Crypto ATM / kiosk operator in India
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in India with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Mandatory FIU-IND registration as a VDA Service Provider (Reporting Entity) under the Prevention of Money Laundering Act (PMLA), 2002, as amended March 7, 2023
- Implement transaction monitoring systems — risk-based, real-time, AI-powered systems to flag suspicious activities like large transfers, structuring, or high-risk patterns
- Deploy blockchain analytics tools (e.g. SaaS models analyzing wallets, histories, typologies like chain-hopping or mixers) for VASP compliance
- Travel Rule compliance: share originator/beneficiary details (name, account, address) for virtual asset transfers via secure channels with screening, recordkeeping, and rejection of incomplete data
- Continuous screening of wallets, addresses, and counterparties against OFAC SDN List, EU Consolidated Financial Sanctions List, and UN Consolidated List
- Immediately freeze sanctioned cryptoassets from designated wallets/exchanges and report to authorities
- 1% TDS on transactions above INR 50,000 under Finance Act 2022 Section 115BBH
- 30% flat tax on virtual digital assets under Finance Act 2022 Section 115BBH
- File Suspicious Transaction Reports (STRs) — general SAR obligations noted to enforcement bodies
- No specific cash-transaction reporting threshold identified for India — FATF recommends $1,000/€1,000 but India may apply requirements to all transactions
Key Restrictions
- No specific kiosk/money-transmitter licensing framework exists — VASPs operate under the general FIU-IND VDA Service Provider registration
- No specific custody framework for crypto; custody is covered only under general FIU registration
- No framework for stablecoins, DeFi, or token issuance
- RBI historically hostile to private crypto (attempted outright ban in 2018, reversed by Supreme Court in 2020) — regulatory uncertainty remains
- A 1% TDS applies on transactions above INR 50,000, creating operational friction for cash-in/cash-out kiosk transactions
- Offshore exchanges blocked in January 2024 for non-compliance — demonstrates active enforcement posture
- Cash-heavy model heightens AML/KYC risk; no explicit kiosk-specific cash reporting threshold identified — prudential operators should treat all cash transactions as reportable
Key Risks
- Regulatory ambiguity — no comprehensive crypto legislation exists (status 'upcoming' since 2021), leaving the kiosk operating model without clear law
- RBI hostility to private crypto creates risk of future restrictive regulations or payment-rail blocking
- Cash-intensive kiosk model poses elevated AML/structuring risk — enforcement precedent includes blocking 9 offshore exchanges in 2024
- Penalties under PMLA can reach up to 3x contravention value plus 3–7 years imprisonment; FEMA violations up to 3x amount
- No explicit cash-transaction reporting threshold for crypto kiosks creates ambiguity in compliance obligations
- Tax burden (30% flat + 1% TDS) may deter users and affect profitability of cash-to-crypto conversion at kiosks
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FIU-IND — VDA Service Provider registration, AML/CFT, blocked 9 offshore exchanges in Jan 2024
RBI — Stablecoins, payments, Digital Rupee CBDC pilot — historically hostile to private crypto
Prevention of Money Laundering Act (amended 2023) (2023) — VDA SP registration with FIU-IND — mandatory
Finance Act 2022 (Section 115BBH) (2022) — 30% flat tax on virtual digital assets; 1% TDS on transactions above INR 50,000
VASP: VDA Service Provider registration with FIU-IND (1-3 months, no minimum capital). Offshore exchanges blocked in 2024 for non-compliance (Binance, KuCoin, etc.) — most subsequently registered. No comprehensive crypto legislation despite being 'upcoming' since 2021.
CUSTODY: No specific custody framework; covered under FIU registration. No framework for stablecoins, DeFi, or token issuance.
EXCHANGE: FIU-IND registration required; offshore exchanges blocked if non-compliant. RBI attempted outright ban in 2018 (reversed by Supreme Court 2020).
Transaction Monitoring Systems: Confirmed as a standard requirement for VASPs. Sources describe risk-based, real-time, AI-powered systems to flag suspicious activities like large transfers, structuring, or high-risk patterns, tailored to customer risk levels.
Blockchain Analytics Tools: Supported indirectly. Sources highlight blockchain monitoring (e.g., SaaS models analyzing wallets, histories, and typologies like chain-hopping or mixers) as essential for VASP compliance, often integrated with transaction monitoring.
Travel Rule Solutions: Explicitly required under FATF standards. VASPs must share originator/beneficiary details (e.g., name, account, address) for virtual asset transfers via secure channels, with screening, recordkeeping, and rejection of incomplete data.
Adopted and Effective Date: Adopted via PMLA amendment on March 7, 2023, explicitly to comply with the FATF Travel Rule by including VDA service providers (often termed VASPs) in the PMLA framework.
Threshold Amounts: No specific threshold is detailed in the provided sources for India; FATF globally recommends $1,000/€1,000, but countries like India set their own (or none), with requirements potentially applying to all transactions.
VASPs Covered: All Virtual Digital Asset Service Providers (also called VDA-SPs), now classified as reporting entities under PMLA. Several VASPs have registered with the Financial Intelligence Unit - India (FIU-IND), while non-compliant ones faced website blocks.
Technical Implementation Requirements: FIU-IND issued specific AML & CFT Guidelines for VDA-related service providers, covering transaction monitoring systems, blockchain analytics tools, and Travel Rule compliance. VASPs must adhere to these and any subsequent FIU-IND directives on implementation status.
Prevention of Money Laundering Act (PMLA), 2002 (amended March 7, 2023): Core legislation extending AML/CFT to VDAs and VASPs. https://www.ikigailaw.com/article/592/the-implementation-of-the-fatf-travel-rule-to-vasps-in-india
FIU-IND AML & CFT Guidelines for VDA Service Providers: Operational guidance post-amendment. https://fiuindia.gov.in/pdfs/downloads/VDA08012026.pdf
Screening obligations: Continuous screening of wallets, addresses, and counterparties against the Specially Designated Nationals (SDN) List (https://sanctionssearch.ofac.treas.gov), plus the 50% Rule (block entities owned ≥50% by SDN-listed persons) (https://ofac.treasury.gov/faqs/topic/1626). No crypto exceptions; includes sanctioned jurisdictions like Iran, North Korea, Syria, Cuba, Crimea/Donbas (https://ofac.treasury.gov/sanctions-programs-and-country-information).
Penalties: Civil fines up to $1M+ per violation (e.g., Binance $3.4B in 2023 for Iran/Russia/Cuba dealings; Bittrex $24M) (https://sanctionslawyers.net/ofac-lawyers/ofac-cryptocurrency-sanctions/); criminal penalties possible. Indian VASPs risk secondary sanctions or PMLA fines up to ₹10 lakh + imprisonment.
Penalties: PMLA fines (up to 3x contravention value) + 3-7 years imprisonment; FEMA violations up to 3x amount.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators may operate as VDA Service Providers registered with FIU-IND under PMLA, subject to AML/CFT obligations including transaction monitoring, blockchain analytics, Travel Rule compliance, and sanctions screening, with no dedicated kiosk-specific licensing framework and significant regulatory ambiguity given RBI's historically hostile stance.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?