For nearly a decade, India's approach to virtual digital assets (VDAs) has been built almost entirely on the periphery of the financial system: a punitive tax regime under Section 115BBH, a tax deduction at source (TDS) mechanism under Section 194S, and anti-money laundering and counter-financing of terrorism (AML/CFT) obligations under the Prevention of Money Laundering Act, 2002 (PMLA), enforced through the Financial Intelligence Unit-India (FIU-IND). What has been conspicuously absent is a regulator willing to define what a VDA is, who may deal in it, and on what terms. The 36th Report of the Parliamentary Standing Committee on Finance on the Securities Markets Code, 2025, tabled in Parliament on 23 July 2026, is the first formal, cross-party acknowledgment that this regulatory gap can no longer be managed through tax measures and executive circulars alone. For lawyers advising VDA exchanges, custodians, tokenisation platforms, and institutional investors, as well as for businesses operating in this space, the Report is not law. It is, however, the clearest indication yet of the direction in which India's regulatory architecture is headed, and it warrants close attention now rather than after the legislative framework catches up.
Background: Why The Securities Markets Code Matters To VDAs
The Securities Markets Code Bill, 2025 was introduced in the Lok Sabha in December 2025 and referred to the Parliamentary Standing Committee on Finance for detailed examination. Its core objective has nothing to do with crypto. Rather, it seeks to consolidate the SEBI Act, 1992, the Securities Contracts (Regulation) Act, 1956, and the Depositories Act, 1996 into a single, technology-neutral code governing India's securities markets. VDAs entered the Committee's scope because of a definitional problem the drafters could not avoid: a technology-neutral definition of "securities" inevitably raises the question of which digital assets fall within its ambit and which fall outside it.
The Committee, chaired by BJP MP Bhartruhari Mahtab, had, in parallel, been conducting a separate months-long study titled A Study on Virtual Digital Assets (VDAs) and the Way Forward, during which it heard testimony from the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), the Institute of Chartered Accountants of India (ICAI), the International Financial Services Centres Authority (IFSCA), and major exchanges, including Binance, WazirX, and ZebPay. That standalone VDA report is expected to be tabled separately during the Monsoon Session.
The 36th Report on the Securities Markets Code is narrower in scope. It addresses VDAs only to the extent that they intersect with the proposed consolidation of India's securities laws. However, because it is the first of the Committee's two reports to be tabled in Parliament, it also serves as the Committee's first public articulation of its approach to crypto regulation more broadly.
The Core Proposal: An Interim SRO-Led Framework
The Committee's central recommendation is deliberately modest in form but significant in substance. Rather than bringing VDAs directly within the ambit of the Securities Markets Code or waiting for a dedicated legislative framework, the Committee has recommended that the Government consider establishing an interim regulatory mechanism operating through recognised Self-Regulatory Organisations (SROs), with those SROs functioning under the supervision of a designated statutory regulator. Both the Securities and Exchange Board of India (SEBI) and the Reserve Bank of India (RBI) have been identified as potential candidates for that supervisory role.
Three features of this recommendation are particularly significant for practitioners.
First, the proposal is expressly interim. The Committee presents the SRO model as a bridge pending "a comprehensive legislative framework," rather than as a substitute for one. This distinction is important from a structuring perspective. Any compliance architecture built around SRO membership should be designed with the expectation that it will eventually be replaced, rather than treated as a permanent regulatory framework.
Second, the proposed model contemplates layered, rather than delegated, supervision. The SRO does not replace the regulator; instead, it functions under the oversight of a designated statutory regulator. This approach is more akin to the AMFI-under-SEBI framework, or the self-regulatory model adopted for payment aggregators, than to a wholly independent industry body. It is therefore reasonable to expect that any eventual framework will prescribe criteria for SRO recognition, reporting obligations to the regulator, and statutory step-in or supervisory powers.
Third, the proposed framework is intended to prescribe substantive minimum standards relating to governance, transparency, disclosure, investor protection, grievance redressal, codes of conduct, and regulatory oversight. This represents a materially more comprehensive regulatory framework than the AML/CFT obligations currently imposed on VDA service providers under the Prevention of Money Laundering Act, 2002 (PMLA). It also suggests that any interim mechanism, if implemented, is likely to resemble a licensing-adjacent regime rather than a mere registration requirement.
Classification: The "Regulatory Grey Area" Problem
The Committee's second major theme is classification. As currently drafted, the Securities Markets Code adopts a technology-neutral definition of "securities." However, VDAs that do not exhibit the defining characteristics of a "security" or a "derivative" under the Securities Contracts (Regulation) Act, 1956, or under the proposed Code, fall outside that definition. SEBI, in its submission to the Committee, expressly acknowledged this position, noting that VDAs lacking security- or derivative-like characteristics may fall entirely outside the Code's regulatory perimeter.
The Committee's response is not to bring all VDAs within the securities framework. Instead, it has recommended that the Government develop clearer legal classifications, recognising that different digital assets may resemble securities, derivatives, or other asset classes depending on their economic function. It has also recommended the inclusion of enabling provisions within the Securities Markets Code to accommodate tokenised financial products as they evolve. In practical terms, this points towards a functional, asset-by-asset approach to classification, reflecting the principle of "same activity, same risk, same regulation," rather than a blanket definition that treats a governance token, a stablecoin, and a tokenised debenture identically.
For counsel advising on token issuances, real-world asset (RWA) tokenisation programmes, or decentralised finance (DeFi) products, this is arguably the most consequential recommendation in the Report. It indicates that India is unlikely to adopt a single, all-encompassing statutory definition of "crypto-assets." Instead, digital assets are likely to be classified according to their economic substance. Consequently, legal characterisation at the product design stage, rather than merely at the compliance stage, is likely to become a standard component of advising on and launching any new VDA product in the Indian market.
What the Report Does Not Do
It is equally important to be clear about the limits of the 36th Report, particularly because some of the commentary surrounding it has overstated its significance.
It does not change the existing law. VDAs remain outside the legal definition of "securities." The existing tax regime, the tax deduction at source (TDS) obligations under Section 194S, and the registration and reporting requirements applicable to VASPs under the Prevention of Money Laundering Act, 2002 (PMLA) and the Financial Intelligence Unit-India (FIU-IND) remain entirely unaffected.
It does not bring VDAs directly within SEBI's jurisdiction. The Committee has stopped short of bringing crypto-assets within the securities law framework. Instead, the proposed SRO-under-a-designated-regulator model represents a deliberate middle path between the status quo and a comprehensive statutory regulatory regime.
It is not binding. Reports of Parliamentary Standing Committees are recommendatory in nature. The Government retains complete discretion over whether, when, and how to act upon their recommendations, and parliamentary practice provides numerous examples of Committee recommendations that have subsequently been modified, diluted, or not implemented at all.
It is not the Committee's final word on crypto regulation. The Committee's separate and dedicated study on VDAs, informed by more extensive testimony from the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), and the Institute of Chartered Accountants of India (ICAI), is yet to be tabled and may ultimately recommend a materially different or more comprehensive regulatory framework.
The RBI's Dissenting Position and Why It Matters for Risk Assessment
No client memorandum on this Report would be complete without acknowledging the institutional disagreement that underlies it. In its testimony before the Committee, the Reserve Bank of India (RBI), represented by Deputy Governor Rohit Jain and Executive Director P. Vasudevan, did not endorse a conventional licensing or SRO-based framework. Instead, the central bank advocated a containment strategy: barring banks and other regulated financial entities from dealing in private crypto-assets or privately issued stablecoins, restricting the use of such assets in payments and settlement systems, and retaining outright prohibition as a recognised policy option under international standard setting frameworks. The RBI's stated concern is that conventional regulation could legitimise speculative products and create a false sense of safety for retail investors. It also expressed concerns relating to AML/CFT compliance and the financing of terrorism in connection with offshore VDA holdings.
Two aspects of the RBI's position are particularly relevant from a legal risk assessment perspective. First, the proposed containment strategy is targeted rather than absolute. It draws a distinction between private, speculative crypto-assets and regulated tokenised instruments, such as government securities, and does not extend to prohibiting individual ownership or trading, both of which remain lawful. Second, this is not a new position. The RBI advanced a substantially similar argument in 2018 when it directed banks to sever relationships with crypto businesses. That circular was subsequently struck down by the Supreme Court in Internet and Mobile Association of India v. Reserve Bank of India (2020) on the ground of proportionality. This time, however, the RBI is urging Parliament to enact the separation through legislation rather than imposing it through administrative action. If adopted, such a legislative approach would likely prove more durable and would be significantly more difficult to challenge on the same grounds that succeeded before the Supreme Court in 2020.
SEBI, by contrast, has signalled a greater willingness to regulate those VDAs that exhibit the characteristics of securities, placing it institutionally closer to the Committee's classification-based approach than to the RBI's containment model. The practical implication for legal advisers is that the Committee's proposed interim SRO framework should not be mistaken for a settled regulatory consensus. Significant differences remain between India's principal financial regulators. Accordingly, any legal risk assessment for clients developing banking, payment, or custody infrastructure around VDAs should treat the RBI's containment approach, and the possibility of its re-emerging in future legislation or regulatory measures, as a live regulatory risk rather than a purely hypothetical one.
Practical Implications For VDA Businesses And Their Counsel
1. Governance and disclosure readiness should begin now, not upon notification.
The Committee's proposed minimum standards relating to governance, transparency, disclosure, investor protection, grievance redressal, and codes of conduct closely mirror the expectations ordinarily imposed on licensed financial intermediaries. Exchanges, custodians, and token issuers that proactively establish these controls including board oversight of VDA-specific risks, segregation of client assets, standardised grievance redressal mechanisms, and conflict-of-interest disclosures will be better positioned when an SRO framework is introduced and are likely to experience a significantly smoother transition than businesses operating solely on a PMLA-driven compliance framework.
2. Product classification should become a core due diligence exercise.
If classification proceeds on an asset-by-asset basis rather than through a single statutory definition of crypto-assets, businesses issuing or dealing in multiple categories of tokens should prepare, or update, legal characterisation memoranda for each product line. Such assessments should analyse whether a particular token is likely to be characterised as a security, derivative, payment instrument, or another form of regulated asset under existing and proposed legal frameworks. This exercise will have direct implications for FEMA classification, offshore structuring through the International Financial Services Centres Authority (IFSCA), and the scope of any future SRO membership requirements.
3. Banking and payment dependencies should be treated as a regulatory risk.
Given the RBI's continued preference for a containment-based approach, businesses that rely on fiat on- and off-ramps, banking partnerships, or payment infrastructure should stress-test those relationships against the possibility of renewed regulatory restrictions, whether through future legislation, fresh RBI directions, or licensing conditions imposed on banks and payment aggregators.
4. Tokenisation and RWA platforms should closely monitor the proposed enabling provisions.
The Committee's recommendation to include enabling provisions within the Securities Markets Code for emerging tokenised financial products provides the clearest legislative basis, to date, for real-world asset (RWA) tokenisation, tokenised debt instruments, and tokenised fund units. As the Code progresses through the legislative process, these provisions warrant close attention, as they may create a more streamlined regulatory pathway for tokenised traditional financial assets than for virtual digital assets generally.
5. Participation in an SRO should be viewed as a strategic decision, not merely a compliance obligation.
If an interim SRO framework is introduced, early and credible participation including involvement in the development of the SRO's governance standards and code of conduct may provide businesses with greater influence over the evolution of the regulatory framework than merely complying after implementation. Industry participants with demonstrable compliance maturity are also likely to be better placed to obtain recognition or play a meaningful role in shaping the designated SRO.
6. The Committee's dedicated VDA report should remain a key regulatory milestone.
The Committee's standalone report on VDAs, informed by more extensive evidence from the RBI, SEBI, ICAI, and other stakeholders, is likely to be more influential in shaping India's eventual regulatory architecture than the Securities Markets Code Report itself. Businesses should therefore ensure that their compliance roadmaps, internal governance frameworks, and client advisories remain sufficiently flexible to accommodate developments once that report is tabled.
Where This Leaves the Market
The Committee's intervention does not resolve the central tension in India's VDA policy: a punitive tax regime that already acknowledges the scale of the market (with 54 FIU-registered VDA service providers and tens of millions of verified users) existing alongside a central bank that continues to regard legal recognition itself as premature. What the 36th Report does accomplish is to bring that tension into the open, placing it squarely on the parliamentary record. It formally places an interim, SRO-based regulatory pathway on the table, compels the Finance Ministry to confront long-standing questions surrounding tokenised securities and crypto-investment products under the Securities Markets Code, and signals, even if it cannot compel, that the "tax without recognition" status quo is no longer viewed by Parliament's Finance Committee as a sustainable long-term policy.
For legal advisers, the immediate task is not to react to legislation that does not yet exist, but to help clients develop the governance, disclosure, and classification frameworks that any plausible iteration of the forthcoming regulatory regime whether SRO-led or otherwise is likely to require.
Fathom Legal advises exchanges, custodians, tokenisation platforms, and institutional participants across the full spectrum of legal and regulatory issues that now shape the VDA ecosystem, including crypto-fintech transaction structuring, data governance under the Digital Personal Data Protection Act, 2023 (DPDP Act), PMLA and FIU-IND registration and reporting, as well as corporate and commercial advisory for businesses operating in this sector. As India's regulatory architecture for VDAs evolves from a framework driven primarily by tax measures towards one founded on governance, classification, and regulatory oversight, preparing governance and disclosure practices in advance is no longer merely prudent risk management it is a strategic competitive advantage.
If your business is assessing its preparedness for the regulatory direction signalled by the Committee's recommendations, Fathom Legal's Technology and Regulatory Practice is well placed to assist. Reach out to us at assist@fathomlegal.com or visit www.fathomlegal.com.