Navigating the 2026 AML & CFT Guidelines for Virtual Digital Assets: The Definitive FAQ Guide

The guidelines are grounded in the Prevention of Money-Laundering Act, 2002 (PMLA) and the Unlawful Activities (Prevention) Act, 1967 (UAPA). They were issued after the Government of India officially notified Virtual Digital Asset Service Providers (VDA SPs) as "Reporting Entities" under the PMLA.

An entity is considered a VDA SP if it conducts any of the following activities for business purposes:

• Exchange between virtual digital assets and fiat currencies.
• Exchange between one or more forms of virtual digital assets.
• Transfer of virtual digital assets.
• Safekeeping or administration of virtual digital assets or custodial wallets.
• Participation in financial services related to an issuer’s offer or sale of a VDA.

Yes. The obligations are "activity-based" and apply irrespective of physical presence in India. Any entity, regardless of its registered location, must register as a Reporting Entity and comply with these rules if it engages in the notified activities for Indian users.

No. The Digital Rupee (e₹) issued by the Reserve Bank of India (RBI) is excluded from the scope of these guidelines as it represents a digital form of sovereign fiat currency.

Yes. Registration with FIU-IND is a mandatory pre-requisite. Non-registration is deemed a violation of the PMLA and may invite enforcement action under Section 13(2) of the Act.

After submitting documents, applicants must attend a mandatory in-person meeting to verify their AML/CFT compliance systems. This must be attended by the Designated Director and Principal Officer. The applicant must provide a live demonstration of their systems, including KYC, transaction monitoring, and blockchain analytics tools.

The Principal Officer (PO) is a management-level officer responsible for implementing compliance obligations. The PO must be an independent officer reporting directly to the Board.

Yes. The Principal Officer must be based in India to ensure effective discharge of obligations. They must be exclusively engaged with the Reporting Entity on a full-time basis and cannot hold concurrent engagements.

Beyond standard ID proofs, VDA SPs must now collect:

• Live Selfie: A photograph with liveness detection technology.
• Geo-Location: Latitude/Longitude of onboarding location, IP address, and timestamp.
• PAN: Mandatory verification of the Permanent Account Number.

Verification of the client's bank account must be carried out through a "penny-drop mechanism". This confirms both the ownership and the operational status of the account.

EDD involves more rigorous verification for higher-risk scenarios. It is mandatory for:

• Clients from high-risk jurisdictions (tax havens, FATF lists).
• Politically Exposed Persons (PEPs).
• Non-Profit Organizations.
• Any case with a mismatch between the address furnished and geo-coordinates.

• High-Risk Clients: At least once every six months.
• All Other Clients: At least once every year.

The Travel Rule requires VDA SPs to share specific information about the sender (originator) and receiver (beneficiary) when transferring funds.

• Originating SPs: Must transmit name, wallet, PAN, and address.
• Beneficiary SPs: Must verify the beneficiary's name against their own records.

No. Submission of the required information must occur before or when the VDA transfer is conducted. Post-facto submission is not permitted.

Yes, but they require stricter scrutiny. VDA SPs must collect data on unhosted wallet transfers and apply risk-based enhanced measures. They may impose limitations based on risk assessment.

Dealings in Anonymity-Enhancing Crypto Tokens (AECs) are considered "unacceptably high risk." Reporting Entities must refrain from permitting deposits or withdrawals of AECs (like Monero or Zcash) designed to obfuscate transaction origins.

No. Transactions involving crypto tumblers, mixers, or other anonymity-enhancing services must not be facilitated. Service providers must deploy tools to detect and block such transactions.

ICOs and Initial Token Offerings (ITOs) are strongly discouraged due to their elevated risks. If facilitated, the controlling parties must undertake documented risk assessments before launch.

An STR is a report filed with FIU-IND when a transaction gives reasonable grounds to believe it involves proceeds of crime or terrorism financing. This must be filed regardless of the transaction amount.

"Tipping-off" refers to revealing to the client that an STR is being filed or that information is being furnished to the FIU-IND. This is strictly prohibited to protect the integrity of investigations.

• Client Records: For five years after the account relationship ends.
• Transaction Records: For five years from the date of the transaction.

Yes. Reporting Entities must conduct an independent annual audit of their AML/CFT controls and systems to assess compliance.