India’s crypto regulatory norms are best understood as a developing compliance framework, not as one standalone cryptocurrency law. Virtual digital assets (VDAs), including many cryptocurrencies and NFTs, are subject to tax rules, anti-money-laundering obligations and financial-reporting requirements. At the same time, India has not generally granted cryptocurrencies legal-tender status, and the regulatory treatment of a particular token can depend on its design, use and activities around it.
For founders, exchanges, investors and Web3 teams, the practical question is not simply whether crypto is “legal” or “illegal.” It is whether the activity is permitted, what taxes apply, whether the business falls within the Financial Intelligence Unit–India (FIU-IND) framework, and whether additional rules apply because the token or service resembles a security, payment instrument, lending product or regulated financial service.
What are India crypto regulatory norms?
India’s crypto regulatory norms currently come from several sources:
- Income-tax provisions governing income from VDAs, withholding tax and transaction reporting.
- Prevention of Money Laundering Act (PMLA) obligations for covered VDA service providers.
- FIU-IND compliance requirements for businesses that provide specified VDA-related services in India.
- Company, consumer-protection, advertising and data-protection requirements that may apply to the operating model.
- Sectoral regulation, where the activity overlaps with securities, payments, banking, lending, investment advice or other regulated functions.
- Foreign-exchange and cross-border rules, which may become relevant when funds, services or entities move across jurisdictions.
This layered model means compliance must be assessed by activity, entity structure, customer location, token features and flow of funds—not only by the name attached to the asset.
Are cryptocurrencies legal in India?
Cryptocurrencies are not generally recognised as legal tender in India. The Indian rupee remains the country’s sovereign currency, and private cryptoassets do not have the same status as money issued or authorised by the Reserve Bank of India (RBI).
However, the absence of legal-tender status does not mean that every crypto-related activity is automatically prohibited. India permits taxation and imposes compliance duties on defined VDA activities, which demonstrates that the legal position is more nuanced. A business may be able to operate if it satisfies applicable registration, AML, tax, corporate, consumer and reporting requirements.
The risk profile changes substantially where a project:
- Represents ownership, debt, profit participation or an investment contract.
- Offers custody, exchange, transfer or brokerage services.
- Accepts customer funds or promises returns.
- Provides lending, derivatives, leverage or pooled investment products.
- Markets tokens to retail users with misleading claims.
- Serves Indian residents from an offshore entity without addressing Indian obligations.
Before launch, founders should obtain a written legal classification of both the token and each product feature.
VDA definition and scope
For Indian income-tax purposes, a VDA broadly covers information, code, numbers or tokens generated through cryptographic means or otherwise representing digital value, exchanged with or without consideration, and capable of being transferred, stored or traded electronically. The definition also covers non-fungible tokens and other notified digital assets, subject to statutory exclusions.
The scope can include cryptocurrencies, utility tokens, certain stablecoins, NFTs and other blockchain-based assets. But classification is not always obvious. A token may be a VDA for tax purposes while also raising separate questions under securities, payments or consumer laws.
Businesses should document:
- The token’s rights and technical functions.
- Whether it provides governance, access, rewards or financial returns.
- How it is issued, marketed and traded.
- Whether it is redeemable or linked to fiat or another asset.
- Who controls wallets, smart contracts and customer assets.
- The jurisdictions in which users and service providers are located.
Crypto taxation in India
Tax on VDA income
Section 115BBH of the Income-tax Act applies a 30% tax rate to income from the transfer of a VDA, subject to statutory provisions. The rate is applied without the usual benefit of lower rates for different holding periods.
A critical feature is that only the cost of acquisition is generally permitted as a deduction. Expenses such as platform fees, infrastructure costs, marketing expenditure or interest may not be deductible against VDA transfer income in the same way as business expenses. Losses from VDA transfers generally cannot be set off against other income or carried forward under the specific VDA regime.
Tax treatment can vary depending on whether the transaction is a transfer, airdrop, mining or staking reward, employment-related token allocation, business receipt or another taxable event. Professional advice is important where tokens are received other than through a straightforward purchase.
One per cent TDS under Section 194S
Section 194S generally requires 1% tax deducted at source on consideration paid for the transfer of a VDA, subject to applicable thresholds and exceptions. The rule can create operational complexity for exchanges, peer-to-peer transactions, brokers and payment flows involving multiple parties.
Platforms should build systems to:
- Identify when a transaction constitutes a VDA transfer.
- Determine who bears the TDS obligation.
- Apply thresholds and exemptions correctly.
- Calculate TDS where consideration is partly in crypto.
- Deposit tax within prescribed timelines.
- File statements and issue certificates or records where required.
- Reconcile wallet, fiat and exchange records.
Incorrect TDS handling can create interest, penalty, reconciliation and customer-service problems even when the underlying trade was legitimate.
GST and indirect-tax questions
GST treatment depends on the precise supply, consideration, platform role and transaction structure. Questions may arise around exchange fees, brokerage, custody, software subscriptions, advertising, token sales and cross-border digital services. There is no single GST answer for every crypto model.
A business should map each revenue stream separately rather than treating all token-related income as one category. It should also review place-of-supply rules, invoicing, registration thresholds, export treatment and whether a customer is a business or consumer.
FIU-IND and anti-money-laundering compliance
India extended PMLA obligations to specified VDA service activities. In practical terms, covered businesses may include entities involved in exchange between VDAs and fiat currencies, exchange between different VDAs, transfer of VDAs, safekeeping or administration of VDAs or related instruments, and participation in the provision or sale of VDAs.
A covered entity generally needs to register with FIU-IND as a reporting entity and maintain an effective AML and counter-terrorist-financing programme. Registration is not a blanket licence or government endorsement; it is a compliance obligation that enables supervisory and reporting oversight.
Core controls typically include:
- Customer identification and KYC verification.
- Beneficial-owner identification for entities.
- Customer risk classification.
- Enhanced due diligence for high-risk customers and transactions.
- Transaction monitoring and unusual-activity detection.
- Record retention and audit trails.
- Suspicious transaction reporting to FIU-IND where required.
- Appointment of a principal officer and designated compliance responsibilities.
- Written policies, employee training and periodic testing.
- Controls for sanctions, politically exposed persons and adverse media.
Businesses should not rely on a one-time KYC check. Wallet behaviour, transaction history, geography, source of funds and product risk should inform ongoing monitoring.
FIU registration: practical preparation checklist
Before applying or commencing covered operations, a VDA business should prepare:
1. Corporate records: incorporation documents, ownership structure, directors and authorised representatives.
2. Business description: products, token types, customer segments, jurisdictions and transaction flows.
3. AML policy: customer acceptance, KYC, risk scoring, enhanced due diligence and escalation rules.
4. Technology evidence: transaction monitoring, wallet screening, case management and audit-log capabilities.
5. Governance documents: principal officer appointment, board approvals and reporting lines.
6. Record-keeping process: retention schedules for identity, transaction and communication records.
7. Incident procedures: fraud, account takeover, sanctions hits, suspicious activity and data breaches.
8. Vendor controls: due diligence over KYC providers, blockchain analytics firms, custodians and cloud providers.
An offshore incorporation does not automatically eliminate Indian obligations. If the business targets Indian users or carries on covered activity in India, it should assess territorial scope and enforcement exposure with specialist counsel.
RBI position and banking considerations
The RBI has historically expressed concerns about consumer protection, monetary stability, money laundering and financial-system risks associated with private cryptoassets. Cryptoassets should not be represented as RBI-approved money, deposits or investments unless a specific regulated product genuinely has that approval.
Banks and payment providers may apply their own risk policies, onboarding standards and transaction controls. A crypto company should maintain transparent banking documentation, explain its source of funds and compliance framework, and avoid misleading claims that imply a government guarantee.
India’s digital-asset policy should also be distinguished from central bank digital currency initiatives. A central bank digital currency is issued by a monetary authority and is fundamentally different from a privately created token.
Securities and financial-product risk
A token can create additional regulatory risk if it promises dividends, profit sharing, appreciation based on managerial efforts, repayment, pooled returns or exposure to an underlying financial asset. Tokenisation does not automatically remove securities or financial-product regulation.
Founders should obtain specialist advice before launching:
- Security-token offerings.
- Fractional ownership products.
- Tokenised funds or real-world assets.
- Crypto derivatives or perpetual contracts.
- Lending, yield or interest products.
- Investment advice or portfolio management.
- Custodial products holding customer assets.
- Stablecoins marketed as payment substitutes.
Marketing language matters. Statements such as “guaranteed returns,” “risk-free yield” or “government-backed crypto” can create serious consumer and enforcement risk.
Compliance requirements for crypto startups in India
A robust compliance programme should be designed before product launch. The following sequence is practical for an Indian Web3 startup:
1. Map the business model
List every activity: issuance, exchange, custody, transfer, staking, rewards, referral programmes, lending, fiat collection and withdrawal. Identify who performs each function and where they are located.
2. Classify the token and services
Prepare a legal memo covering VDA treatment, possible securities or payment characteristics, consumer disclosures and tax implications.
3. Build KYC and AML controls
Select proportionate verification for retail, corporate and high-risk users. Add wallet screening, transaction monitoring and manual review workflows.
4. Design tax operations
Document Section 115BBH reporting, Section 194S TDS responsibilities, GST treatment, accounting policies and customer tax statements.
5. Secure custody and technology
Use segregation of customer assets, multi-signature controls, key-management procedures, access reviews, smart-contract audits, penetration testing and incident-response plans.
6. Protect users
Publish transparent fees, risk disclosures, withdrawal rules, token mechanics, conflicts of interest, complaint channels and privacy notices. Do not hide material terms in technical documentation alone.
7. Monitor regulatory change
India’s digital-asset framework continues to evolve. Assign ownership for tracking Finance Ministry, FIU-IND, RBI, SEBI, GST and Income Tax Department developments.
Common mistakes to avoid
- Treating crypto as unregulated because there is no single crypto statute.
- Assuming FIU registration equals approval of a token or investment product.
- Ignoring Indian users because the company is incorporated offshore.
- Applying generic KYC without blockchain transaction monitoring.
- Failing to reconcile TDS across exchange, wallet and fiat records.
- Advertising token returns without adequate risk disclosures.
- Mixing customer assets with treasury funds.
- Launching staking, lending or derivatives without a product-specific legal review.
- Keeping incomplete records of wallet addresses, counterparties and transaction rationale.
How investors should stay compliant
Individuals should use reputable platforms, preserve trade confirmations and wallet records, calculate gains and losses carefully, and disclose taxable income accurately. Records should include purchase price, sale value, dates, fees, token quantities, wallet transfers, airdrops and staking or mining receipts.
Investors should also be cautious with platforms that promise guaranteed returns, conceal ownership information, pressure users to transfer funds quickly or operate without clear grievance and withdrawal processes. Tax compliance does not validate a fraudulent scheme, and a platform’s existence does not guarantee recovery of assets.
Frequently asked questions
Is crypto banned in India?
India has not generally granted private cryptocurrencies legal-tender status, but crypto-related activity is not accurately described as universally banned. Tax, AML and other obligations apply, and some products may trigger additional regulation or enforcement risk.
Is crypto income taxed in India?
Income from VDA transfers is generally subject to the special tax regime under Section 115BBH, including a 30% rate subject to statutory conditions. Section 194S may also require 1% TDS on consideration for eligible transfers.
Do all crypto businesses need FIU registration?
Not every company that merely develops blockchain software will necessarily be a reporting entity. Businesses performing specified VDA services, such as exchange, transfer or custody-related activities, should assess FIU-IND registration and PMLA obligations.
Can an Indian startup launch a token?
Launching a token requires a product-specific legal, tax, AML and consumer-risk analysis. A token’s rights, marketing, distribution model and associated services may create obligations beyond the general VDA tax framework.
Are NFTs covered by Indian crypto rules?
Many NFTs fall within the VDA definition for tax purposes, subject to statutory exclusions. Tax, GST, consumer and intellectual-property considerations should be reviewed for the specific NFT business model.
Does paying tax make a crypto product legal?
No. Tax treatment does not by itself authorise an asset, exchange, investment product or payment service. Businesses must separately assess licensing, AML, securities, consumer, data and foreign-exchange obligations.
Apply for AI Grants India
Building compliance, risk-monitoring or blockchain infrastructure for India’s digital-asset ecosystem? Apply to AI Grants India to explore support and opportunities for Indian AI founders developing responsible, high-impact technology.