The recent restoration of complete trading services by Bybit Fintech Limited in India, following its registration with the Financial Intelligence Unit-India (“FIU-IND”) and the imposition of a significant monetary penalty, marks a moment in India’s regulatory approach to Virtual Digital Assets (“VDA(s)”) that warrants close study. The incident underscores the assertive application of the Prevention of Money Laundering Act (“PMLA”), 2002, and establishes compliance benchmarks for all VDA Service Providers (“VASP(s)”) operating within or targeting the Indian market.
Legal Framework and Regulatory Foundation
FIU-IND, operating under the Ministry of Finance, functions as the central national agency for receiving, processing, analysing, and disseminating information concerning suspicious financial transactions, with its enforcement powers deriving primarily from Chapter IV of the PMLA and the Prevention of Money Laundering (Maintenance of Records) Rules, 2005.
The Prevention of Money Laundering Act, 2002, stands as India’s foundational anti-money laundering legislation. A significant amendment in March 2023, via Notification No. S.O. 1072(E) dated March 7, 2023, brought VASPs squarely within its regulatory ambit. Consequently, VASPs are now designated as “reporting entities” under Section 2(1)(wa) of the PMLA, mandating their adherence to the same rigorous regulatory obligations as traditional financial institutions. The March 2023 notification specifically identified five categories of VDA-related activities as regulated, thereby requiring compliance.
The Bybit Case: Enforcement Action and Legal Violations
On January 31, 2025, FIU-IND imposed a substantial monetary penalty of Rs. 9,27,00,000 on Bybit Fintech Limited under Section 13 of the PMLA. This penalty was a consequence of multiple contraventions of PMLA provisions and associated rules:
Bybit operated in India without obtaining mandatory registration with FIU-IND, despite its classification as a reporting entity under Section 2(1)(wa) of the PMLA. Following that, its failure to adhere to the obligations under Section 12(1) of the PMLA and related rules that require reporting entities to maintain comprehensive transaction records constituted a material violation. Additionally, Violations under Rule 8(2) and Rule 8(4) indicated a failure to implement adequate customer due diligence and enhanced due diligence measures as required by the PMLA framework.
Following persistent non-compliance by the Company, FIU-IND also exercised its authority to request the Ministry of Electronics and Information Technology (MEITY) to block Bybit’s websites under the Information Technology Act, 2000, highlighting the cross-sectoral enforcement capabilities of Indian financial intelligence authorities.
Industry Enforcement Patterns and Precedents
The Bybit case is not an isolated incident but rather fits into a broader pattern of enforcement actions by FIU-IND. Preceding Bybit’s case, FIU-IND imposed an even larger penalty of Rs. 18,82,00,000 back in June 2024 on Binance, another major global VASP, for similar PMLA violations. This remains the largest crypto-related fine imposed in India to date. The company subsequently registered with FIU-IND and resumed operations in August 2024, demonstrating compliance to be a pathway to market re-entry.
Meanwhile, another VASP, KuCoin, registered with FIU-IND in March 2024 and paid a comparatively smaller penalty of Rs. 3.45 lakh. The significant disparity in penalty amounts between entities suggests FIU-IND’s enforcement approach considers factors such as market size, duration of non-compliance, and transaction volumes.
In contrast, entities like Coinbase adopted a proactive compliance approach, securing registration with FIU-IND in March 2025 before facing enforcement action. This strategy appears to have allowed such entities to avoid monetary penalties while positioning for market re-entry.
These cases also establish that physical presence in India is not a prerequisite for regulatory jurisdiction, provided the entity facilitates VDA-related services to Indian residents, which is a crucial clarification for any international VASP considering the Indian market.
Legal Implications and Regulatory Significance
VASPs registering with FIU-IND after the March 2023 notification remain liable for violations committed during their period of non-compliance, even if they later achieve compliance. This means that regulatory obligations are effective from the notification date, irrespective of when entities ultimately comply. Additionally, even after registration, VASPs must maintain continuous adherence to various obligations, following the AML & CFT Guidelines For Reporting Entities Providing Services Related to Virtual Digital Assets.
Furthermore, India’s VDA regulatory framework, particularly its reliance on the PMLA, aligns closely with the recommendations of the Financial Action Task Force (FATF), which enhances regulatory cooperation on an international scale. As India’s regulatory framework integrates with global AML standards, domestic entities should prepare for potential cross-border regulatory cooperation requirements and requests.
The above-mentioned developments demonstrate that the cost of non-compliance far outweighs the investment required for proactive regulatory adherence. Following these precedents, it would benefit both offshore and domestic stakeholders to consider bolstering their compliance postures to mitigate the risk of significant enforcement action.
Disclaimer: The information published in the above newsletter is collected from various sources in electronic medium and analyzed by the firm. The reader is advised to consult the attorney qualified in their jurisdiction, before acting on any information contained in this newsletter. India Juris excepts no liability what so ever in this regard.
