Executive Summary
- India. The BVI operator's exchange, custody and transfer services engage the notified virtual digital asset (VDA) activities. Registration with Financial Intelligence Unit-India (FIU) and applicable anti-money-laundering duties attach to offshore providers operating in India without requiring an Indian office. A foreign contract does not remove those duties. (S.O. 1072(E), 7 March 2023, reproduced in FIU registration circular, 15 September 2025, para. II; Ministry of Finance release, 9 September 2026.)
- BVI. Effective permission must cover the actual exchange and custody business. An ordinary pending application does not authorise operations. The historical transition protects only qualifying existing providers whose applications met its conditions. (Virtual Assets Service Providers Act, 2022 (BVI Act), ss. 5–7, 27–32 and 40.)
- India. FIU registration concerns AML reporting-entity obligations. It does not establish permission for every token, payment arrangement or financial product. Software support alone does not make the affiliate the exchange's substitute reporting entity. (Prevention of Money-laundering Act, 2002 (PMLA), ss. 2(1)(sa)(vi), 2(1)(wa) and 12; Lok Sabha Unstarred Question 5805, answered 30 March 2026, parts (c), (e) and (f).)
- BVI and India. Retaining customers with the BVI operator is the preferred commercial outcome only where its permissions are effective and its actual service complies. Otherwise, stop adding Indian business while resolving the relevant defect. Custody and withdrawals remain regulated activities; a restricted-service label supplies no exemption. (BVI Act, ss. 5 and 40; FIU circular, 15 September 2025, paras. II–III.)
- BVI and India. Choose migration only to an operator entitled to provide the actual service, with customer rights and asset delivery addressed. If neither compliant retention nor lawful migration is achievable, exit through a controlled customer-asset return process. Registration cancellation does not erase existing obligations. (BVI Act, ss. 23, 29 and 38; Consumer Protection Act, 2019, s. 2(46)(iv)–(vi).)
The operating company and the Indian affiliate
The BVI company is the relevant operator on the stipulated facts. It owes the customer the trading and custody service, accepts the account relationship, and controls asset release. Its location of incorporation and the location of its support staff answer different questions. India's notification captures services performed for another person in the course of business: exchanging VDA and fiat, exchanging VDAs, transferring VDAs, safekeeping or administration, and issuer-related financial services. (S.O. 1072(E), reproduced in FIU circular, 15 September 2025, para. II.)
The board should map each function to a legal entity and a person with actual authority. The map should identify the contracting party, account acceptor, order executor, asset controller, fiat recipient and withdrawal approver. It should also identify who decides suspicious-transaction reports and who can access customer records. An intercompany service agreement must agree with production permissions and transaction logs. These are recommended evidence checks for applying the statutory activity test.
Under the software-only alternative, the affiliate writes code and answers support requests without executing transactions or controlling customer assets. Those functions alone do not establish that it performs a notified VDA service. If its personnel approve transfers, administer wallets or execute exchanges on customers' behalf, the analysis changes. The affiliate's own functions must then be tested against the notification; the BVI company's registration cannot be assumed to cover another entity. Collecting identity documents as an outsourced task also differs from taking responsibility for the customer relationship. (FIU circular, 15 September 2025, para. II; Prevention of Money-laundering (Maintenance of Records) Rules, 2005, r. 9(2).)
Neither an Indian affiliate nor Indian advertising is necessary to the BVI operator's FIU exposure. The Ministry of Finance expressly describes offshore coverage as activity-based and independent of physical presence. Actual provision of accounts, trading and custody to Indian residents is the relevant assumed conduct. A website merely accessible from India would require a different factual assessment. (Ministry of Finance release, 9 September 2026, Release ID 2308131.)
Licentium's earlier “BVI or Cayman for an Indian crypto trading startup” assumes customers outside India. The present case concerns existing Indian customer relationships, rather than choosing an incorporation jurisdiction. Moving the incorporation address does not answer which entity supplies the notified service.
BVI registration and continuing duties
The BVI VASP license question concerns the operator's statutory registration and its approved activities. Section 5 requires registration for business in or from the BVI. A BVI company providing services outside the territory falls within the statutory deeming provision. Section 6 distinguishes general virtual asset services, custody services and operation of a virtual asset exchange. The platform and custody wallet must therefore match the Financial Services Commission (FSC)'s approved scope and conditions. (BVI Act, ss. 2, 5(4), 6–7 and 27–32.)
There are three relevant permission alternatives. An effective registration supports only the activities and conditions actually approved. An ordinary application supplies no operating permission. A qualifying pre-commencement provider can rely on section 40 only if the FSC received its application within the historical six-month period and the statutory continuation has not ended. The FSC identified 31 July 2023 as the application deadline for that transition. Refusal requires cessation, subject to any wind-down time the FSC grants under section 40(6)–(8). (BVI Act, ss. 5–7 and 40; FSC industry update, 1 February 2023.)
The board should match the legal name and company number against the certificate, conditions and FSC register. A group's brand name, an authorised representative's entry or a general-service description is insufficient evidence of exchange-and-custody permission. The Act provides for a register and extracts. An ineffective BVI permission affects the operator's business beyond its Indian accounts. (BVI Act, ss. 5–7 and 37.)
Registration carries continuing duties. The operator must maintain financial resources, required personnel and audit arrangements, preserve records, protect customer assets and comply with AML requirements. The operator must identify, appropriately segregate and account for client assets, with custody access and termination addressed contractually. Overseas registration and foreign enforcement events can also trigger notification to the FSC. (BVI Act, ss. 10–14, 18, 22–23, 25–26, 29 and 41.)
The BVI AML rules separately require a suitably qualified money-laundering reporting officer and, ordinarily, regulatory approval of the appointment. Existing appointments have an express transitional saving. The FSC's VASP guidance requires customer and business risk assessment, ongoing monitoring and effective record retrieval. Outsourcing to India should preserve the operator's ability to perform those duties. (Anti-money Laundering Regulations, reg. 13, substituted by S.I. 43 of 2024; commencement notice S.I. 47 of 2024; FSC VASP AML/CFT Guide, §§ 6–7.)
Indian FIU registration and reporting
Offshore crypto exchanges in India cannot treat BVI registration as a substitute for their Indian AML position. The notified activities include crypto-to-crypto exchange and custody, so removing rupee deposits does not remove the FIU trigger. The statutory description contains no customer-number threshold. Customer-initiated acquisition does not change the character of services subsequently provided to those customers. (S.O. 1072(E), reproduced in FIU circular, 15 September 2025, para. II; Ministry of Finance release, 9 September 2026.)
The strongest contrary argument is that the company contracts abroad and has no Indian operating office. The Ministry's published position expressly rejects physical presence as the prerequisite for offshore providers operating in India. On this hypothetical's actual-servicing facts, the operator should not continue ordinary Indian business on that argument. A fact pattern involving no Indian service would fall outside the assumption. (Ministry of Finance release, 9 September 2026.)
Registration must be established for the contracting operator. An application receipt or pending-system status does not establish completed approval. A generated FIUREID is for reference only; the circular makes registration conditional on completing online registration followed by the Director's approval. FIU's registration process requires substantive scrutiny: its September 2025 circular requires an in-person meeting with the designated director and principal officer, supporting documents and demonstrations of operating controls. In March 2026, the Government identified FIU's updated 8 January 2026 guidance as governing the registration process. A software affiliate's certificate cannot establish that the BVI applicant completed that process. (FIU circular, 15 September 2025, paras. IV–VI; Lok Sabha Question 5805, part (c).)
The operator must perform customer and beneficial-owner due diligence, maintain records and implement reporting controls. Reliance on a third party for due diligence is conditional, and ultimate responsibility remains with the reporting entity. The principal officer must furnish suspicious-transaction information promptly once satisfied that the transaction is suspicious. The current rule does not provide a seven-working-day grace period. Reporting and related information must remain confidential. (PMLA, ss. 11A–12; PML Rules, rr. 3, 3A, 7, 8(2), 8(6) and 9.)
The operational assessment must examine production evidence rather than policy documents alone. FIU's September 2025 circular expressly addresses KYC, transaction monitoring, blockchain analysis, sanctions controls and Travel Rule demonstrations. It also requires a cybersecurity audit certificate from a CERT-In-empanelled auditor. An applicant with an ongoing or intended relationship covered by paragraph IV.1(g) must provide a Partner Accreditation for Compliance and Trust certificate from the FIU-registered VDA service provider concerned. A functioning reporting process also needs access to the BVI company's records and decisions. (FIU circular, 15 September 2025, paras. IV–V.)
Enforcement remains a business-continuity risk after registration becomes necessary. On 9 September 2026, the Ministry reported notices to non-compliant providers and action concerning their mobile applications and website URLs. That announcement concerns enforcement steps, rather than a final finding against this hypothetical operator. Registration remediation should address existing notices and historical failures as well as future controls. (Ministry of Finance release, 9 September 2026; PMLA, s. 13.)
Payment arrangements and the asset offering
FIU registration is an AML status, not a general crypto operating licence. The Government has expressly cautioned against interpreting registration as approval or investor protection. Neither an asset listing nor a bank account follows automatically from it. The continuation decision must concern the actual spot products and payment arrangements, without extending to derivatives, lending or yield products. (Lok Sabha Question 5805, parts (e)–(f); PMLA, s. 12.)
Under a rupee-collection alternative, an Indian customer pays the affiliate or a collection partner for the BVI operator's benefit. FEMA requires scrutiny of payments to non-residents, receipts on their behalf and transactions connected with assets outside India. Its statutory residence test must be applied separately from the account's postal address. A domestic account does not remove those questions. The board should establish the beneficial recipient, settlement path and applicable permission before using that route. (Foreign Exchange Management Act, 1999, ss. 2(v)–(w) and 3–6.)
Under an offshore-bank alternative, the customer sends foreign exchange to the BVI operator. The authorised dealer must assess the transaction's purpose and applicable FEMA permissions. A general remittance allowance should not be treated as approval of the particular crypto transaction. RBI's 31 May 2021 circular preserves applicable due-diligence and FEMA obligations while rejecting reliance on the invalidated 2018 banking circular. (FEMA, ss. 3–6 and 10; RBI circular RBI/2021-22/45, paras. 1–2.)
If the affiliate or another provider aggregates customer payments and settles them to merchants, test the RBI payment-aggregator definition. The current 2025 Directions distinguish domestic and cross-border activity and impose authorisation, due-diligence and settlement requirements. Their cross-border category concerns permitted current-account transactions. Appointment of a payment provider does not determine whether the underlying purchase is permitted. (Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, paras. 3–5, 11, 13 and 16.)
Under a crypto-only alternative, the fiat-collection questions change but the notified exchange, custody and transfer activities remain. The operator should approve each asset and settlement model before offering it to Indian accounts. A token's rights, redemption arrangements and associated financing can change the legal question. The recommendation to retain customers extends only to the separately cleared offering; FIU registration supplies no product approval. (FIU circular, 15 September 2025, para. II; Lok Sabha Question 5805, parts (e)–(f).)
Advertising, customer protection and Indian support operations
Indian customer acquisition requires a separate consumer-law assessment. The Consumer Protection (E-Commerce) Rules apply to a foreign entity systematically offering goods or services to consumers in India. An account's investment or commercial purpose must be assessed under the statutory consumer definition. Indian residence alone does not establish consumer status in every case. (Consumer Protection Act, 2019, s. 2(7); Consumer Protection (E-Commerce) Rules, 2020, r. 2(2).)
Where those Rules apply, the business must provide the prescribed grievance mechanism and contact information. If the operator is a foreign company within section 2(42) of the Companies Act, 2013, rule 4(1) also requires a nodal officer or an alternate senior designated functionary resident in India. It must acknowledge complaints within forty-eight hours and redress them within one month. Marketing must avoid misleading claims about registration, returns, safety and material risks. Those consumer and advertising duties are separate from the FIU registration test. (E-Commerce Rules, r. 4(1), as substituted by G.S.R. 328(E), 17 May 2021, and r. 4(4)–(5); Companies Act, 2013, s. 2(42); Consumer Protection Act, s. 21; CCPA Misleading Advertisements Guidelines, 2022, paras. 3–4.)
For businesses within those Rules, the September 2026 amendment takes effect on 1 January 2027. It adds duties to provide a copy of the recorded complaint and become a partner in the National Consumer Helpline convergence process. It also requires a yearly dark-pattern self-audit and prominent display of the certificate. (G.S.R. 789(E), 9 September 2026, rr. 1(2), 3(a) and 3(c).)
The Indian affiliate must also address its own cybersecurity duties. CERT-In's directions cover bodies corporate and require specified cyber incidents to be reported within six hours of noticing them or being informed of them. They also require designated contact arrangements and retention of ICT logs for 180 days within India. Customer-support access, incident escalation and logging should be included in the intercompany operating design. (CERT-In Directions No. 20(3)/2022-CERT-In, 28 April 2022, clauses (ii)–(iv) and Annexure I.)
The offshore operator must also assess its own cybersecurity duties. CERT-In's FAQs address offshore VDA service providers serving Indian users in matters of cyber incidents, and require a point of contact even without an Indian physical presence. Clause (vi) separately requires covered VDA service providers, exchanges and custodial wallet providers to maintain KYC information and financial-transaction records for five years. The affiliate's controls cannot replace that assessment. (CERT-In Directions, clause (vi); CERT-In FAQs, May 2022, questions 26–29.)
Tax withholding and the 2026 reporting rules
A current operating decision must use the Income-tax Act, 2025 for its applicable periods. It commenced on 1 April 2026, subject to express exceptions; section 536 preserves relevant earlier liabilities and proceedings. FIU materials referring to earlier tax provisions do not dispense with that transition analysis. (Income-tax Act, 2025, ss. 1(3) and 536.)
Section 393(1), Table 8(vi), prescribes one per cent withholding on consideration for a VDA transfer credited or paid to a resident. The withholding point is the earlier of credit or payment. Section 393(4), Table 12, supplies the specified small-payment exclusions. Failure to furnish a valid Permanent Account Number can require higher withholding under section 397(2). Application depends on the payer, payee, consideration and exchange's role. A withdrawal returning an asset to the same beneficial owner does not, without more, establish consideration for a transfer. The operator should not configure withholding by treating every wallet movement as a sale. (Income-tax Act, 2025, s. 393(1), introductory words and Table 8(vi), s. 393(4), Table 12, and s. 397(2).)
Principal trading and matched trades need different responsibility maps. Rule 219 expressly recognises an exchange's agreement to pay tax for transfers of assets it owns under the applicable guidelines. The board should settle responsibility for collection, payment, returns and reconciliations before resuming the affected trade flow. (Income-tax Rules, 2026, r. 219(1)–(3).)
The separate crypto-asset information-reporting rules require another nexus test. Rule 242 addresses residence, incorporation or specified legal status, an obligation to file an Indian income-tax return, management, a regular place of business and relevant branch activity. Indian customers alone are not the complete reporting-provider test. Management or operations conducted through the affiliate can change the result; reportable-user classification is also separate. Reportable-person status turns on residence for tax purposes outside India, subject to the defined exclusions and the rules concerning controlling persons. Relief for compliance in a partner jurisdiction depends on completing the corresponding foreign obligations and meeting rule 242(3)'s conditions. Where the rules apply, the operator must implement the prescribed reporting and due diligence. (Income-tax Act, 2025, s. 509; Income-tax Rules, 2026, rr. 241–244.)
The decision and order of actions
The recommended order is to establish the operator's permissions, stop adding exposure where they fail, and reconcile existing obligations. The board should then clear each Indian product and payment route, test operating controls, and select retention, migration or exit. These recommended risk controls do not presume either company is registered or in breach.
First, require documentary evidence of BVI authority, completed FIU registration, conditions and any regulator or court directions. If BVI authority is ineffective, address the operator's entire regulated business. If FIU registration is absent or pending, do not continue ordinary Indian exchange business while treating the application as a grace period. The historical BVI transition cannot create an Indian exemption. (BVI Act, ss. 5 and 40; FIU circular, 15 September 2025, paras. III and VI.)
Second, where permission or operational compliance has not been established, the recommended interim restriction is to stop Indian acquisition, onboarding, new deposits and new orders. Preserve customer-asset security and reconcile balances immediately. Establish a legally permitted route for custody and returns, including compliance with binding directions. A withdrawal-only service still performs custody or transfer activity, so restriction reduces exposure without itself authorising the remaining service. (FIU circular, para. II; BVI Act, ss. 23 and 29.)
Third, prefer retention with the BVI operator where its permissions are effective, its customer service satisfies applicable requirements, and the actual products and rails are permitted. That avoids changing the counterparty and moving custody merely because customers reside in India. Resume only the functions that satisfy those conditions. Neither registration alone establishes them, and an unresolved impermissible payment route should remain closed. (PMLA, s. 12; BVI Act, ss. 5–7; FEMA, ss. 3–6.)
Fourth, select migration where a different operator can lawfully provide the required service and retention cannot meet the conditions. The recipient needs its own applicable home-jurisdiction authority and Indian FIU position. The Indian software affiliate qualifies only after its actual business and permissions support that role. A new logo, database transfer or group certificate does not change the legal provider by itself. (FIU circular, paras. II–VI; BVI Act, ss. 5–7 and 29.)
Before migration, settle who owes each customer the existing balance and each unsettled transaction. Identify the recipient, custody terms, fees, supported assets and transfer method. Obtain the customer agreement needed for the proposed change and preserve applicable withdrawal rights. The Consumer Protection Act's unfair-contract definition includes detrimental assignment without consent and unilateral termination without reasonable cause. BVI custody agreements must address access, termination and remedies. (Consumer Protection Act, s. 2(46)(iv)–(vi); BVI Act, s. 29(2).)
The recipient must complete its own due-diligence duties or meet the conditions for permitted reliance. Customer records cannot simply be treated as unrestricted group property. BVI law requires adequate protection safeguards or data-subject consent for an overseas personal-data transfer. Its disclosure rules apply separately; India's PML Rules also restrict third-party transfer of KYC records obtained from the central registry. A migration should proceed only through a documented lawful data-transfer route. (BVI Data Protection Act, 2021, ss. 4, 7(1)(c), 9–10; PML Rules, r. 9(1F) and (2).)
For rules 5–6 of India's 2011 sensitive-personal-data Rules, the Ministry distinguishes qualifying outsourced processing for another entity from direct customer contracts. Its 24 August 2011 clarification excludes the former from those two rules, so the affiliate's contractual role matters. The 2025 commencement notification defers the substantive provisions of the Digital Personal Data Protection Act, 2023 and the relevant IT Act amendment for eighteen months. (Ministry clarification, 24 August 2011, Release ID 74990; G.S.R. 843(E), 13 November 2025, para. (c).)
Finally, exit where the conditions for retention cannot be met and no lawful migration is available. Give notices required by the applicable contract, consumer duties and regulatory directions. Address open orders expressly: either complete them lawfully or cancel them through an applicable contractual or regulatory power. Reconcile executions, fees, pending withdrawals and disputed balances before closing each account. A business decision to exit supplies no independent authority for forced conversion or indefinite retention of assets. (BVI Act, ss. 23 and 29; Consumer Protection Act, s. 2(46)(iv)–(vi).)
Preserve records after customer departure. PMLA requires transaction records for five years from the transaction. Identification and account records run for five years after the relationship ends or account closes, whichever is later. Records required under the BVI Act must be kept for at least five years after termination of the relevant business relationship. BVI record duties survive cancellation or revocation, and cancellation leaves legal obligations and third-party rights intact. Closure must therefore retain the records and arrangements needed for outstanding claims, reporting and lawful asset return. (PMLA, s. 12(3)–(4); BVI Act, ss. 22(4)–(6) and 38(3).)