India's Crypto Reckoning: The COINS Act 2025, the WazirX Crisis, and the Road to Regulated VDA Markets
Executive Summary
India occupies a paradoxical position in the global crypto landscape: it is home to the world's largest cryptocurrency user base—with over 100 million users and 861 million on-chain activity participants recorded by Chainalysis in 2025, topping the Global Crypto Adoption Index for the third consecutive year—yet remains without a single comprehensive crypto law.
The Ministry of Finance confirmed in Parliament as recently as December 2024 that there is "no timeline anticipated for introduction of comprehensive regulatory guidelines for the VDA industry in India." The result is a market that generates tens of thousands of tax compliance notices and billions in government revenue while providing investors with no coherent consumer protection framework, no licensed exchange oversight, and no clear regulatory home between an openly hostile RBI, a cautiously expanding SEBI, and a Finance Ministry that taxes crypto aggressively but regulates it not at all.
Three developments have defined India's recent crypto reckoning. The catastrophic WazirX hack triggered landmark litigation before the Delhi High Court and the Supreme Court, exposing a regulatory vacuum so complete that the RBI publicly admitted it does not regulate platforms like WazirX. In parallel, industry groups released the COINS Act 2025—a non-binding model law proposing a Crypto Assets Regulatory Authority (CARA). Meanwhile, India's enforcement apparatus moved aggressively: imposing 18% GST on trading fees, blocking offshore exchanges for PMLA non-compliance, and finalizing a formal CARF implementation commitment by April 2027.
1. Background: The Paradox of the World's Largest Unregulated Market
Virtual Digital Assets (VDAs)—the term India uses for cryptocurrencies, NFTs, and blockchain-based tokens under the Income Tax Act, 1961—are legal to hold, trade, and transfer in India. They are not, however, legal tender, not formally classified as securities or commodities, and not subject to any comprehensive licensing or consumer protection framework. This is not an oversight; it is a deliberate and sustained policy choice.
The regulatory architecture that exists is deliberately partial. The RBI, which has historically advocated for an outright ban on private crypto, has created an informal environment of hostility. SEBI has jurisdiction over security-like tokens and began taking control of DeFi staking and tokenized investment products from April 2025, but has no mandate over pure utility tokens or exchange operations. The FIU-IND, operating under PMLA, is the sole formal registrar of crypto entities—but its mandate covers Anti-Money Laundering compliance only. A 2024 PwC report estimated that regulatory uncertainty has driven approximately $2 billion in crypto investment out of India to more permissive jurisdictions.
2. The WazirX Crisis: When Regulatory Vacuum Costs $235 Million
On July 18, 2024, the Lazarus Group—a North Korea-linked state-sponsored hacking collective—exploited vulnerabilities in WazirX's multi-signature wallet infrastructure, draining approximately $235 million in user assets. The amount represented nearly 45% of WazirX's total holdings. Approximately 4.4 million Indian users were affected.
The Supreme Court's response was equally stark. On April 16, 2025, the Court dismissed a petition filed by WazirX victims, holding that cryptocurrency regulation is "a policy matter for the government, not the judiciary."
With WazirX's Singapore-based restructuring plan approved by creditors, victims expect to recover only 45–50% of losses. For 4.4 million Indian users, there is no regulator, no insolvency protection, and no clear legal precedent to turn to.
3. The Enforcement Paradox: Vigorous on Tax, Absent on Consumer Protection
The most striking feature of India's crypto enforcement landscape is its selectivity. India has moved with considerable speed and force on AML compliance, tax recovery, and offshore exchange registration—but has done nothing to regulate exchange governance, custody standards, or consumer protection.
- PMLA & FIU-IND: Since March 2023, Virtual Digital Asset Service Providers (VDASPs) must register with FIU-IND. The FIU has implemented the FATF Travel Rule with no minimum threshold.
- Offshore Crackdown: In October 2025, FIU-IND issued compliance notices to 25 offshore platforms (including BingX, BitMEX, and Poloniex) for operating without PMLA registration, ordering website takedowns and levying massive penalties against non-compliant giants like Binance.
- SEBI Oversight: From April 1, 2025, SEBI assumed regulatory oversight over VDA products exhibiting the characteristics of securities, such as DeFi staking pools.
4. The COINS Act 2025: Industry's Blueprint for What India Needs
On July 21, 2025, Web3 venture firm Hashed Emergent and policy advisory group Black Dot released the Crypto-systems Oversight, Innovation and Strategy (COINS) Act.
The COINS Act's central institutional proposal is the creation of a Crypto Assets Regulatory Authority (CARA)—a dedicated, independent regulator that would consolidate the fragmented RBI-SEBI-FIU-IND oversight into a single specialist body, modeled on ESMA under the EU's MiCA framework. It proposes a tiered exchange licensing system, tax reform, and politically ambitious provisions such as legally recognizing self-custody as a fundamental right.
5. India's Multi-Layer Tax Burden: The World's Most Complex Crypto Tax Regime
India's crypto tax framework is a three-layer structure that imposes one of the highest effective tax burdens on crypto activity globally:
| Tax Layer | Application & Rate |
|---|---|
| Income Tax (Sec 115BBH) | 31.2% effective rate. A flat 30% tax on all VDA gains plus cess. No deductions allowed except purchase price. No setting off losses against gains. |
| TDS (Sec 194S) | 1% per transaction. Functions as a real-time audit trail for the government. Has resulted in over 44,000 CBDT compliance notices. |
| GST on Service Fees | 18% effective July 7, 2025. Levied on all exchange service fees, withdrawal fees, and staking charges by platforms serving Indian users. |
6. CARF 2027: The Offshore Transparency Countdown
The single most consequential near-term development for Indian crypto investors with offshore holdings is India's formal commitment to implement the OECD's Crypto-Asset Reporting Framework (CARF) by April 1, 2027.
For Indian investors with holdings on Binance or Coinbase, from April 2027, Indian tax authorities will receive automatic, standardized transaction data. Proactive voluntary disclosure—through updated ITR Schedule VDA filings and FEMA compliance—is significantly preferable to a retrospective audit.
7. India vs. The World: The MiCA Benchmark and Regulatory Arbitrage
The European Union's Markets in Crypto-Assets Regulation (MiCA)—fully in force from December 2024—now represents the global gold standard for crypto regulation, creating a unified classification and licensing system. Singapore and Dubai (VARA) have also established robust regulatory sandboxes.
India, despite its massive user base, is the last major G20 economy without a comprehensive VDA framework. The resulting regulatory arbitrage has driven DeFi protocols, crypto gaming studios, and infrastructure projects from India to relocate offshore.
8. Practical Compliance Guide: What Every Stakeholder Must Do Now
- For Crypto Exchanges: FIU-IND registration under PMLA is mandatory. Registered entities must maintain a live KYC system, implement the FATF Travel Rule, and hold a CERT-IN empanelled cybersecurity audit certificate. CARF due diligence infrastructure must be operational by January 1, 2027.
- For Indian Retail Investors: Schedule VDA in the Income Tax Return is mandatory for all crypto transactions. Use only FIU-registered platforms, as registration status is the only available proxy for platform accountability in the absence of consumer protection laws.
- For NRI & Foreign Investors: Offshore holdings on any exchange operating in a CARF-signatory jurisdiction will be automatically reported to CBDT from May 2027. Proactive disclosure of offshore crypto holdings through FEMA Schedule III filings is strongly advisable now.
- For Web3 Startups: Structuring advice is essential before any token launch targeting Indian users. The strategic question of whether to build under India's existing framework or in a VARA/MAS-regulated jurisdiction turns on the specific product architecture.
