Financial Intelligence Unit

FIU-IND AML & CFT Guidelines 2026: What Every Crypto Business in India Must Know

On January 8, 2026, FIU-IND released new AML (Anti-Money Laundering) and CFT (Countering the Financing of Terrorism) Guidelines for Virtual Digital Asset Service Providers (VDASP). These guidelines create an important regulatory framework for crypto-related businesses operating in India. 

Earlier, the rules were simple, but now each VDASP will have to develop a more well-organized and technology-based compliance system. Crypto businesses will also have to operate with the AML and CFT rules like banks and other regulated financial institutions. 

In this blog, we will discuss the key points of the 2026 FIU-IND guidelines, updated as on 8 January, 2026. You will also know who is covered by these rules, the laws based on these guidelines, and what they mean for businesses. 

What are the 2026 FIU-IND AML and CFT Guidelines? 

The FIU-IND AML and CFT Guidelines 2026 are new compliance guidelines for Virtual Digital Asset Service Providers (VDASP). These guidelines reduce the risk of money laundering, terrorist financing, and other financial crimes. 

These guidelines were released by the Financial Intelligence Unit-India (FIU-IND) on 8 January 2026. They explain how to comply with the PMLA and PMLR rules. 

Now, businesses also have to follow those rules properly. For example, doing KYC of the customer, completing Customer Due Diligence (CDD), monitoring transactions, sending suspicious transaction reports when necessary, and maintaining all records properly. After these guidelines, compliance in the crypto business will have to be given more importance. 

Who Should Follow FIU-IND AML and CFT Guidelines? 

These guidelines by FIU-IND apply to organizations and businesses that provide virtual digital asset-related services. It is not the location of the organization, but the type of activities they are conducting. 

The entities that fall under this guideline are: 

• Crypto Exchanges
• Crypto Wallet Service Providers
• Digital Asset Custodians
• NFT Platforms
• Token Issuing Institutions
• VDA Brokers
• Web3 Service Providers
• Entities registered abroad but serving Indian users

Even when an entity is registered outside India and they provide notified VDA services to Indian customers, it will also have to comply with the FIU-IND rules. So, this guideline is called an activity-based compliance framework. 

Legal Basis of these Guidelines 

FIU-IND’s AML and CFT Guidelines of 2026 are based on multiple laws and government notifications. These laws set out the compliance, reporting, and AML/CFT responsibilities of Virtual Digital Asset Service Providers in India. 

Law / Notification	Purpose
Prevention of Money Laundering Act, 2002 (PMLA)	The primary law that establishes India’s anti-money laundering framework and sets compliance obligations for reporting entities.
Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (PMLR)	Prescribes customer due diligence, record-keeping, transaction monitoring, and reporting requirements.
Notification S.O.1072(E), March 2023	Recognized Virtual Digital Asset Service Providers as Reporting Entities under the PMLA.
Notification S.O.4877(E), November 2023	Designated FIU-IND as the AML, CFT, and CPF regulator for Virtual Digital Asset Service Providers.
Unlawful Activities (Prevention) Act, 1967 (UAPA)	Supports compliance measures to prevent terrorist financing and enforce sanctions.
Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005	Establishes measures to prevent proliferation of financing and implement related sanctions.

Through this legal framework, FIU-IND seeks to ensure that VDA services operating in India are operated in accordance with international AML and CFT standards. 

What is a Virtual Digital Asset (VDA)? 

According to Section 2(47A) of the Income-tax Act in India, Virtual Digital Asset (VDA) means a digital asset that can be created, stored, bought, or transferred electronically. This includes digital assets like cryptocurrencies, some types of tokens, and NFTs (Non-Fungible Tokens). In addition, digital assets that the government may notify in the future may also come under the scope of the VDA. 

However, the Digital Rupee (e₹) or Central Bank Digital Currency (CBDC) does not fall under these guidelines. It is the government digital currency issued by the Reserve Bank of India (RBI). 

These Guidelines of FIU-IND apply to the purchase and sale of VDA, exchange from one VDA to another, VDA transfer, custody services, and financial services related to the issue of VDA. 

FIU-IND Requirements for VDASP  

As per the new guidelines of FIU-IND, a person carrying on notified VDA activities and falling within the PMLA framework must comply with FIU-IND registration requirements before commencing those activities. Without this registration, running VDA-related, notified services is not permitted as per the law. 

The following steps are followed during registration: 

• Apply as a Reporting Entity on the FINGate Portal.
• Submit the required information and documents.
• Provide information about the organization’s AML/CFT arrangements.
• A technical walkthrough or system demo may berequiredwith FIU-IND. 
• The organization is given an FIU RE-ID (Reporting Entity ID) when everything is satisfactory.

Documents that may be required in general: 

• Company registration documents
• GST and income tax information
• AML/CFT policy of the organization
• Ownership and management information
• Other required AMLcompliance documents 

Through this registration, FIU-IND ensures that the organization is ready to comply with the required AML/CFT rules. When an organization provides such services without registration, then regulatory action can be taken against it under PMLA. 

Governance Requirements as per the FIU-IND AML and CFT Guidelines  

FIU-IND wants every VDASP to have a strong compliance system within it. So, not only technology, but also the division of responsibilities within the organization is important. Two important positions are mandatory. 

These include: 

• Appointment of Designated Director (DD). 
• Appointment of Principal Officer (PO). 
• DD oversees the AML/CFT compliance of the entire organization. 
• PO monitors suspicious transactions, reports, and manages day-to-day compliance. 
• These two should be separate individuals. 
• Regular compliance reports should be submitted to the board. 
• Staff should be trained on AML/CFT. 
• The AML/CFT system should be independently audited from time to time. 
• Risk assessment and internal controls should be reviewed regularly. 

Such a governance framework provides clarity to the organization’s responsibilities. It also increases the credibility of the organization with regulators and reduces compliance risks. 

AML, CFT, and CPF Policy Requirements 

As per the FIU-IND Guidelines, each VDASP must develop a written AML, CFT, and CPF Policy. This policy should clearly outline the organization’s compliance measures, risk management, and reporting processes. It is not enough to just create a policy; it must be updated regularly. 

A good policy usually includes the following: 

• Money laundering risk assessment
• Countering the risk of terrorist financing
• Controlling the risk of proliferation financing
• Customer onboarding and KYC process
• Customer Due Diligence (CDD)
• Transaction monitoring system
• Sanctions Screening rules
• Procedure forsubmittingSuspicious Transaction Report (STR) 
• Security of customer information and data
• Record retention for a specified period
• Policy reviews at least once a year
• Publishing a summary of the AML Policy on the organization’s website or app

The organization can work according to the same rules as such a policy. In addition, it helps to show the necessary documents during the inspection or audit of the FIU-IND. 

Customer Due Diligence (CDD) and Risk Classification 

Customer Due Diligence (CDD) is one of the most important parts of the FIU-IND Guidelines. It verifies the identity of the customer and provides services properly, understanding the level of risk. CDD starts at the time of new customer onboarding. Later, it has to be updated again when necessary. 

The following issues are usually addressed during CDD: 

• Know Your Customer (KYC) verification. 
• PAN verification is mandatory. 
• Collecting necessary identification documents and contact information. 
• In the case of a company or any other organization, verifying the information of the organization. 
• Identifying the real owner or beneficial owner. 
• Classifying the customer into different categories based on risk. 
• Keeping more vigilance for high-risk customers. 
• Updating KYC information again after a certain period of time. 
• Re-verifying if there is a major change in the customer’s information or activity. 

Through this process, the institution can understand the risk of the customer in advance. This helps to identify suspicious transactions and comply with AML/CFT rules. 

Requirement for Enhanced Due Diligence (EDD) 

In some cases, regular CDD is not sufficient; Enhanced Due Diligence (EDD) is required. More detailed information about the customer is collected and verified through this. 

EDD is applicable to the following cases: 

• High-risk customers 
• Politically Exposed Persons (PEPs) 
• Non-profit Organization (NPO) 
• Customers from high-risk countries or regions 
• Where the risk of money laundering or other financial crimes is high. 

The Tasks performed during EDD: 

• Verify the source of funds. 
• Verify the customer information more thoroughly. 
• Keeping additional monitoring on transactions. 
• Regularly reviewing the customer profile when necessary. 

If this additional verification cannot be completed or satisfactory information is not obtained, the institution should terminate the business relationship with that customer and submit an STR to FIU-IND. 

Transaction Monitoring and Travel Rule Compliance 

As per the FIU-IND Guidelines, each VDASP is required to regularly monitor the customer’s transactions. Not only large transactions, but also any unusual or suspicious activity should be monitored. Many organizations are now using automated monitoring systems. 

This process usually includes: 

• Monitoring all transactions regularly. 
• Using an Automated Monitoring System. 
• Identifying unusual transactions through AI and analytics. 
• Monitoring transactions of different wallets. 
• If necessary, check suspicious transactions separately. 

In addition, the guidelines also have clear instructions on travel rules. It helps to store the necessary information of the sender and recipient during VDA transfers. 

Travel Rules require the following information to be stored: 

• Originator’s name and PAN 
• Originator’s Wallet Address 
• Beneficiary’s name 
• Beneficiary’s Wallet Address 
• Sharing information promptly 
• Maintaining complete transaction records 

As a result of this rule, each transaction’s information can be easily found. It also helps to provide the necessary information quickly during investigations. 

Sanctions Screening and Suspicious Transaction Reporting (STR) 

As per FIU-IND Guidelines, sanctions screening is mandatory before onboarding a customer and during the transaction. This checks whether an individual or entity is on the banned list. 

During Sanctions Screening, the following points are usually followed: 

• Screening during customer onboarding.
• Screening again during the KYC update.
• Re-verification when a new sanction list is published.
• Screening, if necessary, before the transaction.
• Follow the UNSC sanction list.
• Follow the rules of UAPA.
• Follow the instructions of WMDA.

If a transaction seems suspicious, then a Suspicious Transaction Report (STR) must be submitted to FIU-IND. 

STR usually contains the following information: 

• Customer KYC information
• Wallet Address
• Transaction information
• Counterparty information
• Reason for suspicion

The information must be correct and complete when submitting the STR. At the same time, the institution or employees can never inform the customer that an STR has been filed against him. This is called Prohibition on Tipping Off. 

Record Keeping and Reporting Obligations 

As per the FIU-IND Guidelines, every VDASP is required to maintain customer and transaction-related information for a specified period of time. Maintaining proper records is very useful during investigations and audits. 

The organization generally has to ensure the following things: 

• Maintaining records related to customer KYC and identity. 
• Retaining complete information on each transaction. 
• Retaining records for a specified period of time even after the account is closed. 
• Retaining necessary records for at least 5 years. 
• Retaining audit trails, verification logs, and other important information. 
• Submit monthly reports to FIU-IND as required. 
• Storing all information in a secure manner. 
• Having a system for quick retrieval of information for regulatory agencies, if required. 

Having a good record-keeping system helps to maintain compliance. It is also possible to provide information quickly when the regulatory agency asks for it. 

High-Risk Activities According to FIU-IND Guidelines 

FIU-IND has considered certain Virtual Digital Asset (VDA) activities to be at a higher risk. In these cases, institutions need to be extra vigilant and follow stronger compliance measures. 

High-Risk Activity	Regulatory Approach
ICOs and ITOs	Strong compliance controls
Unhosted wallets	Enhanced monitoring
Unregistered VDASPs	Higher regulatory risk
Privacy-focused crypto assets	Generally discouraged
Mixers and tumblers	High-risk and closely monitored

The above activities may pose a relatively high risk of money laundering and other financial crimes. So, FIU-IND has asked institutions to place greater emphasis on risk assessment, additional due diligence, and regular monitoring. More caution has been instructed to follow the use of privacy-focused crypto assets, mixers, and Tumblers. 

Impact of the New Guidelines on Crypto Business 

After the 2026 Guidelines of FIU-IND, compliance is no longer just a legal formality. Now it has become an important part of an organization’s regular business operations. So, organizations need to build a strong compliance system from the beginning. 

The issues that are gaining more importance because of this change: 

• Compliance is now an important part of the business. 
• The responsibilities of management and senior executives have increased. 
• Technology-based monitoring systems need to be used. 
• More documents and records need to be stored than before. 
• Good compliance is needed to maintain relationships with banks and financial institutions. 
• One must always be prepared for inspections by regulatory agencies. 
• Regular policy reviews and continuous compliance should be maintained. 

Organizations that prioritize these issues from the beginning will be able to operate their business with less risk in the future. 

How can Enterslice help with Compliance? 

Complying with the new FIU-IND Guidelines may not be easy for many organizations. Especially in the case of new virtual digital asset service providers, proper planning and documentation are very important. In this case, Enterslice provides the necessary compliance support. 

Our Services: 

• Full support for FIU-IND Registration 
• Preparation of AML, CFT, and CPF Policy 
• Compliance Gap Assessment 
• Advice on KYC and Customer Onboarding processes 
• Development of Risk Assessment Framework 
• Preparation of required Internal Compliance Documentation 
• Support for Regulatory Reporting 
• Preparation for Audits 
• Providing regular Compliance Advisory for VDASP 

Conclusion 

FIU-IND’s AML and CFT Guidelines 2026 have brought a significant change in the crypto compliance system in India. Now virtual digital asset service providers will have to build a stronger compliance system across all areas- governance, customer onboarding, AML, CFT, CPF, transaction monitoring, reporting, and record keeping. 

Organizations that adhere to these rules from the start will be able to reduce regulatory risks. It will also increase the credibility of the business and help to work with banks and other financial institutions. 

Enterslice supports Virtual Digital Asset Service Providers with professional assistance to understand the FIU-IND rules, create the right compliance framework, and keep pace with the changing regulatory environment. Businesses can operate more securely in the long term.

FAQs Releated To FIU-IND AML & CFT Guideline