How to Get a VASP License in India: What FIU-IND Registration Actually Requires in 2026

If you searched for “VASP license India” expecting to land on a government portal with an application form, I want to save you some time: that portal doesn’t exist. India has never issued anything called a VASP license, and it isn’t building one anytime soon. What it has instead is a patchwork of obligations bolted onto an anti-money-laundering statute, a tax code that treats crypto more harshly than almost any other asset class, and two regulators who don’t fully agree on what crypto even is. Understanding that distinction is the actual first step, not a footnote.

Here’s why that matters practically. If you go looking for “VASP licensing requirements” the way you would for, say, a payment aggregator license from the RBI, you’ll end up preparing for a process that doesn’t map onto how Indian authorities actually treat this sector. The compliance work is real and demanding — arguably more demanding than a single-window license, because it’s spread across at least three different pieces of law. This guide walks through what that actually looks like: who needs to register, why RBI and SEBI keep sending different signals, what the registration process and paperwork involve, how the tax rules change your economics, and what happens if a platform tries to skip all of it.

Is There Really No VASP License in India?

Correct — there isn’t one. The term “VASP” itself comes from the Financial Action Task Force’s Recommendations on virtual assets, which ask member countries to bring virtual asset businesses under AML/CFT supervision. Most major jurisdictions responded by writing a dedicated crypto statute — the EU’s MiCA Regulation, or Dubai’s VARA rulebook, for instance. India took a narrower route: rather than legislating a new licensing regime, the Ministry of Finance simply amended the scope of an existing one. Its Gazette Notification S.O. 1072(E), dated 7 March 2023, brought virtual digital asset activity — exchange, transfer, safekeeping, and administration — within the Prevention of Money Laundering Act, 2002, classifying VDA service providers as “reporting entities” alongside banks and NBFCs.

Three days later, FIU-IND issued its AML & CFT Guidelines for these reporting entities, which it has since revised twice — once in January 2025 and again on 8 January 2026, which is the version currently in force. So when people ask us for help getting a “VASP license,” what they actually need is FIU-IND registration as a PMLA reporting entity, built on top of a genuine AML/CFT compliance function. It’s not a business license in the sense of authorising you to operate — it’s a mandatory registration that sits alongside whatever else applies to your specific activity.

Who Actually Has to Register with FIU-IND?

The test is activity-based, not licence-based, which trips up a lot of founders who assume that because they’re “just building infrastructure,” they’re outside scope. If your business does any of the following for Indian users, registration applies regardless of where your company is incorporated:

• Centralised exchanges facilitating buying, selling, or swapping of virtual digital assets against fiat or other VDAs.

• OTC desks and broker-dealers executing high-value trades or acting as intermediaries for clients.

• Custodians and wallet providers that hold or control private keys on behalf of customers.

• Token issuers and qualifying NFT platforms, where the underlying asset meets the VDA definition.

• Transfer and payment services moving virtual digital assets between parties.

That last point about location is worth sitting with. The obligation is activity-based and not contingent on physical presence in India — meaning an offshore exchange with no local office but real Indian users is still expected to register. FIU-IND has already tested this in practice: it issued show-cause notices under Section 13 of the PMLA to nine offshore VDA service providers for non-compliance, and referred their web addresses to the Ministry of Electronics and IT for blocking. By the government’s own count, 31 VDA service providers had registered as reporting entities at that stage; more recent reporting puts the figure closer to the mid-50s by mid-2026, which tells you enforcement is picking up pace, not slowing down.

Why Do RBI and SEBI Seem to Disagree on Crypto?

This is the part most guides gloss over, and I’d rather state it plainly than pretend the picture is tidier than it is. India’s two most relevant financial regulators are not aligned. The RBI’s institutional position has, if anything, hardened — internal government documents reported in 2025 and again in 2026 describe the central bank as “leaning toward prohibition” on the reasoning that formally regulating crypto would grant it legitimacy and could eventually make the sector systemically significant. The RBI would clearly rather channel activity toward its own Digital Rupee (e₹) than toward privately issued tokens or stablecoins.

SEBI’s position is different. It has floated a multi-regulator framework under which tokens that behave like securities — carrying voting rights, or profit-sharing arrangements — would fall under its own oversight, a shift that effectively began from 1 April 2025 for qualifying tokens. A Parliamentary Standing Committee’s 36th Report on the Securities Markets Code, tabled on 23 July 2026, went further and recommended an interim regime built around Self-Regulatory Organisations supervised by either SEBI or the RBI.

But that’s a recommendation, not law. The government’s formal position hadn’t shifted as of the same month, and a comprehensive crypto discussion paper has now been delayed or shelved at least five times since 2023. So if you’re building a licensing and compliance roadmap right now, build it for the regime as it exists today — and go in knowing the ground could move under you within a budget cycle or two.

What Does the FIU-IND Registration Process Actually Involve?

Once you know registration applies to you, the sequence generally looks like this:

• Incorporate or establish your Indian presence, since registration is done against a PAN and CIN, not a foreign entity number.

• Build your AML/CFT policy and KYC/CDD programme before you apply — FIU-IND doesn’t accept registrations backed by a policy that exists only on paper; it expects the underlying controls to actually function.

• Appoint a Principal Officer and a Designated Director, the two named individuals accountable for AML compliance and for liaising with FIU-IND directly.

• Register through the FINnet 2.0 gateway, submitting company information, ownership structure, GST and income-tax filings, financials, and compliance declarations.

• Attend a mandatory in-person verification meeting. This isn’t optional or occasional — FIU-IND has made clear it requires this step before final approval, and it’s usually where incomplete KYC or vague officer designations get flagged and sent back.

Read more - Financial Intelligence Unit India (FIU IND) Registration Process in 2026: A Step-by-Step Guide

What Documents Will FIU-IND Actually Ask For?

The paperwork is less about volume and more about whether it reflects a business that’s genuinely operational, not aspirational. At minimum, expect to prepare:

• Corporate documents — Certificate of Incorporation, PAN, CIN, MOA/AOA, and shareholding and beneficial-ownership details.

• Financial records — recent GST returns, income-tax returns, and audited or provisional financial statements.

• AML/CFT documentation — your board-approved policy, KYC and customer due-diligence procedures, sanctions and PEP screening protocols, and a transaction-monitoring framework.

• Personnel documentation — appointment letters and CVs for your Principal Officer and Designated Director, since FIU-IND assesses these individuals almost as carefully as the entity itself.

• Technology and custody documentation — wallet management and key-custody controls, and an incident-response plan, particularly if you’ll be holding customer assets.

In the applications we’ve worked on, the ones that stall almost never stall over a missing document. They stall because the AML policy reads like it was adapted from a template rather than built around what the business actually does — same boilerplate risk categories, same generic escalation matrix, nothing that maps to the applicant’s real transaction flow. FIU-IND reviewers notice that faster than you’d expect.

How Does the Tax Regime Change Your Compliance Math?

This is where India genuinely stands apart, and it isn’t a side issue — it shapes your business model as much as registration does.

Under Section 115BBH of the Income-tax Act, any income from transferring a virtual digital asset is taxed at a flat 30%, plus 4% health and education cess, regardless of the taxpayer’s slab or how long the asset was held. You can deduct only the cost of acquisition — no other expenses — and losses can’t be set off against gains from other VDAs or carried forward at all. That regime, introduced through the Finance Act, 2022, has carried straight through into the Income-tax Act, 2025, which came into force on 1 April 2026.

Layered on top of that is Section 194S, which requires a 1% TDS deduction on VDA transfer payments once they cross ₹10,000 in a financial year (₹50,000 for certain “specified persons”). On an exchange, the platform deducts and deposits this automatically.

In a peer-to-peer transaction, though, the obligation shifts to the buyer. They have to deduct and file it themselves — a detail that trips up a surprising number of people trading directly, and one that's easy to miss until a notice shows up. Reporting flows through Form 26QE or 26Q depending on payer category.

And the compliance stakes rose again from 1 April 2026: reporting entities that fail to file prescribed crypto transaction statements now face a daily penalty for as long as the default continues, with a separate flat penalty for incorrect or uncorrected reporting. If your business model involves facilitating transfers at any scale, TDS deduction and transaction reporting aren’t back-office details — they need to be built into your product from day one, not retrofitted after a regulator asks about them.

What Happens If a Platform Skips Registration?

FIU-IND’s enforcement pattern gives a fairly clear answer. Non-compliant reporting entities — including offshore ones serving Indian users — have received show-cause notices under Section 13 of the PMLA, which gives the Director, FIU-IND, powers roughly equivalent to a civil court, including summoning parties and imposing monetary penalties. Where entities don’t respond or resolve the notice, FIU-IND has referred the matter to MeitY for website blocking, and the relevant apps have been delisted from both the iOS and Android app stores in India. None of that requires a court order first — it happens through the regulatory and administrative process itself.

How Long Does It Take, and What Does It Cost?

I’d rather give you an honest answer than a clean number that doesn’t hold up. Unlike a fixed-fee government license, FIU-IND registration doesn’t come with a published fee schedule — your real costs are incorporation, legal and compliance advisory fees, and the ongoing cost of running an actual AML function (staff, monitoring tools, audits). Timelines depend heavily on how complete your application is the first time and how quickly you can schedule the mandatory in-person meeting; businesses that show up with a genuinely operational AML programme tend to move faster than businesses that treat the policy documents as a checkbox exercise.

A Quick Illustrative Walkthrough (Not a Real Case)

To make this concrete: imagine a Bengaluru-based OTC desk — call it ChainDesk, a name I’m using purely as an illustration, not a real company — planning to serve high-net-worth clients trading large VDA blocks. Before writing a single policy document, ChainDesk would need to settle its business model (OTC only, no custody), incorporate as a private limited company, and appoint a Principal Officer with real AML experience rather than a junior hire holding the title on paper. It would build KYC and transaction-monitoring procedures that actually run on its trade flow, register through FINnet 2.0, and prepare to deduct 1% TDS under Section 194S on every qualifying trade before the money moves — because retrofitting that after clients are onboarded is far messier than building it in from the start.

Frequently Asked Questions

Is a VASP license the same as FIU-IND registration?

Not quite. FIU-IND registration is a mandatory reporting-entity registration under the PMLA — it confirms you’re compliant with AML obligations, but it doesn’t function as a business licence authorising a specific commercial activity the way a banking or payments licence would.

Can an offshore exchange serving Indian users register with FIU-IND?

Yes, and in practice it’s expected to. The obligation is tied to whether you serve Indian users, not where your company is incorporated.

Do I need SEBI’s approval as well?

Only if what you’re issuing behaves like a security — for example, a token carrying voting rights or profit-sharing features. Most VDAs, including major cryptocurrencies, currently fall outside SEBI’s direct remit.

Is crypto actually legal in India right now?

Yes. Buying, holding, and trading virtual digital assets is legal. What India hasn’t done is regulate it as a distinct, licensed financial product — it’s taxed and monitored, not formally licensed.

Will this framework change soon?

Possibly, but there’s no confirmed timeline. A comprehensive discussion paper has been delayed repeatedly since 2023, and while a Parliamentary panel has recommended a clearer regulatory structure, the government’s formal position hasn’t moved yet as things stand.

Getting compliant in India isn’t a single filing. It’s a coordinated build across PMLA registration, AML infrastructure, tax withholding, and an eye on which regulator might claim jurisdiction over your specific token or activity next — and most of the founders we talk to underestimate how much that last part alone can reshape a business model. Our team at Finlaw Consultancy works through this end-to-end with exchanges, custodians, OTC desks, and token issuers, from FIU-IND registration and AML/CFT policy design to structuring TDS and reporting obligations correctly from the outset. If you’re planning to launch, or already operating and want a clear-eyed read on where you actually stand, get in touch and we’ll walk through it together.