Navigating the Stricter Regulatory Landscape: FIU-IND's 3rd Revision Circular for VDA Service Providers
The regulatory framework for Virtual Digital Assets (VDAs) in India has definitively transitioned from ambiguous oversight to a stringent, technology-driven compliance mandate. Central to this paradigm shift is the Financial Intelligence Unit - India (FIU-IND), which has systematically tightened the onboarding and monitoring of VDA Service Providers (SPs) under the Prevention of Money Laundering Act, 2002 (PMLA).
For our corporate clients navigating the digital asset space, the release of the 3rd Revision of the Circular (F.No. 9-8/2023/COMPL/FIU-IND-Pt-II) on September 15, 2025, marks a critical escalation in regulatory scrutiny. The days of simple paperwork are over; FIU-IND now demands rigorous structural transparency and live technological audits.
1. The Regulatory Baseline: PMLA and Notified Activities
Before dissecting the new registration requirements, it is essential to establish the baseline of what constitutes a reporting entity in the Indian VDA ecosystem.
Definition of a Reporting Entity: Section 2(1)(wa) of the PMLA defines a "reporting entity" as a banking company, financial institution, intermediary, or a person carrying on a designated business or profession.
Notified VDA Activities: The Central Government's March 07, 2023 notification brought specific activities under the PMLA framework when carried out for or on behalf of another natural or legal person in the course of business. These include:
- Exchange between virtual digital assets and fiat currencies.
- Exchange between one or more forms of virtual digital assets.
- Transfer of virtual digital assets.
- Safekeeping or administration of virtual digital assets or instruments enabling control over them.
- Participation in and provision of financial services related to an issuer's offer and sale of a virtual digital asset.
(Note: 'Virtual Digital Asset' carries the meaning assigned to it in Section 2(47A) of the Income-tax Act, 1961).
2. The 3rd Revision Circular: The 11-Point Tech-Driven Registration Protocol
To streamline the registration process and ensure complete transparency, the September 2025 circular introduced rigorous new demands. The FIU-IND will not schedule the mandatory in-person meeting until the following documentation (Points 1a to 1k) is submitted in full to their satisfaction:
Corporate Structure and Operational Proofs
- 1(a) Business Nature Note: A brief note explaining exactly how the service provider's activities fall under the March 07, 2023 notification.
- 1(b) Corporate Structure & SBO: A concise disclosure of the corporate structure, supported by an organogram, alongside the detailed particulars of Significant Beneficial Ownership (SBO).
Corporate, Financial & Tax Records
- 1(c) MCA Filings: Copies of Incorporation Documents, Annual Returns, Balance Sheets, and Profit & Loss Accounts filed with the Ministry of Corporate Affairs for the last 3 financial years.
- 1(d) GST Records: Copies of GST Returns for the last 3 financial years, along with GST registrations in all operating states to establish the nature of activities performed.
- 1(e) Income Tax & TDS: Copies of Income Tax Returns and explicitly, copies of Form 26Q/26QF/26QE filed with the Income Tax Department for TDS on VDA transactions.
B2B Arrangements & The PACT Certificate
- 1(f) Contractual Agreements: Duly executed copies of all contractual, operational, intermediary, custodial, or platform arrangements with domestic or international entities (exchanges, brokers, aggregators), plus a brief narrative on their scope and intended function.
- 1(g) The "PACT" Certificate: Replacing the older "Fit and Proper" terminology, applicants must now secure a "Partner Accreditation for Compliance and Trust" (PACT) certificate from FIU IND registered VDA SP(s) if they have an ongoing or prospective relationship/agreement with them.
Integrity Declarations & Cyber Security
- 1(h) Legal Integrity: A self-declaration confirming no pending proceedings with the Directorate of Enforcement (ED) or other law enforcement, and no criminal cases initiated against the applicant, company/LLP, or its directors/partners.
- 1(i) AML/CFT Questionnaire: A duly filled questionnaire covering various compliance aspects.
- 1(j) Mandatory Cyber Security Audit: A cyber security audit certificate from a CERT-In empanelled auditor affirming compliance with all legal frameworks, specifically including the requirements set forth in the Directions dated 28th April 2022 under Section 70B(6) of the Information Technology Act, 2000.
- 1(k) Additional Info: Any other information/document required by or shared with the Reporting Entity to ensure completion.
3. The In-Person Meeting & Live Technological Demonstration
The FIU-IND has fundamentally elevated the mandatory in-person meeting from a routine documentation review to a full-scale technical audit.
- Mandatory Attendance: The meeting at the FIU-IND office must be attended mandatorily by the Designated Director (DD) and the Principal Officer (PO). Qualifications for the PO are strictly guided by the "Guidance for Principal Officer (PO) 25.02.2025".
4. Final Registration and FINNet 2.0 Integration
The circular explicitly clarifies a common misconception regarding the FINNET 2.0 Portal. VDA SPs must be aware that any system-generated "FIUREID" upon initial portal submission is for reference only.
Final registration in letter and spirit is granted only after the online registration on the FINNet 2.0 Portal is completed, and it is followed by the in-principal approval by the Director of FIU-India. The Director reserves the absolute right to deny or cancel the registration if the Reporting Entity is found to be not fulfilling its obligations under the PMLA.
