The latest FIU guidelines mark a clear shift in how India wants the crypto ecosystem to function. Until now, many compliance expectations around virtual digital asset service providers operated in grey zones, with businesses relying on interpretation rather than instruction. These changes make it evident that FIU is no longer in a wait-and-watch mode. Crypto businesses are now expected to operate with the same seriousness, discipline, and accountability as other financial intermediaries.
One of the most significant changes is the stricter onboarding process for new VDASPs. Registration with FIU is no longer a formality and will involve deeper scrutiny of ownership structures, internal controls, and compliance readiness. This raises the entry barrier for new players but also helps filter out entities that are not prepared to operate responsibly in the Indian market.
Responsibility within organisations has also been clearly pushed upwards. The Principal Officer now carries greater ownership and must report directly to the Board. This makes AML compliance a governance issue rather than a backend function. With this shift comes increased liability, requiring senior leadership to actively engage with compliance rather than delegate it entirely.
Transparency has been strengthened by mandating VDASPs to publish summaries of their AML and KYC policies on their websites. Users will now be able to see how platforms verify identities and manage risk. This public-facing disclosure not only builds trust but also puts pressure on platforms to follow what they publish.
Compliance obligations have expanded further with the introduction of annual risk-based assessments of products and mandatory internal AML and KYC audits. VDASPs are now required to periodically evaluate whether their offerings pose heightened financial crime risks and to formally review their compliance systems every year. This adds to operational cost but aligns crypto platforms more closely with regulated financial institutions.
On the operational side, the guidelines finally bring clarity on digital onboarding and KYC verification. Clear parameters on what information must be collected and how verification should be conducted remove long-standing uncertainty. High-risk users will now have to undergo re-KYC every six months, reinforcing the idea that compliance is an ongoing process rather than a one-time exercise.
Some flexibility has also been introduced. Where Travel Rule vendors are unavailable, self-declaration by users is now permitted, offering limited relief in cross-border or infrastructure-constrained scenarios. At the same time, sanction screening requirements have been clearly defined, leaving little room for inconsistent implementation.
The reporting burden has increased with the introduction of new filings such as VTR and FTR. Alongside this, the guidelines discourage VDASPs from facilitating ICOs and ITOs, which may affect revenue models built around token launches. Further, any platform offering services to Indian users must be registered with FIU, irrespective of its location, reinforcing India’s regulatory reach. Restrictions on the use of AEC tokens for deposits and withdrawals add another compliance and operational constraint.
Overall, the message from FIU is clear. Crypto businesses are not being banned, but they are being normalised into the financial regulatory framework. The era of light-touch or informal compliance is coming to an end.
Going forward, the industry must invest in strong internal governance, treat compliance as a core business function, and proactively align with regulatory expectations rather than react to enforcement. Platforms that adapt early, build transparent systems, and engage constructively with regulators are more likely to survive and shape the next phase of India’s crypto ecosystem.