India mandates tighter KYC for crypto users under new FIU rules

Source: Cryptonews Original Title: India mandates tighter KYC for crypto users under new FIU rules Original Link: India’s FIU has mandated live selfie KYC with geolocation and IP tracking for all new crypto users.

Key Requirements

• Crypto exchanges will be required to update KYC every 6 or 12 months based on user risk
• ICOs, ITOs, and anonymity-focused crypto tools have been flagged as high risk under the new guidance

The updated guidance requires regulated crypto platforms to implement more stringent measures when onboarding users and to conduct verification more frequently than before.

New requirements include:

• Live selfie pictures using software to confirm physical presence through features such as eye-blinking or head movement, designed to curb deepfaked static images
• Additional government-issued photo identification, such as a passport, Aadhaar, or voter ID
• Verification of both email address and mobile number
• Small test transaction to the user’s bank account before accessing platform services
• Capture of user’s IP address, geolocation, timestamp, and device details at registration
• KYC updates every six months for high-risk clients, and annually for all other customers

Background: Recent Security Incidents

These tighter measures follow major security incidents affecting India’s crypto exchanges. In 2024, WazirX, India’s largest exchange at the time, lost approximately $235 million worth of various cryptocurrencies in a breach that severely disrupted operations. The following year, CoinDCX, among the country’s top exchanges, fell victim to a $44 million hack targeting an internal operational wallet.

FIU’s Stance on Privacy-Focused Cryptos and Token Offerings

Within the guidelines, the FIU reiterated strong opposition to privacy-enhancing tools such as crypto mixers, tumblers, and obfuscation techniques, along with tokens designed to conceal ownership and transaction history.

The regulator also seeks to “strongly discourage” Initial Coin Offerings and Initial Token Offerings, which it believes pose heightened and complex risks related to money laundering and terror financing.

As such, the FIU requires all registered entities to implement necessary controls to prevent transactions connected with privacy coins, mixers, and unregulated token offerings.

India’s Broader Crypto Regulatory Landscape

India became one of the most tightly regulated jurisdictions for crypto after imposing a flat 30% tax on capital gains from digital asset transactions and disallowing offsetting of losses. Many within the country’s crypto sector argue this policy is restrictive for what could be one of the largest addressable markets globally.

Since categorizing Virtual Digital Asset service providers under the Prevention of Money Laundering Act in March 2023, the FIU has steadily pushed toward mandatory registration and compliance for all exchanges operating in the country.

Recent data suggests that 49 entities registered as reporting institutions during the 2024-25 period, including 45 domestic platforms and four major offshore exchanges such as certain head platforms, which re-entered the market after completing compliance procedures.

Key agencies like the Reserve Bank of India remain skeptical of cryptocurrencies and have continued to classify them as high-risk assets for the country’s financial system and macroeconomic stability.