Regulating the Unregulable: A Comparative Analysis of Cryptocurrency Governance under the EU's MiCA and India's PMLA-Centric Framework

Introduction

A. The Regulatory Problem

In 1996, Judge Frank Easterbrook dismissed the suggestion that cyberspace required a legal grammar of its own. He likened the proposal to teaching a “law of the horse”: a niche subject which, however much litigation it might attract, would tell us nothing useful about law as such.¹ Lawrence Lessig replied in a now-famous essay that the architecture of a new technological space changes what law is even capable of doing. On Lessig’s account, the four modalities of regulation (law, code, social norms, and the market) interact in digital environments in ways they never quite did in physical ones.² Three decades on, that same argument has resurfaced almost intact in debates over cryptocurrency and decentralised finance (“DeFi”). The recurring question is whether what we are looking at is just commodities, payments and securities law dressed in new clothes, or whether decentralised, pseudonymous, border-indifferent financial infrastructure demands a genuinely new regulatory vocabulary. That question forms the analytical spine of this article.

Cryptocurrency poses a harder version of the Lessig–Easterbrook puzzle than the early internet ever did. The reason is structural. The technology is not simply making jurisdiction more difficult, nor is it merely enabling new forms of harmful content. In many of its most important applications, it has been engineered to remove the identifiable intermediary on which financial regulation has depended at least since the first Basel framework. Decentralised exchanges, automated market-makers and protocol-governed lending platforms can operate without a corporate entity, without a registered office, and sometimes without any human party who can lawfully be served with notice. Therein lies the empirical heart of what this article calls the “unregulable” challenge. The difficulty is not that regulators lack will. It is that activity-based and entity-based regulatory tools alike find themselves swinging at a technology that has been designed to minimise the surface area available for either approach.

B. Why India and the European Union

This article compares two jurisdictions that have responded to the same challenge in almost mirror-image fashion. The European Union, through Regulation (EU) 2023/1114 on Markets in Crypto-Assets (“MiCA”),³ has constructed the world’s first comprehensive, harmonised, ex ante licensing regime for crypto-asset issuers and service providers. It became fully applicable across all twenty-seven member states on 30 December 2024.⁴ India has done the opposite. It has consciously declined to legislate. The much-promised “discussion paper” on crypto policy has slipped repeatedly since 2023, and as recently as 2026 it was shelved once again, caught between the Reserve Bank of India (“RBI”), which resists anything that might lend the sector “legitimacy”, and the Ministry of Finance and the Securities and Exchange Board of India (“SEBI”), both of which favour a segmented, multi-regulator framework.⁵ In the absence of legislation, India has chosen to govern crypto-assets through an ex post, activity-driven patchwork. The principal instruments are a punitive flat tax under Section 115BBH of the Income-tax Act, 1961, a transaction-tracing withholding tax under Section 194S, and, most importantly for the present argument, the extension of the PMLA to “virtual digital asset service providers” (“VDA SPs”) as reporting entities, whether or not they have a physical presence in the country.⁶

The comparison is doctrinally productive precisely because it isolates two pure types. MiCA is the cleanest available example of entity-based, licensing-first regulation. It works by demanding that an identified legal person obtain authorisation before lawfully offering a service. Its weak point, as Part IV demonstrates, is the point at which no identified entity is left to be authorised.⁷ India’s PMLA extension is the cleanest available example of activity-based, enforcement-first regulation. It imposes duties on whoever performs a defined activity (exchange, transfer, custody) “regardless of the physical presence of the entity in India”.⁸ In theory that gives it longer reach against offshore platforms, but the price is paid in legal certainty: liability attaches only after the fact, and through executive notice rather than codified rule.

C. Argument and Structure

Three claims are advanced. First, that MiCA and the PMLA framework embody two distinct regulatory logics: entity-based ex ante authorisation on the one hand, and activity-based ex post enforcement on the other, each calibrated to a different vulnerability in decentralised markets. Second, that on the evidence of the first eighteen to thirty months of operation, neither logic has cracked the problem from which this article takes its title. Both regimes succeed in bringing centralised intermediaries (exchanges, custodians, stablecoin issuers) within the perimeter; both struggle, on their own regulators’ admission, when confronted with protocols and platforms that lack an identifiable controlling entity.⁹ Third, that the comparative weaknesses of the two models turn out to be complementary rather than identical. That observation suggests that a hybrid design (licensing applied to centralised chokepoints, paired with activity-based, technology-enabled supervision for everything else, all of it stitched together within an internationally coordinated framework) is a more defensible path than either jurisdiction’s present approach taken in isolation.

Part II sets out the theoretical scaffolding. Part III turns to MiCA: its structure, its enforcement record, and the specific point (the “fully decentralised” exemption in Recital 22) at which its entity-based logic begins to fail. Part IV examines the Indian framework: the constitutional backstory that produces today’s activity-based default, the tax architecture, the FIU-IND enforcement drive, and the political economy of the stalled discussion paper. Part V evaluates both regimes against four criteria. Part VI sets out a hybrid proposal and concludes.

Theoretical Framework: Why Decentralised Finance Resists Traditional Regulatory Design

A. The Cyberlaw Antecedent

Lessig’s central insight, that “code is law” in the sense that the architecture of a digital system constrains behaviour as effectively as a statute, and sometimes more so,¹⁰ anticipates the particular difficulty that DeFi protocols throw up for financial regulators. A traditional securities exchange can be compelled to register because it is a legal person amenable to process. An automated market-maker deployed as immutable smart-contract code on a public blockchain has none of those properties by design. The protocol’s “compliance” is whatever the code permits. No regulator’s notice can compel a smart contract with no administrator to do anything that it was not already programmed to do. Easterbrook’s challenge, that a body of “cyberlaw” would teach us nothing the general law of contract, tort and property could not already teach, just as a “law of the horse” would teach us nothing about law in general,¹¹ is not just a rhetorical jab. It is a falsifiable empirical claim about whether digital architecture changes the substance of regulatory problems or only their setting. The evidence assembled in Parts III and IV speaks directly to that claim. Where crypto-asset activity flows through an identifiable intermediary (an exchange, a custodian, a stablecoin issuer), existing legal categories such as licensing, AML reporting and tax withholding have done their work, vindicating Easterbrook’s scepticism. Where activity has been engineered to remove that intermediary, however, neither jurisdiction’s regulators have managed to locate an adequate analogue within existing categories. That outcome vindicates Lessig’s opposing claim that architecture can place a problem beyond the reach of law as conventionally practised.

B. Entity-Based versus Activity-Based Regulatory Design

Financial regulation scholarship has long distinguished between two design choices for bringing a sector inside a supervisory perimeter.¹² Entity-based regulation attaches obligations to a defined class of legal person, such as a bank, a broker-dealer or a crypto-asset service provider, and requires that person to obtain authorisation before conducting the regulated business. Its principal virtue is certainty. The firm and its regulator both know, in advance, what is expected. Its principal weakness, as the Bank for International Settlements’ Financial Stability Institute has noted in the specific context of crypto-asset markets, is that “whether a platform is regulated would depend not on the type of activity but on the nature of the platform or participant”, an arrangement that hands market participants a permanent incentive to restructure themselves around the boundary of the regulated category.¹³

Activity-based regulation works the other way. Obligations attach to the performance of a defined function (exchange of value, custody of assets, transfer on behalf of another) without regard to the legal form or domicile of whoever is performing it. Its advantage is that it is harder to engineer around: the obligation rides on the conduct, not on the corporate wrapper. Its disadvantage is less ex ante clarity, because a firm may not know with confidence, until challenged, whether what it is doing falls within the regulated activity at all.

That dichotomy sits alongside an older strand of financial-regulation theory: Edward Kane’s notion of the “regulatory dialectic,” first set out in his 1977 and 1981 work on banking innovation.¹⁴ Kane’s central claim was that regulation and regulatory evasion do not unfold as a tidy sequence (rule, then circumvention, then new rule) but as a continuous, mutually-shaping cycle. Regulated firms innovate around the constraints they face; regulators respond by closing the gap that the innovation opened; in turn, that response produces fresh innovation around the new boundary.¹⁵ Kane’s own examples were drawn from twentieth-century banking. The one-bank holding company structure, adopted in the 1960s precisely to escape activity restrictions, was closed off by extending holding-company regulation; that closing-off in turn produced new circumvention strategies.¹⁶ A recent application of Kane’s framework to cryptocurrency money laundering charts how launderers continually identify “open doors” (the unregulated or under-regulated points of crypto-to-fiat exchange) and how regulatory responses close some of those doors even as new technological developments open others. The authors of that study read the pattern as confirmation of Kane’s dialectic rather than as disconfirmation of it.¹⁷ The argument of the present article can be restated in Kane’s vocabulary. MiCA and India’s PMLA extension are each, in their own way, attempts to close the dialectical loop. MiCA does so by raising the cost of operating outside an authorised, identifiable corporate structure. India’s PMLA extension does so by raising the cost of operating outside a registered activity, irrespective of corporate structure. As Parts III and IV show, each has already produced the next turn of the dialectic, MiCA in the form of the DeFi “fully decentralised” exemption examined in Part III.C, India in the form of the offshore-to-domestic migration patterns that followed the FIU-IND enforcement wave examined in Part IV.C.

C. The Specific Problem of “Genuine” Decentralisation

Both design philosophies, and Kane’s dialectical model with them, share an unstated assumption: that someone (a natural or legal person, or at the very least an identifiable activity with a traceable counterparty) can be located as the relevant locus of obligation. DeFi protocols that are, in MiCA’s own language, “fully decentralised” and operate “without any intermediary”¹⁸ test that assumption to destruction. Where governance has been handed off to a decentralised autonomous organisation, where no privileged administrator key remains, and where the front-end interface is one of several mirrors hosted by anonymous volunteers, activity-based regulation has nothing left to attach to that is meaningfully different from imposing liability on the software’s anonymous authors. No legal system has been willing to embrace that result at scale. Kane’s dialectic, on this reading, does not merely slow at this boundary. It may stop altogether, because the dialectic presupposes an adversary capable of responding to regulatory pressure by innovating around it, and a protocol without administrator or legal personality cannot respond to anything. It can only continue executing the code it was deployed to execute. That is the sense in which this article uses the word “unregulable”. The claim is not that cryptocurrency in general escapes regulation (the evidence in Parts III and IV is the opposite: centralised intermediaries are being regulated quite effectively, and remain very much the actors against whom Kane’s dialectic continues to operate), but rather that the specific subset of activity that has been engineered to remove an identifiable counterparty resists entity-based regulation, activity-based regulation, and the dialectical adaptation process that underlies both, for the same structural reason. There is no party left on the other side of the obligation to either comply or evade.

The European Union’s MiCA: Entity-Based Regulation at Scale

A. Legislative Architecture

MiCA was adopted by the European Parliament on 20 April 2023, approved by the Council on 16 May 2023, and published in the Official Journal of the European Union on 9 June 2023. It entered into force on 29 June 2023.¹⁹ Provisions on asset-referenced tokens and e-money tokens (in plain terms, stablecoins) became applicable from 30 June 2024. The rest of the Regulation, including the core licensing regime for crypto-asset service providers (“CASPs”), became fully applicable across the Union on 30 December 2024.²⁰ Formally, MiCA is a regulation rather than a directive. That means it applies directly in all member states without the need for transposing national legislation, a striking break from the patchwork of national virtual-asset-service-provider regimes that previously governed the sector.²¹

The Regulation organises its subject matter into three broad categories of obligation. First, disclosure. Persons offering crypto-assets to the public, or seeking their admission to trading, must publish a mandatory white paper. The principal exception covers crypto-assets that already qualify as financial instruments under the Markets in Financial Instruments Directive.²² Second, authorisation. MiCA creates a bespoke authorisation regime for issuers of asset-referenced tokens and e-money tokens. Prior approval from a national competent authority is mandatory; reserve-asset backing is mandatory; governance and conflict-of-interest safeguards are mandatory; and for “significant” stablecoins, defined partly by reference to the EU’s Digital Markets Act gatekeeper criteria, enhanced prudential supervision applies.²³ Third, and of greatest consequence for market structure, MiCA provides that from 30 December 2024 the provision of crypto-asset services (custody, operation of a trading platform, exchange services, order execution, portfolio management and advice) may only be performed by a legal person duly authorised as a CASP.²⁴ Authorised CASPs receive a “passport” allowing cross-border service provision across the Union, mirroring the long-standing MiFID II model applicable to investment firms.²⁵

It is worth pausing on one feature. MiCA contains no third-country equivalence regime. A non-EU firm cannot rely on its home-jurisdiction licence to serve EU clients. The “reverse solicitation” exemption (which permits a third-country firm to respond to an EU client’s own unprompted initiative) is, by design, narrow, and is expected to be construed strictly.²⁶ That closes one obvious arbitrage route, namely offshore incorporation to escape EU licensing while still soliciting EU clients. The Indian framework, as Part IV demonstrates, has had to confront the same arbitrage route directly, but only belatedly, through extraterritorial enforcement rather than statutory design.

B. The Parallel AML Architecture: The Transfer of Funds Regulation

MiCA’s licensing regime operates alongside a second instrument, the Regulation on the transfer of funds and certain crypto-assets (the “Transfer of Funds Regulation” or “TFR”), which transposes Recommendation 16 of the Financial Action Task Force (the so-called “travel rule”) into binding EU law.²⁷ The TFR also became applicable on 30 December 2024. It requires CASPs to collect and transmit originator and beneficiary information for every crypto-asset transfer between CASPs, with no de minimis threshold. That is a materially stricter standard than the FATF’s own recommended USD/EUR 1,000 floor, and stricter still than the United States’ USD 3,000 threshold under the Bank Secrecy Act.²⁸ For transfers to or from unhosted, self-custodied wallets, CASPs must collect originator and beneficiary information all the same, and above €1,000 they must assess whether the counterparty customer actually controls the self-hosted address before releasing funds.²⁹ Final implementing guidelines on that obligation were issued by the European Banking Authority in July 2024.³⁰

The TFR illustrates a second axis on which this article’s comparative argument runs. Even within the EU’s predominantly entity-based licensing model, the Union has found it necessary to lay over an activity-based, transaction-level tracing obligation. The reason is simple. Licensing alone, applied only at the point of onboarding a CASP, cannot, by itself, prevent illicit transfers between two licensed compliant entities, or between a licensed entity and an unhosted wallet outside the perimeter. The coexistence of MiCA’s entity licensing and the TFR’s activity-based tracing inside a single regulatory package is, in effect, an implicit concession that no single design logic suffices, even within the jurisdiction most committed to the entity-based model.

C. The Limits of Entity-Based Design: The “Fully Decentralised” Exemption

Recital 22 of MiCA states, in its own words, that the Regulation “should apply to natural and legal persons and certain other undertakings and to the crypto-asset services and activities performed, provided or controlled, directly or indirectly, by them, including when part of such activities or services is performed in a decentralised manner,” but that “where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within the scope of this Regulation.”³¹ The same recital adds a further qualification of considerable doctrinal weight: “where crypto-assets have no identifiable issuer, they should not fall within the scope of Title II, III or IV of this Regulation”, although “crypto-asset service providers providing services in respect of such crypto-assets should, however, be covered by this Regulation.”³² Read together, those two sentences trace exactly the boundary this article identifies as the structural failure point of entity-based design. The Regulation reaches the service-provider layer even where the underlying asset has no identifiable issuer, but it recedes entirely once the service itself has no identifiable intermediary. That is the moment at which MiCA’s only available regulatory subject (the “crypto-asset service provider” defined in Recital 21 as “any person that provides crypto-asset services on a professional basis”³³) ceases to exist in identifiable form.

This is not an oversight. It is a deliberate, if underspecified, boundary. The EU legislature acknowledged in 2023 that an authorisation requirement directed at “crypto-asset service providers” presupposes the existence of a provider, and chose not to resolve what should happen when no such provider can be identified. In practice the exemption has proved much harder to apply than to articulate. The European Securities and Markets Authority has conceded that “the precise scope of th[e] exemption remains unclear” and that decentralisation must be assessed case-by-case, because it “is not an absolute concept” but “exists on a spectrum.”³⁴ A protocol can look decentralised at the level of its transaction-validation mechanism while quietly retaining centralising control points: an administrator key that allows the contract to be paused, an upgrade authority lodged with a small founding team, concentrated governance-token voting power, or a single “official” front-end that functions, in practice, as the only realistic point of access even though mirror sites exist.³⁵ The joint report of the European Banking Authority and the European Securities and Markets Authority on recent developments in crypto-assets, prepared under Article 142 of MiCA and published on 16 January 2025, was commissioned specifically to begin mapping this terrain. The very fact of its publication is evidence that, more than two years after MiCA’s adoption, the boundary of the Regulation’s own personal scope remained an open empirical question rather than a settled legal one.³⁶

The European Commission’s response has been to propose more legislation rather than to resolve the ambiguity through guidance alone. A public consultation launched on 20 May 2026 (informally termed “MiCA 2.0”) explores a “CASP-as-gatekeeper” model. Under that model, centralised intermediaries that interface with DeFi protocols, such as front-ends, fiat on-ramps and aggregators, would carry compliance and potentially liability obligations for the decentralised protocols to which they connect. The effect would be to regulate decentralisation by regulating its points of centralised contact, rather than by attempting to regulate the protocol layer directly.³⁷ Industry reaction has been sharply divided. Proponents argue that this is the only administrable solution, given that “truly anonymous, decentralised protocols” cannot themselves be served with a notice or held to a capital requirement. Critics warn that holding gatekeepers liable for the protocols they connect to will produce a curated, pre-approved DeFi ecosystem and push genuine innovation outside the EU altogether.³⁸ As of this writing, no DeFi-specific legislative text has been adopted. The Commission’s consultation deadline runs to 31 August 2026.³⁹

That is the precise empirical vindication of the theoretical claim advanced in Part II.C. MiCA’s entity-based licensing apparatus, when applied to centralised exchanges and stablecoin issuers, has worked broadly as designed. Société Générale listed an authorised stablecoin on a Luxembourg-based exchange within months of the framework’s partial application, and the CASP passporting regime has delivered exactly the harmonised, EU-wide market access that regulators intended. At the precise point where the underlying activity has been engineered to remove an identifiable entity, however, MiCA’s logic has nothing left to authorise. The Union’s regulators have, in effect, conceded as much by reopening the legislative file rather than relying on the existing text of Recital 22.

D. Early Enforcement Record

MiCA’s enforcement record in its first full year of application is consistent with a regime whose authorisation gateway is functioning as intended for the centralised market at which it is aimed. ESMA maintains, and is empowered to update, a public register of non-compliant CASPs operating without authorisation. National competent authorities retain primary supervisory responsibility, and report upwards to ESMA on significant developments concerning CASPs that exceed fifteen million active EU users annually.⁴⁰ The supervisory audits that ESMA itself conducted in the first half of 2025, however, picked up inconsistent approaches across member-state regulators. The harmonisation that MiCA promises on paper has not yet been fully achieved in supervisory practice, a finding consistent with the broader literature’s caution that a single EU-level instrument does not, of itself, produce a single EU-level enforcement culture.⁴¹

India’s Fragmented, Activity-Based, Enforcement-First Model

A. The Constitutional Backdrop: Proportionality as the Default Constraint on Prohibition

India’s current regulatory posture cannot be understood in isolation from its immediate predecessor. What looks today like a vacuum of inadvertence is in fact a vacuum that followed the judicial defeat of an actual ban. On 6 April 2018, the Reserve Bank of India issued a circular directing all entities it regulated to cease providing banking services to any person or business dealing in virtual currencies, and to terminate existing such relationships within three months.⁴² The RBI had earlier issued cautionary press notes on 24 December 2013, 1 February 2017 and 5 December 2017 on the risks of virtual currencies, but it produced no new empirical finding specific to the 2018 circular itself.⁴³

The Internet and Mobile Association of India, together with affected exchanges, challenged that circular before the Supreme Court. In Internet and Mobile Association of India v. Reserve Bank of India, decided on 4 March 2020, a three-judge bench (Nariman, Bose and Ramasubramanian JJ.) upheld the RBI’s statutory authority to regulate virtual currencies under the Reserve Bank of India Act, 1934, the Banking Regulation Act, 1949 and the Payment and Settlement Systems Act, 2007. The petitioners’ contention that virtual currencies fell entirely outside the RBI’s jurisdiction, because they were not “legal tender”, was rejected.⁴⁴ The Court nonetheless quashed the circular itself. It held that an outright prohibition on banking access was disproportionate to the risk that the RBI had identified, particularly because the RBI could not produce empirical evidence that any regulated entity had in fact suffered loss from its exposure to virtual-currency exchanges over the preceding five years.⁴⁵ It is important to be precise about what the Court did not hold. It did not hold that virtual currencies were lawful, that they were legal tender, or that they were entitled to any particular regulatory treatment. It held only that this restriction, in this form, failed the proportionality test under Article 19(1)(g) of the Constitution.⁴⁶

The doctrinal significance of IAMAI for the present argument is considerable, and the judgment does not stand alone. Two years later, in Vijay Madanlal Choudhary & Ors. v. Union of India & Ors., decided on 27 July 2022, a differently constituted three-judge bench (Khanwilkar, Maheshwari and Ravikumar JJ.) considered, in a consolidated batch of more than 240 petitions, the constitutionality of the PMLA’s most consequential enforcement powers. Those powers included the reversal of the burden of proof under Section 24, the “twin conditions” restricting bail under Section 45, the admissibility of statements made to the Enforcement Directorate under Section 50, and the basic question of whether ED officers (who operate outside the procedural protections of the Code of Criminal Procedure, 1973) are properly understood as “police officers” at all.⁴⁷ The Court upheld each of those provisions. Among other things, it held that the mere generation of proceeds of crime is sufficient to constitute the offence of money laundering under Section 3, and that ED officers are not police officers for the purposes of the Code of Criminal Procedure. The second holding has the practical effect of placing PMLA investigation, including investigation of virtual-digital-asset-related conduct, outside the procedural safeguards that ordinarily attach to police investigation in India.⁴⁸ Where IAMAI constrained the executive’s power to prohibit virtual-currency-related banking activity outright, Vijay Madanlal Choudhary left the investigative apparatus that the same executive would later deploy against VDA SPs from March 2023 onwards fully intact, or in some respects expanded. Read together, the two judgments produced exactly the institutional configuration that Part II.B identifies as the activity-based model in its purest form: a judiciary unwilling to permit a blanket entity-based prohibition, but at the same time unwilling to constrain the scope of activity-based, ex post investigative power once a statutory hook (here, the PMLA’s reporting-entity framework) was used to reach the relevant conduct. The vacuum that followed IAMAI, therefore, was not the product of legislative inertia alone. It was a vacuum that the Supreme Court’s own proportionality reasoning had specifically required the executive to fill with something more calibrated than a blanket ban, and Vijay Madanlal Choudhary confirmed that whatever instrument the executive chose to fill it with would receive a wide berth from judicial review. The instruments India eventually chose were tax law and the PMLA. Both operate without ever resolving whether virtual digital assets are themselves lawful property, a question IAMAI deliberately left open and that remains open as of this writing.⁴⁹

B. The Taxation Layer: The Flat-Rate Levy and Transaction-Level Withholding

The Finance Act, 2022 inserted Section 115BBH into the Income-tax Act, 1961, with effect from 1 April 2022. It imposes a flat 30 per cent tax on income from the transfer of “virtual digital assets”, a term defined broadly in the newly inserted Section 2(47A) to capture cryptocurrency, non-fungible tokens, and any other digital asset that the central government may notify.⁵⁰ The rate applies uniformly, regardless of whether the gain would otherwise have been characterised as short-term, long-term, business income or capital gain. Distinctively, the provision permits no deduction whatsoever apart from the cost of acquisition. Transaction fees, platform charges and other incidental expenses are not deductible. Losses on one virtual digital asset cannot be set off against gains on another, against any other head of income, or carried forward to a subsequent assessment year.⁵¹ A complementary provision, Section 194S, requires whoever pays consideration for a transfer of virtual digital assets to deduct tax at source at 1 per cent of the gross consideration, once aggregate transfers in a financial year exceed ₹50,000 for “specified persons” or ₹10,000 otherwise. The provision took effect on 1 July 2022.⁵²

Official revenue data confirms both the bite of the regime and its function as a transaction-tracing mechanism independent of its fiscal purpose. In a written reply to the Rajya Sabha on 28 March 2023, the Union Minister of State for Finance confirmed that tax deducted at source under Section 194S had, by 20 March 2023 (within the first nine months of the provision’s operation), aggregated ₹157.9 crore. The reply added, expressly, that “crypto assets are currently unregulated in the country,” even as transactions in them remained “subjected to provisions of various laws like the Prevention of Money Laundering Act, 2002 and the Income-Tax Act, 1961.”⁵³ That ministerial statement, made on the floor of Parliament and recorded in India’s own official record, captures precisely the regulation-by-attribute structure that Part IV.D identifies below. An asset class is taxed, traced and monitored without its underlying legal status (regulated, unregulated, or something in between) ever being affirmatively settled by either statute or, after IAMAI, by binding judicial determination.

Where an exchange intermediates the transaction, the exchange withholds; in direct peer-to-peer transfers, the obligation falls on the buyer personally. Whether by deliberate design or by accident, that allocation creates a transaction-level paper trail running through the banking and tax system independent of, and prior to, any AML-specific reporting obligation.⁵⁴ The tax regime’s regulatory function is best understood as a hybrid one. Nominally, it is a revenue measure. In practical effect (no loss offset, no expense deduction, mandatory 1 per cent withholding on every transaction regardless of profitability) it operates simultaneously as a deterrent on trading velocity and as a transaction-tracing mechanism. Industry commentary has consistently identified the withholding tax, rather than the 30 per cent headline rate itself, as the more significant driver of trading migration towards offshore and peer-to-peer venues. The reasoning is straightforward. The 1 per cent TDS represented an immediate liquidity cost on every trade that registered domestic exchanges could not avoid passing through. Non-compliant offshore platforms, until enforcement caught up with them, as discussed below, could not be compelled to withhold at all.⁵⁵

C. The Anti-Money Laundering Layer: Bringing VDA Service Providers Within the PMLA

The decisive extension of India’s enforcement-first model came on 7 March 2023. On that day the Ministry of Finance notified that “virtual digital asset service providers” engaged in any of five designated activities, namely (a) exchange between virtual digital assets and fiat currency, (b) exchange between one or more forms of virtual digital assets, (c) transfer of virtual digital assets, (d) safekeeping or administration of virtual digital assets and (e) participation in or provision of financial services related to an issuer’s offer or sale of a virtual digital asset, would fall within the definition of “reporting entity” under Section 2(1)(wa) of the PMLA.⁵⁶ The Press Information Bureau’s own contemporaneous release confirms the notification’s stated rationale in terms that capture the activity-based logic with unusual precision. Virtual digital asset service providers “operating in India (both offshore and onshore)” engaged in the designated activities “are required to be registered with FIU IND as Reporting Entity,” and, critically, “the obligation is activity-based and is not contingent on physical presence in India.”⁵⁷ In the vocabulary of this article, that is the deliberate rejection of an entity-based jurisdictional limit in favour of a functional one, a design choice that anticipates, and is plainly drafted to defeat, the obvious offshore-incorporation strategy that an entity-based regime invites.

The practical force of that design choice soon became visible in the enforcement wave that followed. The official record of that wave is now available, in substantial part, through the Government of India’s own press releases rather than through trade-press paraphrase alone. On 28 December 2023, India’s Financial Intelligence Unit (“FIU-IND”) issued, under Section 13 of the PMLA, compliance show-cause notices to nine offshore exchanges (Binance, Bitfinex, Bitstamp, Bittrex, Gate.io, Huobi, Kraken, KuCoin and MEXC Global). The Director, FIU-IND, simultaneously wrote to the Secretary, Ministry of Electronics and Information Technology, requesting that the entities’ URLs be blocked for “operating illegally without complying with the provisions of the PML Act in India.”⁵⁸ The same official release records that, as of that date, thirty-one virtual digital asset service providers had already registered with FIU-IND voluntarily. That figure is evidence that the activity-based notification of March 2023 had already produced substantial domestic compliance well before the offshore enforcement campaign began.⁵⁹ By January 2024, Apple and Google had removed the relevant applications from their Indian app stores, and the platforms were rendered inaccessible to ordinary Indian users.⁶⁰ KuCoin registered with FIU-IND in March 2024 after paying a penalty of approximately ₹34.5 lakh. Binance (which, before the ban, had accounted for an estimated 90 per cent of Indian crypto holdings, reportedly worth some USD 4 billion) registered with FIU-IND and resumed Indian operations in August 2024, after a penalty of ₹18.82 crore (approximately USD 2.25 million) imposed by an FIU-IND order of 19 June 2024, at the time the largest cryptocurrency-related penalty ever imposed in India.⁶¹ OKX, by contrast, elected to exit the Indian market entirely in 2024 rather than register.⁶²

A second compliance wave followed on 1 October 2025, when FIU-IND issued notices under the same Section 13 power to twenty-five further offshore platforms, among them Paxful, Changelly, CEX.IO, BTCC and Remitano. The Press Information Bureau’s release of that date repeats, almost verbatim, the activity-based rationale first articulated in 2023.⁶³ Individual enforcement orders have followed the same statutory pattern in named cases. FIU-IND’s order against Bybit Fintech Limited, made public via PIB release, records a monetary penalty of ₹9.27 crore imposed because Bybit “kept expanding its services in the Indian market without securing mandatory registration.” The agency’s persistent non-compliance finding triggered a website-blocking direction to MeitY under the Information Technology Act, 2000.⁶⁴ FIU-IND’s own Annual Report for financial year 2024–25 records that, by 31 March 2025, forty-nine virtual digital asset service providers (forty-five domestic and four offshore) had completed registration. Aggregate penalties of approximately ₹28 crore were imposed on non-compliant platforms during the year. The Report’s strategic analysis of suspicious transaction reports filed by registered platforms identifies typologies that include hawala-linked unaccounted transactions, illegal gambling, fraud schemes, and at least one instance connected to an illegal online platform.⁶⁵

This enforcement record (now traceable in substantial part to primary government sources) demonstrates that activity-based jurisdiction, applied without an entity-based territorial limit, can reach offshore intermediaries that an entity-based licensing regime, lacking, as MiCA does, any third-country passport or equivalence mechanism, would have had to address through diplomatic cooperation or not at all. India’s approach instead used the leverage of app-store delisting and domestic-market access denial to compel compliance extraterritorially. In roughly eight months (December 2023 to August 2024, in the case of Binance) it achieved a result that required no treaty, no mutual-recognition agreement, and no cooperation from the platforms’ home regulators.

It bears separate note that India’s enforcement record against virtual-digital-asset-related conduct is not confined to the FIU-IND’s PMLA-registration campaign. A separate parliamentary answer, given by the Minister of State for Finance on 28 March 2023, recorded that as of 31 January 2023 the Enforcement Directorate had attached, seized or frozen approximately ₹936 crore in proceeds of crime connected to cryptocurrency-related investigations, had arrested five persons, and had filed six prosecution complaints (including one supplementary complaint) before the Special Court constituted under the PMLA. A parallel show-cause notice had also issued to the exchange then known as WazirX (Zanmai Labs Pvt Ltd) under the Foreign Exchange Management Act, 1999.⁶⁶ That figure, confirmed in India’s own parliamentary record, indicates that the PMLA’s activity-based reporting framework operates alongside, and is reinforced by, the Enforcement Directorate’s separate and longer-standing power to investigate and prosecute money-laundering offences connected to virtual digital assets independent of the registration regime addressed above. That second, criminal-law layer of activity-based enforcement is one that the comparative analysis in Part V should be read as encompassing alongside the FIU-IND’s civil/regulatory registration apparatus.

D. The Limits of Activity-Based Enforcement Without Codified Rules

The same enforcement record, however, illustrates the predicted cost of activity-based design identified in Part II.B: legal uncertainty borne by the regulated party until the moment of executive action. None of the platforms targeted in either the December 2023 or the October 2025 waves had been given advance, codified notice (in the form of a published rule specifying a quantitative threshold of Indian user activity, rather than a general notification followed eventually by individualised show-cause action) of the precise point at which their conduct would trigger PMLA reporting obligations. The Ministry of Finance’s own framing, repeated verbatim across both enforcement waves’ official releases (“activity-based” and “regardless of physical presence”), is doctrinally coherent. It is clearly intended to defeat offshore-incorporation arbitrage. But it supplies no ex ante test analogous to MiCA’s bright-line authorisation requirement. A platform’s exposure to enforcement only becomes apparent once FIU-IND acts.⁶⁷

That uncertainty has a second, more structural dimension, connected to the IAMAI and Vijay Madanlal Choudhary judgments discussed in Part IV.A. Because the constitutionality, and even the basic property status, of virtual digital assets remains formally unresolved (FIU-IND registration is, as Indian legal commentary has emphasised, a reporting-entity registration under the PMLA and “does not authorise any specific business activity”⁶⁸), India’s framework regulates the handling of an asset class whose underlying legal status it has never affirmatively defined, whether through primary legislation or through a binding judicial holding to that specific effect. A platform can be all of these things at once: taxed as though dealing in property (Section 115BBH, per the Ministry of Finance’s own Rajya Sabha submission acknowledging the asset class is “currently unregulated”⁶⁹), monitored as though dealing in a money-laundering-prone instrument (the March 2023 PMLA notification), and yet operating in a domain in which the Reserve Bank of India (the same institution whose 2018 prohibition was struck down in IAMAI on proportionality grounds rather than on the merits of the underlying risk assessment) continues to favour central bank digital currency over private-asset legitimation as a matter of stated policy preference. That is regulation by attribute rather than regulation by status. It is a coherent strategy for revenue collection and money-laundering interdiction, but it supplies none of the certainty that MiCA’s licensing model (whatever its own DeFi-specific limitations examined in Part III.C) offers a compliant market participant deciding whether and how lawfully to enter a market in the first place.

E. The Political Economy of Non-Legislation: The Stalled Discussion Paper

India’s preference for activity-based enforcement over comprehensive legislation is not, on the evidence presently available, an oversight awaiting bureaucratic capacity. It reflects an active and unresolved disagreement inside the executive itself: between the same Reserve Bank of India whose 2018 prohibition was judicially constrained in IAMAI, on the one hand, and a Ministry of Finance and Securities and Exchange Board of India more open to a structured, multi-regulator framework, on the other. The government first promised a public discussion paper on crypto-asset policy by September 2024. That deadline was missed, with officials citing competing institutional priorities including the IMF–World Bank annual meetings and the 2024 general election cycle.⁷⁰ By December 2024, the Ministry of Finance informed Parliament that there was “no timeline anticipated” for comprehensive regulatory guidelines. Reports through mid-2025 suggested that the paper was in “final drafting stages,” targeting a focus on stablecoins informed by the United States’ GENIUS Act, with release expected successively in June and then July 2025.⁷¹ In September 2025, a government document reported on by Reuters indicated that India was now leaning against comprehensive legislation altogether, on the express reasoning that regulating crypto-assets would confer “legitimacy” on the sector and risk making it “systemic”. The same document estimated Indian investor exposure at approximately USD 4.5 billion and concluded that the present level did not yet present systemic risk.⁷² By April 2026, the paper was once again reported to have been shelved. The impasse persisted between an RBI “firmly resisting any move that could legitimise the sector” and a Finance Ministry and SEBI more open to a segmented, multi-regulator model. The divide was reinforced by the RBI’s own December 2025 Financial Stability Report, which urged that central bank digital currency, rather than privately issued stablecoins, be prioritised as the means of preserving the “singleness of money.”⁷³

The Supreme Court itself has registered open frustration with that posture. It has observed that the legislative vacuum had enabled the use of virtual digital assets in patterns “similar to hawala,” and has reminded the government that it had called for definitive policy direction nearly two years earlier. The Delhi High Court, separately, sought formal responses from the RBI, SEBI and the Finance Ministry on their regulatory positions in January 2025.⁷⁴ As of this writing, that judicial pressure has not produced legislative movement.

The Indian case therefore illustrates a feature largely absent from the conventional entity-based-versus-activity-based literature discussed in Part II.B, but squarely consistent with Kane’s regulatory-dialectic framework discussed in Part II.B–C. The ex post character of the activity-based model is not merely a technical design trade-off. In India’s case, it is actively preferred by at least one powerful institutional veto-player (the RBI, whose own 2018 attempt at entity-based prohibition was the direct cause of the IAMAI litigation) precisely because activity-based enforcement avoids the legitimating function that comprehensive legislation would perform. On that reading, enforcement-first regulation is not simply a stopgap awaiting eventual codification. For as long as the RBI retains effective veto power over the legislative process, it may be the institutional equilibrium itself, and the dialectical cycle Kane describes (innovation, enforcement, re-innovation) continues to run entirely within the activity-based register, never advancing to the entity-based, codified stage that MiCA represents in the European Union.

Comparative Evaluation

This Part tests the EU and Indian models against four criteria drawn from the regulatory-design literature discussed in Part II: legal certainty, enforcement reach against decentralised and offshore activity, cost to legitimate innovation, and effectiveness in genuinely cross-border conditions.

A. Legal Certainty

MiCA performs unambiguously better on this axis for centralised market participants. A prospective CASP knows, before it enters, the precise disclosure, governance and prudential requirements it must satisfy. Once authorised, it benefits from a single EU-wide passport.⁷⁵ India’s regime supplies no equivalent ex ante clarity. A platform’s regulatory exposure crystallises only through FIU-IND’s exercise of enforcement discretion, and the basic legal status of the underlying asset class remains, by judicial design following IAMAI, unresolved.⁷⁶ This is the clearest point of MiCA’s comparative advantage.

B. Enforcement Reach, Including Against Offshore and Decentralised Activity

Here the comparison is more evenly balanced, and in one specific respect it favours India. MiCA’s absence of a third-country regime means that the EU has no equivalent mechanism to India’s extraterritorial, activity-based assertion of jurisdiction over offshore platforms serving its domestic market. An EU consumer using a non-EU exchange that solicits no EU business directly falls largely outside MiCA’s reach, unless and until that platform seeks EU market access through proper channels.⁷⁷ India’s FIU-IND campaign against Binance, KuCoin and the twenty-five further offshore platforms targeted in October 2025 demonstrates that an activity-based jurisdictional assertion, backed by app-store delisting leverage, can compel offshore compliance more directly, and more quickly, than the EU’s licensing perimeter. The EU perimeter depends on a firm choosing to seek authorisation, rather than on a regulator’s capacity to deny it market access unilaterally.⁷⁸ Against decentralised protocols lacking any identifiable controlling entity, however, both regimes are equally unable to act. India’s PMLA notification, like MiCA’s CASP licence, presupposes a “service provider” capable of registering or being penalised. Neither jurisdiction has yet devised a mechanism that reaches a protocol with no administrator at all, though the EU, through its MiCA 2.0 consultation, is actively attempting to do so.⁷⁹

C. Cost to Legitimate Innovation

The empirical record on this axis is asymmetric in character rather than directly comparable in scale. MiCA’s critics have specifically identified its stablecoin reserve and transaction-limit provisions as having effectively foreclosed an entire category of algorithmic stablecoin design within the EU, and industry voices have raised the same concern regarding the proposed “CASP-as-gatekeeper” model for DeFi.⁸⁰ India’s costs to innovation are differently structured. The prohibition on loss offset and the 1 per cent transaction-level withholding tax under Sections 115BBH and 194S have been widely identified, independent of any AML consideration, as the principal driver of trading migration to non-compliant or offshore venues. They impose a velocity cost that a comprehensive regulatory framework offering, for instance, loss carry-forward would not necessarily impose.⁸¹ In both cases, the innovation cost is a direct artefact of each jurisdiction’s chosen instrument: MiCA’s prescriptive product-design rules in the EU, and India’s punitive tax design layered onto activity-based AML obligations in India.

D. Effectiveness Under Genuinely Cross-Border Conditions

Both jurisdictions’ frameworks depend, to a degree each readily concedes, on international standard-setting rather than on unilateral design. MiCA’s Transfer of Funds Regulation and India’s FIU-IND obligations both implement FATF Recommendation 16. Both jurisdictions’ stricter-than-FATF design choices (the EU’s zero de minimis threshold,⁸² India’s activity-based extraterritorial assertion) represent national elaborations on a shared international floor rather than wholly independent inventions. The FATF’s own 2025 monitoring data shows uneven global implementation: 85 of 117 responding jurisdictions, or 73 per cent, had passed travel-rule legislation, up from 65 jurisdictions the previous year, but supervision and enforcement remain inconsistent even among adopters.⁸³ That uneven implementation means that both the EU’s and India’s domestic enforcement gains are partially contingent on a global compliance floor that, as of 2026, neither jurisdiction can unilaterally raise.

Toward a Hybrid Model: Proposals

A. Tiered Licensing Calibrated to Centralisation, Not to Asset Class

The comparative evidence in Part V suggests that the entity-versus-activity dichotomy is, in practice, a false binary that both jurisdictions have already begun to abandon in favour of hybrids: MiCA through the Transfer of Funds Regulation’s activity-based overlay, India through its evident interest, reflected in SEBI’s reported preference for a “multi-regulator” approach, in more structured oversight.⁸⁴ This article proposes that future reform in both jurisdictions, and in any jurisdiction designing crypto-asset regulation from a comparatively later starting point, should make this hybrid explicit rather than incidental. Licensing obligations should attach to the degree of centralisation that a platform exhibits, measured by criteria already under EU regulatory discussion (the existence of an administrator key, the concentration of governance-token voting power, and the presence of a singular practical point of access) rather than to either the platform’s nominal legal form (pure entity-based design) or the bare fact that a regulated activity has occurred (pure activity-based design).

B. Technology-Enabled Supervision as a Substitute for Intermediary-Dependent Enforcement

Where genuine decentralisation is established, this article argues that supervisory effort is better directed at the level of the public blockchain itself, through analytics-based monitoring of suspicious transaction patterns, of the kind FIU-IND has already begun applying to its existing reporting-entity data to identify hawala-linked typologies,⁸⁵ than at compelling registration from entities that, by hypothesis, do not exist in identifiable form. That does not solve the enforcement problem against truly anonymous bad actors, but it offers a more administrable middle path than either an unenforceable licensing mandate or an enforcement vacuum.

C. International Cooperation Frameworks

Both jurisdictions’ strongest enforcement results in the period under review were achieved through mechanisms with an inherently international dimension: FATF’s Recommendation 16 floor underlying both the TFR and the FIU-IND framework, and India’s leverage over global app-store operators (Apple, Google) functioning as a de facto international enforcement multiplier that no purely domestic licensing regime could replicate.⁸⁶ That suggests that future reform should formalise, rather than treat as incidental, cooperation between the EU’s emerging anti-money-laundering authority and equivalent bodies among major crypto-asset jurisdictions, including India. Particular attention should be paid to a shared methodology for assessing the “fully decentralised” exemption that ESMA has acknowledged it cannot yet define with confidence.⁸⁷

D. Innovation Sandboxes

Finally, both jurisdictions’ innovation costs identified in Part V.C are attributable to blunt, category-wide instruments: MiCA’s prescriptive stablecoin design rules and India’s flat-rate, no-loss-offset tax treatment, rather than to the underlying objective of consumer protection or revenue collection as such. A regulatory sandbox model, of the kind already piloted at sub-national level in India (the Telangana Web3 Sandbox) and under active discussion at EU level in connection with the MiCA 2.0 consultation, would permit regulators to test calibrated, activity-specific rules against genuine DeFi products before generalising them across the entire regulated population. The result would be to reduce the risk that prescriptive rules drafted for centralised intermediaries are mechanically extended to a fundamentally different technological context.⁸⁸

Conclusion

Neither the European Union nor India has solved the “unregulable” challenge that this article set out to examine. On the evidence assembled here, neither was likely to, given the instruments each jurisdiction chose. MiCA’s entity-based licensing regime has, within eighteen months of full application, brought the EU’s centralised crypto-asset market (exchanges, custodians, stablecoin issuers) within a harmonised, passportable authorisation perimeter that has no precedent elsewhere in the world. Yet the same regime’s own regulators have publicly conceded that they cannot yet say with confidence where the boundary of “fully decentralised” activity lies, and the European Commission’s decision to reopen the legislative file barely a year after full application is the clearest possible institutional admission that Recital 22 left more unresolved than it settled. India’s activity-based, enforcement-first model has achieved something that MiCA’s design cannot easily replicate: rapid, extraterritorial compliance from major offshore exchanges, secured through tax leverage, AML notification and app-store delisting rather than through any codified licensing test. That has come at a considerable, and, on the evidence of the RBI’s institutional posture and its central role in both the 2018 IAMAI litigation and the ongoing discussion-paper impasse, possibly deliberate cost: the underlying legal status of virtual digital assets, and the conditions under which any given platform’s conduct will trigger enforcement, both remain unresolved.

The comparative lesson is not that one jurisdiction has out-designed the other. It is that entity-based and activity-based logics fail at structurally different points, and that each jurisdiction’s failures are, in good part, the predictable consequence of choosing one logic in comparative isolation from the other. A more durable framework, whether for the EU, for India, or for the jurisdictions (including much of the Global South) still designing their first comprehensive response, would treat licensing and activity-based supervision as complementary instruments triggered by the actual structure of centralisation that a given platform exhibits, rather than as competing philosophies between which a jurisdiction must choose once and definitively. Until that synthesis is attempted in earnest, both the world’s most comprehensive crypto-asset statute and the world’s most aggressive activity-based enforcement campaign will continue to reach everything inside the regulated perimeter except the activity specifically engineered to fall outside it, which is, after all, the activity that gave this article its title.

*****

Footnotes

1. Frank H. Easterbrook, Cyberspace and the Law of the Horse, 1996 University of Chicago Legal Forum 207, 208, available at: https://chicagounbound.uchicago.edu/uclf/vol1996/iss1/7/ (last visited on June 28, 2026).

2. Lawrence Lessig, The Law of the Horse: What Cyberlaw Might Teach, 113 Harvard Law Review 501, 502 (1999), available at: https://cyber.harvard.edu/works/lessig/LNC_Q_D2.PDF (last visited on June 28, 2026).

3. Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937, OJ L 150, 9.6.2023, pp. 40–205, available at: https://eur-lex.europa.eu/eli/reg/2023/1114/oj/eng (last visited on June 28, 2026).

4. Norton Rose Fulbright, Regulating Crypto-Assets in Europe: A Practical Guide to MiCA (October 2024), available at: https://www.nortonrosefulbright.com/en/knowledge/publications/2cec201e/regulating-crypto-assets-in-europe-practical-guide-to-mica (last visited on June 28, 2026).

5. CryptoTimes, India’s Crypto Policy Delayed Again as RBI Blocks Discussion Paper (1 April 2026), available at: https://www.cryptotimes.io/2026/04/01/indias-crypto-policy-delayed-again-as-rbi-blocks-discussion-paper/ (last visited on June 28, 2026).

6. Ministry of Finance, Government of India, Notification S.O. 1072(E), dated 7 March 2023; Candour Legal, FIU-IND Registration for Crypto Businesses: Who Needs It and What It Actually Is (24 April 2026), available at: https://candourlegal.com/fiu-ind-registration-crypto-businesses-india-4/ (last visited on June 28, 2026).

7. Bank for International Settlements, Financial Stability Institute, Crypto, Tokens and DeFi: Navigating the Regulatory Landscape, FSI Insights on Policy Implementation No. 49, at 11 (17 May 2023), available at: https://www.bis.org/fsi/publ/insights49.pdf (last visited on June 28, 2026).

8. Ministry of Finance, Notification S.O. 1072(E), supra note 6; CoinGeek, Indian Regulator Issues Notices to 25 Offshore ‘Crypto’ Platforms (2025), available at: https://coingeek.com/indian-regulator-issues-notices-to-25-offshore-crypto-platforms/ (last visited on June 28, 2026).

9. Aurum, MiCA’s DeFi ‘Fully Decentralised’ Exemption: Where Regulators Draw the Line (23 January 2026), available at: https://aurum.law/newsroom/MiCAs-DeFi-Fully-Decentralised-Exemption (last visited on June 28, 2026).

10. Lessig, supra note 2, at 506.

11. Easterbrook, supra note 1, at 207.

12. Bank for International Settlements, Financial Stability Institute, supra note 7, at 8–11.

13. Id. at 11.

14. Edward J. Kane, Good Intentions and Unintended Evil: The Case against Selective Credit Allocation, 9(1) Journal of Money, Credit and Banking 55 (1977); Edward J. Kane, Accelerating Inflation, Technological Innovation, and the Decreasing Effectiveness of Banking Regulation, NBER Working Paper No. 0638 (1981), available at: https://www.nber.org/papers/w0638 (last visited on June 28, 2026).

15. Bank Underground (Bank of England), The Structure of Regulatory Revolutions (7 December 2021), available at: https://bankunderground.co.uk/2021/12/07/the-structure-of-regulatory-revolutions/ (last visited on June 28, 2026).

16. Cumberland Advisors, TNB and the Regulatory Dialectic (2018), available at: https://www.cumber.com/market-commentary/tnb-and-regulatory-dialectic (last visited on June 28, 2026).

17. Daniel Dupuis & Kimberly C. Gleason, Money Laundering with Cryptocurrency: Open Doors and the Regulatory Dialectic, 28(1) Journal of Financial Crime 60 (2021), available at: https://www.researchgate.net/publication/343695529_Money_laundering_with_cryptocurrency_open_doors_and_the_regulatory_dialectic (last visited on June 29, 2026).

18. Regulation (EU) 2023/1114, supra note 3, Recital 22.

19. FMA Österreich, Markets in Crypto-Assets Regulation (MiCAR), available at: https://www.fma.gv.at/en/cross-sectoral-topics/markets-in-crypto-assets-regulation-micar/ (last visited on June 28, 2026); Greenberg Traurig LLP, New Rules for Crypto-Assets in Europe (2024), available at: https://www.gtlaw.com/en/insights/2024/9/new-rules-for-crypto-assets-in-europe (last visited on June 28, 2026).

20. Norton Rose Fulbright, supra note 4.

21. Id.

22. Regulation (EU) 2023/1114, supra note 3, Title II.

23. Norton Rose Fulbright, supra note 4.

24. Id.

25. Id.

26. Id.

27. Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets, OJ L 150, 9.6.2023; Hacken, Crypto Travel Rule: Global VASP Requirements in 2025, available at: https://hacken.io/discover/crypto-travel-rule/ (last visited on June 28, 2026).

28. Hacken, supra note 27; OpenDue, Crypto Travel Rule: FATF Requirements Explained (28 January 2026), available at: https://www.opendue.com/blog/crypto-travel-rule-explained (last visited on June 28, 2026).

29. Hacken, supra note 27.

30. European Banking Authority, Guidelines on Information Requirements in Relation to Transfers of Funds and Certain Crypto-Assets Transfers under Regulation (EU) 2023/1113 (‘Travel Rule Guidelines’), EBA/GL/2024/11 (4 July 2024), available at: https://www.eba.europa.eu/sites/default/files/2024-07/6de6e9b9-0ed9-49cd-985d-c0834b5b4356/Travel%20Rule%20Guidelines.pdf (last visited on June 28, 2026).

31. Regulation (EU) 2023/1114, supra note 3, Recital 22, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1114 (last visited on June 28, 2026).

32. Id.

33. Id., Recital 21.

34. Merkle Science, Is DeFi Truly Exempt from MiCA Regulations?, available at: https://www.merklescience.com/blog/is-defi-truly-exempt-from-mica-regulations (last visited on June 28, 2026).

35. Aurum, supra note 9.

36. European Banking Authority & European Securities and Markets Authority, Joint Report on Recent Developments in Crypto-Assets (Article 142 of MiCAR), ESMA75-453128700-1391 / EBA/Rep/2025/01 (16 January 2025), available at: https://www.esma.europa.eu/sites/default/files/2025-01/ESMA75-453128700-1391_Joint_Report_on_recent_developments_in_crypto-assets__Art_142_MiCA_.pdf (last visited on June 28, 2026).

37. European Commission, Targeted Consultation on the Review of the Markets in Crypto-Assets Regulation (launched 20 May 2026; consultation period closing 31 August 2026); see Regulation (EU) 2023/1114, supra note 3, art. 59 (authorisation requirement for crypto-asset service providers, on which the proposed gatekeeper model would build); European Banking Authority & European Securities and Markets Authority, supra note 36.

38. Cointribune, MiCA Is Not Enough: Europe Is Preparing New DeFi Regulation by 2026 (7 June 2025), available at: https://www.cointribune.com/en/mica-is-not-enough-europe-is-preparing-new-defi-regulation-by-2026/ (last visited on June 28, 2026).

39. European Commission, supra note 37.

40. Norton Rose Fulbright, supra note 4.

41. Cyfrin, MiCA Regulation Explained: A Guide to EU Crypto Compliance (21 November 2025), available at: https://www.cyfrin.io/blog/mica-regulation-explained-a-guide-to-eu-crypto-compliance (last visited on June 28, 2026).

42. Reserve Bank of India, Prohibition on Dealing in Virtual Currencies (VCs), RBI/2017-18/154, DBR.No.BP.BC.104/08.13.102/2017-18 (6 April 2018).

43. Internet and Mobile Association of India v. Reserve Bank of India, 2020 SCC OnLine SC 275, para. 1.1; Government of India, Ministry of Finance, Press Information Bureau release, Crypto Assets are Borderless, Require International Collaboration to Prevent Regulatory Arbitrage (28 March 2023), available at: https://www.pib.gov.in/PressReleasePage.aspx?PRID=1896722 (last visited on June 28, 2026).

44. Internet and Mobile Association of India v. Reserve Bank of India, supra note 43.

45. Id.

46. Id.; Oxford Business Law Blog, Let’s Trade Crypto: Indian Supreme Court Quashes Prohibition (19 March 2020), available at: https://blogs.law.ox.ac.uk/business-law-blog/blog/2020/03/lets-trade-crypto-indian-supreme-court-quashes-prohibition (last visited on June 28, 2026).

47. Vijay Madanlal Choudhary & Ors. v. Union of India & Ors., 2022 SCC OnLine SC 929 (27 July 2022), official judgment available at: https://api.sci.gov.in/supremecourt/2014/19062/19062_2014_3_1501_36844_Judgement_27-Jul-2022.pdf (last visited on June 28, 2026).

48. Id.

49. Internet and Mobile Association of India v. Reserve Bank of India, supra note 43.

50. The Finance Act, 2022 (Act 6 of 2022), inserting s. 115BBH, Income-tax Act, 1961; s. 2(47A), Income-tax Act, 1961.

51. TaxGuru, Analysis of Section 194S & Section 115BBH of Income Tax Act, 1961 (30 May 2025), available at: https://taxguru.in/income-tax/analysis-section-194s-section-115bbh-income-tax-act-1961.html (last visited on June 28, 2026).

52. The Finance Act, 2022 (Act 6 of 2022), inserting s. 194S, Income-tax Act, 1961; Central Board of Direct Taxes, Circular No. 13/2022 (22 June 2022).

53. Government of India, Ministry of Finance, Press Information Bureau release, Direct Tax Deducted at Source from Transfer of Virtual Digital Assets Aggregates to Rs. 157.9 Crore upto 20th March 2023 for FY 2022-23 (28 March 2023), available at: https://www.pib.gov.in/PressReleasePage.aspx?PRID=1911517 (last visited on June 28, 2026).

54. DisyTax, Section 194S – TDS on Virtual Digital Assets (Crypto, NFTs) (19 July 2025), available at: https://disytax.com/section-194s-tds-virtual-digital-assets/ (last visited on June 28, 2026).

55. CryptoTimes, From Banned to Branded: How Binance Went from India’s Blacklist to Its Award Stage (17 April 2026), available at: https://www.cryptotimes.io/2026/04/17/from-banned-to-branded-how-binance-went-from-indias-blacklist-to-its-award-stage/ (last visited on June 28, 2026).

56. Ministry of Finance, Government of India, Notification S.O. 1072(E) (7 March 2023).

57. Government of India, Ministry of Finance, Press Information Bureau release, Financial Intelligence Unit India (FIU IND) Issues Compliance Show Cause Notices to Nine Offshore Virtual Digital Assets Service Providers (VDA SPs) (28 December 2023), available at: https://www.pib.gov.in/PressReleasePage.aspx?PRID=1991372 (last visited on June 28, 2026).

58. Id.

59. Id. (“Till date 31 VDA SPs have registered with FIU IND.”).

60. CoinGeek, supra note 8.

61. Financial Intelligence Unit – India, Order in Original No. 10/DIR/FIU-IND/2024 (19 June 2024) (imposing a monetary penalty of Rs. 18,82,00,000 on Binance for contravention of s. 12(1), Prevention of Money Laundering Act, 2002, read with the Prevention of Money-laundering (Maintenance of Records) Rules, 2005); Candour Legal, supra note 6; CryptoTimes, supra note 55.

62. CoinGeek, supra note 8.

63. Government of India, Ministry of Finance, Press Information Bureau release, Financial Intelligence Unit (FIU IND) Issues Notices for Non-Compliance to 25 Offshore Virtual Digital Assets Service Providers (VDA SPs) under Section 13 of the Prevention of Money Laundering Act (PML) Act, 2002 (1 October 2025), available at: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2173758 (last visited on June 28, 2026).

64. Government of India, Ministry of Finance, Press Information Bureau release, FIU-IND Imposes Monetary Penalty of Rs. 9 Crore 27 Lakhs on Virtual Digital Asset Service Provider Bybit Fintech Limited (Bybit), available at: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2098153 (last visited on June 28, 2026).

65. Financial Intelligence Unit – India, Annual Report 2024-25 (2025); see also Cyril Amarchand Mangaldas, FIG Paper No. 53 (VDA Series 8): FIU-IND’s Annual Report 2024-25: Trends and Takeaways for India’s Digital Assets Industry (January 2026), available at: https://corporate.cyrilamarchandblogs.com/2026/01/fiu-inds-annual-report-2024-25-trends-and-takeaways-for-indias-digital-assets-industry/ (last visited on June 28, 2026).

66. Government of India, Ministry of Finance, Press Information Bureau release, Crypto Assets are Borderless, Require International Collaboration to Prevent Regulatory Arbitrage, supra note 43.

67. Press Information Bureau releases, supra notes 57 and 63.

68. Candour Legal, supra note 6.

69. Press Information Bureau release, supra note 53.

70. CoinDesk, India’s Crypto Discussion Paper on Hold Due to Other Priorities (9 October 2024), available at: https://www.coindesk.com/policy/2024/10/09/indias-crypto-discussion-paper-on-hold-due-to-other-priorities (last visited on June 28, 2026).

71. CryptoTimes, supra note 5.

72. CryptoTimes, India to Issue Crypto Discussion Paper in July, Stablecoins in Focus (26 June 2025), available at: https://www.cryptotimes.io/2025/06/26/india-to-issue-crypto-discussion-paper-in-july-stablecoins-in-focus/ (last visited on June 28, 2026).

73. CryptoTimes, supra note 5.

74. Id.

75. Norton Rose Fulbright, supra note 4.

76. Candour Legal, supra note 6.

77. Norton Rose Fulbright, supra note 4.

78. CoinGeek, supra note 8.

79. Merkle Science, supra note 34; Regulation (EU) 2023/1114, supra note 3, Recital 22; European Commission, supra note 37.

80. Regulation (EU) 2023/1114, supra note 3, arts. 23 and 36 (restricting issuance of asset-referenced tokens used widely as a means of exchange beyond one million transactions and EUR 200,000,000 per day, and requiring a segregated reserve of assets); Cointribune, supra note 38.

81. CryptoTimes, supra note 55.

82. Hacken, supra note 27.

83. Financial Action Task Force, Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers (June 2025), at 4, available at: https://www.fatf-gafi.org/content/dam/fatf-gafi/recommendations/2025-Targeted-Upate-VA-VASPs.pdf.coredownload.pdf (last visited on June 28, 2026).

84. Giottus, India’s Crypto Regulations: The 2025 Complete Guide, available at: https://www.giottus.com/blog/crypto-regulations-in-india-all-you-need-to-know-in-2025 (last visited on June 28, 2026).

85. Financial Intelligence Unit – India, Annual Report 2024-25, supra note 65; Candour Legal, supra note 6.

86. CoinGeek, supra note 8.

87. Merkle Science, supra note 34.

88. Giottus, supra note 84; European Commission, supra note 37.