Geo-location check, live-selfie required to onboard crypto users

Bengaluru: Crypto exchanges are now required to capture a live photograph of the client and employ liveness detection technology to verify clients' physical presence during onboarding. Financial Intelligence Unit (FIU) - India has tightened compliance norms and released  its updated AML (Anti-Money Laundering) & CFT (Countering the Financing of Terrorism) Guidelines last week, for entities providing services related to Virtual Digital Assets such as cryptocurrency.

 Also, crypto exchanges  are required to undergo cybersecurity audits.  "These audits help both the exchanges and regulators assess the strengths of security systems and overall compliance on the platform. In addition, the guidelines mandate the retention of transaction data for a specified period, ensuring that relevant information is available to support investigations by enforcement agencies when required," Mudrex CEO Edul Patel said.

"The scope of the audit shall cover areas such as governance, compliance, access control and insider risk; infrastructure and AML systems security, among others," according to the guidelines.

The purpose of these guidelines is also to assist entities engaged in or seeking to engage in VDA activities to better understand and comply with AML obligations. Digital Rupee (e₹), Central Bank Digital Currency (CBDC), issued by the RBI is excluded from the scope of these guidelines as it represents a digital form of sovereign fiat currency.

Also, exchanges need to classify clients  whether they are high risk or  medium risk.  This classification needs to be taken based on identity, financial position, nature of business activity, information about the client's business and their location.

Crypto exchanges have welcomed these guidelines as mandating FIU registration for starting VDA-related business is seen as a significant step to strengthen accountability in the crypto ecosystem.

"Measures such as liveness detection and geo-tagging during the onboarding process help strengthen user verification, improve transparency, and ensure greater accountability across platforms. Over the long-term, such initiatives play a crucial role in building trust, encouraging responsible participation, and supporting the sustainable growth and wider acceptance of crypto in India," ZebPay COO Raj Karkara said.

According to WazirX Founder Nishcal Shetty, leading Indian exchanges have already been following global best practices and bank-level compliance standards. "Steps like penny drop method, ID verification through selfies, etc were steps WazirX already had in place as part of the customer onboarding journey. Now the contours are clearly defined, and everyone knows exactly what is expected without any room for ambiguity, preventing any layer of non-compliance for Indian platforms," Shetty said.

Edul Patel said many of these measures such as strong KYC, transaction monitoring, cybersecurity audits, and Travel Rule compliance were already being followed by responsible exchanges, and putting them formally on paper helps standardise best practices across the industry. "For investors, this significantly strengthens trust, transparency, and accountability, and clearly signals the need for a comprehensive regulatory framework that protects users while allowing India’s crypto sector to grow in a mature and sustainable manner," he added.