, XT.com, WhiteBIT and ChangeNow. Its Director also sent takedown notices for their apps and URLs under s. 79(3)(b) of the Information Technology Act, 2000. The release does not call the 15 offshore and gives no registered count.
Non registration is deemed a violation of the PMLA and may invite action under Section 13(2) (para 2.1(b)). The third revision of the registration circular, dated 15 September 2025, treats a failure to register as a breach in itself.
Earlier rounds of notices were announced in government releases too. On 28 December 2023, FIU-IND sent show cause notices to nine offshore providers, Binance, KuCoin and Kraken among them, and asked for their URLs to be blocked; 31 VDA service providers had registered by then. On 1 October 2025, 25 more offshore providers received notices, including Huione, Paxful, Changelly and BingX, with takedown notices under the same s. 79(3)(b). That release counted 50.
Money penalties came by order: ₹18.82 crore for Binance (19 June 2024) and ₹9.27 crore for Bybit (31 January 2025), whose websites FIU-IND had blocked.
Coinbase India received a warning in an order dated 6 March 2025, which records that it had ceased its operations in India.
What are the new crypto rules in India in 2026?
Five dated items:
- 8 January. FIU-IND's VDA guidelines, updated as on this date, set the six month and yearly KYC refresh, screening when a transaction starts and the live demonstration at registration.
- 30 March. The Finance Act, 2026 receives assent; it rewrites s. 446 with the ₹200 a day and ₹50,000 penalties for the crypto asset statement.
- 1 April. The Income Tax Act, 2025 comes into force, with the 30 percent tax in s. 194 and the 1 percent TDS in s. 393.
- 9 September. Notices for non compliance and takedown notices for 15 platforms.
- 14 September. The OECD's updated list of CARF commitments shows India as not yet committed.
FIU-IND's home page carried no newer VDA notice when checked on 11 November 2026.
Will India pass a crypto law?
Not yet. As of November 2026, no law that licenses or bans crypto is in force. Every rule above comes from the tax law, the PMLA or, for takedowns, the Information Technology Act. The policy track is still open: press reports of 24 July 2026 say the Standing Committee on Finance, in a report presented on 23 July 2026, called for an appropriate regulatory framework for VDAs and an interim mechanism through recognized self regulatory organizations under a designated regulator.
Cross border tax reporting is the second track. The OECD's list of commitments to the crypto asset reporting framework (CARF), last updated on 14 September 2026, names India among four jurisdictions relevant to the CARF that have not yet committed, and a footnote to India's entry says it is in the process of making a political commitment. Dates for an Indian CARF exchange quoted in commentary are not on that list.
Until a law passes, the PMLA duties in Table 1 are what binds platforms. Three events would change this answer: the rules for the s. 509 statement, an Indian CARF commitment and a crypto bill in Parliament.
Back to the registration meeting. Under the January 2026 guidelines, the Designated Director and the Principal Officer attend, and the applicant shows its systems working. A platform that can pull up, for any client, the screening record for each of the four moments, the date of the last KYC update, the travel rule data sent with the transfer and the Principal Officer's reasons for each closed alert is ready for that walkthrough.
