India requests a cybersecurity audit of crypto exchanges

India requires all exchanges, custodians, and cryptocurrency intermediaries to undergo cybersecurity audits by auditors approved by CERT-In. This is mandatory for signing up for FIU, placing VDA providers under compliance obligations similar to banks under the Prevention of Money Laundering Act 2002.

Crypto crime accounts for 20–25% of total murder cases, often using the darknet, privacy coins, mixers, and unregulated exchanges to conceal the flow of funds. FIU also replaced “Fit & Proper” with the certification “Partner Accreditation for Compliance & Trust,” focusing on compliance.

Despite enhancing user protection, there are still concerns about auditors' ability to handle the specific risks of crypto. Crypto in India is taxed at 30% on profits, along with a 1% TDS, and the Income-Tax Bill 2025 requires reporting to VDA processing organizations.