Crypto Businesses as PMLA Reporting Entities: India’s 2026 Compliance Architecture for VDA Service Providers

India does not regulate anti-money-laundering risk in virtual digital assets merely by warning users about cryptocurrency. Since 7 March 2023, a business carrying on any of five specified virtual digital asset activities for or on behalf of another person in the course of business is a “person carrying on designated business or profession” and therefore a reporting entity under the Prevention of Money-Laundering Act, 2002. The classification carries enforceable duties of registration, customer and beneficial-owner identification, record keeping, transaction monitoring, reporting, sanctions screening, confidentiality and governance.

The legal trigger is activity, not a preferred business label

Central Government Notification S.O. 1072(E), dated 7 March 2023, was issued under Section 2(1)(sa)(vi) PMLA. It designates five activities:

exchange between virtual digital assets and fiat currencies;

exchange between one or more forms of virtual digital assets;

transfer of virtual digital assets;

safekeeping or administration of virtual digital assets or instruments enabling control over them; and

participation in, or provision of, financial services related to an issuer's offer and sale of a virtual digital asset.

Each activity is covered when carried on for or on behalf of another natural or legal person in the course of business. The operative inquiry is therefore functional. An exchange, broker, custodian, transfer service, wallet-control provider, token-offer service provider or another intermediary cannot avoid the regime merely by calling itself a technology company. Conversely, software publication or a person's transaction solely on his or her own account is not automatically within the notification; the facts must satisfy the service, agency and business elements.

The notification adopts the definition of “virtual digital asset” in Section 2(47A) of the Income-tax Act, 1961. That definition is broad, but statutory exclusions and notifications must be checked. The PMLA classification does not by itself declare a VDA legal tender, create a general exchange licence, determine whether a token is a security, or settle tax treatment. AML registration is not a representation by the State that a product is otherwise lawful.

Domestic and offshore reach

FIU-IND's current guidance applies the regime to service providers operating in or from India. A foreign incorporation, overseas server or absence of a physical Indian office does not by itself answer whether the business is serving the Indian market. Customer access, India-facing solicitation, rupee rails, local distribution, transaction flows, personnel and the actual provision of a covered service are material.

An offshore provider should conduct a documented Indian-nexus assessment before onboarding Indian users. Restricting a website in theory while continuing India-directed marketing or facilitating Indian transactions creates a mismatch between policy and conduct. Where the covered nexus exists, the provider should follow the FIU-IND registration process instead of treating overseas regulation as a substitute.

Registration with FIU-IND

Registration is through FIU-IND and the FINnet framework under the current registration circular. FIU-IND's third revised circular dated 15 September 2025 and the Updated AML and CFT Guidelines dated 8 January 2026 are the current operational materials. An applicant should use those versions, not an archived 2023 checklist.

Registration is not a one-time upload. FIU-IND may examine the ownership chain, key managerial persons, business model, products, geographies, transaction systems, AML controls and the capacity to furnish prescribed reports. Material changes in control, management, services or compliance appointments should be evaluated for notification or updated filing under the current directions.

The Designated Director and Principal Officer

The statutory governance roles are different. Under the Prevention of Money-laundering (Maintenance of Records) Rules, 2005, the Designated Director is the person designated to ensure overall Chapter IV compliance. For a company, the role is ordinarily the managing director or a whole-time director duly authorised by the board; corresponding rules identify the appropriate person for other organisational forms.

The Principal Officer must be a management-level officer. The reporting entity communicates the prescribed particulars of both roles to FIU-IND. The Principal Officer is responsible for furnishing information, but delegation does not remove the reporting entity's or senior management's obligation to resource and supervise the programme. Independence, direct escalation, access to records and sufficient authority are practical necessities.

Enterprise risk assessment and internal controls

Rule 9 requires a documented, current assessment of risks relating to clients, countries and geographical areas, products, services, transactions and delivery channels. A VDA service provider should translate that requirement into a risk methodology specific to its operation: token features, privacy-enhancing technology, cross-chain bridges, decentralised-finance exposure, peer-to-peer flows, self-hosted wallets, high-risk jurisdictions, sanctions exposure, account takeover, fraud typologies and the speed and irreversibility of transfers.

Controls should be proportionate to assessed risk and approved by senior management. They ordinarily include customer acceptance standards, customer due diligence, enhanced due diligence, transaction monitoring, sanctions and proliferation-financing controls, suspicious-transaction escalation, record preservation, employee screening and training, quality assurance, independent testing and remediation tracking. A blockchain analytics score is an input, not a legal conclusion. Off-chain information and the customer's profile remain essential.

Customer and beneficial-owner due diligence

Sections 11A and 12 PMLA and Rule 9 require identification of clients and beneficial owners using reliable, independent sources, an understanding of the purpose and intended nature of the relationship, and reasonable steps to understand the customer's business, ownership and control. The current Rules generally use a threshold of more than ten per cent for controlling ownership in companies and partnerships, while control through other means remains relevant even below that percentage.

Due diligence must occur at commencement of an account-based relationship and in the other circumstances prescribed by Rule 9. It is not completed merely by collecting a PAN or identity image. The provider must test authenticity, identify the natural person behind a legal arrangement, screen relevant persons, understand expected activity and investigate inconsistencies. Enhanced measures are required for higher-risk relationships and specified transactions. If required conditions cannot be fulfilled, the provider must apply the statutory and rule-based consequences rather than permit anonymity by default.

Ongoing monitoring and suspicious transaction reporting

Section 12 requires records that permit reconstruction of individual transactions and requires prescribed information about attempted as well as executed transactions to be furnished to the Director, FIU-IND. Under Rule 8, once the Principal Officer is satisfied that a transaction is suspicious, it must be reported promptly and no later than seven working days. Suspicion reporting has no minimum value threshold.

Potential indicators include rapid movement through multiple assets or chains without an economic explanation, use of mixers or obfuscation services, exposure to sanctioned or illicit addresses, mule-account patterns, unusual fiat cash-out, repeated structuring, implausible source of funds, fraud proceeds, darknet exposure and activity inconsistent with the known business. Indicators require analysis; they are not automatic proof of money laundering.

The fact that an STR is maintained or furnished must remain confidential. Employees must avoid tipping off the customer. Section 14 protects a reporting entity, its directors and employees from civil or criminal proceedings for furnishing information under Section 12(1)(b), subject to the statutory terms. That good-faith reporting protection does not excuse negligent controls or disclosure of confidential reporting activity.

The Travel Rule

Paragraph 5.3 of FIU-IND's 8 January 2026 Guidelines applies the Travel Rule to VDA transfers. An originating reporting entity must undertake customer due diligence and sanctions screening and ensure that required, accurate originator information and required beneficiary information accompany the transfer or related message. The beneficiary institution must be able to receive, retain and use that information. Transfers missing required information must be detected and handled through risk-based controls.

The information must be transmitted before, simultaneously with or concurrently with the transfer; post-facto submission is not permitted. The technological arrangement must transmit and store it securely and permit prompt access by competent authorities. The guidance recognises a self-declaration mechanism only in exceptional cases where the technology cannot feasibly be deployed. That is not a general exemption from counterparty and wallet-risk assessment.

Records and data governance

Transaction records must be preserved for five years from the transaction date. Identity records, account files and business correspondence must be preserved for five years after the relationship ends or the account closes, whichever is later. Enhanced-due-diligence information has its own five-year rule under Section 12AA. Records should preserve the data necessary to reconstruct the transaction, including parties, nature, amount, asset, date, wallet identifiers and related analysis.

Because compliance files contain identity, wallet and behavioural data, access controls, encryption, retention schedules, audit trails and breach response are indispensable. PMLA confidentiality is not permission to collect unlimited data indefinitely. The provider must reconcile mandatory retention and disclosure with applicable privacy and cybersecurity duties.

Enforcement and remedies

Under Section 13, the Director may inquire into Chapter IV compliance and may require a special audit in the circumstances stated by the Act. Upon finding a failure, the Director may issue a written warning, direct compliance with specific instructions, require periodic reports, or impose a monetary penalty of not less than ₹10,000 and up to ₹1 lakh for each failure. “Each failure” makes repeated or systemic defects potentially significant.

A reporting entity aggrieved by a Section 13(2) order may appeal to the Appellate Tribunal under Section 26. Non-payment can lead to recovery under Section 69. Separate facts may also expose persons to action under other laws; FIU registration does not displace tax, foreign-exchange, consumer, information-technology, sanctions or criminal-law obligations.

Judicial position and its limits

No located Supreme Court or High Court merits judgment, as of 5 September 2026, supplies a comprehensive interpretation of the five activities designated by the 7 March 2023 notification or of FIU-IND's 2026 VDA Guidelines. The governing propositions in this field therefore come principally from the PMLA, the 2005 Rules, the notification and current FIU-IND directions. It would be misleading to attach an unrelated PMLA precedent merely to give the subject a judicial appearance.

Internet and Mobile Association of India v Reserve Bank of India, (2020) 10 SCC 274, concerned the proportionality of the RBI circular dated 6 April 2018 restricting regulated entities from dealing in virtual currencies. It predates the 2023 PMLA notification and does not invalidate or dilute present reporting-entity obligations. It also does not establish a general right to conduct every VDA business free from later statutory regulation.

Practical compliance sequence

A VDA business should first map each product and flow against the five notified activities and record its India nexus. It should then complete FIU-IND registration under the current circular, formally appoint and empower its Designated Director and Principal Officer, approve an enterprise risk assessment and client-due-diligence programme, and test its transaction-monitoring and Travel Rule systems before scale.

The programme must be operational rather than documentary. Management should receive meaningful risk and STR metrics; investigators should record why alerts were closed; wallet and counterparty controls should be tested; sanctions lists and risk intelligence should be updated; outsourcing should be governed by audit and access rights; and deficiencies should have owners and deadlines. Reliance on a vendor does not transfer the statutory responsibility of the reporting entity.

Conclusion

India's VDA AML framework is an activity-based reporting regime. The decisive questions are what service is performed, for whom, in what commercial setting and with what Indian nexus. Once within the notification, the business assumes the full architecture of Chapter IV PMLA and the Maintenance of Records Rules, supplemented by FIU-IND's current registration circular and 2026 Guidelines. Registration is only the entrance; defensible identity, monitoring, Travel Rule, reporting, confidentiality and governance systems are the continuing obligation.

Sources

Central Government Notification S.O. 1072(E), dated 7 March 2023, issued under Section 2(1)(sa)(vi) PMLA: https://egazette.nic.in/WriteReadData/2023/244184.pdf

Financial Intelligence Unit–India, AML and CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets, updated 8 January 2026: https://fiuindia.gov.in/pdfs/downloads/VDA08012026.pdf

Financial Intelligence Unit–India, Third Revision of Circular for Registration of Virtual Digital Asset Service Providers as Reporting Entities, dated 15 September 2025: https://fiuindia.gov.in/pdfs/downloads/VDASP15092025.pdf

Prevention of Money-Laundering Act, 2002, Sections 2, 11A, 12, 12A, 12AA, 13, 14, 26 and 69: https://www.indiacode.nic.in/handle/123456789/15402

Prevention of Money-laundering (Maintenance of Records) Rules, 2005, as amended: https://fiuindia.gov.in/files/AML_Legislation/notification.html

Supreme Court of India, Internet and Mobile Association of India v Reserve Bank of India, Writ Petition (Civil) No. 528 of 2018, judgment dated 4 March 2020, (2020) 10 SCC 274: https://api.sci.gov.in/supremecourt/2018/19230/19230_2018_4_1501_21151_Judgement_04-Mar-2020.pdf

This article provides general information and does not constitute legal advice. Regulatory classification and compliance obligations should be assessed against the current business model and official directions.

#PMLA #VirtualDigitalAssets #CryptoCompliance