India Tightens AML and KYC Norms for Cryptocurrency Exchanges

Live Verification and Location Tracking Made Mandatory​

India has introduced a tougher compliance framework for cryptocurrency exchanges, tightening Anti Money Laundering and Know Your Customer requirements to curb illegal activity in the digital asset ecosystem. The updated norms significantly expand onboarding checks and ongoing monitoring obligations for exchanges operating in the country.

Under the revised framework, cryptocurrency platforms are classified as Virtual Digital Asset service providers and are required to move beyond basic document uploads during customer onboarding.

Live Selfie Checks and Geographical Data Capture​

A key change is the mandatory use of live selfie verification. Users must complete a real time photo capture process that confirms physical presence through actions such as eye blinking or head movement. This step is intended to prevent the use of static images or manipulated visuals during account creation.

Exchanges are also required to capture detailed location and access data at the start of onboarding. This includes latitude and longitude, date, timestamp, and the IP address from which the account registration is initiated.

Bank Account Validation and Multi Layer Identity Checks​

To verify bank account ownership, platforms must implement the penny drop mechanism, which involves processing a nominal Re 1 transaction to confirm that the account is active and linked to the user.

In addition to a Permanent Account Number, users must submit a secondary identity document such as a passport, Aadhaar, or voter ID. Email and mobile numbers must be verified through one time passwords to complete the onboarding process.

Focus on High Risk Accounts and Periodic KYC Updates​

Exchanges have been directed to ensure that the individual submitting credentials during onboarding is the same person accessing the application and initiating account creation. This verification must be supported by live photo capture and liveness detection technology.

For clients classified as high risk, KYC details must be updated every six months. All other users will be subject to annual KYC updates.

Enhanced Due Diligence for Sensitive Profiles​

An enhanced due diligence process is required for high risk individuals or entities. This includes gathering information from open sources and consulting independent databases, particularly in cases involving links to tax haven jurisdictions, politically exposed persons, or non profit organisations.

Strong Restrictions on ICOs, ITOs, and Anonymity Tools​

The new framework takes a strict view on Initial Coin Offerings and Initial Token Offerings, citing elevated risks due to weak economic justification and increased exposure to financial misuse. Exchanges have also been instructed not to facilitate transactions involving anonymity enhancing crypto tokens, tumblers, or mixers.

Such tools, which are designed to obscure the origin, ownership, or value of transactions by blending assets from multiple sources, are to trigger immediate risk mitigation measures if detected.

Long Term Record Retention Mandated​

Cryptocurrency exchanges must preserve client identification details, address information, and transaction records for a minimum period of five years. These records are required to be retained for longer durations if they are linked to ongoing investigations.

The updated compliance framework has been issued by the Financial Intelligence Unit and reflects a clear push toward stricter identity verification, deeper transaction traceability, and tighter control over high risk crypto activities in the Indian market.