Selfie, 'penny drop' mandated as KYC for crypto customers in India

New Delhi: Selfie with liveness detection, recording of geographical coordinates, and verification of bank account by the 'penny-drop' method are among the mandatory new measures listed by India's financial intelligence agency under the anti-money laundering and terrorist financing KYC protocols for cryptocurrency exchanges while onboarding users.

The directives also discourage Initial Coin Offerings (ICOs) and Initial Token Offerings (ITOs), equivalent to IPOs in stock markets, by the exchanges. They say that tumblers, mixers, and anonymity-enhancing tokens-linked transactions shall "not" be facilitated.

PTI has reviewed the updated set of guidelines brought out by the Financial Intelligence Unit (FIU), a body that functions under the Union Finance Ministry, on January 8 as part of the 'anti-money laundering (AML) and combating financing of terror (CFT) guidelines for reporting entities providing services related to virtual digital assets (cryptocurrency).'

The guidelines have been updated about three years after they were first published in March 2023.

The FIU is the single-point regulator for cryptocurrency exchanges (reporting entities or VDA service providers) operating in India under the provisions of the Prevention of Money Laundering Act (PMLA).

The fresh guidelines mean that all crypto exchanges must register with FIU as reporting entities and submit regular reports on suspicious transactions and maintain records of their clients (customers) to identify and combat money laundering, terrorist financing and proliferation financing risks associated with crypto assets, which India has not identified as a legal tender but taxes under the Income-Tax law.

The guidelines stipulate that exchanges should "mandatorily" obtain the Permanent Account Number (PAN), selfie with liveness detection, and latitude and longitude coordinates of the onboarding location with date and timestamp, alongwith the IP (Internet Protocol) address of the customer as part of the 'client due diligence' measures.

The RE (crypto exchange) shall also ensure that the client whose credentials are being furnished at the time of onboarding is the same individual who is actually accessing the application and personally initiating the account creation process, they stipulate.

"The authenticity of such access and personal presence shall be established by capturing a live photograph of the client and employing liveliness detection technology to verify the client's physical presence...," it said.

Liveness detection is done by specified software and is used for various legal purposes in India, such as generating a life certificate for pensioners, where they have to blink their eyes to establish that they are alive and authentic.

The exchanges have also been directed to collect one more identity and address document of the client-- either passport, driving licence, proof of possession of Aadhaar, voter ID or an equivalent ID -- apart from verifying their mobile number and email through a one-time password (OTP).

A verification of the client's bank account shall be done through the 'penny-drop' mechanism to confirm the ownership and operational status of the account, it said.

Under the 'penny-drop' method, a refundable Rs 1 credit is taken by the banking or payment gateway from a customer to authenticate their bank account.

The exchanges have been asked to do a KYC (Know Your Customer) updation for "high-risk" clients every six months and for all others annually.

An 'enhanced client due diligence', by gathering details from open sources and consulting independent databases, is to be done for high-risk individuals or entities who either have links to tax haven countries or jurisdictions named under the FATF grey or black list and politically exposed persons (PEPs) or non-profit organisations (NPOs).

On ICOs/ITOs, the guidelines state that these activities present "heightened and complex" money laundering and terror financing risks as they "lack" justified economic rationale, while anonymity-enhancing crypto tokens (AECs), tumblers and mixers are designed to conceal or obfuscate the origin, ownership or value of transactions.

Such transactions shall not be facilitated and must trigger suitable risk mitigation measures, they state.

As the name suggests, crypto tumblers or mixers blend coins from different sources after a transaction, making it very difficult for them to be traced.

The guidelines also ask exchanges to preserve client ID, their address and transaction details for at least five years and retain them until an investigation is closed.