Crypto rules tightened: Live selfies, geo-tagging mandatory for users; FIU rolls out tougher KYC norms

India’s Financial Intelligence Unit (FIU) has rolled out stringent new Anti-Money Laundering (AML) and Know Your Customer (KYC) norms for cryptocurrency exchanges, making live selfie verification and geographical tracking mandatory during user onboarding, according to guidelines issued on January 8, PTI reported. Under the updated framework, crypto exchanges are classified as Virtual Digital Asset (VDA) service providers and will be required to go beyond basic document uploads for customer verification, the guidelines accessed by PTI showed.As per the rules, users must take a “live selfie” using software that verifies their physical presence through features such as eye-blinking or head movement, a step aimed at preventing the use of static images or deepfakes. Exchanges are also required to capture the latitude and longitude, date, timestamp and IP address from which an account creation process is initiated.In addition, exchanges must follow the “penny-drop” verification method, involving a nominal Re 1 transaction to confirm that the bank account provided is active and belongs to the registrant.Apart from a Permanent Account Number (PAN), users will now have to submit a secondary identity document such as a Passport, Aadhaar or Voter ID, along with OTP verification of both email ID and mobile number.The FIU, which operates under the Union Finance Ministry, has also taken a tough stance against mechanisms that conceal the trail of crypto transactions. The guidelines seek to “strongly discourage” Initial Coin Offerings (ICOs) and Initial Token Offerings (ITOs), citing their lack of economic justification and elevated risk.The FIU is the single-point regulator for cryptocurrency exchanges operating in India under the Prevention of Money Laundering Act (PMLA). All such exchanges must register as reporting entities, submit regular reports on suspicious transactions and maintain customer records to identify and combat money laundering, terrorist financing and proliferation financing risks. While crypto assets are not recognised as legal tender in India, they are taxed under the Income-Tax law.“The RE (crypto exchange) shall also ensure that the client whose credentials are being furnished at the time of onboarding is the same individual who is actually accessing the application and personally initiating the account creation process,” the guidelines stipulate.“The authenticity of such access and personal presence shall be established by capturing a live photograph of the client and employing liveliness detection technology to verify the client’s physical presence…,” they add.The guidelines mandate KYC updation every six months for “high-risk” clients and annually for all other users. Enhanced client due diligence is required for high-risk individuals or entities, including those linked to tax haven countries, jurisdictions on the FATF grey or black list, politically exposed persons (PEPs) and non-profit organisations (NPOs). This includes gathering information from open sources and consulting independent databases.On ICOs and ITOs, the FIU said these activities pose “heightened and complex” money laundering and terror financing risks as they “lack” justified economic rationale. It also flagged anonymity-enhancing crypto tokens, tumblers and mixers as tools designed to conceal or obfuscate the origin, ownership or value of transactions.Such transactions must not be facilitated and should trigger appropriate risk-mitigation measures, the guidelines said. Crypto tumblers or mixers, which blend coins from multiple sources after a transaction, make tracing extremely difficult.The FIU has also directed exchanges to preserve client identity, address and transaction records for a minimum of five years and retain them until any investigation is concluded.