FIU-IND registration is not a finish line. It is the point at which continuous AML/CFT compliance actually begins.
Virtual Digital Asset Service Providers (VASPs) operating in India have spent the last three years internalising a single milestone: registration with the Financial Intelligence Unit–India (FIU-IND) as a "reporting entity" under the Prevention of Money Laundering Act, 2002 (PMLA), following the Ministry of Finance's Notification S.O. 1072(E) dated 7 March 2023, which brought specified VDA activities within the PMLA framework. For many exchanges, obtaining an FIU registration number through the FINGate portal has come to feel like the objective itself.
That framing understates what the law actually requires. Registration is a gateway obligation. What follows ongoing customer due diligence, transaction monitoring, suspicious transaction reporting, record-keeping and governance is where the substance of AML/CFT compliance, and the bulk of regulatory risk, actually sits. FIU-IND's updated "AML & CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets," issued on 8 January 2026 ("2026 Guidelines"), which replaces the original guidelines of 10 March 2023, sharpens this distinction considerably. It does not relax the compliance bar for VASPs; it raises it, particularly on governance, risk classification and the seniority expected of compliance personnel.
This article sets out what the 2026 Guidelines actually changed, and what a VASP's compliance function needs to keep doing, continuously, once the registration certificate is in hand.
What the January 2026 Update Actually Changed
The 2026 Guidelines do not overhaul the underlying AML/CFT architecture built around the PMLA and the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005 (PML Rules). They consolidate it. Requirements that had previously been scattered across circulars including the September 2025 circular on VASP registration and a February 2025 guidance note on Principal Officer qualifications that was not publicly available have now been folded into a single instrument. For a compliance officer, that consolidation matters practically: obligations that were previously implicit or informally communicated are now stated on the record, and are correspondingly easier for FIU-IND to supervise against.
Four changes are worth flagging specifically:
The Principal Officer must now be based in India. The earlier guidance said the Principal Officer (PO) should "preferably" be based in India. The 2026 Guidelines remove the qualifier the PO must be based in India. This is a substantive tightening for VASPs with distributed or offshore compliance teams, and it may require a genuine restructuring of reporting lines rather than a policy amendment.
Designated Director and Principal Officer responsibilities are now separately and more granularly defined. Where the 2023 Guidelines addressed the Designated Director (DD) and PO obligations together, the 2026 Guidelines split them out. The DD carries board-level responsibility for overall PMLA compliance, including maintaining internal mechanisms for customer due diligence and transaction records, and for the entity's risk assessment process. The PO's role is defined in more operational terms: decision-making on alert governance, recording the reasons for treating (or not treating) a transaction as suspicious, periodic review of alerted transactions, and notably conducting surprise checks on the entity's own monitoring team to catch gaps before a regulator does. The PO must also report to the Board, at least annually, on the effectiveness of the AML/TF programme, a summary of STRs and other filings, proposed policy changes, and any red-flag guidance issued by FIU-IND.
Risk assessment and client risk classification are now subject to fixed review cycles. The entity-level ML/TF risk assessment must be formally documented and reviewed at intervals not exceeding one year, with Board oversight. Separately, client risk classification must sort customers into at least "High Risk" and "Medium Risk" categories under a Board-approved framework, and that classification must be reviewed no less than once every six months. This converts what many VASPs treated as a discretionary best practice into a defined, auditable cycle.
The VASP registration process itself is now codified within the Guidelines, rather than sitting in a separate circular including the FINGate-based initiation of registration, operational readiness checks, and the mandatory in-person meeting with a live demonstration of AML/CFT systems to FIU-IND officials.
Compliance teams that built their frameworks against the 2023 Guidelines should not assume those frameworks remain sufficient. The PO location requirement, the DD/PO role split, and the fixed risk-review cycles are places where a gap analysis against the 2026 text is warranted.
STR Reporting Is a System, Not a Filing
The suspicious transaction reporting obligation under PMLA does not turn off once an exchange is registered it is, in effect, the reason the registration exists. Where a VASP's monitoring processes give rise to suspicion of money laundering, terrorist financing or a related offence, a Suspicious Transaction Report (STR) must be furnished to FIU-IND, generally within seven working days of the point at which suspicion is formed. The 2026 Guidelines place the responsibility for that determination, and for recording the reasons behind it, squarely on the Principal Officer, who must also justify and document any decision not to report an alerted transaction.
For a VDA business, the inputs feeding that determination look different from those in traditional banking. FIU-IND's guidance contemplates wallet addresses, transaction hashes, device identifiers and IP-level data as relevant to detecting and evidencing suspicious activity, alongside conventional KYC and transaction data. In practice, this means an exchange's STR capability is only as good as its underlying transaction-monitoring and blockchain-analytics tooling. Screening customer wallets and counterparty addresses against sanctions lists and known illicit-activity clusters, tracing the provenance of inbound VDA transfers, and flagging exposure to mixers, high-risk exchanges or privacy-enhancing protocols are not, on their own, distinct statutory categories they are the practical means by which a VASP builds the evidentiary basis an STR requires. A P2P transfer where either wallet is unhosted is treated by FIU-IND as warranting particular scrutiny under the safeguards set out in its guidance.
The commercial risk here is straightforward. A policy document describing an STR process is not evidence that the process works. What a regulator will test is whether alerts are actually generated, investigated within a defensible timeframe, escalated to the PO, and either reported or documented as non-reportable with reasons on file end to end, and repeatably.
Ongoing Due Diligence: KYC Does Not End at Onboarding
PMLA requires reporting entities to undertake continuing due diligence, not a one-time verification exercise. Customer information and transaction patterns must be periodically examined to confirm they remain consistent with what the exchange knows about the customer's profile, business and, where relevant, source of funds. Where the information on file becomes inadequate, unreliable or stale, the due diligence exercise must be revisited.
For a VASP, the practical triggers for revisiting a customer's risk profile are reasonably predictable: a previously dormant account suddenly transacting at volume; a customer's wallet interacting with addresses linked to sanctioned entities, darknet markets or ransomware proceeds; a marked change in the customer's declared geography or the jurisdictions its counterparties sit in; or transaction patterns inconsistent with the customer's stated purpose of account. The 2026 Guidelines' requirement that client risk classification be reviewed at least every six months gives this obligation a concrete cadence a VASP's compliance system should be capable of re-risking a customer and triggering enhanced due diligence between scheduled reviews as well, wherever a material change in behaviour surfaces sooner.
Records Must Be Reconstructable, Not Merely Retained
Section 12 of the PMLA, read with Rule 3 of the PML Rules, requires reporting entities to maintain records sufficient to reconstruct individual transactions, and to retain records relating to clients, beneficial owners, account files and business correspondence for five years from the date of the transaction (with certain records tied to the business relationship retained for the prescribed period following its conclusion).
For a crypto exchange, satisfying this obligation is not simply a matter of keeping a KYC file and a transaction ledger in separate systems for five years. A regulator reviewing a specific transaction should be able to move, without friction, from customer identity to transaction history, to the relevant wallet address and transaction hash, to source and destination information, to the risk rating applied at the time, and to any investigation or STR decision connected to it. Where that chain has to be manually reconstructed from disparate systems on request, the record-keeping obligation is being met in form but not in the manner the regulator is likely to expect in practice.
Governance That Keeps Pace With the Business
The DD and PO roles are the backbone of the governance obligation, but they are not the whole of it. Internal reporting channels, employee AML/CFT training, an escalation framework for unusual activity, and periodic review of AML/CFT policy all form part of demonstrating that a compliance programme is a functioning system rather than a static document.
This becomes most exposed at points of business change: a new token listing, entry into a new jurisdiction, a change in custody architecture (self-custody integrations in particular), or a shift in customer base for instance, a move from purely retail customers toward institutional or high-net-worth flows. A risk framework calibrated for the business as it existed at registration will not automatically remain adequate as the product suite and customer base evolve. The entity-level risk assessment obligation under the 2026 Guidelines reviewed at least annually, but properly revisited sooner where the business changes materially in the interim exists precisely to catch this.
FINGate Is the Delivery Mechanism, Not the Obligation
FINGate is the portal through which registration applications and statutory reports are filed. It is important infrastructure, but it is not itself the compliance obligation. The substantive responsibility identifying reportable activity, gathering accurate supporting information, validating it, and filing complete and timely reports sits with the VASP and its Principal Officer. A technically successful FINGate filing does not, on its own, demonstrate that the underlying monitoring system is adequate. Equally, the absence of a filing in a given period is not proof that there was nothing to report; it may simply mean the monitoring system is not catching what it should be.
What Exchanges Should Do Now: A Working Checklist
The shift the 2026 Guidelines represent is best addressed by treating post-registration compliance as a recurring operating cycle rather than a static policy set. A compliance team can usefully test the following on a defined schedule:
Governance seniority. Confirm the PO is based in India, engaged exclusively and full-time, and holds at least three years of relevant AML/PMLA experience — the 2026 Guidelines' minimum eligibility bar. Confirm the DD and PO roles are functionally, not just nominally, distinct.
Risk assessment cadence. Document the entity-level ML/TF risk assessment and refresh it at least annually, with Board sign-off, and sooner following material business change.
Client risk classification. Confirm a Board-approved High/Medium (at minimum) risk classification framework is in place and is actually being reviewed at least every six months, with re-risking triggered by relevant events between cycles.
STR pipeline integrity. Test the full chain alert generation, PO-level investigation, the seven-working-day reporting clock, and documented reasoning for both reportable and non-reportable determinations rather than only checking that filings have been made.
Transaction monitoring coverage. Confirm monitoring rules and blockchain-analytics tooling account for current VDA typologies: unhosted-wallet transfers, mixer and privacy-tool exposure, sanctioned-address screening, and new token or product categories as they are launched.
Record reconstructability. Spot-test whether a single transaction can actually be traced end to end identity, KYC history, wallet and hash data, risk rating, and any related STR decision without manual reassembly across systems.
Board reporting. Confirm the PO's annual report to the Board (or its sub-committee) covers programme effectiveness, STR summary, proposed policy changes, and FIU-IND red-flag guidance, as the 2026 Guidelines require.
Training records. Confirm AML/CFT training is delivered, current, and evidenced not merely referenced in policy.
Some of the above are express statutory or FIU-IND requirements the STR timeline, the record-retention period, the PO's India-based seniority requirement, and the risk-review cadences are stated obligations under the PMLA, PML Rules and the 2026 Guidelines. Others such as the specific analytics tooling used for wallet screening, or the precise mechanics of re-risking between formal review cycles reflect what FIU-IND's guidance points toward or what sound compliance practice in the VDA sector currently looks like, rather than a prescriptive statutory checklist. Where FIU-IND has not spelled out a specific methodology, exchanges should design proportionate controls calibrated to their own risk profile, and document the reasoning, rather than assume a single approach is mandated.
Conclusion
The next phase of India's VASP regulatory maturity will not be measured by how many exchanges hold an active FIU-IND registration. It will be measured by how effectively those exchanges sustain compliance after registration and by whether that can be demonstrated on request, not merely asserted. FINGate gets a VASP into the reporting ecosystem. Continuous AML/CFT governance is what keeps it there. The operative question for a compliance function is therefore not "Are we registered?" but "Can we demonstrate, today, that our AML/CFT framework is continuously working?"
At Fathom Legal, we advise VASPs and other crypto businesses on navigating this evolving regulatory landscape through structured AML/CFT assessments, regulatory gap analyses against the FIU-IND 2026 Guidelines, policy reviews, transaction-monitoring and reporting frameworks, and ongoing compliance support helping businesses move beyond registration to build compliance systems capable of standing up to regulatory scrutiny.