Apply for AI Grants India

India’s crypto policy is best understood as a compliance framework built from several sources—not as one comprehensive cryptocurrency statute. The term “crypto” commonly covers virtual digital assets (VDAs), including cryptocurrencies, tokens and certain NFTs, while the legal treatment of each activity can differ. Tax rules, anti-money-laundering obligations, advertising standards, foreign-exchange controls and existing financial laws all matter.

For Indian investors and Web3 companies, the practical question is not simply whether crypto is legal or illegal. It is whether a transaction, platform or business model complies with the applicable tax, reporting, customer-due-diligence and regulatory requirements. This guide explains the current India crypto regulation landscape, its major obligations and the compliance steps businesses should consider.

What Is India Crypto Regulation?

India crypto regulation is a combination of statutes, rules, tax provisions, regulatory guidance and enforcement actions that affect VDAs and digital-asset businesses. Unlike jurisdictions with a single crypto licensing code, India has taken a cautious, risk-based approach.

The framework typically affects:

• Taxation: Income from VDA transfers is taxed under a special regime.
• Anti-money laundering: Covered VDA service providers must comply with the Prevention of Money Laundering Act (PMLA) framework.
• Financial regulation: Activities involving payment systems, deposits, securities or investment products may trigger additional rules.
• Foreign exchange: Cross-border transactions can raise issues under the Foreign Exchange Management Act (FEMA).
• Consumer and advertising law: Promotions must not be misleading or conceal material risk.
• Data and cybersecurity: Platforms handling identity and transaction information need strong privacy and security controls.

The legal classification of a token depends on its design and use. A token that represents an investment, a claim, a payment function, access to a service or ownership of an asset may create different legal questions.

Is Cryptocurrency Legal in India?

Cryptocurrency is not banned outright in India, but it is not recognised as legal tender. The Indian rupee remains the country’s sovereign currency, and private crypto-assets do not have the same status as money issued or authorised by the Reserve Bank of India (RBI).

This distinction is important. People may hold or transfer crypto-assets subject to applicable law, but that does not mean every crypto-related activity is permitted, regulated as a bank-like service or protected by government-backed deposit insurance.

Crypto businesses also cannot assume that the absence of a dedicated licensing regime means they have no obligations. An exchange, custodian, broker, wallet provider or VDA service may be subject to PMLA registration and reporting requirements, tax obligations, consumer-protection rules and other sector-specific laws.

VDA Tax Rules in India

India introduced a special tax framework for income from VDAs. Key features include:

• Income from transferring a VDA is generally taxed at a flat 30% rate, plus applicable surcharge and cess.
• Only the cost of acquisition is generally permitted as a deduction when computing taxable VDA income.
• Losses from VDA transfers generally cannot be set off against other income or carried forward for adjustment against future VDA income.
• A 1% tax deducted at source (TDS) may apply to consideration for transfers of VDAs, subject to statutory thresholds and conditions.

The tax treatment can apply whether the asset is a major cryptocurrency, an altcoin, a stablecoin or another asset falling within the VDA definition. Taxpayers should maintain records for every transaction, including purchase price, sale value, fees, wallet addresses, dates, exchange statements and rupee conversion methodology.

How Crypto Income May Be Reported

Tax treatment can depend on the nature of the activity. For example:

• Investment or trading: Gains from transfers may fall under the VDA tax regime.
• Mining or validation: The tax position may depend on how the activity is organised and how rewards are received.
• Airdrops: Receipt and subsequent transfer can create separate tax questions.
• Staking rewards: Timing, valuation and characterisation should be analysed carefully.
• Crypto received for services: It may first be treated as business or professional income, followed by VDA consequences on a later transfer.
• NFT sales: The asset may qualify as a VDA, but the underlying transaction and the seller’s business model remain relevant.

Because Indian tax treatment can vary by facts, founders and high-volume traders should obtain advice from a qualified tax professional rather than rely on exchange-generated summaries alone.

PMLA and AML Compliance for Crypto Businesses

The Indian government brought specified VDA-related activities within the PMLA framework. Covered reporting entities generally include businesses involved in activities such as:

• Exchange between VDAs and fiat currencies;
• Exchange between one or more forms of VDAs;
• Transfer of VDAs;
• Safekeeping or administration of VDAs or instruments enabling control over VDAs; and
• Participation in financial services connected with an issuer’s offer or sale of a VDA.

A covered entity must typically implement a risk-based anti-money-laundering programme. Core controls may include:

• Customer identification and verification;
• Beneficial-owner identification for companies and other legal persons;
• Customer risk classification;
• Transaction monitoring and blockchain analytics;
• Screening against sanctions and politically exposed person lists;
• Suspicious transaction reporting;
• Record retention;
• Internal escalation and investigation procedures; and
• Appointment of appropriate compliance and reporting personnel.

Registration with the Financial Intelligence Unit–India (FIU-IND) is a central operational requirement for covered VDA service providers. Registration is not a substitute for compliance: businesses must also maintain policies, systems, audit trails and evidence that controls operate effectively.

FIU-IND Registration and Offshore Platforms

The FIU-IND has taken enforcement action against offshore VDA platforms serving Indian users without meeting applicable AML obligations. This signals that a company’s incorporation outside India does not automatically remove Indian compliance exposure.

An offshore platform should assess factors such as:

• Whether it actively solicits Indian residents;
• Whether it provides services to Indian customers;
• Whether its website, app or support operations target India;
• Where customer onboarding and transaction activity occur;
• Whether it has Indian agents, employees or vendors; and
• Whether its activities fall within the PMLA definition of a reporting entity.

Potential consequences of non-compliance can include restrictions on access, penalties, investigation, reputational damage and disruption to banking or payment relationships. Web3 founders should obtain a formal India nexus analysis before launching a product targeted at Indian users.

RBI’s Position and Payment-System Risk

The RBI has consistently raised concerns about private crypto-assets, including volatility, consumer protection, monetary sovereignty, illicit-finance risks and financial stability. Crypto-assets are not the same as RBI-regulated payment instruments, bank deposits or central bank money.

A crypto business must be especially careful if its product involves:

• Wallet balances presented like deposits;
• Lending or yield products;
• Payment processing or merchant settlement;
• Stablecoin-based remittance;
• Custody of customer funds;
• Peer-to-peer money movement; or
• Claims that users can redeem assets at par with the rupee.

These features may create regulatory questions beyond VDA taxation and AML. Depending on the structure, laws and rules concerning payment systems, banking, lending, deposits, securities or foreign exchange may become relevant. Product design should therefore begin with a legal classification review, not only a technical architecture review.

Crypto, FEMA and Cross-Border Transactions

Indian residents engaging with overseas exchanges, decentralised protocols or foreign token issuers may encounter FEMA-related issues. Cross-border crypto transactions can involve questions about:

• Whether the transfer is a permissible current or capital account transaction;
• How the transaction is valued in foreign currency;
• Whether overseas holdings or income must be disclosed;
• Whether tax and reporting obligations arise in India;
• Whether an Indian company is paying a foreign vendor or receiving overseas funding; and
• Whether the structure resembles a prohibited remittance or an unregulated financial product.

There is no universal compliance answer for every wallet transfer. The facts, counterparties, asset type, purpose, payment route and residency of the parties matter. Indian startups raising capital through tokens or providing services to global protocols should document their flow of funds and seek FEMA advice before execution.

Advertising and Consumer Protection

Crypto promotions can create substantial legal and reputational risk. Advertising should present volatility, liquidity, technology and counterparty risks clearly. Businesses should not imply guaranteed returns, risk-free income, government endorsement or assured liquidity unless they can substantiate those claims and the representation is legally permissible.

A compliant marketing review should check:

• Claims about returns or performance;
• Risk disclosures and their visibility;
• Influencer and affiliate relationships;
• Statements about regulation or licensing;
• Use of terms such as “safe,” “guaranteed” or “approved”;
• Targeting of inexperienced users; and
• Consistency between marketing material and actual product functionality.

Platforms should also maintain a complaint-handling process and transparent terms covering custody, fees, withdrawals, account restrictions, asset risks and dispute resolution.

Data Protection and Cybersecurity for VDA Platforms

Crypto platforms process sensitive identity and financial information. A robust compliance programme should align privacy, security and AML processes rather than treating them as separate projects.

Important controls include:

• Data minimisation during onboarding;
• Encryption in transit and at rest;
• Hardware security modules or equivalent key-management controls;
• Multi-factor authentication;
• Privileged-access management;
• Withdrawal address controls and cooling periods for high-risk activity;
• Incident response and breach notification procedures;
• Vendor and cloud-risk assessments;
• Segregation of customer assets where applicable; and
• Immutable audit logs for administrative and transaction activity.

Businesses must also evaluate obligations under India’s digital personal data framework and applicable sectoral guidance. A privacy notice should explain what is collected, why it is processed, retention periods, disclosures and user rights in clear language.

Compliance Checklist for Indian Crypto Startups

Before launching or expanding a VDA product in India, founders should prepare a written compliance plan covering:

1. Business classification: Define whether the company is an exchange, broker, custodian, wallet, protocol, analytics provider, token issuer or software vendor.
2. User and geography scope: Identify Indian residents, foreign users, restricted jurisdictions and the basis for geoblocking.
3. Token analysis: Document the token’s rights, utility, governance, redemption features and economic design.
4. PMLA assessment: Determine whether the activity is covered and whether FIU-IND registration or reporting controls are required.
5. KYC/AML operating model: Select vendors, define risk tiers and establish escalation thresholds.
6. Tax operations: Build transaction-level records, TDS workflows where applicable and customer tax statements.
7. Funds and custody: Document wallet architecture, key custody, segregation and reconciliation.
8. FEMA review: Analyse foreign investment, cross-border payments, offshore users and token-based compensation.
9. Marketing controls: Approve campaigns, influencer scripts, risk language and performance claims.
10. Security and incident response: Test smart contracts, conduct penetration testing and rehearse breach scenarios.
11. Governance: Assign accountable owners, maintain board oversight and conduct periodic independent reviews.

What Investors and Traders Should Do

Individual users should maintain complete records rather than relying solely on an exchange. Export trade histories regularly, preserve deposit and withdrawal evidence, record wallet transfers and reconcile the 1% TDS reflected in transaction documentation where applicable.

Before using a platform, check whether it clearly identifies its operating entity, customer-support process, custody model, withdrawal terms and compliance status. Avoid assuming that app availability, social-media popularity or incorporation overseas means the platform is authorised or protected in India.

Investors should also distinguish between:

• Holding an asset and operating a customer-facing exchange;
• Buying a token and soliciting public investment;
• Software development and providing custody;
• A decentralised protocol’s code and the activities of an identifiable operator; and
• Technical access from India and legally targeting Indian residents.

These distinctions do not eliminate risk, but they help identify the right legal questions.

Future Direction of India Crypto Regulation

India’s regulatory direction is likely to remain coordinated across taxation, AML, consumer protection, financial regulation and international cooperation. The country has participated in global discussions on crypto-asset reporting and financial integrity, while domestic authorities continue to assess risks associated with private digital assets.

The most important trend for businesses is that compliance expectations are becoming operational. Regulators and enforcement agencies are increasingly focused on customer onboarding, transaction monitoring, beneficial ownership, advertising, offshore access and evidence of controls—not merely on whether a company has written policies.

Crypto founders should design for regulatory change by using modular systems, maintaining detailed records, monitoring official notifications and avoiding product claims that depend on legal uncertainty. A conservative launch plan is usually less expensive than rebuilding onboarding, custody and reporting systems after enforcement action.

Frequently Asked Questions About India Crypto Regulation

Is crypto banned in India?

No blanket ban currently makes all cryptocurrency ownership illegal, but crypto is not legal tender and activities involving VDAs remain subject to tax, AML and other legal requirements.

What tax applies to crypto in India?

Income from qualifying VDA transfers is generally taxed at 30%, plus applicable surcharge and cess. A 1% TDS regime may also apply to qualifying transfers, subject to statutory conditions.

Do crypto exchanges need FIU-IND registration?

A VDA service provider carrying out activities covered by the PMLA framework may need to register with the FIU-IND and comply with KYC, AML, record-keeping and suspicious-transaction reporting obligations.

Can Indian residents use overseas crypto exchanges?

Access to an overseas platform does not automatically resolve Indian tax, AML or FEMA issues. Users and businesses should assess the platform, transaction type, fund flow and reporting obligations.

Is crypto regulated by the RBI?

Private crypto-assets are not equivalent to RBI-regulated money or payment instruments. RBI concerns are particularly relevant where a product involves payments, deposits, lending, redemption or financial intermediation.

Apply for AI Grants India

Building compliance, fraud detection, blockchain analytics or responsible-finance technology for India’s digital-asset ecosystem? Apply to AI Grants India for support and opportunities designed for Indian AI founders.