Key Highlights
- India’s FIU has tightened crypto exchange rules, making user onboarding tougher to strengthen AML and KYC compliance.
- Live selfie checks and location tracking are now mandatory to stop fake identities and AI-based verification fraud.
- Exchanges must verify bank accounts and collect extra ID to reduce money laundering through fake or third-party accounts.
India’s Financial Intelligence Unit (FIU) has tightened rules regarding cryptocurrency trading, making it more difficult for people to register and use cryptocurrency platforms.
The goal is to enhance anti-money laundering (AML) regulations and ensure that criminals do not use cryptocurrency to use anonymous identities and complex transaction processes.
The exchanges are required to follow more stringent guidelines regarding Know Your Customer (KYC), as has been mandated by the Prevention of Money Laundering Act (PMLA).
Live selfies and location checks
Under the new rules, users must complete a live selfie verification while creating an account. This is not just uploading a photo. The system will ask users to blink their eyes or move their head to prove they are physically present.
This liveness detection is designed to confirm that a real person is present and to prevent the use of stolen photos, recorded videos, or AI-generated deepfakes to bypass identity checks.
The FIU has also made geographical tracking compulsory during the onboarding process. Crypto exchanges must capture the user’s latitude, longitude, IP address, date, and time at the moment the account is created. Authorities say this data will help establish where accounts are being opened from and assist in monitoring and investigating suspicious activity.
Bank checks and risky crypto tools
Another major requirement involves bank account verification. Exchanges must follow the “penny-drop” method, under which a small amount, such as Re 1, is sent to the user’s bank account to confirm that it is active and belongs to the person registering. This step is aimed at reducing the risk of money laundering through fake or third-party accounts.
In addition to a Permanent Account Number (PAN), users must now provide a second ID, like Aadhaar, Passport, or Voter ID. They also have to verify their email and mobile number with a one-time password to activate their account
The guidelines take a tougher stance on crypto tools and practices that hide transaction trails. The FIU has warned exchanges not to support privacy coins, tumblers, or mixers, which mix funds and make tracking very hard. These tools, the agency said, carry serious risks of money laundering and terror financing.
The regulator has further said that Initial Coin Offerings (ICOs) and Initial Token Offerings (ITOs) carry “heightened and complex risks,” noting that many lack clear economic justification. Exchanges have been asked to strongly discourage such activities and apply strict risk controls.
Tax authorities raise parallel concerns
At the same time, India’s Income Tax Department has expressed concerns to lawmakers that cryptocurrencies and decentralized finance (DeFi) platforms are making tax enforcement increasingly difficult. Officials told the Parliamentary Standing Committee on Finance that the anonymity and near-instant nature of crypto transactions complicate efforts to trace income and identify beneficial owners.
The officials cited anonymous wallets, offshore exchanges, and the increased use of decentralized exchanges as being significant hurdles.
They pointed out that more Indian crypto transactions are now taking place on foreign exchanges, which has made investigations more difficult. This is happening even though reporting related to virtual digital assets has increased since crypto was brought under the tax net.
Under current Indian tax rules, crypto gains are taxed at 30%. Losses cannot be offset against profits.
All these developments point to a broader push by Indian authorities to bring the crypto sector under tighter regulation as digital asset adoption continues to grow.
Also Read: FIU-IND Tightens Crypto Rules, Mandates Cybersecurity Audits
