India's Crypto Push: Cybersecurity as the New Trust Standard

India has mandated that all cryptocurrency exchanges, custodians, and intermediaries undergo mandatory cybersecurity audits under the directive of the Financial Intelligence Unit of India (FIU-IND), a move aimed at bolstering security and preventing money laundering. The directive, effective from September 2025, requires virtual digital asset (VDA) service providers to engage auditors affiliated with the Indian Computer Emergency Response Team (CERT-In), the nodal agency under the Ministry of Electronics and Information Technology. This regulatory step aligns the crypto sector with banking and financial institutions under the Prevention of Money Laundering Act (PMLA), 2002, which governs anti-money laundering practices across India’s financial ecosystem.

Currently, approximately 55 firms in India are registered under the VDA framework, offering services such as exchange, custodianship, and financial operations. These entities must now comply with enhanced security protocols, including penetration testing, encryption of user data, and secure management of private keys. The mandate comes amid a sharp rise in crypto-related cybercrimes, with nearly 20-25% of all cyber offenses in the country now involving digital assets. Hackers frequently exploit darknet markets, privacy-enhancing coins, and mixing services to obscure the movement of stolen funds, complicating investigations.

Industry leaders have largely welcomed the move, highlighting its potential to build user trust and align Indian platforms with global best practices. Avinash Shekhar, CEO of Pi42, emphasized that robust security measures are essential for an industry built on trust. Edul Patel, CEO of Mudrex, added that the directive is a significant step toward strengthening investor protection and fostering a resilient crypto ecosystem. The requirement follows a spate of high-profile breaches in recent years, including incidents at major exchanges in 2024 and 2025, which exposed vulnerabilities in existing security frameworks.

The audit process is not merely a technical compliance exercise but a comprehensive review of digital defenses. Exchanges are expected to submit detailed reports to regulators, ensuring that they meet stringent compliance standards. Failure to adhere to these requirements could result in registration denial, suspension, or revocation by the FIU-IND. The directive also replaces the earlier "Fit & Proper" certificate with a new "Partner Accreditation for Compliance & Trust" (PACT) certificate, which narrows the scope of evaluation to compliance-related parameters. However, experts suggest that further clarification from the FIU is necessary to ensure consistent application of the new certification across the sector.

The regulatory shift aligns India with global trends, as countries like the United States, European Union, and Japan continue to tighten oversight of digital assets. These measures aim to combat illicit financial flows, enhance transparency, and reduce the risks associated with decentralized finance. India’s approach mirrors international efforts to integrate cryptocurrencies into traditional financial frameworks while maintaining investor safeguards. For example, the EU’s Markets in Crypto-Assets (MiCA) regulation and Japan’s requirement for exchange insurance reflect similar principles of security and compliance.

Despite the benefits, implementation challenges remain. The cost of compliance could pose a significant burden for smaller firms, potentially leading to market consolidation. Experts warn that high operational costs and a shortage of cybersecurity professionals may hinder effective execution of the mandate. Moreover, the regulatory ambiguity surrounding decentralized exchanges and the integration of VDAs with traditional financial systems could delay the full realization of the directive’s objectives.

As India continues to refine its regulatory stance, the emphasis on cybersecurity audits signals a broader commitment to balancing innovation with risk mitigation. The government’s ongoing initiatives—such as the Digital Rupee pilot and expanded use of blockchain in public services—underscore its strategic vision for a secure and compliant digital finance ecosystem. With global investors closely watching how these policies evolve, India’s regulatory approach may serve as a model for other emerging markets seeking to navigate the complexities of crypto governance.