FIU-IND Registration for Crypto Exchanges and Web3 Businesses: PMLA Compliance Explained

India has no crypto licence. There’s no SEBI registration for exchanges, no RBI authorisation, and no single crypto law. So founders are often surprised to learn that one registration is mandatory for almost every crypto business serving Indian users, and that operating without it can get your app blocked and your company fined.

That registration is with the Financial Intelligence Unit-India (FIU-IND) under the Prevention of Money-laundering Act, 2002 (PMLA). This guide explains who needs FIU-IND registration, what PMLA compliance actually involves, how FIU-IND has acted against offshore exchanges, and the remedies when an enforcement notice arrives.

Who needs FIU-IND registration?

In March 2023, the government notified “virtual digital asset service providers” (VDA SPs) as reporting entities under the PMLA. A business is a VDA SP if, for or on behalf of another person, it carries out any of these activities:

• exchange between VDAs and fiat currencies;
• exchange between one or more forms of VDAs;
• transfer of VDAs;
• safekeeping or administration of VDAs, or instruments enabling control over them; or
• participation in, and provision of financial services related to, an issuer’s offer and sale of a VDA.

That covers centralised exchanges, P2P platforms that hold funds, custodians, wallet providers with custody, brokers and many token-launch services. It applies whether the business is in India or offshore. FIU-IND’s position is that obligations don’t depend on physical presence in India, so offshore platforms serving Indian users must register too (CryptoSlate).

What FIU-IND registration is not

It’s an anti-money-laundering registration, not a licence. It doesn’t mean the platform is authorised by SEBI or the RBI, or that customer assets are protected (CryptoTimes). Founders should never market it as a “licence”.

Why it matters commercially

Indian banks, payment gateways and app stores increasingly ask crypto businesses for proof of FIU-IND registration before onboarding them. Without it, a Web3 startup may find it can’t open accounts, take payments or stay listed. So registration is a business necessity as much as a legal one.

PMLA compliance: what a registered VDA SP must do

FIU-IND issued AML/CFT guidelines for VDA SPs in March 2023 and published an updated version on 8 January 2026, which is now the operative framework (CryptoSlate; Candour Legal). The core obligations:

• Registration with FIU-IND as a reporting entity, through its online portal.
• Principal Officer and Designated Director. Appoint a Principal Officer for reporting and a Designated Director responsible for overall PMLA compliance.
• KYC and customer due diligence, including enhanced due diligence for higher-risk customers, and screening against sanctions lists.
• Suspicious transaction reports (STRs) and other prescribed reports to FIU-IND within the required timelines.
• The travel rule. Collect and transmit originator and beneficiary information with VDA transfers, in line with FATF standards.
• Record-keeping. Keep transaction and KYC records, generally for five years.
• Risk assessment and internal policies, with training, independent audit and board oversight.

For a founder, the practical work is building a compliance function that can produce evidence on demand: written KYC procedures, a transaction-monitoring system with documented rules, a log of every suspicious transaction report filed and every alert closed, sanctions-screening results, and board minutes showing that the Designated Director reviews AML compliance regularly. When FIU-IND inspects a VDA SP, it asks for records, not intentions. Smaller platforms often outsource parts of this, such as blockchain analytics and screening tools, but the legal responsibility stays with the registered entity.

Compliance doesn’t end with registration. FIU-IND expects ongoing reporting and can inspect, question and penalise reporting entities.

Enforcement: how FIU-IND has acted against offshore exchanges

FIU-IND has made it clear that it will enforce these rules against offshore platforms.

• December 2023: show-cause notices to nine offshore exchanges, including Binance and KuCoin, followed by blocking of their URLs and apps. Several later registered after paying penalties. Binance was fined ₹18.82 crore (Oquilia).
• October 2025: registration notices to 25 more offshore platforms (Oquilia).
• September 2026: non-compliance notices to 15 offshore VDA SPs, with directions to take down their apps (CryptoTimes; YourStory).

According to FIU-IND’s annual report for 2024-25, 49 VDA SPs had registered (45 domestic and 4 offshore), with total penalties of about ₹28 crore imposed during the year (Business Standard; Cyril Amarchand Mangaldas).

The legal tools

Under Section 13 of the PMLA, the FIU-IND Director can issue warnings, direct compliance, order compliance reports and impose a monetary penalty of ₹10,000 to ₹1 lakh for each failure. For a large exchange, “each failure” can mean thousands of transactions. Blocking orders for apps and websites are issued through MeitY under Section 69A of the IT Act.

Registration strategy for Web3 startups

Not every Web3 business is a VDA SP, and over-registering creates obligations you don’t need. Start by mapping your product against the five activities above.

• Probably a VDA SP: custodial exchanges, P2P platforms with escrow, custodial wallets, OTC desks, brokers, and launchpads that handle token sales for issuers.
• Possibly not: truly non-custodial wallet software, pure blockchain analytics, NFT creators selling their own work, and developer tools. But structure and facts matter, and “decentralised” in marketing doesn’t make you decentralised in law.
• Grey areas: DeFi front-ends, bridges, payment gateways that convert crypto, and NFT marketplaces that hold assets in escrow. See our guide to NFT ownership in India.

In our view, the safest approach is a written regulatory classification memo for your product, updated as it evolves. If you do need FIU-IND registration, register before launch rather than after a notice. Offshore applicants face longer timelines and, where they’ve already served Indian users, penalty discussions.

Remember the other regimes too. VDA SPs also deal with 30% crypto tax and 1% TDS mechanics (see crypto tax in India), the new exchange reporting duties under Section 509 of the Income-tax Act, 2025, GST on platform fees, CERT-In’s cyber rules (which impose specific KYC and record-keeping duties on virtual asset service providers; see our CERT-In 6-hour rule guide), and the DPDP Act (see our DPDP Act compliance checklist). Users should also know that FIU-registered platforms can still fail; read what to do when a crypto exchange is hacked.

Remedies when FIU-IND comes calling

• Respond to show-cause notices fully and on time, with evidence of the compliance steps you’ve taken or begun. A credible remediation plan, backed by registration, often reduces penalties.
• Seek a personal hearing before any penalty order. The PMLA requires that the entity be heard.
• Appeal a penalty order to the Appellate Tribunal under Section 26 of the PMLA, generally within 45 days, and from there to the High Court under Section 42.
• Challenge blocking orders. Where an app or website is blocked under Section 69A of the IT Act, review and writ remedies are available, but registration and compliance are usually the faster route to restoration.
• For users of blocked platforms, withdraw assets where the platform allows it, keep records for tax purposes, and prefer FIU-registered platforms going forward. FIU-IND publishes the list of registered reporting entities.

Quick answers

Is FIU-IND registration a crypto licence?

No. It’s an anti-money-laundering registration under the PMLA, not authorisation from SEBI or the RBI.

Do offshore crypto exchanges need FIU-IND registration?

Yes, if they serve Indian users. FIU-IND has blocked and penalised offshore platforms that didn’t register.

What is the penalty for not complying with PMLA?

Under Section 13, a fine of ₹10,000 to ₹1 lakh for each failure, plus directions, and possible blocking of the platform.

Related reading: India’s shelved crypto policy paper and stablecoins in India; also building a Web3 startup with an Indian team; also VARA licences and FIU-IND registration for Dubai exchanges, Dubai vs GIFT City for crypto and Web3 businesses and the UAE’s September 2026 DeFi deadline; also launching a token from Dubai with Indian investors and using an Indian exchange’s Dubai entity; also UK crypto exchanges serving Indian users and clone apps copying your crypto brand in India; also the FCA crypto authorisation deadline for overseas firms, how the UK crypto regime reaches Indian Web3 startups, the UAE FIU and VARA crypto agreement and UK staking regulation for Indian providers; also the FCA DeFi consultation for Indian protocol developers and UK crypto promotions and Indian influencers; also how to check a crypto firm’s licence in the UAE and the crypto travel rule between the UAE and India; also whether crypto is legal in India in 2026, whether WazirX and CoinDCX are legal and whether P2P crypto is legal in India.

Final word

At Halverton & Co., we advise investors, crypto and Web3 businesses and digital-asset holders on FIU-IND registration, PMLA compliance programmes, crypto regulatory classification and enforcement proceedings. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and act as fractional legal counsel for crypto, Web3 and fintech companies. Halverton & Co.: Where tech needs law!

Write to us at office@halvertonandco.com, or get in touch, to discuss your situation.

This article reflects the law and developments reported up to early October 2026. It is for general information only and is not legal, tax or investment advice. Crypto rules change quickly; please take advice on your specific facts before acting.