India has taken a significant step toward stricter digital asset regulation, mandating bank-grade cybersecurity audits for cryptocurrency exchanges, custodians, and intermediaries. The directive, issued by the Financial Intelligence Unit (FIU), requires all virtual digital asset (VDA) service providers to undergo audits conducted by professionals empanelled with the Indian Computer Emergency Response Team (CERT-In), according to a Sept. 17 report from the Economic Times.
CERT-In, operating under the Ministry of Electronics and Information Technology, supervises India’s cybersecurity framework. Completion of these audits is now a prerequisite for FIU registration, effectively placing crypto firms under the same compliance obligations as banks outlined in the Prevention of Money Laundering Act, 2002.
Cybersecurity Concerns Trigger Stricter Oversight
Harshal Bhuta, partner at P. R. Bhuta & Co., told the outlet that the measure likely follows recent crypto thefts at exchanges. He noted that strict adherence to CERT-In’s April 28, 2022 guidelines—such as log maintenance and subscriber data retention—would enhance law enforcement’s ability to trace illicit funds hidden through privacy tools and mixers.
Data from Giottus, a local crypto platform, revealed that crypto-related crimes now account for 20–25% of India’s total cyber offenses. Criminals often exploit darknet markets, privacy-enhancing tokens, and poorly regulated exchanges to launder funds.
The FIU has also introduced a new certification framework, replacing the “Fit & Proper” certificate with the “Partner Accreditation for Compliance & Trust” certificate, underscoring the government’s intent to prioritize strict compliance and trustworthiness.
Balancing Regulation and Industry Challenges
While experts view the audits as a step toward better investor protection, questions remain over whether auditors with banking expertise can adequately address crypto-specific risks such as private key management and smart contract vulnerabilities.
Broader challenges also persist, including India’s 30% tax on crypto gains and a 1% tax deducted at source (TDS) on transactions. These measures, combined with regulatory uncertainty, have raised concerns about the long-term viability of the industry.
The Income-Tax Bill 2025 formally defines VDAs and requires reporting from entities handling them, while government documents reveal ongoing hesitation over fully legalizing crypto. Officials argue that banning the sector outright would not stop decentralized trading, while U.S. stablecoin legislation could pose additional risks by reshaping global payments and undermining India’s domestic payment infrastructure.
India’s Cautious Regulatory Path
India continues to tread carefully with digital assets, attempting to strike a balance between fostering innovation and safeguarding financial stability. While the new cybersecurity audits mark a regulatory upgrade, industry participants stress that compliance must also account for the unique technical risks of blockchain systems.
