Virtual Digital Asset Service Provider
Also written Virtual Digital Asset Service Provider (VDA SP) · VDA SP · VDA Service Provider
A provider of services related to virtual digital assets — a reporting entity under section 2(1)(wa) of the PMLA, which must register with FIU-IND and meet its record-keeping and reporting duties.
In plain language
A crypto exchange or wallet provider is not a bank, a stock broker or an insurer. So for a long time it sat outside the PMLA's list of entities with reporting duties.
The PMLA was built so that this gap could be closed without changing the Act. A reporting entity includes a person carrying on a designated business or profession. That group includes such other activities as the Central Government may designate by notification. Virtual digital asset service providers were brought in this way.
Once inside, they have the same duties as every other reporting entity. They must register with FIU-IND. They must keep records and verify their customers. They must report suspicious transactions. The workbook's Bybit order shows the price of treating these duties as optional.
How it works
How a VDA SP became a reporting entity.
| Step | Source |
|---|---|
| "Reporting entity" means a banking company, financial institution, intermediary or person carrying on a designated business or profession | PMLA section 2(1)(wa) |
| A person carrying on designated business or profession includes a person carrying on such other activities as the Central Government may, by notification, designate | PMLA section 2(1)(sa), sub-clause (vi) |
| VDA SPs designated; FIU-IND issues AML and CFT Guidelines for Reporting Entities offering services related to VDAs | 10 March 2023 |
| FIU-IND circular on registration of VDA SPs as reporting entities | 17 October 2023 |
What the guidelines summarise. The AML and CFT guidelines for reporting entities, including those related to VDAs, summarise the obligations under three statutes: the PMLA, the Unlawful Activities (Prevention) Act, 1967, and the Weapons of Mass Destruction and Delivery Systems (Prohibition of Unlawful Activities) Act, 2005.
The duties that follow. As a reporting entity, the VDA SP must register with FIU-IND — every reporting entity has to register to furnish information online — communicate its Designated Director and Principal Officer under Rule 7, record suspicious transactions under Rule 3(1)(D), and report them within the Rule 8 timeline.
The Bybit order (Chapter 7, section 7.1). Bybit Fintech Ltd kept expanding its services in India without securing mandatory registration with FIU-IND. The persistent non-compliance led FIU-IND to have its websites blocked under the Information Technology Act, 2000 through MeitY. By order dated 31 January 2025, under section 13 of the PMLA, the Director of FIU-IND found violations of section 12(1) read with Rules 2(1)(h), 7(2), 8(2), 8(4), 3(1)(D) and 7(3), and imposed a total penalty of Rs 9,27,00,000 under section 13(2)(d).
A worked example
The Bybit facts are from Chapter 7; the calendar below is a teaching aid built on them.
| Date | Event | What it meant for an offshore VDA platform serving Indian users |
|---|---|---|
| 10 March 2023 | FIU-IND AML and CFT guidelines for VDA service providers | The obligations are written down |
| 17 October 2023 | FIU-IND circular on registration of VDA SPs as reporting entities | Registration process is explicit |
| Thereafter | Bybit keeps expanding in India, unregistered | Every month of operation is operation as an unregistered reporting entity |
| Date not given in the workbook | Websites blocked via MeitY under the IT Act for persistent non-compliance | Access to Indian users cut off |
| 31 January 2025 | Order under section 13 | Rs 9,27,00,000 penalty |
Reading the charge list. The violations cited are not only about registration. Rule 7(2) and 7(3) concern furnishing information and having an internal mechanism to detect reportable transactions; Rule 3(1)(D) is the record of suspicious transactions; Rule 8(2) is the STR deadline; and Rule 8(4) makes each day of delay a separate violation. An unregistered entity cannot report — so a registration failure becomes a reporting failure, day after day.
For an IFSC regulated entity. A fund management entity in GIFT City whose investor wants to subscribe USD 500,000 using proceeds of a token sale on an overseas VDA platform should treat the platform's registration status and the source of funds as part of its customer risk assessment — the workbook's case shows how far outside the framework such a platform can operate.
Why NISM asks about it
Chapter 7 (Discussion on PMLA related Cases), section 7.1, is the Bybit order, and its sample question asks what a VDA SP is classified as under the PMLA — a reporting entity. Chapter 1, section 1.4.6, and Chapter 2's definitions explain the designated-business route by which VDA SPs came within the Act. Expect the classification question, the two FIU-IND dates in 2023, and the penalty figure.
Common exam traps
- A VDA SP is a reporting entity, not a "regulated entity" — the workbook's own sample question offers both. Regulated entity is the IFSCA term for units licensed by IFSCA.
- The route in is section 2(1)(sa)(vi), the Central Government's power to designate further activities — not an amendment adding VDA SPs by name.
- Two 2023 dates: guidelines on 10 March 2023, registration circular on 17 October 2023.
- The penalty was Rs 9,27,00,000, by order of 31 January 2025, under section 13.
- Blocking came through MeitY under the IT Act, not through the PMLA itself.
- Registration is not a formality. Without it, the Rule 7 and Rule 8 duties cannot be performed, and each day of delay is a separate violation.
Check yourself
1.Under the PMLA 2002, what is a Virtual Digital Asset Service Provider (VDA SP) classified as?
- a)Reporting Entity
- b)Regulated Entity
- c)Registered Entity
- d)Related Entity
Show the answer
Answer: (a) Reporting Entity
As a Virtual Digital Asset Service Provider (VDA SP), Bybit is classified as a 'reporting entity' under Section 2(1)(wa) of the Prevention of Money Laundering Act (PMLA).
Option B is the IFSCA Guidelines' term, not the PMLA's. There, a Regulated Entity means a unit/entity which has been granted license, recognition, registration or authorisation by the Authority — a different concept under a different instrument. Options C and D have no statutory basis at all.
**Section 2(1)(wa) defines "reporting entity" means a banking company, financial institution, intermediary or a person carrying on a designated business or profession — and a VDA service provider enters through the open limb of the last category: person carrying on such other activities as the Central Government may, by notification, so designate, from time-to time.
That open sub-clause is how new business models are brought inside the Act without amending it.
What followed from the classification. Being a reporting entity, Bybit owed the section 12 duties and had to register with FIU-IND — yet it kept expanding its services in the Indian market without securing mandatory registration with the FIU-IND.
**The penalty was ₹9,27,00,000 (Nine crore twenty-seven lakh rupees) under Section 13(2)(d), by order dated January 31st, 2025, for violating Section 12(1) of the PMLA read with Rule 2(1)(h), Rule 7(2), Rule 8(2) Rule 8(4), Rule 3(1)(D) and Rule 7(3) of PMLR, 2005.
And there was a second sanction: the persistent and continuous non-compliance caused FIU-IND to block their websites to stop operations under the Information Technology Act, 2000 through the Ministry of Electronics and Communication Technology (MEITY).
Guidance had preceded it — AML/CFT guidelines for VDA reporting entities on March 10, 2023, and a registration circular on October 17, 2023.
2.IFSCA-licensed regulated entities must register with FIU-IND by completing enrolment on which portal?
- a)FINGate 2.0 Portal
- b)SEBI Portal
- c)FIU-IND Portal
- d)RBI Portal
Show the answer
Answer: (a) FINGate 2.0 Portal
All regulated entities licensed with IFSCA are mandatorily required to register with the Financial Intelligence Unit of India (FIU-IND) by completing the enrolment on the FINGate 2.0 Portal.
What FINGate is: FINGate 2.0 is the primary platform through which data associated with money laundering or other crimes is furnished to FIU-IND. FINGate 2.0 is FINNET 2.0's front-end web portal used by regulated entities to report suspicious financial transactions.
It serves both registration and reporting — which is why registration must come first. An unregistered entity has no channel through which to file.
The process: registration on FIU-IND FINGate 2.O portal is a two-step procedure. The first step is Regulated Entity registration, and second step is Designated Director and Principal Officer registration.
Two steps — the entity, then its two named officers.
What is furnished: the registration process involves furnishing the details about the business, the Principal Officer, and the regulated entity's Designated Director, who shall take care of the AML program within the organisation.
And failing to register is a substantive breach: non-registration with FIU-IND is treated as non-compliance with the IFSCA (AML, CFT, and KYC) Guidelines.
Chapter 7 shows what that can mean in practice — a virtual digital asset service provider that expanded in India without FIU-IND registration was penalised and had its websites blocked.
Options B and D name the wrong regulators. Reports go to FIU-IND, not to SEBI or the RBI — and within the IFSC the sectoral regulator is IFSCA in any event, since the regulatory powers of four financial services regulators in India... have been vested in IFSCA.
Where this is taught
Free preparation for NISM Series IFSCA-01Related terms
- Principal officerThe named individual at a non-individual intermediary who carries personal regulatory responsibility for the advisory business, and who must personally hold the prescribed qualification and NISM certification.
- Designated DirectorThe person a reporting entity designates to ensure overall compliance with Chapter IV of the PMLA — and, where the entity is located in an IFSC, the person heading that entity in India.
- FINGate 2.0FINNET 2.0's front-end web portal — the platform on which every IFSCA-licensed regulated entity must register with FIU-IND, and through which suspicious transactions are reported.
- Reporting entityUnder Section 2(1)(wa) of the PMLA, a banking company, financial institution, intermediary or person carrying on a designated business or profession — the entity that must keep records and report to FIU-IND.
- Suspicious transactionAny transaction or attempt, cash or not, that to a person acting in good faith suggests proceeds of crime or terrorist financing, or looks unjustifiably complex or without economic rationale.
- FIU-INDIndia's central national agency for receiving, processing, analysing and disseminating information on suspect financial transactions, set up in November 2004 and reporting to the Economic Intelligence Council.
- Central Bank Digital CurrencyA digital representation of fiat currency issued by a central bank — expressly outside the scope of FIU-IND's AML/CFT/PF guidelines for virtual digital asset service providers.