India has made it harder for cryptocurrency platforms to follow the rules by requiring live identity verification and more customer data collection. These new rules went into effect on January 8. The changes formally classify crypto exchanges as Virtual Digital Asset (VDA) service providers and place them under enhanced Anti-Money Laundering and Know Your Customer obligations.
The updated framework requires platforms to move beyond static document uploads during onboarding. Reporting entities must now conduct live identity verification and apply stronger Client Due Diligence processes. Regulators cited the speed and pseudonymous nature of crypto transactions as factors that increase the risk of money laundering, terror financing, and proliferation financing if left unchecked.
Under the new rules, exchanges must identify customers through reliable and independent sources while collecting a broader range of technical identifiers. These include IP addresses with timestamps, geolocation data, device identifiers, wallet addresses, and transaction hashes. Authorities said the data would support verification, monitoring, and risk assessment efforts.
Live selfie checks and expanded KYC requirements
According to a report by The Times of India, crypto platforms must now verify users through live selfie images that confirm physical presence. The verification software tracks eye blinking or head movement to prevent the use of static or deepfaked images during onboarding.
Users must submit additional government-issued photo identification, such as a passport, Aadhaar card, or voter ID. Platforms must also verify registered email addresses and mobile phone numbers through one-time password authentication.
Permanent Account Number verification has become mandatory before any VDA-related activity. Exchanges must collect and validate PAN details for all users, without exception. Bank account verification has also tightened, with platforms required to use a “penny-drop” mechanism to confirm ownership and operational status of linked accounts.
At the time of registration, exchanges must capture IP address data, geolocation details, timestamps, and device information. The guidelines also require exchanges to update KYC records every six months for high-risk users and once a year for all other customers.
Industry reaction highlights reduced ambiguity
Industry participants largely welcomed the revised framework. Nischal Shetty, founder of WazirX, said that measures such as selfie-based verification and penny-drop checks were already standard at major exchanges.
He added that the updated guidelines remove ambiguity and reduce the risk of uneven enforcement across platforms. The clearer framework also sets consistent expectations for both domestic and offshore exchanges operating in the Indian market.
India’s Financial Intelligence Unit has steadily pushed toward mandatory registration and compliance since categorizing VDA service providers under the Prevention of Money Laundering Act in March 2023. During the 2024–25 period, 49 entities registered as reporting institutions, including 45 domestic platforms and four offshore exchanges such as Binance, Coinbase, and KuCoin, which re-entered the market after completing compliance procedures.
Security breaches shape regulatory response
The tighter onboarding and monitoring requirements follow major security incidents that affected two of India’s largest crypto exchanges. In 2024, WazirX lost approximately $235 million worth of cryptocurrencies in a breach that severely disrupted operations and resulted in a court-monitored recovery plan.
In 2025, CoinDCX suffered a $44 million hack that targeted an internal operational wallet used for liquidity on a partner exchange. Although customer cold wallets were not compromised, the incident intensified concerns around platform risk and internal controls.
These early experiences exposed weaknesses in exchange security and oversight, reinforcing regulators’ view that stronger preventive measures are necessary at the onboarding stage.
FIU discourages ICOs and privacy-focused tools
The FIU also addressed fundraising activity under the new framework. Regulators said the measures are designed to “strongly discourage” Initial Coin Offerings and Initial Token Offerings, citing concerns over economic rationale, disclosure standards, and risk mitigation.
Enhanced due diligence is now mandatory for high-risk transactions, politically exposed persons, non-profit organizations, and clients linked to jurisdictions listed by the Financial Action Task Force as grey or blacklisted.
Exchanges must deploy systems to detect mixers, tumblers, and other anonymity-enhancing services and block transactions where identified. The FIU reiterated its opposition to privacy coins and obfuscation tools designed to conceal transaction histories.
Customer identity and transaction records must be retained for at least five years or until the conclusion of any investigation.
Tax authorities renew concerns over crypto activity
India’s tax authorities have also raised alarms over digital asset usage. Officials from the Income Tax Department told a parliamentary standing committee on finance that cryptocurrencies and decentralized finance platforms undermine tax enforcement.
The officials argued that decentralized exchanges, anonymous wallets, and cross-border transactions complicate taxation efforts. Under India’s Income Tax Act, gains from cryptocurrency sales face a flat 30% tax, with deductions limited to cost basis. Loss offsets are not permitted.
Despite India’s large potential crypto market, key institutions such as the Reserve Bank of India continue to classify cryptocurrencies as high-risk assets for financial stability.
Gunel Ismayilova
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that despite the nature of much of the material created and hosted on this website, HODL FM is not a financial reference resource, and the opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice. HODL FM strongly recommends contacting a qualified industry professional.
