Crypto-based assets continue to keep regulators across the world on their toes. The race to develop effective regulation for the ever-evolving range of crypto- based assets is riddled with roadblocks; the basic challenges being imposing a uniform classification on them within the broader class of digital assets and regulating them both responsibly and effectively.

India has adopted a broad definition to cover crypto-based assets: virtual digital assets (VDAs). VDAs are defined as assets representing a certain value created using encryption or other methods, including unique digital items such as non-fungible tokens (NFTs).

There is currently no specific law in India on the regulation of VDAs. India’s banking regulator - the Reserve Bank of India (RBI), in April 2018, did try to limit the circulation of VDAs in the Indian financial ecosystem. The RBI restrained banks and other entities regulated by the RBI from providing services to entities dealing in VDAs (virtual currencies at that time). The RBI’s direction and power to regulate VDAs were challenged before the Supreme Court, which struck down the RBI's April 2018 circular as being disproportionate. The Supreme Court, however, upheld the RBI’s power and authority to regulate virtual currencies.

More recently, the Ministry of Finance released a notification in March 2023 under the Prevention of Money Laundering Act, 2002 (PMLA) that introduces reporting obligations on businesses dealing with VDAs (the “March 2023 Notification”).  

The PMLA imposes reporting and compliance obligations on “reporting entities” (REs). REs include banks, financial institutions, and entities carrying on designated business activities (identified by the Ministry of Finance). The March 2023 Notification expanded the list of designated businesses – a person or entity carrying on the activities outlined in the table below in the course of business is now an RE under the PMLA regime:

The business activities added under the ambit of REs are the same activities identified by the Financial Action Task Force under the definition of “Virtual Asset Service Provider” in its recommendations on combating money laundering and terror financing.

REs are subject to a significant number of compliance and reporting obligations. These include various requirements under the PMLA which are inter-linked with regulations and directions issued by the RBI. Although crypto-exchanges have usually followed know your customer (KYC) standards and diligence for their customers, the compliance obligations are now a “must-have”, rather than the “good-to-have” they were before. These obligations include the following:

The enforcement authority (an officer empowered under Section 49(1) of the PMLA) can inquire about the status of compliance or conduct audits of the RE’s records. The enforcement authority, if it is of the opinion that an RE is non-compliant, may direct the RE to comply with specific instructions, direct the RE to increase reporting obligations or impose a monetary penalty on the RE. More importantly, VDA-related REs will now have to actively, and as a legal obligation, assist the Directorate of Enforcement (the entity responsible for enforcing economic laws and fighting economic crime in India) in its investigations by providing information and documents.

Although the above list of obligations is not exhaustive, it clearly reflects the need to implement adequate processes to ensure compliance. For instance, REs need to maintain records of customers and all transactions for a period of five years. This will require an increase in security and storage capacity, and subsequent compliance with privacy and data localisation (RBI requires end-to-end data on transactions to be stored in India) obligations.

Similarly, monitoring all transactions on an exchange to adequately identify suspicious transactions requires advanced system and oversight capabilities. Indian regulators may even consider all VDA transactions as high risk due to their potential anonymity and cross-border aspects. Consequently, even regular day-to-day VDA activities may be seen as potentially suspicious or high-risk transactions requiring constant monitoring and EDD measures. These compliance obligations are onerous and unhelpfully ambiguous.

There has been a disconnect between the enforcement authorities and the industry in the recent past on which activities invite RE compliance obligations. For instance, the FIU-I held that PayPal (a technology interface not handling funds) is an RE under the PMLA and imposed a monetary penalty on PayPal for alleged violations of compliance and reporting obligations. PayPal challenged the FIU-I’s decision before the Delhi High Court. The Court held that PayPal is an RE under the PMLA required to maintain records and furnish information on transactions. The court reasoned that regulatory authorities must be empowered “to view and analyse all aspects of data connected with a particular transaction” in order to effectively fight against money laundering. Following this judgment, a technology interface or system with enables payment between a payer and a beneficiary will be treated as an RE under the PMLA.

The March 2023 Notification substantially increases the cost and compliance burden on exchanges, wallet providers, and other service providers dealing in VDAs. It hits anonymity (a key factor in the popularity of VDAs), and would require consistent, costly, and canonical disclosures of VDA transactions. VDA-related REs will have to build and implement adequate processes and infrastructure akin to banks to not only track and comply with the requirements but go above and beyond to safeguard themselves from the potentially onerous expectations of enforcement authorities.