India tightens crypto rules with live selfies, geo checks

India has significantly tightened compliance requirements for cryptocurrency exchanges as part of a broader push to curb money laundering and illicit financial activity in the digital asset market. The Financial Intelligence Unit of India has issued fresh Anti-Money Laundering and Know Your Customer guidelines that place stricter obligations on crypto platforms during user onboarding, transaction monitoring and record keeping.

Crypto exchanges brought under tighter oversight

Under the new framework, cryptocurrency exchanges are formally classified as Virtual Digital Asset service providers under the Prevention of Money Laundering Act. This makes them reporting entities that must comply with enhanced due diligence and reporting standards. All such platforms are required to register with the FIU and submit regular reports on suspicious transactions, according to Times of India.

India does not recognise crypto assets as legal tender. However, they are taxed under the Income Tax law, and regulators have increased scrutiny to manage risks related to money laundering, terror financing and proliferation financing.

Mandatory live selfie and location tracking

One of the key changes relates to user onboarding. Crypto exchanges can no longer rely only on document uploads. Users must now take a live selfie during account creation. The selfie must use software that verifies the person’s physical presence through eye blinking, head movement or similar actions. This step aims to prevent identity fraud, including the use of static images or manipulated visuals.

Exchanges must also capture detailed technical information at the onboarding stage. This includes the exact latitude and longitude, date, time stamp and IP address from where the user begins the registration process. The FIU has stated that exchanges must ensure the person providing credentials is the same individual who is personally creating and accessing the account.

Expanded KYC and other verification

The new guidelines mandate stronger identity checks. In addition to a Permanent Account Number, users must submit a second government issued identity document. This can include a passport, Aadhaar card or voter ID. Platforms must also verify the user’s email address and mobile number through one time passwords.

Bank account verification is also compulsory. Exchanges must use the penny drop method, to confirm that the bank account is active and belongs to the same user. This step ensures that financial links are genuine and traceable.

Frequent reviews for high risk clients

The FIU has directed exchanges to carry out periodic KYC updates. High risk clients must undergo KYC updation every six months, while all other users must be reviewed annually. High risk categories include individuals or entities linked to tax haven jurisdictions, countries listed by the Financial Action Task Force under grey or black lists, politically exposed persons and non profit organisations.

For such cases, exchanges must conduct enhanced client due diligence. This involves checking open source information and independent databases to assess risk levels more accurately.

Crackdown on ICOs, mixers and anonymous tokens

The guidelines also take a strict view on Initial Coin Offerings and Initial Token Offerings. The FIU has stated that these activities carry heightened money laundering and terror financing risks and often lack justified economic rationale. Exchanges have been asked to strongly discourage such offerings.

In addition, platforms must not facilitate transactions involving anonymity enhancing crypto tokens, tumblers or mixers. These tools are designed to hide the origin and ownership of crypto funds. Any such activity must trigger appropriate risk mitigation measures.

Long term data retention requirements

Crypto exchanges must preserve customer identity records, address details and transaction data for at least five years. If an investigation is ongoing, the data must be retained until the case is closed. The FIU has emphasised that strong record keeping is essential to track and investigate suspicious activity in the crypto ecosystem.

These measures mark a major shift in India’s regulatory approach to digital assets, placing compliance and traceability at the centre of crypto operations.