CyphrQ
Menu

India Crypto Tax and PMLA Rules: What Exchanges and Users Must Know

India's crypto rules for exchanges and users: PMLA coverage since March 2023, FIU-IND registration, the RBI's position, tax and safe-use checks.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

In India, crypto tax and anti-money-laundering law do most of the regulating. Gains from transferring crypto are taxed at a flat 30%, and the payer holds back 1% of the sale price as tax. Since 7 March 2023, crypto exchange, transfer and custody businesses also fall under the Prevention of Money-laundering Act (PMLA) and must register with FIU-IND, India's financial intelligence unit. Not legal, tax or investment advice.

This post is for people in India who use a crypto platform, and for the teams who run, bank or audit one.

The tax figures below come from the Income Tax Department's own pages, read on 25 October 2026. Those pages describe the Income-tax Act, 1961. The Income-tax Act, 2025 came into force on 1 April 2026, so check which Act and section numbers apply to the year you are filing for.

What does Indian law mean by a "virtual digital asset"?

Indian law uses the term "virtual digital asset", or VDA, rather than "cryptocurrency". The definition sits in the tax law: clause (47A) of section 2 of the Income-tax Act, 1961.

The anti-money-laundering rules borrow that same definition. FIU-IND's registration notice of 4 July 2023 says "virtual digital asset" has the meaning in section 2(47A) of the Income-tax Act, 1961. So one definition decides both what is taxed as a VDA and which businesses count as VDA service providers.

How is crypto taxed in India?

Two rules carry most of the weight.

A flat 30% tax on gains. Section 115BBH of the Income-tax Act, 1961, as shown on the Income Tax Department's site, taxes income from transferring a VDA "at the rate of thirty per cent". The only deduction allowed is the cost of acquisition. A loss on one VDA can't be set off against other income, and it can't be carried forward to later years.

1% TDS on the sale price. The department's TDS guide says section 194S requires the payer to deduct tax "at the rate of 1% of such sum" when paying a resident for a VDA. TDS is tax deducted at source: the payer holds back part of a payment and pays it to the government. Who deducts depends on the trade: the buyer in a direct deal, the exchange when it pays the seller, and both exchange and broker when a broker sits in between, unless they agree in writing that the broker deducts. Without a PAN the rate rises to 20%.

FIU-IND's registration notice ties the two regimes together. It asks each provider for copies of "Form 26Q/26QF/26QE filed with Income Tax Department for TDS on VDA transactions".

Take these points to your tax adviser:

  • Which Act and section numbers apply to your tax year, now that the 2025 Act exists.
  • How your platform reports the TDS it held back, so you can claim credit for it.
  • The thresholds below which TDS does not apply, which the department's guide sets out.

Which crypto businesses does India's PMLA cover?

The Ministry of Finance notification F. No. P-12011/12/2022-ES Cell-DOR, dated 7 March 2023, added five activities to the PMLA. They count only "when carried out for or on behalf of another natural or legal person in the course of business", according to the FIU-IND notice that reproduces them.

Activity named in the 7 March 2023 notification Typical business
Exchange between virtual digital assets and fiat currencies Rupee on-ramps and off-ramps
Exchange between one or more forms of virtual digital assets Crypto-to-crypto trading
Transfer of virtual digital assets Sending and withdrawal services
Safekeeping or administration of virtual digital assets or instruments enabling control over them Custodians and hosted wallets
Participation in and provision of financial services related to an issuer's offer and sale of a VDA Token sale services

The right-hand column is my own illustration, not the notification's wording. The phrase "instruments enabling control" matters for security teams. My reading is that it reaches keys and wallet credentials, not just the coins.

Someone trading their own coins from their own wallet is not running one of these businesses. The rules bite on the platforms people use.

What does FIU-IND registration require of a crypto platform?

The FIU-IND notice sets out the duties. Providers must comply with the PMLA, its rules, and guidelines that FIU-IND issued to VASPs on 10 March 2023. That "inter alia includes" a process for customer due diligence, record keeping, internal control, employee training, and filing suspicious transaction reports with FIU-IND.

Registration comes first. The notice says registration with FIU-IND is a "pre-requisite" for meeting those duties. It also says failure to register "is in itself a non-compliance" with the PMLA and "shall attract action under section 13(2)".

The process is hands-on. The provider's Designated Director and Principal Officer must attend an in-person meeting at FIU-IND's office. They bring, among other things:

  • a note explaining how the business falls within the 7 March 2023 activities
  • the corporate structure and significant beneficial ownership
  • three years of company filings, GST returns and GST registrations in every state where it operates
  • income tax returns and the TDS forms for VDA transactions
  • agreements with any exchange, in India or abroad, for the covered activities
  • a self-declaration that no proceedings by the Directorate of Enforcement or other law enforcement agencies are pending, and no criminal cases

The notice I read does not say how platforms based outside India are treated. Check with FIU-IND directly before you rely on an answer either way.

What is the RBI's position on crypto?

The Reserve Bank of India does not license crypto exchanges under the rules covered here. Its main published instruction is about how banks deal with crypto customers.

In April 2018 the RBI issued circular DBR.No.BP.BC.104/08.13.102/2017-18 on virtual currencies. The Supreme Court set it aside on 4 March 2020, in Internet and Mobile Association of India v. Reserve Bank of India. On 31 May 2021 the RBI told banks, NBFCs and payment system providers that the 2018 circular "is no longer valid" and must not be cited, in its notice Customer Due Diligence for transactions in Virtual Currencies (RBI/2021-22/45).

The same notice says what banks may still do. They can keep running customer due diligence under their KYC, AML and CFT rules, meet their PMLA duties, and apply the Foreign Exchange Management Act (FEMA) to overseas remittances. In practice, expect your bank to ask where crypto-related money comes from and where it goes.

Do CERT-In's cyber security rules apply to Indian crypto platforms?

CERT-In is India's national cyber incident response agency. Its directions can apply to service providers, but I did not open them within this research, so I am not summarising them. Read them on CERT-In's own site, cert-in.org.in, and check how they apply to your platform.

Personal data is a separate duty. KYC files are personal data under India's data protection law. My DPDP Act explainer covers the duties, and the breach notification deadlines guide covers the reporting clock.

How can crypto users in India protect themselves?

None of this tells you whether to buy anything. It tells you how to deal with platforms more safely.

  1. Ask a platform whether it is registered with FIU-IND as a reporting entity. I did not find a public list on FIU-IND's home page, so ask for evidence and keep the answer.
  2. Expect identity checks. Customer due diligence is a PMLA duty for these platforms. A platform that skips it is a warning sign, not a convenience.
  3. Never share your one-time passwords, seed phrase or private keys. No genuine platform or official needs them.
  4. Be wary of urgent calls and videos from "support staff" or "officials". My guide to spotting deepfake scams covers the checks.
  5. Keep your own records of every trade, transfer and TDS entry for tax time.

For how other regions handle this, see the crypto regulation hub. The EU version is in my MiCA explainer.

Going deeper: for security and IT teams

This section assumes you know KYC and AML basics. I only cite the FIU-IND notice of 4 July 2023 and the RBI notice of 31 May 2021, both read at source. I could not open the FIU-IND guidelines of 10 March 2023 themselves, the PMLA record-keeping rules, the tax law, or CERT-In's directions. Check retention periods, reporting deadlines and formats there before they go into a control framework.

Map the five duties to controls. Each of the five duties in the notice needs an owner, a system and evidence:

  • Customer due diligence: identity verification, beneficial-owner capture for corporate clients, and re-verification triggers. Log the outcome and the evidence reference, not just a pass flag.
  • Record keeping: append-only storage for KYC records and transaction history, with access logging. Restores need regular testing, because a record you cannot produce does not exist.
  • Suspicious transaction reporting: transaction-monitoring rules, an alert queue, case notes and a decision trail from alert to filed report. Restrict who can see case files.
  • Internal control and training: written procedures, attendance records and periodic testing by someone outside the operations team.

Treat the registration pack as an evidence register. The documents FIU-IND asks for in items 1(a) to 1(h) double as an audit checklist. They include beneficial ownership, three years of statutory and GST filings, TDS forms and agreements with any exchange in India or abroad. My reading is that liquidity-sharing and white-label arrangements belong in that last item. Keep a current copy of each, with the date it was last checked.

In practice, rules change under you. The RBI's 2018 circular was set aside by the Supreme Court on 4 March 2020. More than a year later, on 31 May 2021, the RBI still had to tell regulated entities to stop citing it (RBI/2021-22/45). Banks' onboarding scripts and partner policies lagged the law. Version your compliance content, record the source and date of each rule, and review it on a schedule.

In practice, registration is gated on clean records. FIU-IND's notice asks for a self-declaration that no Directorate of Enforcement or other law enforcement proceedings and no criminal cases are pending against the company or its directors (FIU-IND, 4 July 2023). Screen directors and partners as part of your own governance, not only at registration.

Custody is in scope. "Safekeeping or administration of ... instruments enabling control over virtual digital assets" points at keys. Document who can sign, approval thresholds, where key shares and backups live, and how you reconcile client holdings against the firm's own. The 2025 Bybit hack shows how a compromised signing process becomes an exchange-scale loss.

Banking partners. Under the RBI's 2021 notice, banks run due diligence on VDA-related flows and apply FEMA to overseas remittances. Prepare source-of-funds evidence and a short explanation of your flows before your bank asks.

What to ask a VDA service provider:

  1. What is your FIU-IND registration status, and who is your Principal Officer?
  2. Which of the five notified activities do you carry out?
  3. How do you monitor transactions, and who decides on filing a suspicious transaction report?
  4. Who controls client keys, and how are client assets kept apart from yours?
  5. Which agreements do you have with exchanges in India or abroad?

Which steps should Indian crypto businesses take now?

  • Map your services against the five activities in the 7 March 2023 notification.
  • Confirm your FIU-IND registration, Designated Director and Principal Officer.
  • Check which Act's section numbers apply to your tax year.
  • Re-check everything with the regulator. This post may lag a rule change.

Learn more

  • FIU-IND: notices to reporting entities, including VDA service providers.
  • RBI notifications: the 2021 notice on customer due diligence for virtual currencies.

Key takeaways

  • India uses tax law and anti-money-laundering law to oversee crypto, under one definition of "virtual digital asset".
  • Five VDA business activities have been under the PMLA since 7 March 2023.
  • Providers must register with FIU-IND. Not registering is itself a PMLA non-compliance.
  • The duties cover customer due diligence, records, internal control, training and suspicious transaction reports.
  • The RBI's 2018 circular is no longer valid. Banks still do customer due diligence on crypto flows and apply FEMA to overseas remittances.
  • Gains from transferring a VDA are taxed at 30%, with no loss set-off, and the payer deducts 1% TDS under section 194S of the Income-tax Act, 1961.

Sources