India has quietly built one of the most structured anti-money laundering (AML) regimes for the crypto industry. Since March 2023, the country’s crypto exchanges and Virtual Digital Asset (VDA) platforms have been brought under the Prevention of Money-Laundering Act (PMLA), the same law that governs banks, brokers, and payment companies. In addition to further enhancing oversight, this move made it mandatory for any cryptocurrency exchange platform operating in India to register with the Financial Intelligence Unit – India (FIU-IND).
Crypto Comes Under PMLA
In 2023, the Ministry of Finance issued a notification that formally brought five categories of Virtual Digital Asset (VDA) activities under the PMLA.
- Exchange between virtual digital assets and fiat currencies,
- Exchange between one or more forms of virtual digital assets,
- Transfer of virtual digital assets,
- Safekeeping or administration of virtual digital assets or instruments enabling control over such assets; and
- Participation in and provision of financial services related to the offer or sale of virtual digital assets.
The above five categories of activities, when carried out in the course of business for or on behalf of another person, would trigger AML obligations under the Act.
By defining these activities, the government effectively placed crypto exchanges, wallet providers, and similar service providers within the same regulatory framework that applies to financial institutions. Any entity conducting these functions, regardless of whether it was incorporated in India or abroad, would now be treated as a reporting entity under Section 2(1)(wa) of the PMLA.
Why FIU-IND Matters
The Financial Intelligence Unit – India (FIU-IND) is India’s national agency that tracks and investigates suspicious financial activity. It is the nodal point for AML compliance, where banks, fintechs, and now crypto exchanges file reports on suspicious or high-value transactions. Under Rule 7(3) of the PMLA Rules, the FIU’s Director has the authority to issue detailed procedures for registering and monitoring reporting entities.
After the 2023 notification, FIU issued a circular in July 2023, later updated in September 2025, outlining exactly how crypto service providers must register and what they must demonstrate before approval.
Who Has to Register
Any business dealing in Virtual Digital Assets (VDAs) must register with the Financial Intelligence Unit India (FIU-IND) if it operates as a Virtual Digital Asset Service Provider. This covers companies that enable the buying, selling, or trading of crypto assets, hold or transfer digital assets on behalf of users, or provide services related to token issuance or sale.
The rule applies even if the platform is based outside India but serves Indian users through apps, websites, or marketing aimed at the Indian market.
Failing to register would be considered a breach of the Prevention of Money-Laundering Act (PMLA). The FIU is empowered to initiate strict action against non-compliant platforms, including financial penalties or blocking their access within India.
The Registration Process: Step by Step
Registering with FIU is a multi-layered due diligence process that tests both the company’s structure and its compliance systems.
Here’s what the process looks like:
Step 1: Online Application
Exchanges start by applying through FIU’s FINNet 2.0 portal. The system generates a provisional registration number, but this is just the beginning; full approval comes only after FIU’s scrutiny.
Step 2: Submit Detailed Documentation
Before FIU even schedules a meeting, exchanges must upload and share a full compliance pack that includes:
- Company incorporation papers and annual filings (last 3 years)
- Ownership and beneficial ownership details
- GST and income tax returns (last 3 years)
- Copies of contracts with custodians, liquidity partners, or third parties
- A signed declaration confirming no pending cases with enforcement agencies
- A filled-out AML/CFT questionnaire (FIU’s own form)
Step 3: Cybersecurity Audit
Every exchange must undergo a cybersecurity audit by a CERT-IN empanelled auditor. This ensures their IT systems comply with the cybersecurity rules issued by India’s Computer Emergency Response Team (CERT-IN).
Step 4: The In-Person Meeting
This is the most unique (and rigorous) part of the FIU process. The exchange’s Designated Director and Principal Officer must physically appear before FIU in New Delhi. They need to give a live demonstration of their AML and transaction monitoring systems, how user onboarding works, how suspicious transactions are flagged, how blockchain analytics and travel rule systems are integrated, and how reports are filed.
Step 5: FIU’s Approval
If everything (documents, controls, and tech) checks out, FIU grants in-principle approval, followed by a formal registration certificate signed by the Director of FIU-IND.
What Happens After Registration
Once a crypto exchange is registered with FIU-IND, it must operate under the same anti-money laundering (AML) standards that apply to banks and other financial institutions under the Prevention of Money-Laundering Act (PMLA). This means the exchange is required to verify customer identities through Know Your Customer (KYC) checks, apply Enhanced Due Diligence (EDD) for higher-risk users, and keep detailed records of all client transactions.
Registered platforms must also regularly submit Suspicious Transaction Reports (STRs) and Cash Transaction Reports (CTRs) to the FIU, appoint a Principal Officer and a Designated Director to oversee compliance, and ensure their teams are trained on AML responsibilities.
These are not one-time formalities. FIU-IND monitors compliance on an ongoing basis, and exchanges are expected to maintain robust internal systems that detect, report, and prevent financial crimes in real time.
What If an Exchange Doesn’t Register?
Failing to register with the Financial Intelligence Unit, India (FIU-IND), is a direct violation of the Prevention of Money-Laundering Act (PMLA). Under Section 13 of the Act, the FIU has wide powers to enforce compliance. It can demand information, issue corrective directions, impose monetary penalties, and even suspend or cancel an exchange’s registration.
In more serious cases, FIU-IND can refer matters to the Directorate of Enforcement (ED) for investigation under money laundering laws. Over the past year, the FIU has already sent show-cause notices to several offshore crypto exchanges and directed app stores and internet service providers to block access to platforms operating in India without registration. The message from regulators is clear: any exchange serving Indian users must be FIU-compliant, or risk losing access to the market entirely.
Who Is a Principal Officer under FIU-IND
A Principal Officer (PO) is a senior executive appointed by a reporting entity such as a crypto exchange to act as the primary liaison with the Financial Intelligence Unit – India (FIU-IND). This officer plays a central role in ensuring the organization’s compliance with anti-money laundering and counter-terrorist financing (AML/CFT) regulations. The Principal Officer is responsible for overseeing the exchange’s AML framework, ensuring timely submission of Suspicious Transaction Reports (STRs) and Cash Transaction Reports (CTRs), and coordinating directly with FIU-IND during audits or inspections.
Why It Matters
For crypto exchanges, FIU registration isn’t just another compliance checkbox. It is a gateway to legitimacy in India’s regulatory ecosystem. Registered platforms signal to regulators, banks, and users that they operate under Indian law, maintain transparent operations, and actively prevent misuse of virtual assets. For users, it means better accountability and reduced risk of dealing with unregulated offshore platforms that could disappear overnight.
Conclusion
For any crypto exchange serving Indian users, FIU-IND registration is not optional; it is a legal requirement and the cornerstone of lawful operation in India’s digital asset market. With the FIU stepping up enforcement and tightening oversight, compliance has become more than just a regulatory obligation; it is a matter of business survival and credibility in the Indian crypto ecosystem
FAQ
Why is FIU-IND registration mandatory for crypto exchanges in India?
FIU-IND registration is mandatory to ensure that crypto exchanges comply with India’s AML/CFT regulations and operate within the legal framework.
What are the key requirements for obtaining FIU registration?
Exchanges must submit corporate and ownership documents, undergo a cybersecurity audit, and demonstrate AML/CFT systems to FIU-IND.
What are the consequences of failing to register?
Failure to register exposes exchanges to financial penalties, suspension or blocking of access in India, and possible Enforcement Directorate action.
