India has introduced stricter know-your-customer requirements for cryptocurrency users as part of new compliance guidance issued by the country’s Financial Intelligence Unit, signaling a tougher regulatory stance on digital asset platforms operating in the country.
Under the updated rules, crypto exchanges must implement enhanced identity verification during user onboarding. This includes mandatory live selfie verification that confirms a user’s physical presence through actions such as eye blinking or head movement, a measure aimed at preventing deepfake and static-image fraud.
In addition to live selfies, users will be required to submit government-issued photo identification such as a passport, Aadhaar card, or voter ID. Exchanges must also verify both a user’s email address and mobile number and conduct a small test transaction to the user’s bank account before granting full platform access.
At registration, platforms will be required to record detailed metadata, including IP address, geolocation, device information, and timestamps. These measures are designed to strengthen traceability and reduce the risk of identity misuse and financial crime.
The FIU has also introduced stricter timelines for ongoing compliance. Users classified as high-risk will need to update their KYC information every six months, while all other customers must complete annual updates.
The move follows a series of high-profile security breaches that have shaken confidence in India’s crypto ecosystem. In 2024, WazirX, then the country’s largest exchange, suffered a breach that resulted in losses of approximately $235 million and forced the platform into a court-monitored recovery process.
In 2025, CoinDCX was hit by a $44 million hack involving an internal operational wallet used for liquidity purposes. Although customer funds held in cold storage were not affected, the incident intensified regulatory concerns over platform risk and internal controls.
FIU targets ICOs and privacy-focused crypto tools
The new guidance also reiterates the FIU’s strong opposition to privacy-enhancing crypto technologies. Tools such as mixers, tumblers, and transaction obfuscation techniques, as well as privacy-focused cryptocurrencies, have been flagged as high-risk due to their potential use in money laundering and terror financing.
Initial Coin Offerings and Initial Token Offerings are also discouraged under the framework, with the FIU citing elevated compliance and enforcement risks. Registered entities are required to implement controls to prevent transactions linked to unregulated token offerings and anonymity-focused crypto tools.
India’s crypto industry faces growing regulatory pressure
India has become one of the most tightly regulated major crypto markets globally. The country imposes a flat 30% tax on digital asset capital gains and does not allow losses to be offset, a policy many industry participants say has slowed innovation and adoption.
Since bringing Virtual Digital Asset service providers under the Prevention of Money Laundering Act in March 2023, the FIU has steadily expanded its oversight. During the 2024–25 period, 49 entities registered as reporting institutions, including 45 domestic platforms and four major offshore exchanges such as Binance, Coinbase, and KuCoin, which re-entered the Indian market after completing compliance procedures.
Despite these developments, the Reserve Bank of India remains cautious, continuing to classify cryptocurrencies as high-risk assets that could threaten financial stability if left unchecked.
With the latest FIU rules, India is signaling that tighter oversight rather than liberalization will shape the next phase of its crypto market evolution.
