Centre Directs Crypto Exchanges To Conduct Cyber Security Audits

SUMMARY

The FIU-IND has directed all virtual digital asset service providers to submit a cyber security audit certificate from CERT-In empanelled auditors

The move comes at a time when the Indian cryptocurrency space has witnessed some major cyber attacks in recent times, leading to users incurring heavy losses

While a crypto heist saw WazirX losing $234 Mn worth of cryptocurrencies last year, CoinDCX was hit by a cyberattack this year which saw hackers steal assets worth $44 Mn

Strengthening the regulations for crypto exchanges, the Financial Intelligence Unit – India (FIU-IND) has directed all virtual digital asset service providers (VDA SPs) to submit a cyber security audit certificate from Indian Computer Emergency Response Team (CERT-In) empanelled auditors.

VDA SPs include companies that offer digital asset services, including cryptocurrency exchanges, wallet services with VDA transfer features, peer-to-peer trading platforms, among others.

Notably, the Centre brought VDA SPs under the ambit of Prevention of Money Laundering Act (PMLA) in March 2023, mandating them to report suspicious transactions, conduct customer due diligence, among others. Later that year, all virtual digital asset service providers were asked to register as reporting entities with the FIU.

Additionally, these service providers are also required to provide their annual returns, GST returns, and copies of ITRs to the authorities.

Commenting on the requirement for a cyber security audit certificate, CoinSwitch cofounder Ashish Singhal told Inc42, “We were among the first exchanges to register with the FIU-IND as a reporting entity, and since then, we have remained fully aligned with all of its regulatory requirements. We will, of course, extend the same commitment to this mandate as well.”

The development comes at a time when India’s cryptocurrency space has witnessed some major cyber attacks in recent times, leading to users incurring heavy losses.

In July 2024, WazirX was hit by a major heist, losing $234 Mn worth of cryptocurrencies from one of its wallets hosted on Liminal, an institutional digital asset custody platform.

During the same month this year, CoinDCX was also hit by a major cyberattack which saw hackers steal assets worth $44 Mn from the crypto exchange’s internal operational account.

This comes at a time when regulations for cryptocurrencies remain unclear in India. While the RBI is a staunch opponent of cryptocurrencies, the Centre has not outrightly banned it. However, cryptocurrencies are taxed heavily. The government imposes a 30% tax on profits from cryptocurrency trading and a 1% TDS (Tax Deducted at Source) on transactions above INR 10k per year.

The Centre collected INR 705 Cr in taxes from VDA income between FY23 and FY24. However, raids and surveys unveiled additional INR 630 Cr of unreported income from trading of such assets, minister of state (MoS) for finance Pankaj Chaudhary informed the Parliament last month.

Last month, the income tax department disseminated nearly 44,000 messages to individuals for not filing their cryptocurrency transactions in their FY25 returns.