The Union Budget of 2022 introduced significant clarity on the taxation of cryptocurrencies in India. Prior to this, there was no specific tax framework for digital assets. This guide provides a comprehensive overview of the regulatory requirements and steps for establishing a cryptocurrency trading business or exchange in India.
Understanding the Regulatory Landscape
The legal status of cryptocurrencies in India remains in a state of evolution. While not explicitly prohibited, the ecosystem is governed by a growing body of financial and corporate regulations. Prospective crypto businesses must navigate a complex framework that emphasizes transparency, anti-money laundering (AML) protocols, and corporate compliance.
Operating a crypto exchange or trading company requires adherence to the Companies Act of 2013, regardless of whether the entity is domestic or foreign-owned. The process involves multiple government approvals and strict compliance with financial regulations.
Core Registration: The Private Limited Company
The most common structure for a crypto business in India is a Private Limited Company (Pvt Ltd). This entity type offers limited liability protection to its shareholders. A minimum of two members is required to incorporate such a company, with the maximum number of shareholders capped at 200.
Steps for Private Limited Company Registration
- Obtain a Digital Signature Certificate (DSC): This is a mandatory digital signature from a government-recognized agency, required for filing all electronic incorporation documents.
- Apply for a Director Identification Number (DIN): Every proposed director of the company must obtain a unique DIN. This is typically issued upon the filing of the SPICe+ form (INC-32) for company incorporation.
- Select a Company Name: Choose a unique name that is not identical or deceptively similar to any existing registered company. The name must end with 'Pvt Ltd'.
File Forms with the Registrar of Companies (ROC): The SPICe+ form (INC-32) is used for:
- Allotment of DIN
- Name reservation
- Company incorporation
- Application for Permanent Account Number (PAN) and Tax Deduction and Collection Account Number (TAN)
Additionally, forms INC-33 (MoA) and INC-34 (AoA) are filed to submit the company's Memorandum and Articles of Association.
Required Documentation
For Indian Nationals:
- Identity Proof (Passport, Driver’s License, Voter ID)
- Address Proof
- PAN Card
- Aadhaar Card
- Passport-sized photographs
- Proof of registered office address
- Affidavit on stamp paper
For Foreign Nationals:
- Passport
- Proof of address (as per foreign standards)
- Email and mobile number
Mandatory Additional Registrations
After company incorporation, several other registrations are critical for operation:
- Permanent Account Number (PAN): For tax purposes.
- Tax Deduction and Collection Account Number (TAN): For tax deducted at source.
- Goods and Services Tax Identification Number (GSTIN): For indirect taxation.
- FIU-IND Registration: Mandatory for all Virtual Digital Asset (VDA) service providers.
- Legal Entity Identifier (LEI): Required for non-individual entities conducting single payment transactions of ₹50 crore or more through NEFT or RTGS systems.
Financial Intelligence Unit (FIU-IND) Registration
A pivotal requirement for crypto businesses is registration with India's Financial Intelligence Unit. The Ministry of Finance mandates that all VDA service providers register with FIU-IND and comply with the Prevention of Money Laundering Act (PMLA) and its associated rules and guidelines.
Registration Procedure
The process involves two parts:
- Reporting Entity Registration: The company must submit an application with the required documents. Upon verification, FIU-IND issues a certificate of registration.
- Principal Officer Registration: After the entity is registered, an application for the designated Principal Officer must be filed. This individual will be responsible for compliance communications.
Consequences of Non-Compliance
Failure to register with FIU-IND is a violation of the PMLA and can result in:
- Official warnings and directives
- Mandatory reporting on compliance measures
- Monetary penalties
- Potential referral to the Ministry of Electronics and Information Technology (MeitY) to block the non-compliant platform's URLs and mobile applications in India.
Ongoing Reporting Obligations
Registered entities must submit periodic reports to FIU-IND, including:
- Cash Transaction Reports (CTRs) for transactions ≥ ₹10 lakh, due by the 15th of the next month.
- Suspicious Transaction Reports (STRs), due within 7 working days of identification.
- Reports for cross-border wire transfers ≥ ₹5 lakh and immovable property transactions ≥ ₹50 lakh.
Risk Management and Operational Controls
Running a crypto exchange requires a proactive approach to risk. Entrepreneurs must assess regulatory ambiguity, market volatility, and cybersecurity threats. A robust compliance framework is essential.
Key departments to establish include:
- Accounting & Compliance: Manages GST, income tax, ROC filings, KYC/AML, and FIU reporting.
- Legal & Regulatory: Monitors legal changes and handles litigation related to crypto regulations.
- Operations: Manages day-to-day trading, payment processing, and crypto transactions.
- Software & Security: Implements critical cybersecurity measures.
Essential security controls comprise multi-factor authentication, strong encryption, regular software patching, intrusion detection systems, and comprehensive employee training. Regular security audits, penetration testing, and a solid incident response plan are non-negotiable for safeguarding assets.
👉 Explore advanced compliance strategies
Key Considerations for Launching an Exchange
- Draft clear, comprehensive terms and conditions for user agreements.
- Implement strong user verification, including OTP, Aadhaar-based authentication, and live video KYC.
- Consider using escrow account systems for customer transactions to enhance trust and security.
- Maintain transparent records of earnings, losses, crypto holdings, and client deposits.
Frequently Asked Questions
What is the first step to starting a crypto exchange in India?
The first step is to incorporate a Private Limited Company under the Companies Act, 2013. This establishes your legal business entity and is a prerequisite for all subsequent regulatory registrations, including FIU-IND.
Is FIU-IND registration mandatory for all crypto businesses?
Yes. As per the July 2023 mandate from the Ministry of Finance, all entities providing services related to Virtual Digital Assets (VDAs) must register with the Financial Intelligence Unit-India (FIU-IND) and comply with PMLA regulations.
What are the risks of not complying with FIU-IND regulations?
Non-compliance can lead to severe penalties, including monetary fines, mandatory compliance directives, and ultimately, the blocking of your website and application by Indian authorities. This effectively shuts down operational access to the Indian market.
Do I need a Legal Entity Identifier (LEI) for my crypto company?
An LEI is required if your company (a non-individual entity) engages in single payment transactions of ₹50 crore or more through the NEFT or RTGS systems. It is a global code that helps in uniquely identifying parties to financial transactions.
What security measures are critical for a new exchange?
Essential measures include multi-factor authentication for all users, encryption of data, regular security audits and penetration testing, a dedicated incident response team, and continuous employee training on the latest cybersecurity threats and protocols.
How can I handle the regulatory uncertainty in the Indian crypto space?
Staying informed is key. Work with legal experts specializing in Indian financial technology law, maintain stringent compliance with all existing regulations (PMLA, FIU-IND, corporate laws), and implement flexible operational systems that can adapt to new regulatory announcements.