Chapter 7: Discussion on PMLA Related Cases

The rapid emergence of Virtual Digital Assets (VDAs) and cryptocurrency trading platforms has created unprecedented challenges for anti-money laundering enforcement worldwide. The case of FIU-IND v. Bybit Fintech Limited (Order dated January 31, 2025) stands as a landmark regulatory precedent defining the extra-territorial application of the Prevention of Money Laundering Act, 2002 (PMLA) to foreign, offshore digital asset service providers catering to Indian residents.

                      FIU-IND v. BYBIT FINTECH LIMITED
                                      │
          [ Bybit Fintech Ltd: Offshore VDA Exchange Platform ]
                                      │
               Serving Indian Retail Investors & Traders
             Without Registering with FIU-IND as Reporting Entity
                                      │
                                      ▼
                   [ Statutory Violation of PMLA Framework ]
              - Section 2(1)(wa): Classified as 'Reporting Entity'
              - Notification of March 10, 2023 & Circular of Oct 17, 2023
              - Section 12(1): Mandatory Registration, CDD, Recordkeeping
                                      │
                                      ▼
                      [ Enforcement Escalation Ladder ]
        1. Show Cause Notice under Section 13 of PMLA
        2. Website & App Blocking via MEITY under Section 69A of IT Act
        3. Adjudication by Director, FIU-IND (Order of Jan 31, 2025)
                                      │
                                      ▼
                   [ Final Penal Sanctions Imposed ]
                    Total Fine: ₹9,27,00,000 (₹9.27 Crore)

Factual Background and Regulatory Context

On March 7, 2023, the Ministry of Finance, Government of India, issued a historic gazette notification bringing entities providing services relating to Virtual Digital Assets within the ambit of the PMLA. Under Section 2(1)(wa) of the PMLA, any person carrying on designated activities—including the exchange between virtual digital assets and fiat currencies, exchange between one or more forms of VDAs, transfer of VDAs, safekeeping or administration of VDAs, and participation in financial services related to an issuer’s offer and sale of a VDA—was classified as a Reporting Entity (RE).

Subsequently, FIU-IND issued:

1. Detailed AML/CFT Guidelines for VDA Service Providers on March 10, 2023; and
2. A comprehensive circular on October 17, 2023, prescribing the mandatory onboarding and registration procedure for all VDA service providers on the FIU-IND portal.

Bybit Fintech Limited, an offshore cryptocurrency exchange incorporated outside India, actively onboarded Indian resident clients, accepted deposits in fiat currency and digital tokens, and facilitated high-volume crypto spot and derivative trading without obtaining mandatory registration with FIU-IND.

Findings of Non-Compliance and Statutory Breaches

In proceedings conducted by the Director, FIU-IND, Bybit was found guilty of willful, continuous, and systemic non-compliance under Section 13(2)(d) of the PMLA:

• Failure to Register as a Reporting Entity: Operating within the Indian economic territory by servicing Indian clients without registering with FIU-IND, directly violating Section 12 of the PMLA.
• Absence of Customer Due Diligence (CDD): Enrolling clients without performing customer verification in accordance with Rule 9 of the PML Rules, 2005.
• Failure to Maintain and Furnish Records: Non-maintenance of transaction logs and non-reporting of Suspicious Transaction Reports (STRs) under Rule 3, Rule 7, and Rule 8 of the PML Rules.
• Extra-Territorial Jurisdiction: The Director, FIU-IND affirmed that offshore entities providing digital financial services to Indian residents cannot take refuge behind foreign incorporation; any entity touching the Indian financial stream falls squarely under PMLA jurisdiction.

Regulatory Penalties and Blocking Orders

To protect the integrity of the Indian financial system and prevent untraceable capital flight, the Government took multi-pronged enforcement action:

1. Digital Interdiction: FIU-IND requested the Ministry of Electronics and Information Technology (MEITY) under Section 69A of the Information Technology Act, 2000, to block the URLs and mobile applications of Bybit and other non-compliant offshore exchanges from being accessed within India.
2. Monetary Penalty: Vide the order dated January 31, 2025, the Director, FIU-IND, exercising statutory powers under Section 13(2)(d) of the PMLA, imposed a monetary penalty of ₹9,27,00,000 (Nine Crore Twenty-Seven Lakh Rupees) on Bybit.

Key Compliance Takeaways for GIFT IFSC Entities

• Digital asset intermediaries, FinTech firms, and international brokers operating in GIFT IFSC cannot service Indian or global clients without formal regulatory registration and registration with FIU-IND.
• Regulatory obligations attach to the nature of the economic service provided and the geographic nexus of the user base, irrespective of where server infrastructure or holding corporate entities are domiciled.

The supervisory jurisprudence of the International Financial Services Centres Authority (IFSCA) demonstrates that compliance in the GIFT IFSC is rigorously enforced. The Authority conducts active on-site surprise inspections, thematic audits, and off-site monitoring to verify that licensed entities maintain physical substance, operational governance, and valid regulatory authorisations.

Case 1: IFSCA v. Prowess Insurance Brokers Pvt. Ltd. (PIBPL) – Authorisation Cancellation

                  CHRONOLOGY: IFSCA v. PROWESS INSURANCE BROKERS
                                        │
     [ Aug 17, 2020 ]: IRDAI grants approval to open IIIO Branch in GIFT IFSC
                       (Co-terminus with IRDAI CoR expiring Sept 21, 2021)
                                        │
     [ Sept 21, 2021 ]: IRDAI CoR expires; IFSCA IIIO Regulations, 2021 take effect
                                        │
     [ Jan 12, 2022 ]: IFSCA directs Noticee to halt all fresh insurance business
                       pending renewal of Certificate of Registration
                                        │
     [ Defiance ]: Noticee ignores IFSCA directives; continues executing fresh business
                                        │
     [ Enforcement Order ]: Cancellation of IIIO Authorisation under Sec 12 & 13 of
                            IFSCA Act, 2019 r/w Reg 30 of IIIO Regulations, 2021

Factual Matrix and Regulatory Evolution

• M/s Prowess Insurance Brokers Pvt. Ltd. (PIBPL) was registered with the Insurance Regulatory and Development Authority of India (IRDAI) as a 'Direct Broker (Life & General)'.
• Under the IRDAI (IFSC Insurance Intermediary Offices) Guidelines, 2019, PIBPL received authorization on August 17, 2020, to establish a branch office in GIFT IFSC as an IFSC Insurance Intermediary Office (IIIO).
• Clause 11 of the 2019 Guidelines mandated that the validity of approval for the IIIO branch was co-terminus with the original Certificate of Registration (CoR) issued by IRDAI, which expired on September 21, 2021.
• In 2021, the IFSCA notified the IFSCA (Insurance Intermediary) Regulations, 2021, superseding the IRDAI guidelines. Under the new regime, PIBPL was required to secure renewal of its primary CoR from IRDAI and subsequently file an application with IFSCA for renewal of its IFSC branch CoR.

Violations and Non-Compliance

• On January 6, 2022, PIBPL informed IFSCA that its renewal application was pending with IRDAI.
• On January 12, 2022, IFSCA formally directed PIBPL not to engage in any fresh insurance business until registration renewal was granted, permitting only the servicing of existing policyholders.
• PIBPL willfully failed to acknowledge IFSCA’s directives and defiantly continued executing fresh insurance contracts in the IFSC.

The IFSCA Order

Exercising powers under Section 12 and Section 13 of the IFSCA Act, 2019, and Regulation 30 of the IIIO Regulations, 2021 read with Section 33(6)(b) of the Insurance Act, 1938, the IFSCA cancelled the validity of approval/authorisation granted to PIBPL to operate its branch in GIFT IFSC. The Authority held that:

• PIBPL remained legally liable for all past acts and omissions;
• PIBPL was obligated to settle all outstanding regulatory fees and statutory dues; and
• PIBPL was mandated to preserve all client and transactional records under applicable record-keeping rules.

---

Case 2: IFSCA v. NEO Asset Management Private Limited – Enforcement of Physical Substance and KMP Presence

                  CHRONOLOGY: IFSCA v. NEO ASSET MANAGEMENT
                                        │
     [ Nov 22, 2023 ]: Registered as FME (Non-Retail) under Fund Management Regs, 2022
                                        │
     [ July & Aug 2024 ]: 1st & 2nd Surprise Visits by IFSCA
                          Absence of Principal Officer & Key Management Personnel (KMP)
                                        │
     [ Sept 12, 2024 ]: Advisory Letter issued granting 4 weeks to establish physical presence
                        Noticee fails to collect physical copy or acknowledge email
                                        │
     [ Oct 2024 ]: 3rd & 4th Surprise Visits find office still abandoned / devoid of KMP
                                        │
     [ Enforcement Order ]: Formal Warning issued under Reg 143 of FME Regs, 2022
                            Strict warning against repeat violations

Factual Matrix and Surprise Inspection Findings

• NEO Asset Management Private Limited (IFSC Branch) was granted registration by IFSCA as a Fund Management Entity (Registered FME - Non-Retail) on November 22, 2023, under the IFSCA (Fund Management) Regulations, 2022.
• A foundational premise of operating in GIFT IFSC is maintaining genuine economic substance: licensed entities cannot operate as mere "letterbox" companies. Regulations 7(4) and 10(1) mandate that the Principal Officer and Key Managerial Personnel (KMPs) must be physically based out of the GIFT IFSC office.
• IFSCA carried out unannounced surprise inspections on July 31, 2024, and August 21, 2024. On both occasions, the IFSC office was found devoid of any manpower, with neither the Principal Officer nor any KMPs present.

Regulatory Escalation and Persistent Default

• On September 12, 2024, IFSCA issued an Advisory Letter granting the firm a 4-week cure period to ensure the physical presence of designated personnel.
• The Noticee failed to acknowledge receipt of the advisory email and failed to collect the physical letter from IFSCA headquarters.
• Following the expiry of the 4-week window, IFSCA conducted a 3rd and 4th surprise visit on October 17, 2024, and October 24, 2024. The office remained completely unattended.

The IFSCA Order

Under Regulation 143 of the IFSCA (Fund Management) Regulations, 2022 read with Sections 12 and 13 of the IFSCA Act, 2019 and Section 11B of the SEBI Act, the IFSCA disposed of the proceedings by issuing a stern regulatory Warning to NEO Asset Management and its IFSC Branch. The Authority placed the firm on notice that any repetition of substance defaults would lead to the immediate cancellation of its fund management licence.

Summary Comparison of IFSC Enforcement Precedents

The failure to establish effective transaction monitoring mechanisms, investigate internal alerts, and report suspicious transactions to FIU-IND exposes reporting entities to severe statutory penalties. Two landmark orders issued by the Director, FIU-IND—Way2Wealth Brokers Pvt. Ltd. (2022) and Paytm Payments Bank Ltd. (2024)—illustrate the legal liabilities arising from transaction monitoring defaults.

---

Case 1: FIU-IND v. Way2Wealth Brokers Private Limited (Order No. 29/DIR/FIU-IND/2022)

                 FIU-IND v. WAY2WEALTH BROKERS PRIVATE LIMITED
                                       │
     [ Referral from SEBI ]: Allegations of circular trading and market manipulation
                                       │
     [ Findings of FIU-IND Investigation ]:
     1. Failure to investigate and escalate AML system transaction alerts
     2. Failure to file Suspicious Transaction Reports (STRs) within statutory timelines
     3. Failure to integrate SEBI adverse regulatory orders into AML monitoring matrices
                                       │
                                       ▼
     [ Penal Sanctions Imposed ]:
     - Monetary penalty of ₹1,00,000 under Section 13(2)(d) of PMLA
     - Mandatory statutory directions under Section 13(2)(a) & 13(2)(b)
     - Mandatory 30-day compliance certification signed jointly by
       Designated Director and Principal Officer

Factual Background and SEBI Reference

Following an investigation into market manipulation and circular trading in securities, SEBI forwarded a regulatory reference to FIU-IND regarding systemic deficiencies in the AML mechanisms of Way2Wealth Brokers Private Limited. FIU-IND initiated supervisory proceedings under Chapter IV of the PMLA.

Core Breaches Established

1. Alert Handling and Investigation Failure: In December 2021, transaction monitoring alerts were triggered by client accounts engaging in synchronized and circular trades. The intermediary's compliance team failed to properly investigate the alerts, failed to record rationales for alert closures, and failed to file STRs with FIU-IND.
2. Ignoring Adverse Regulatory Information: Way2Wealth failed to incorporate SEBI's publicly available adverse orders and interim directions into its AML transaction screening filters. The entity treated clients who were under regulatory investigation the same as ordinary low-risk clients.

Penalty and Corrective Mandates

The Director, FIU-IND imposed a monetary penalty under Section 13(2)(d) of the PMLA, accompanied by structural directions under Section 13(2)(a) and 13(2)(b). Way2Wealth was required to submit, within 30 days, a formal certification jointly signed by its Designated Director and Principal Officer confirming the complete overhaul of its automated alert management framework.

---

Case 2: FIU-IND v. Paytm Payments Bank Limited (Order dated March 15, 2024)

                   FIU-IND v. PAYTM PAYMENTS BANK LIMITED
                                      │
     [ Genesis ]: Police FIRs in Hyderabad uncovering transnational online gambling,
                  illegal betting apps, and fraudulent streaming syndicates
                                      │
     [ Modus Operandi ]: Crime proceeds routed through payout accounts and 34 beneficiary
                         mule accounts maintained with Paytm Payments Bank; funds remitted abroad
                                      │
     [ Systemic AML Breaches Established by Director, FIU-IND ]:
     1. Complete breakdown of internal transaction monitoring for Payout Services
     2. Illegal reliance on unregulated third parties for KYC verification (Rule 9(2) breach)
     3. Failure to conduct ongoing due diligence on mule accounts (Rule 9(12) breach)
     4. Chronic failure to file STRs on 34 high-velocity accounts (Rule 8 breach)
                                      │
                                      ▼
     [ Maximum Regulatory Sanctions Imposed ]:
     Total Monetary Fine of ₹5,49,00,000 (₹5.49 Crore) under Section 13(2)(d) of PMLA

Factual Matrix and Criminal Syndicate Modus Operandi

• Cyber Crime Police in Hyderabad registered FIRs under the Indian Penal Code and the Telangana State Gambling Act uncovering a multi-crore criminal syndicate connected to foreign entities.
• The syndicate operated illegal online betting platforms, fraudulent dating apps, and fake gaming services, defrauding hundreds of thousands of Indian citizens.
• The proceeds of these illegal operations were funneled through bulk Payout accounts and commercial accounts maintained with Paytm Payments Bank Ltd., from where funds were layered and remitted overseas.

Systemic Violations under Chapter IV of PMLA

FIU-IND conducted an extensive audit of Paytm Payments Bank's compliance architecture, establishing gross statutory violations:

1. Payout-Related Deficiencies:
   • Failure to establish an automated internal mechanism to detect and flag suspicious transactions in bulk payout services, violating Section 12(1) read with Rules 3(1)(D) and 7(3).
   • Total absence of ongoing due diligence over commercial payout accounts (Rule 9(12)).
   • Illegal Third-Party Reliance: The bank outsourced customer verification to unregulated, non-compliant third-party entities, violating Rule 9(2)(c) and Rule 9(2)(f).
2. Beneficiary Account Breaches:
   • Failure to file STRs in respect of 34 beneficiary accounts that received high-velocity criminal proceeds.
   • Ignoring obvious red flags such as rapid fund velocity, lack of economic rationale, and sudden spikes in transaction volumes through recently opened accounts.

The FIU-IND Order

Vide its order dated March 15, 2024, the Director, FIU-IND, exercising powers under Section 13 of the PMLA, imposed a monetary penalty of ₹5,49,00,000 (Five Crore Forty-Nine Lakh Rupees) on Paytm Payments Bank Ltd.

Key Compliance Lessons for Financial Intermediaries