AML audit readiness and evidence trails for India's registered crypto platforms
TL;DR Riskmeld helps Indian crypto exchanges, wallets and brokers prove they follow FIU-IND's anti-money-laundering guidelines. It maps each guideline to the evidence a platform has to hold, checks that logs are complete and tamper-evident and gets the file ready for the annual independent audit. Compliance heads pay a yearly subscription.
By one measure India is the world's most active crypto market, ranking first of 151 countries in one blockchain analytics firm's 2024 adoption index[1]. It's also unforgiving. In July 2024 about US$230 million left a large Indian exchange's multisig wallet in one night[2].
The 2026 FIU-IND guidelines piled on more work - an India-based full-time Principal Officer, a live demo of AML systems before registration, tamper-proof audit trails with verification responses and timestamps, and an independent AML audit every year that goes to the board[3].
Most Indian platforms run lean compliance teams, and that evidence ends up scattered across a handful of tools.
What it does, in regulatory terms: compliance-management software. Riskmeld is not an auditor and gives no legal opinion. An independent firm still has to sign the audit. Riskmeld just makes the platform ready for it.
It holds the FIU-IND guideline paragraphs as a checklist, each tied to the evidence it needs, like KYC verification logs, alert decisions with reasons, unhosted-wallet data and Board papers. Connectors pull logs from the platform's KYC vendor, transaction monitoring and ticketing systems and then hash and timestamp them so any later edit shows up. An AI model reads policies and alert notes and flags gaps for a human, such as an alert closed with no recorded reason. Before audit season it exports a file laid out the way auditors work.
The seed pitched AI that checks smart contracts for legal compliance. We dropped that, since India has no law a contract's code can be measured against. What India regulates is the platform, under PMLA, with 30% tax and 1% TDS on VDA transfers[4]. Code scanning is cheap anyway, and open-source analysers ship 100 detectors free[5].
The buyer is the Principal Officer or compliance head at an FIU-registered VDA service provider. The money comes from compliance spend that used to go on consultants and spreadsheets. Our test price is ₹15–40 L a year, by transaction volume.
Audit firms that review these platforms are a second channel, because a clean evidence file shortens their work.
FIU-IND issued consolidated guidelines on 8 January 2026, replacing the 2023 set[3]. They spell out the annual independent audit and add tamper-proof logging and stricter rules on Principal Officers. Every registered platform now has a dated, repeating obligation, and a failed audit lands straight on its board's desk.
We found no public count of FIU-registered VDA service providers. FIU-IND posts the registration notice but no register[6]. That count is the market - a few dozen to a few hundred platforms at most, each with a yearly audit.
India's top rank in crypto adoption[1] is an adjacent signal of the user base those platforms serve. Treat this as a narrow, high-value niche.
One Indian audit firm has run smart-contract audits since 2018, now sells AI vulnerability scanning and has worked on 1,500+ projects, but its focus is code security and not AML records[7]. Global blockchain-analytics firms sell transaction screening. Law firms and consultants publish guideline summaries and run audits.
Nobody we found turns the Indian guideline paragraphs into a living evidence checklist.
| Difficulty | Hard (53/100) |
| Starting capital | ₹1.2–2.2 Cr |
| Time to launch | 9–12 months |
The hard parts are trust and integration. Would you hand your KYC logs to a vendor you'd never heard of? Neither will they, so you need security certification and a credible AML lead from day one. Every platform's systems are different too, and connectors take months to build.
You don't need a licence to sell compliance software. Your clients carry the regulated duties, and you must not claim to discharge them.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI clear an alert, file a suspicious transaction report or sign off on compliance. Those calls belong to the Principal Officer and the independent auditor, and a missed flag has legal weight.
Want to work out the AI layer for Riskmeld? Talk to Yash →
Here's what can go south -
I'd only do this with AML or bank-compliance experience and a phone full of Indian crypto compliance heads. If you're a crypto enthusiast without that background then it'll be a long, hard slog.
Prove one thing first - that five registered platforms will share real evidence for a paid readiness review before their next audit.
Plan for roughly ₹1.2–2.2 Cr over 9–12 months, mostly on connectors, security certification and a credible AML lead.
It can be at ₹15–40 L a year per client, but the market is a few dozen to a few hundred registered platforms, so revenue tops out early.
Yes, wherever crypto platforms face yearly AML audits. You'd rebuild the checklist around that country's rules and regulator.
The free Riskmeld validation kit has the line-by-line capital breakdown, the effort scoring, the PMLA and FIU-IND checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for compliance heads, and 5 assumptions to test. Download the kit →
Thinking about building Riskmeld or something close to it? The make-or-break work is earning enough trust to connect to a platform's KYC and alert logs, and that's the kind of thing I help founders plan. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.