Explained: Why India is mandating live selfies and location tracking for crypto users

India has tightened the regulatory screws on cryptocurrency exchanges, with the Financial Intelligence Unit (FIU) rolling out a new set of stringent Anti-Money Laundering (AML) and Know Your Customer (KYC) norms aimed at curbing illicit activity in the digital asset ecosystem.

The updated guidelines, issued on January 8 and accessed by PTI, significantly raise compliance requirements for crypto exchanges, formally categorising them as Virtual Digital Asset (VDA) service providers under the Prevention of Money Laundering Act (PMLA).

Who do these rules apply to? 

The norms apply to all cryptocurrency exchanges classified as Virtual Digital Asset (VDA) service providers. These entities are regulated under the Prevention of Money Laundering Act (PMLA) and must be registered with the FIU as reporting entities. 

What changes for users? 

Crypto users will face a much stricter onboarding process. Exchanges must now: 

• Verify identity through a live selfie using liveness-detection software (eye blinking or head movement) 
• Capture geographical data, including latitude, longitude, IP address, date and timestamp at the time of account creation 
• Use the penny-drop method, involving a Re 1 transaction, to verify bank account ownership 
• Collect a PAN and one additional government-issued ID such as Aadhaar, Passport or Voter ID 
• Verify email ID and mobile number through OTPs 

These steps are aimed at ensuring the person opening the account is physically present and genuinely initiating the process. 

Why is liveness detection being made mandatory? 

The FIU says liveness detection helps prevent identity fraud, including the misuse of static photographs and deepfake technologies. It ensures the individual whose documents are submitted is the same person accessing the platform. 

What is the stance on ICOs, ITOs & anonymity tools? 

The FIU has taken a tough position on: 

• Initial Coin Offerings (ICOs) and Initial Token Offerings (ITOs), which it says lack economic justification and pose high money-laundering and terror-financing risks 
• Anonymity-enhancing crypto tokens, as well as tumblers and mixers, which obscure transaction origins 

Exchanges are directed not to facilitate such transactions and to apply strong risk-mitigation measures when detected. 

What are “high-risk” clients under the new rules? 

High-risk clients include: 

• Individuals or entities linked to tax havens 
• Persons from jurisdictions on the FATF grey or black list 
• Politically exposed persons (PEPs) 
• Non-profit organisations (NPOs) 

Such clients will undergo enhanced due diligence, including checks using open-source information and independent databases. 

How often will KYC need to be updated? 

• High-risk clients: every six months 
• All other clients: annually 

What records must exchanges maintain? 

Crypto exchanges must preserve: 

• Customer identity and address details 
• Transaction records 
• These records must be kept for at least five years, or longer if an investigation is ongoing. 

Cryptocurrencies are not recognised as legal tender in India. However, transactions involving crypto assets are taxed under the Income-Tax law.