Digital Asset Trading Compliance Obligations - India Focus with Global Case Laws

Digital Assets in India are legally termed Virtual Digital Assets (VDA) under Section 2(47A) Income Tax Act - includes crypto, NFT, any cryptographically generated token. Not legal tender, but not illegal to trade after Supreme Court judgment.

I. Core Compliance Framework Since March 2023

1. PMLA Notification - Gazette S.O. 1072(E) dated 07.03.2023
All VDA Service Providers (VDA SPs) are now Reporting Entities under Prevention of Money Laundering Act, 2002. Applies irrespective of physical presence - offshore serving Indian users also covered.

Activities covered:

• Exchange between VDA and fiat
• Exchange between VDAs
• Transfer of VDAs
• Safekeeping / administration of VDAs or instruments enabling control
• Participation in financial services related to VDA issuance

Obligations as Reporting Entity:

a) FIU-IND Registration: Mandatory. Must register at FINNET 2.0 as RE. Failure = show cause + website blocking + app store removal.

b) KYC / Client Due Diligence:

• Full KYC - PAN mandatory, Aadhaar + video KYC as per PML (Maintenance of Records) Rules 2005
• Beneficial Owner identification for non-individuals
• Risk categorization: low, medium, high. Enhanced DD for high-risk jurisdictions
• Ongoing DD - transaction monitoring, not one-time KYC

c) Transaction Reporting:

• Cash Transaction Report (CTR) > Rs 10 lakh
• Suspicious Transaction Report (STR) to FIU within 7 days of suspicion
• Counterfeit Currency Report, Cross-Border Wire Transfer Report
• Maintain records for 5 years of transaction + KYC

d) Travel Rule - FATF Recommendation 16: For VDA transfers > USD/EUR 1000 equivalent, originator and beneficiary information must travel with transaction. India implemented via FIU guidance 2024.

e) Appoint Key Officers: Principal Officer (PO) + Designated Director - personally liable for PMLA compliance. Must file with FIU.

2. Tax Compliance - Finance Act 2022

• 30% flat tax u/s 115BBH on VDA gains, no set-off of loss, no deduction except cost of acquisition
• 1% TDS u/s 194S on every sale - buyer to deduct, including exchanges. Exchanges must file TDS return. Non-compliance = interest + penalty.
• No distinction between short/long term.

3. FEMA Compliance
Cross-border VDA transfer is treated as capital account transaction. RBI hasn't allowed. ED has attached under FEMA - see WazirX Rs 289.68 cr case for FEMA violation

4. Consumer & Data Compliance

• No SEBI regulation yet, but if token qualifies as security - SEBI Act applies
• DPDP Act 2023 - user data localization
• IT Act - intermediary due diligence

II. Landmark Case Laws

1. Internet and Mobile Association of India (IAMAI) vs RBI (2020) 10 SCC 274 - Foundation Case

Facts: RBI Circular dated 6 April 2018 banned all banks regulated by RBI from providing services to crypto exchanges / traders.

Supreme Court Held:

• Trading in crypto is a legitimate business protected under Article 19(1)(g) - Right to trade
• RBI has power to regulate under Banking Regulation Act, but complete banking ban was disproportionate and failed proportionality test under Article 19(6)
• Ban quashed, banking access restored

Ratio: Crypto not illegal, but RBI can impose risk-based regulation, not prohibition. This judgment opened VDA trading in India.

2. FIU Enforcement Wave - Binance, KuCoin, Bybit - 2023-2025

FIU vs 9 Offshore Exchanges Dec 2023: FIU issued show-cause to Binance, Kraken, KuCoin, Huobi, Gate.io, Bittrex, Bitstamp, MEXC, Bitfinex for serving Indian users without FIU registration. Result: URLs blocked, Apple App Store delisted apps in Jan 2024

Binance - Rs 18.82 crore penalty: Paid $2.25 million, then registered with FIU-IND in Aug 2024 as Nest Services Ltd and resumed operations. Demonstrated extraterritorial reach of PMLA.

KuCoin - Rs 35.5 lakh penalty: Paid and resumed May 2024 as first offshore to comply

Bybit Fintech Ltd - Rs 9.27 crore penalty 2025: FIU imposed Rs 92.7 million for failure to register, blocked website and ceased operations for persistent non-compliance

Legal Principle Established: Physical presence not needed; serving Indian user = Reporting Entity.

3. WazirX / Zanmai Labs ED Investigation - 2022 - PMLA & Lax AML

Facts: ED investigated instant loan app money laundering via crypto route. Found WazirX assisted 16 fintech accused by encouraging obscurity and having lax AML norms, failing to trace crypto assets

Action:

• Rs 64.67 crore frozen under PMLA
• Later Rs 47.64 lakhs in WRX + USDT frozen in E-nuggets gaming fraud case
• Rs 289.68 cr assets seized under FEMA

Compliance lesson: Even before 2023 notification, ED treated exchanges as de-facto reporting entities and scrutinized KYC/AML. Now explicit.

4. Global Precedents Applied in India

SEC vs Ripple Labs, Inc., SDNY July 13, 2023 - Howey Test
Most cited for whether token = security.

Under Howey: Investment of money in common enterprise with expectation of profits from efforts of others = security.

Court Held:

• Institutional sales via written contracts = securities transaction - SEC win
• Programmatic sales on exchanges via blind bid/ask to retail = NOT securities because retail buyer could not know money went to Ripple

India relevance: SEBI uses same logic to decide if a VDA issuance is unregistered securities offering. Most Indian token launches structure to avoid institutional private sale.

US vs Ishan Wahi (Coinbase Insider Trading) 2023
First crypto insider trading case. SEC held listing info is UPSI. Indian compliance takeaway: VDA exchanges must implement insider trading controls under PMLA's fraud prevention.

OFAC vs Tornado Cash - Sanctions Compliance
Mixers banned for money laundering. Indian exchanges must screen for tainted addresses using blockchain analytics (Chainalysis, TRM).

III. Compliance Checklist for Trading Desk / Exchange

1. Pre-trade: FIU registration + PO appointment + KYC system + Sanctions screening (OFAC, UN) + IP geo-blocking for sanctioned countries
2. Trade: Real-time AML monitoring, Travel Rule data capture, 1% TDS deduction and challan
3. Post-trade: STR filing to FIU within 7 days, CTR monthly, 5-year record retention, blockchain analytics for suspicious cluster, quarterly audit by FIU
4. Penalty for non-compliance: Up to Rs 50k to no limit under PMLA Sec 13, plus personal liability for Designated Director, plus blocking under Sec 69A IT Act