India’s Crypto Regulation Gap

Beyond Trading and PMLA, India Needs a Full Digital-Asset Framework

India’s next crypto policy should not be limited to the question of whether retail investors can buy or sell crypto. The real regulatory challenge is much broader: protecting customer assets, ensuring fair markets, safeguarding monetary sovereignty and addressing national-security risks.

India already has important pieces of a regulatory perimeter. Virtual Digital Asset Service Providers are covered by the PMLA framework, and FIU-IND’s January 2026 guidelines impose AML, KYC, transaction-monitoring and AML/CFT/CPF obligations. At the same time, the Ministry of Finance has explicitly stated that crypto products and NFTs remain unregulated and that users may have no regulatory recourse for losses. FIU registration therefore should not be confused with a full financial-market licence or product approval.

The regulatory gap can be organised into three major areas.

Trading, Customer Assets & Consumer Protection India needs a dedicated crypto market-conduct and customer-protection framework covering the entire lifecycle of a retail investor’s money and assets.

Customer assets and custody: Exchanges holding Bitcoin, USDT or other assets for customers should have clear rules on segregation of customer assets, custody, wallet controls, reconciliation, use or rehypothecation of assets, proof of assets and liabilities, withdrawals and treatment of customer assets during insolvency.

Insurance and financial safeguards: The framework should determine when exchanges and custodians require cybersecurity insurance, custody insurance, capital buffers, reserve requirements or equivalent financial protection against operational failure, hacks and loss of customer assets.

Consumer protection and education: India needs standardised risk disclosures, transparent fees, grievance redressal, advertising standards, conflict disclosures and dedicated crypto financial-literacy programmes. Retail users should clearly understand custody risk, leverage, stablecoins, staking, lending and offshore-platform risks.

Product classification and taxation: Crypto is no longer just spot trading. Regulation should separately classify spot VDAs, staking, Earn/APY products, lending, derivatives and perpetuals, mining, airdrops, DeFi, tokenised assets, stablecoins, crypto cards and payment products. Each category needs clarity on taxation, TDS, GST, reporting and consumer rights. From 1 April 2026, VDA-related TDS falls within Section 393(1), Table Sl. No. 8(vi) of the Income-tax Act, 2025, illustrating that tax administration is evolving even while broader product regulation remains incomplete.

Transparent trade monitoring: Exchanges should be subject to market-surveillance standards capable of identifying insider trading, front-running, wash trading, spoofing, pump-and-dump activity, artificial volumes, listing conflicts, related-party market making and other forms of market manipulation. IOSCO’s global crypto recommendations specifically identify market manipulation, insider trading, conflicts of interest, custody and retail distribution as core areas requiring regulatory controls.

The Regulation Gap PMLA can monitor suspicious money flows. It does not by itself create a complete framework governing market fairness, exchange solvency, customer-asset ownership, insurance, insider trading, custody, product suitability or investor compensation.

Monetary Sovereignty, Stablecoins & Cross-Border Payments The second pillar should look beyond crypto trading and examine how digital assets interact with the Indian rupee and the financial system. India needs a specific stablecoin framework addressing issuers, reserves, redemption rights, custodians, audits, foreign-currency-backed stablecoins, systemic concentration and their use for trading, savings, payments and cross-border transfers.

The policy question is particularly important for USD-linked stablecoins. At scale, foreign-currency stablecoins can create risks involving currency substitution, cross-border capital movement and potential digital dollarisation. This does not mean stablecoins have already dollarised India; it means the exposure should be measured and regulated before it becomes systemically significant.

There must also be regulatory clarity for crypto payment gateways, payment aggregators, crypto-linked cards, merchant payments, gift-card routes and other crypto-to-commerce models. Section 4 of the Payment and Settlement Systems Act, 2007 requires RBI authorisation for operating a payment system where the arrangement falls within that Act.

Most importantly, India needs explicit guidance on FEMA and the Liberalised Remittance Scheme (LRS) for offshore VDA purchases, stablecoins, P2P transactions, cross-border wallets, crypto cards and merchant settlement. FEMA Sections 3, 5 and 6 respectively deal with foreign-exchange dealings/payments, current-account transactions and capital-account transactions, but crypto-specific factual classifications can remain difficult and need authoritative clarification.

The Regulation Gap Crypto policy must protect not only investors, but also the rupee, India's payment architecture, foreign-exchange controls and monetary sovereignty.

National Security & Crypto-Enabled Illicit Finance India already has a significant AML architecture. FIU-IND’s 2026 VDA guidelines expressly operate within the framework of the PMLA, UAPA and the Weapons of Mass Destruction Act for AML, counter-terrorist financing and proliferation-financing controls.

The next layer should be stronger operational coordination against crypto use connected with terror financing, narcotics trafficking, organised cybercrime, scams, ransomware, sanctions exposure and other serious crimes.

That means better coordination between financial-intelligence, enforcement, cybercrime and national-security authorities; 24/7 preservation and lawful freezing channels; faster cross-border cooperation with foreign VASPs; blockchain-forensics capability; and stronger supervision of offshore services, P2P channels and high-risk transaction routes.

This is increasingly relevant globally. FATF’s July 2026 review specifically highlighted growing risks involving VA-enabled organised fraud, stablecoins, P2P transactions through unhosted wallets, offshore VASPs and DeFi, while calling for stronger supervision and international cooperation.

The Regulation Gap National-security regulation cannot end with exchange KYC. It must follow the movement of value across exchanges, wallets, stablecoins, P2P networks, offshore entities and cross-border payment channels.

India Needs Regulation Beyond PMLA PMLA is necessary, but it is only one layer of crypto regulation. India ultimately needs a broader activity-based Digital Asset Regulatory Framework built around:

Market Integrity + Customer Asset Protection + Consumer Protection + Product Classification + Tax Clarity + Stablecoin Regulation + Payment Oversight + FEMA/LRS Clarity + Monetary Sovereignty + National Security + Cross-Border Cooperation.

The international direction is already moving toward the principle of “same activity, same risk, same regulation.” The FSB recommends comprehensive, function-based oversight, customer-asset safeguards, governance, disclosures, conflict management and cross-border cooperation.

India does not necessarily need to force every crypto activity under one regulator. It needs clear statutory ownership of every risk: financial intelligence, market conduct, customer assets, payments, foreign exchange, taxation, consumer protection and national security.

The central policy question should therefore change: Not simply “Should India allow crypto?” but “If Indians use crypto, who protects their assets, who protects the market, who protects the rupee and who protects the country?” That is the India Crypto Regulation Gap that a comprehensive framework must close.