Overview on Virtual Digital Assets (VDA) – Legal & AML Framework
Definition of Virtual Digital Assets (VDA) :
As per Section 2(47A) of the Income-tax Act, 1961, a Virtual Digital Asset includes:
- Digital tokens or codes : Any information, code, number, or token (other than Indian or foreign currency) created using cryptography or similar technology, which:
- Represents digital value,
- Can be exchanged with or without consideration,
- Acts as a store of value or unit of account, and
- This Can be used in financial transactions or investments, and
- Can be transferred, stored, or traded electronically.
- Non-Fungible Tokens (NFTs) : NFTs or any other similar tokens, by whatever name called.
- Other notified digital assets: Any other digital asset that the Central Government may notify in the Official Gazette from time to time.
Money Laundering Law in India :
The Prevention of Money-Laundering Act, 2002 (PMLA) is India’s main law to prevent money laundering. For these Guidelines, money laundering has the same meaning as given under Section 3 of the PMLA. Along with the Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (PMLR), the law lays down obligations for Reporting Entities, such as:
- Customer Due Diligence (CDD),
- Know Your Customer (KYC),
- Record keeping,
- Transaction monitoring, and
- Reporting of specified and suspicious transactions.
Who Are Reporting Entities?
Under Section 2(1)(sa) of the PMLA, Reporting Entities include persons carrying on designated businesses or professions. This definition also allows the Central Government to notify additional activities or businesses as Reporting Entities.
Inclusion of VDA Service Providers under PMLA : To address money laundering and terrorist financing risks linked to VDAs, the Government of India issued Notification S.O. 1072(E) dated 7 March 2023. Under this notification, Virtual Digital Asset Service Providers (VDA SPs) carrying out the following activities on behalf of others are classified as Reporting Entities:
- Exchange between Virtual Digital Asset and fiat currencies;
- The Exchange between different VDAs;
- Transfer of Virtual Digital Assets;
- Safekeeping or administration of Virtual Digital Asset or tools that control Virtual Digital Assets; and
- Providing financial services related to the issue or sale of Virtual Digital Assets.
As a result, Virtual Digital Asset SPs are now required to comply with AML, CFT, and CPF regulations, similar to banks and other financial institutions.
Regulator for Virtual Digital Asset Service Providers :
Through Notification S.O. 4877(E) dated 9 November 2023, the Director, Financial Intelligence Unit – India (FIU-IND) was appointed as the regulator for Virtual Digital Asset SPs under Section 49(1) of the PMLA. Under the PML Rules, a Regulator is an authority responsible for supervising and monitoring Reporting Entities. Accordingly, FIU-IND is the designated AML/CFT/CPF regulator for Virtual Digital Asset Service Providers.
Purpose and Scope of the Guidelines related to Virtual Digital Asset
These are known as the: AML, CFT, and CPF Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets. The Guidelines consolidate and explain the requirements under:
- Prevention of Money-Laundering Act, 2002 (PMLA);
- Unlawful Activities (Prevention) Act, 1967 (UAPA); and
- Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005 (WMDA), along with rules made under these laws.
Key Compliance Requirements for VDA Service Providers
The Guidelines require Reporting Entities to:
- Implement effective KYC and Customer Due Diligence (CDD);
- Conduct ongoing monitoring of transactions;
- Identify and report suspicious transactions;
- Maintain proper records and documentation; and
- Support investigations by law enforcement and regulatory authorities.
The objective is to prevent money laundering, terrorist financing, and proliferation financing in activities related to Virtual Digital Assets.
FIU Registration & Reporting Entity Status
Since March 2023, Virtual Digital Asset Service Providers (VDA SPs) must register with FIU‑IND as “reporting entities” under the Prevention of Money Laundering Act, 2002. Morover that Failure to register results in penalties under PMLA, section 13(2).
Governance & Compliance Function
- Each exchange must appoint:
- A Designated Director responsible for overall PMLA compliance, and
- full-time Principal Officer (minimum 3 years AML/CFT experience), directly accountable to the board.
- Internal systems must include regular risk assessments, governance frameworks, and internal audits.
Customer Due Diligence & KYC
Strict KYC protocols include:
- PAN verification, full identity proof (Aadhaar, passport, DL, voter ID), date of birth and contact info
- Live selfie capture with movement prompts, IP address, geo-coordinates (lat/long) at onboarding.
- OTP/esign verification of phone/email; bank-account “penny drop” verification.
- Risk-based refresh: High-risk clients (e.g. from FATF grey/black countries, PEPs) reassessed every 6 months; others annually.
Transaction Monitoring & Reporting
- Exchanges must monitor transactions and file: Suspicious Transaction Reports (STRs), Cross-Border Wire Transfer Reports (CBWTRs) — per FIU-IND AML/CFT Guidelines (Mar ’23).
- Monitoring includes tracking transfers to/from unhosted wallets and recording beneficial ownership of wallets.
- Records must be retained for at least five years.
Risk Controls & Sanctions Screening :
Enhanced due diligence for high‑risk jurisdictions, non-profits, tax-haven clients. Screening against international sanctions lists; anonymous transactions using mixers/tumblers are blocked or flagged.
Enforcement & Penalties :
For FY 2024–25, 49 exchanges (45 domestic + 4 offshore) completed FIU registration; offshore access revoked for 25 non-compliant exchanges. Total penalties of INR 28 crore (~USD 3.4 million) were imposed for AML violations. Applies to both Indian and offshore exchanges serving Indian users. Exchanges now operate under a regulatory framework akin to banks, with active monitoring of crypto flows.
Key Terminology Used in the Blockchain Industry
- 5th Anti-Money Laundering Directive: A European law introduced in 2018 that brought cryptocurrencies and crypto businesses under anti-money laundering and counter-terrorism rules.
- Address: A digital location (like an account number) used to send or receive cryptocurrency.
- Alphanumeric: Made up of both letters and numbers.
- Altcoin: Any cryptocurrency other than Bitcoin.
- Anonymity: When a person’s identity is not publicly known.
- Anti-Money Laundering (AML): Rules designed to prevent criminals from hiding or using illegal money. Financial institutions must track transactions and report suspicious activity. Many crypto businesses must also follow AML rules.
- Bank Secrecy Act (BSA): A US law that requires banks and financial institutions to keep records, report large cash transactions, and report suspicious activities to prevent money laundering and crime.
- Binance Chain: A blockchain created by Binance that supports its own coin (BNB), token creation, and decentralized trading.
- Bitcoin (BTC): The first cryptocurrency, allowing people to send money directly to each other without banks. Transactions are recorded on a public ledger called the blockchain. Total supply is limited to about 21 million.
- Bitcoin ATM: A machine that allows users to buy or sell Bitcoin using cash or debit cards.
- Blockchain: A shared digital record that stores all transactions in a secure and transparent way.
- Blockchain Analytics: The process of tracking and analyzing blockchain transactions to detect fraud, crime, or regulatory risks.
- Block: A group of transactions added together to the blockchain.
- BNB (Binance Coin): A cryptocurrency mainly used within the Binance ecosystem.
- Cold Storage: Storing cryptocurrency offline to keep it safe from hacking.
- Crypto Custodian: A company that stores and protects cryptocurrencies for customers.
- Cryptoasset: A digital asset secured by cryptography and recorded on a blockchain.
- Cryptocurrency: Digital money that works on a blockchain and is not controlled by governments or banks.
- Cryptocurrency Exchange: A platform where users can buy or sell cryptocurrencies.
- Cryptography: The use of mathematical methods to secure digital data.
- Dark Web: A hidden part of the internet that requires special software to access. Some illegal activities take place there, but not everything on it is illegal.
- Decentralized Application (dApp): An application that runs on a blockchain instead of a central server.
- Decentralized Autonomous Organization (DAO): An organization run by computer code and smart contracts, without traditional management.
- Decentralized Exchange (DEX): A platform that allows users to trade crypto directly with each other without a central authority.
- Decryption: The process of turning encrypted data back into readable form.
- Decentralized Finance (DeFi):Financial services like lending, trading, and investing that work without banks or intermediaries.
- Digital Signature: A cryptographic method used to prove that a transaction or message is genuine.
- Distributed Ledger Technology (DLT): Technology that allows multiple participants to share and verify records without a central authority.
- Encryption: The process of converting data into a secure code to protect it.
- Ethereum: A blockchain platform that supports smart contracts, tokens, and decentralized applications. Its native currency is Ether (ETH).
- FATF Travel Rule: A rule requiring crypto service providers to share sender and receiver details for large crypto transactions.
- Fiat Currency: Traditional money issued by governments, such as INR, USD, or EUR.
- FinCEN: A US government agency that fights financial crime and money laundering.
- Fork: When a blockchain splits into two versions due to changes or disagreements.
- FUD: Fear, Uncertainty, and Doubt—negative information that can affect crypto prices.
- Fungible Token: A token where each unit is identical and interchangeable, like cash.
- Genesis Block: The very first block created on a blockchain.
- Hacking: Gaining unauthorized access to computer systems or networks.
- Halving: An event where Bitcoin mining rewards are cut in half to control supply.
- Hardware Wallet: A physical device used to store cryptocurrency securely.
- Hash Rate: The total computing power used to process blockchain transactions.
- HODL: A slang term meaning to hold crypto long-term instead of selling.
- Hyperledger: An enterprise blockchain project supported by major global companies.
- Initial Coin Offering (ICO): A method of raising funds by selling new crypto tokens to investors.
- Know-Your-Customer (KYC): A process where businesses verify the identity of their customers to prevent fraud and crime.
- Litecoin (LTC): A cryptocurrency similar to Bitcoin but faster and with a higher supply limit.
- Mainnet: The live, fully operational version of a blockchain.
- Mining: The process of validating transactions and adding them to the blockchain.
- Mixer: A service that mixes crypto transactions to hide their origin.
- Native Asset: The main cryptocurrency of a blockchain (e.g., ETH for Ethereum).
- Neobank: A fully digital bank with no physical branches.
- Node: A computer that connects to and helps maintain a blockchain network.
- Non-Fungible Token (NFT): A unique digital asset representing ownership of something specific, like digital art.
- NPRM: A public notice issued by a US agency proposing new or revised rules.
- Paper Wallet: A printed copy of crypto keys stored offline.
- Peer-to-Peer (P2P): A system where users interact directly without intermediaries.
- Privacy Coin: A cryptocurrency designed to hide transaction details.
- Private Key: A secret code that allows access to and control over cryptocurrency funds.
- Protocol: A set of rules that determines how a blockchain operates.
- Pseudonymous: Transactions are visible, but identities are not directly revealed.
- Public Key: A key that can be shared to receive cryptocurrency.
- Pump and Dump: A scam where prices are artificially inflated and then sold off quickly.
- Ripple / XRP: A company and cryptocurrency focused on fast international payments.
- Sanctions:Restrictions imposed by governments to block financial activity with certain countries or individuals.
- Satoshi Nakamoto: The unknown creator of Bitcoin. A “satoshi” is the smallest unit of Bitcoin.
- Security Token: A digital version of traditional securities like shares or bonds.
- Silk Road: A former dark-web marketplace shut down in 2013.
- Smart Contract: Self-executing code that automatically carries out agreements.
- Stablecoins: Cryptocurrencies designed to maintain a stable value, usually linked to fiat currency.
- Standard: A set of agreed technical rules that ensure systems work together.
- Token: A digital unit created on a blockchain for specific uses.
- Token Swap: Exchanging old tokens for new ones when a project moves to its own blockchain.
- Tokenize: Converting real-world assets into digital tokens.
- Transaction Fee: A fee paid to process a crypto transaction.
- Unbanked: People without access to traditional banking services.
- Unregulated: Activities not covered by existing financial laws.
- Utility Token: A token used to access products or services.
- Vanity Address: A customized crypto address containing chosen letters or words.
- Virtual Asset Service Provider (VASP): A business that provides crypto services such as exchanges, wallets, or transfers.
- Wallet: A tool used to store, send, and receive cryptocurrency.
- Wei: The smallest unit of Ether.
- Whales: Individuals or entities holding large amounts of cryptocurrency.
- Whitelist: A list of approved users or crypto addresses.
- XRP: The cryptocurrency used by Ripple for global payment solutions.