The article examines the impact of the recently introduced FIU-IND registration process for virtual digital asset businesses, associated requirements and obligations (prominently including FIU-IND reporting) and the consequences thereof.

I. Introduction

The regulatory landscape surrounding virtual digital assets (“VDA”) in India has undergone a tumultuous past. For context, the Reserve Bank of India (“RBI”) imposed a prohibition on any dealing concerning crypto assets and currencies in India in 2018. As a result of such prohibition, Indian banks and other regulated entities were barred from providing services to any entities which dealt in such assets. The prohibition was removed as recently as 2022, when – upon hearing a petition filed by the Internet and Mobile Association of India (an industry body whose members included domestic VDA entities) – the Supreme Court of India ruled in favor of providing a framework for the regulation of virtual assets and currencies.

The Indian government has since announced its intent to regulate VDA entities by enacting legislation at the central level and has taken some measures to regulate and tax VDA transactions. Nevertheless, until quite recently, VDA businesses remained largely unregulated – in the sense that no principal statute or authority was established for regulation or authorization of VDA entities. However, with the steady rise of the adoption and use of VDAs in India – a major change to the regulatory regime was introduced by the Indian Ministry of Finance (“Ministry”) vide its notification dated March 7, 2023 (“March Notification”).

The March Notification classified entities engaged in offering certain services pertaining to VDAs (“VDA Service Providers” or “VDA SPs”) as “reporting entities” under the Prevention of Money Laundering Act, 2002 (“PMLA”) – the nodal statute enacted by the Indian government to combat money laundering practices in India. As a result, VDA SPs were brought under the direct purview and authority of India’s Financial Intelligence Unit (“FIU-IND”). Effective March 10, 2023, the FIU-IND released the ‘AML & CFT Guidelines For Reporting Entities Providing Services Related To Virtual Digital Assets’ (“Guidelines”) inter-alia requiring VDA SPs to compulsorily register with it as reporting entities.

The issuance of the Guidelines (and measures taken for the implementation thereof) by the FIU-IND have had far reaching consequences on both domestic and international VDA SPs operating in India, which are examined hereinbelow.

II. Regulation of VDA Service Providers by FIU-IND

The FIU-IND (established as of November 04, 2008) is an independent body operating under the ambit of the Ministry, which reports directly to the Economic Intelligence Council (EIC) headed by the Finance Minister. It is the nodal Indian agency responsible for “receiving, processing, analyzing and disseminating information relating to suspect financial transactions to enforcement agencies and foreign FIUs.”

Following the designation of VDA SPs as reporting entities by the Ministry (vide the March Notification), the FIU-IND issued the Guidelines to elaborate the specific practices and procedures to be enacted by VDA SPs for the purpose of compliance with the PMLA and the Prevention of Money-laundering (Maintenance of Records) Rules, 2005 (“PMLR”) framed thereunder. As a cornerstone of compliance, the Guidelines mandated all VDA SPs operating in India, whether domestic or foreign, to register as reporting entities with the FIU-IND.

Importantly, vide its notification dated July 4, 2023 (“July Notification”), the Ministry subsequently reaffirmed the requirement for VDA SPs (qualifying as reporting entities) to comply with the PMLA, the PMLR as well as the Guidelines. In particular, the July Notification specified that FIU-IND registration was a pre-requisite of the compliance to be observed by VDA SPs under the PMLA. In furtherance, it also highlighted that non-compliance by a VDA SP would be subject to punitive action under the PMLA.

As a result of the Ministry’s actions, not only is the FIU-IND empowered to exercise stricter scrutiny over VDA entities and transactions – so is the RBI (as elaborated hereinbelow). In the case of the FIU-IND, it is directly empowered to regulate VDA entities, to enforce their compliance with the provisions of the PMLA and relative rules and regulations (including its own Guidelines) and to penalize them for non-compliance.

The FIU-IND’s commitment to enforcing the Guidelines is evident from the subsequent measures taken by it against non-compliant entities. Notably, in January 2024, the FIU-IND identified nine offshore VDA SPs (which were not registered with the FIU-IND) and issued show cause notices to such entities regarding their non-compliance with the statutory requirements in India. Pursuant to the directions of the FIU-IND, the websites of the relevant non-compliant VDA SPs were further blocked by the Indian Ministry of Electronics and Information Technology (MeitY) and their mobile applications were delisted from the IoS and Android Mobile Stores in India.

III. Scope of Compliance

Per the March Notification, the following activities (when carried out “for or on behalf of another natural or legal person in the course of business”) have been termed as designated activities subject to regulation under the PMLA – thereby qualifying the entities carrying out such activities (i.e. VDA SPs) as reporting entities for the purpose of the statute:

It is worthwhile to note that the same meaning is ascribed to the term ‘VDA’ under the PMLA (for the purpose of regulation of such assets) and under the Income Tax Act, 1961(for the purpose of taxation of such assets). For reference, the Income Tax Act, 1961 defines the term to broadly include: “…any information or code or number or token (not being Indian currency or foreign currency), generated through cryptographic means or otherwise, by whatever name called, providing a digital representation of value exchanged with or without consideration, with the promise or representation of having inherent value, or functions as a store of value or a unit of account including its use in any financial transaction or investment, but not limited to investment scheme; and can be transferred, stored or traded electronically…a non-fungible token or any other token of similar nature, by whatever name called...any other digital asset, as the Central Government may, by notification in the Official Gazette specify…”

While registration with the FIU-IND is an important pre-requisite of legal compliance for VDA SPs, it is important for VDA SPs operating in India to acquaint themselves and comply with the various legal requirements applicable to their business prior to approaching the FIU-IND. This includes compliance with the PMLA, PMLR as well as ancillary guidelines issued by the FIU-IND and other regulatory authorities (such as the RBI), as elaborated hereinbelow:

The PMLA broadly outlines the principal legal requirements required to be followed by VDA SPs (in the capacity of reporting entities). For the purpose of compliance with the PMLA, VDA SPs are required inter-alia to adopt prescribed modes of authentication for the verification of the identity of its clients (or users) as well as ‘beneficial owners’ (i.e. persons having ownership or control in the business affairs of any client organization), to maintain records of specific transactions and to furnish such records to designated authorities, prominently including the FIU-IND, from time to time. The legal requirements in the PMLA are required to be implemented in conformity with the practices and procedures set out in the PMLR.

The PMLR details the practices and procedures to be observed by reporting entities for the purpose of compliance with the principal requirements in the PMLA. To this end, the PMLR inter-alia elaborates the practices and procedures and the timelines to be observed by reporting entities and their personnel for undertaking client due diligence and enhanced due diligence; for obtaining relevant information from clients, for maintaining information of transactions and for furnishing requisite information reports to the FIU-IND. Importantly, the PMLR mandates reporting entities to appoint a Designated Director as well as a Principal Officer for undertaking compliance with the PMLA and for coordinating with the FIU-IND.

The Guidelines set out the specific measures to be undertaken by VDA SPs qualifying as reporting entities for the purpose of compliance with the provisions of the PMLA and PMLR.  In this regard, the Guidelines elaborate general as well as reporting obligations that VDA SPs must undertake to identify and prevent money laundering, terrorist financing or proliferation financial activities – and to maintain and report information in this regard to the FIU-IND. Additionally, the Guidelines prescribed specific obligations for VDA SPs (specific to the service rendered by them as a VDA SP).

In view of the above, careful reading and interpretation of the PMLA and the PMLR together with the Guidelines becomes necessary for domestic and offshore VDA SPs alike to effectively meet and comply with all legal requirements imposed thereunder. It is worth noting that VDA SPs must also identify and comply with requirements pertaining to their business under additional ancillary rules and regulations in India – in particular the KYC requirements of the RBI as well as other relevant taxation and advertisement restrictions.

IV. Process of Registration with the FIU-IND

The FIU-IND maintains an official portal whereat an entity may prepare and submit application for onboarding as a reporting entity. Following submission of the online application for registration (along with the relevant documentation) on the portal, the FIU-IND will scrutinize the application and may request additional information or supplementary documentation from the applicant prior to grant approval for enrolment as a reporting entity.

As previously mentioned, it is important for VDA SPs (both offshore or domestic) operating in India to acquaint themselves and comply with the legal requirements applicable to their business prior to approaching the FIU-IND for registration. Illustratively, the enrolment process with the FIU-IND, requires the applicant to furnish details of its appointed Designated Director and Principal Officer and requires the relevant personnel to be involved in the enrolment process, including in the preparation and submission of information to the FIU-IND.

Further, the onboarding procedure envisaged by the FIU-IND for VDA SPs (both offshore and domestic) involves scheduling of an in-person meeting for submission of documents of the applicant VDA SP. The July Notification issued by the Ministry contains a (non-exhaustive) list of documents to be submitted by the applicant VDA SP as part of the process. The applicant can be required to submit additional information/documents by the FIU-IND for completion of the FIU-IND registration process. The applicant may also choose to submit additional documents for ensuring completion of such a process.

Importantly, the Designated Director and Principal Officer appointed by the applicant VDA SP are required to appear in any in-person meeting that the FIU-IND may schedule as part of the enrollment process.

V. Consequences of non-compliance of registration with the FIU-IND

Failure to register with the FIU-IND as a reporting entity or to observe the legal compliance required from reporting entities under the PMLA (and ancillary rules and regulations) can lead to imposition of statutory penalties as well as other negative consequences for a VDA SP.

Importantly, Section 13 of the PML Act empowers the FIU-IND to conduct an inquiry as regards the obligations of any reporting entity upon a third-party application as well as at any time upon its own volition. As part of such an inquiry, the FIU-IND is authorized to conduct an audit of the reporting entity and take appropriate measures against the reporting entity. These comprise the following:

It is worthwhile to note that the FIU-IND is quite vigilant in enforcing the requirements stipulated under the PMLA and PMLR upon reporting entities. The FIU-IND has previously imposed significant penalties on reporting entities (notably including a penalty to the tune of INR 9600000 / approx. USD 115200 on the payments giant, PayPal) for failing to register with the FIU-IND despite qualifying as a reporting entity.

The actions recently taken by FIU–IND against unregistered offshore VDA businesses, in particular – stress the importance for VDA SPs (qualifying as reporting entities) to ensure compliance with the PMLA and its ancillary rules and regulations.

VI. Impact of FIU-IND Regulation on the VDA Industry

The issuance of the Guidelines (and measures taken for the implementation thereof) by the FIU-IND have led to drastic changes in the regulatory regime applicable to VDA SPs operating in India.

While the Indian Government proposed to bring about central legislation to regulate operation of privately held virtual assets and currencies in India, such legislation remains forthcoming. Rather than pressing ahead with the enactment of specific statute or regulation to govern cryptocurrencies or crypto-assets/VDAs in India, Indian authorities continued to place reliance on the ancillary laws, rules and regulations prevailing in the country. Following the amendment of the PMLA by the Ministry, the FIU-IND is empowered as the chief authority for regulating the VDA industry in India. Both domestic and offshore VDA SPs alike are directly liable to observe compliance under the PMLA (and its ancillary rules and regulations) and directly accountable to the FIU-IND in the event of any non-compliance.

Domestic stakeholders (VDA SPs and Indian customers alike) are reported to have welcomed the actions taken by the FIU-IND and the issuance of its Guidelines. Especially considering the rising preference of Indian users to engage with FIU-IND registered and legally compliant VDA businesses, various domestic VDA SPs have taken actions to comply with the legal and regulatory requirements under the PMLA and to register with the FIU-IND. As of January 2024, reportedly over 30 domestic VDA SPs have already registered with FIU-IND as reporting entities.

In light of recent actions taken by the FIU-IND and MeitY against offshore VDA SPs to enforce their compliance with the PMLA, it is evident that the Indian Government does not intend to allow non-compliant and unregistered VDA SPs to continue to function in India. Thus, offshore VDA SPs must either move to comply with the requirements of the FIU-IND or withdraw their business from India.

Pursuant to the issuance of show cause notices by FIU to offshore VDA SPs (regarding non-compliance with the statutory requirements and the absence of registration with FIU-India), the global cryptocurrency exchange ‘KuCoin’ (which was among the unregistered offshore VDA SPs identified by FIU-IND) has recently become the first offshore VDA SP to obtain registration with the FIU-IND as a reporting entity.

With this development, KuCoin is currently the only offshore VDA platform authorized to operate and offer services in the Indian market. Interestingly, as part of the announcement made by KuCoin on its platform (as of March 23, 2024) regarding the attainment of FIU-IND registration, it has also announced a series of localization measures for its business in India – including the establishment of a local team in the country. Such measures provide a blueprint for regulatory compliance to other offshore VDA SPs seeking to continue operating in the Indian market.

VII. Conclusion

In view of the above, the ramifications of the FIU IND regulation of the VDA industry seem to be quite apparent even in the short term. Given that domestic as well as offshore VDA SPs are now left with the option to either register with the FIU-IND or discontinue their business operations in India, various stakeholders have swiftly moved to comply with the requirements of stipulated by the FIU-IND, to familiarize themselves with and adhere to the PMLA, PMLR and Guidelines

Further, for VDA customers/users based in India, the FIU-IND’s regulatory measures have been perceived as a positive development given the traditional risks associated with VDA industry. Interestingly, the loss of business caused to offshore VDA SPs (due to the blocking orders issued by MeitY) seems to have bolstered the preference of Indian users to engage with registered and legally compliant VDA SPs. As a result, domestic VDA businesses in India have reported increased user traffic – a trend which is bound to continue till the time offshore platforms attain registration with the FIU-IND and re-enter the Indian market. Further, the introduction of FIU-IND regulation is reported to have placed a curb on certain practices perpetuated by VDA SP – such as shifting of assets outside the country to avoid taxation of VDA transactions.

While offshore VDA SPs are likely to face additional challenges (in comparison to domestically based VDA SPs) in modifying their modus operandi to comply with legal and regulatory requirements mandated under Indian money laundering laws, the recent registration of KuCoin as a reporting entity attests that such compliance can be achieved (and serves as an example to spur other VDA SPs to also obtain FIU-IND registration and re-enter the Indian market).

In light of the above, it will be interesting to see the impact of FIU-IND regulation in the long term upon domestic and international stakeholders. It is worthwhile to note that VDA SPs operating in India are required to comply with applicable local laws and regulations (including local tax, data protection, and advertising requirements) in addition to money laundering laws.

Authors: Ashneet Hanspal and Parag Singhal