India Locks Down Crypto: Live Selfies, Geo-Tracking & Penny-Drop KYC Now Mandatory

Effective from guidelines issued on January 8, 2026, India's Financial Intelligence Unit (FIU-IND) has released considerably tighter KYC and AML requirements for consumers of cryptocurrency and Virtual Digital Asset (VDA) service providers. The plan aims to fight tax evasion, money laundering, terrorist funding, and other unlawful activities in the crypto sphere. Under the Prevention of Money Laundering Act (PMLA), crypto exchanges are formally categorized as VDA service providers and have to register with the FIU as reporting entities, file suspicious transaction reports, and maintain client records for at least five years.

To stop fraud and anonymity, the revamped onboarding procedure includes several levels of verification. Users must present live selfies with liveness detection (monitoring eye/head movements to counter deepfakes), geolocation and IP tracking (including latitude, longitude, timestamp, and device details), OTP verification for email/mobile, PAN mandatory checks, secondary government-issued IDs, and bank account authentication via small "penny-drop" test transfers. With increased due diligence for questionable accounts, regular KYC re-verification is required—every six months for high-risk customers and annually for others.

These steps coincide with India's general conservative approach to crypto (taxed as VDAs, not legal tender), thereby strongly dissuading high-risk activities like ICOs and ITOs given their great risks and lack of economic justification. Leaders in business from companies like WazirX and Mudrex have embraced the clarity since many techniques already in use—selfies and penny drops, for example—were helping to define compliance and lower enforcement ambiguity throughout the ecosystem.