Six years after the Reserve Bank of India directed regulated entities to sever ties with virtual currency businesses, and more than five years after the Supreme Court set that direction aside, Indian cryptocurrency exchanges are still asking their lawyers the same question: why is it so hard to get, and keep, a bank account. The answer is not that the RBI's 2018 restriction survives in some altered form. It does not. The answer lies in a more complicated overlay of AML law, bank-level risk appetite, and an unresolved policy debate inside the RBI itself about whether banks should be anywhere near this asset class at all. Understanding that overlay, rather than reciting the history of a circular that no longer has legal force, is what a lawyer advising an exchange or a bank actually needs to do.
1. From Regulatory Concern to Banking Restriction
The RBI's discomfort with virtual currencies did not begin in 2018. As early as 2013, the central bank cautioned users, holders and traders of virtual currencies about the financial, operational, legal and security risks involved, without imposing any binding restriction.¹ Similar cautionary statements followed over the next several years, consistently framed around consumer protection, extreme price volatility, money laundering exposure and the absence of any sovereign backing.
The position changed materially on 6 April 2018. Acting under the Reserve Bank of India Act, 1934, the Banking Regulation Act, 1949 and the Payment and Settlement Systems Act, 2007, the RBI issued a circular directing all entities it regulated to refrain from dealing in virtual currencies or providing any service, including account facilities, loans, or fund transfers, that facilitated a person or entity dealing in or settling virtual currencies. Entities already providing such services were required to exit the relationship within a stipulated period.² It is important to be precise about what this did and did not do. The circular did not prohibit any individual or business from owning or trading cryptocurrency. It prohibited RBI-regulated entities, principally banks, from servicing that trade. Because a virtual currency business without banking rails cannot meaningfully operate, the practical effect was to make it commercially unviable for Indian exchanges to function, without any statute ever declaring cryptocurrency itself illegal.
2. The Supreme Court Decision: What IAMAI v RBI Actually Held
The Internet and Mobile Association of India challenged the circular, and the matter culminated in the Supreme Court's decision in Internet and Mobile Association of India v. Reserve Bank of India, reported at (2020) 10 SCC 274. The Court's reasoning proceeded in two stages that are frequently conflated in commentary.
First, the Court accepted that the RBI possesses wide statutory authority to regulate matters affecting the banking and payment systems, and that this power extends to taking pre-emptive measures against risks the central bank reasonably perceives, even absent a completed harm.³ Second, and separately, the Court examined whether the specific measure chosen, a blanket prohibition on banking access, satisfied the doctrine of proportionality applicable to restrictions on the fundamental right to carry on trade or business under Article 19(1)(g) of the Constitution. On this second question, the RBI failed. The Court found that the central bank had not placed on record any empirical or tangible material demonstrating that virtual currency exchanges had caused actual damage to entities the RBI regulates, notwithstanding several years of the industry's operation in India.⁴ In the absence of demonstrated harm, and given the existence of less restrictive alternatives such as regulation short of prohibition, the circular's blanket character rendered it disproportionate. The circular was accordingly set aside.
What the judgment did not do deserves equal emphasis. The Court did not hold that cryptocurrency is legal tender. It did not create any freestanding right for a virtual currency business to obtain banking services. It expressly preserved the RBI's authority to regulate the sector through proportionate, evidence-based measures, and it left Parliament's legislative competence over the subject entirely untouched.⁵ Describing the judgment as having "legalised crypto" therefore overstates its holding. It removed one specific, disproportionate instrument. It did not immunise the sector from future regulation, nor did it convert banking access into an entitlement.
3. The 2021 Clarification: Compliance Obligations Survive
For over a year after the judgment, several banks continued to caution customers against dealing in virtual currencies, citing the 2018 circular. This prompted the RBI to issue a further circular on 31 May 2021, expressly stating that references to the 2018 circular were "not in order" since it had been set aside with effect from the date of the Supreme Court's order and could no longer be cited.⁶
The second half of that clarification is the part practitioners should not skip past. The RBI stated that banks and other regulated entities could continue to carry out customer due diligence in line with the standards governing Know Your Customer norms, anti-money laundering and combating the financing of terrorism, and their obligations under the Prevention of Money Laundering Act, 2002, in addition to ensuring compliance with the Foreign Exchange Management Act, 1999 for overseas remittances.⁷ Read together, the two halves of the 2021 circular establish the theme that runs through everything that follows in this article: the removal of the 2018 restriction did not remove the underlying compliance obligations or risk assessments that apply to any customer, crypto-related or otherwise.
4. From "Ban" to De-Risking: Why Access Can Still Be Difficult
A bank evaluating a crypto exchange as a customer faces a distinct risk profile compared with a conventional commercial account. Source-of-funds verification is harder where the customer's own inflows originate from pseudonymous wallets. Transaction monitoring systems built for fiat rails struggle with blockchain-native activity, cross-border transfers, and peer-to-peer settlement that bypasses the exchange's own order book. Sanctions screening against wallet addresses is a different discipline from screening against named counterparties. Add to this the elevated incidence of fraud, mule accounts and customer chargeback disputes associated with the sector, and it becomes apparent why many banks classify VDA-related businesses as high risk under their own internal policies, independent of anything the RBI directs.
This is de-risking, a term used across banking regulation generally to describe a bank's decision to limit or terminate relationships with entire categories of customers rather than manage the individual risk each customer presents. It is a commercial and compliance decision taken by the regulated entity, not a regulatory prohibition. The distinction matters legally. "The RBI prohibits banks from serving crypto businesses" is, since 2020, a false statement of law. "A bank has assessed a crypto exchange as high risk and declined to open an account" is a lawful exercise of the bank's own risk-based approach to customer acceptance, subject only to applicable KYC and PMLA obligations and to the bank's own contractual and regulatory duties of non-discrimination where these exist. Indian law does not currently impose a general obligation on a bank to provide banking facilities to a cryptocurrency exchange merely because no statutory prohibition survives. Absent evidence that a refusal is arbitrary, discriminatory in a manner actionable at law, or itself traceable to an unlawful RBI direction, a bank's declinature is not automatically unlawful.
5. The PMLA Overlay: What Changed in March 2023
The compliance environment shifted again on 7 March 2023, when the Department of Revenue in the Ministry of Finance issued a gazette notification bringing specified virtual digital asset activities, including exchange between VDAs and fiat currency, exchange between VDAs, transfer of VDAs, and safekeeping or administration of VDAs, within the definition of activities covered by the PMLA.⁸ VDA service providers carrying on these activities became "reporting entities" under the statute, obliged to register with the Financial Intelligence Unit-India, appoint a principal officer and designated director, conduct customer due diligence, maintain prescribed records, and file suspicious transaction reports. FIU-IND followed with AML/CFT guidelines for VDA reporting entities on 10 March 2023.⁹
This notification is activity-based rather than presence-based: an offshore exchange serving Indian users is captured regardless of where it is incorporated, a position FIU-IND has enforced through show-cause notices and, where platforms failed to engage, requests to the Ministry of Electronics and Information Technology to block access.¹⁰ Several major exchanges have since registered, in some cases following penalty orders for prior non-compliance.
FIU-IND registration is a meaningful development for the banking-access question because it means an exchange is no longer operating in a vacuum of undefined AML expectations; it has a statutory framework to point to. It is not, however, a licence to operate a crypto exchange in any market-conduct sense, and it does not compel a bank to open an account. Registration demonstrates that a baseline AML obligation is being discharged. It does not substitute for the bank's own independent risk appetite, which remains a separate and additional layer of assessment.
6. What Exchanges Face Today
An Indian VDA exchange seeking a durable banking relationship should expect a bank, at minimum, to examine corporate and beneficial ownership transparency, FIU-IND registration status, the robustness of its KYC and enhanced due diligence procedures for higher-risk customers, source-of-funds controls, blockchain transaction monitoring capability, sanctions screening, controls around peer-to-peer transaction risk, segregation and reconciliation of customer funds, cyber-security posture, and governance around suspicious transaction reporting. Some of these, FIU-IND registration and PMLA record-keeping, are statutory floor requirements. Others, such as a bank's insistence on a particular transaction-monitoring vendor or a minimum operating history before onboarding, are contractual conditions the bank imposes under its own enhanced due diligence policy, not requirements Indian law itself mandates. Conflating the two, describing industry practice as an RBI rule, misstates the legal position to a client and can lead to poor negotiating posture with a prospective banking partner.
The picture has, if anything, become more unsettled rather than more settled through 2025 and 2026. RBI officials have continued to press, including before the Parliamentary Standing Committee on Finance, for a policy that would formally bar banks and regulated financial institutions from holding, trading in, or taking any exposure to crypto assets and privately issued stablecoins, citing contagion risk to the banking system and concerns for monetary sovereignty.¹¹ No such formal prohibition has been enacted as of this writing, and the RBI has itself acknowledged that current investor exposure does not yet represent a systemic risk. But the direction of the central bank's stated preference is relevant to any lawyer advising a bank on how conservatively to treat this sector, and to any exchange assessing how stable its existing banking relationships are likely to remain.
7. A Practical Scenario
Consider an exchange that is registered with FIU-IND and has implemented KYC procedures consistent with FIU-IND guidance. It approaches a scheduled commercial bank for a current account and payment gateway access. The bank classifies the business as high risk, requiring enhanced due diligence, and ultimately declines to onboard it. The 2018 circular cannot justify the refusal; it has no legal force. The 2021 clarification does not assist the exchange either, since it never obliged banks to onboard crypto customers, only clarified that the 2018 circular could not be cited and that ordinary KYC/AML obligations continued to apply. FIU-IND registration strengthens the exchange's compliance narrative but creates no corresponding banking entitlement. The bank, meanwhile, retains an independent statutory duty to conduct due diligence under KYC and PMLA norms, and separately retains commercial discretion to decline a relationship it assesses as carrying unacceptable risk, provided that discretion is exercised on a genuine risk basis rather than as an unlawful blanket policy dressed up as individual assessment.
8. The Regulatory Position, Issue by Issue
There is no single answer to "is crypto regulated in India," because different regimes answer different questions. Cryptocurrency is not legal tender and the RBI has consistently opposed treating it as such. Holding or trading VDAs is not prohibited by any statute currently in force. VDA income is taxed under Section 115BBH of the Income-tax Act at a flat rate, with tax deducted at source under Section 194S, a framework this article addresses only briefly since it is not a banking-access question. AML obligations for VDA service providers now exist under the PMLA and FIU-IND guidelines. Banking access is not the subject of any current RBI prohibition, but remains governed by each bank's own risk assessment, against a policy backdrop in which the RBI has openly advocated for a more restrictive framework. Cross-border VDA transactions raise a further, less settled FEMA analysis that exchanges and their counsel should treat as a distinct workstream rather than assume is resolved by PMLA registration.
9. Conclusion: Banking Access After the Banking Ban
The useful legal narrative here is not that the Supreme Court legalised crypto in 2020. It is that Indian VDA regulation moved from an express, centrally imposed restriction on banking services to a more diffuse arrangement in which exchanges operate within tax and AML frameworks while individual banks continue to exercise their own judgment about customer risk, informed by a central bank that has never concealed its preference for keeping the regulated financial system at arm's length from this asset class. For a lawyer advising an exchange, a bank, or an in-house compliance function, the operative question is no longer confined to whether an activity is legally permissible. It is whether the client's compliance architecture, its KYC depth, its transaction monitoring, its governance around suspicious activity reporting, is sufficient to persuade a risk-averse, closely supervised financial institution that the relationship is one it can defend to its own regulator. That is a commercial and evidentiary question as much as a legal one, and it is the question that will continue to define banking access for Indian crypto exchanges for as long as Parliament leaves the underlying legislative gap unfilled.
Fathom Legal advises crypto exchanges, Web3 businesses and technology companies on the regulatory issues surrounding their operations in India. Our work covers banking and payment arrangements, PMLA and FIU-IND compliance, FEMA, cross-border transactions and corporate structuring. We also assist businesses in building compliance frameworks that address both legal requirements and the practical expectations of banks and other regulated financial institutions.